1 3 4 5 6 7 13

How Biometric Authentication Poses New Challenges to Our Security and Privacy

July 11, 2017

Nasir Memon

Discusses the challenges that face biometric authentication in the areas of privacy and network security. The use of biometric data — an individual’s measurable physical and behavioral characteristics — isn’t new. Government and law enforcement agencies have long used it. The Federal Bureau of Investigation (FBI) has been building a biometric recognition database; the U.S. Department of Homeland Security is sharing its iris and facial recognition of foreigners with the FBI. But the use of biometric data by consumer goods manufacturers for authentication purposes has skyrocketed in recent years.

IllusionPIN: Shoulder-Surfing Resistant Authentication Using Hybrid Images

July 11, 2017

Athanasios Papadopoulos, Toan Nguyen, Emre Durmus and Nasir Memon.

We address the problem of shoulder-surfing attacks on authentication schemes by proposing IllusionPIN (IPIN), a PIN-based authentication method that operates on touchscreen devices. IPIN uses the technique of hybrid images to blend two keypads with different digit orderings in such a way, that the user who is close to the device is seeing one keypad to enter her PIN, while the attacker who is looking at the device from a bigger distance is seeing only the other keypad. The user’s keypad is shuffled in every authentication attempt since the attacker may memorize the spatial arrangement of the pressed digits.

Proactive Defense Against Physical Denial of Service Attacks using Poisson Signaling Games

July 10, 2017

Jeffrey Pawlick and Quanyan Zhu

While the Internet of things (IoT) promises to improve areas such as energy efficiency, health care, and transportation, it is highly vulnerable to cyberattacks. In particular, distributed denial-of-service (DDoS) attacks overload the bandwidth of a server. But many IoT devices form part of cyber-physical systems (CPS). Therefore, they can be used to launch “physical” denial-of-service attacks (PDoS) in which IoT devices overflow the “physical bandwidth” of a CPS. In this paper, we quantify the population-based risk to a group of IoT devices targeted by malware for a PDoS attack.

A Factored MDP Approach to Optimal Mechanism Design for Resilient Large-Scale Interdependent Critical Infrastructures

July 5, 2017

Linan Huang, Juntao Chen and Quanyan Zhu

Enhancing the security and resilience of interdependent infrastructures is crucial. In this paper, we establish a theoretical framework based on Markov decision processes(MDPs) to design optimal resiliency mechanisms for interdependent infrastructures. We use MDPs to capture the dynamics of the failure of constituent components of an infrastructure and their cyber-physical dependencies. Factored MDPs and ap- proximate linear programming are adopted for an exponentially growing dimension of both state and action spaces. Under our approximation scheme, the optimally distributed policy is equivalent to the centralized one.

Efficient Detection for Malicious and Random Errors in Additive Encrypted Computation

July 3, 2017

Nektarios Georgios Tsoutsos and Michail Maniatakos

Although data confidentiality is the primary security objective in additive encrypted computation applications, such as the aggregation of encrypted votes in electronic elections, ensuring the trustworthiness of data is equally important. And yet, integrity protections are generally orthogonal to additive homomorphic encryption, which enables efficient encrypted computation, due to the inherent malleability of homomorphic ciphertexts. Since additive homomorphic schemes are founded on modular arithmetic, our framework extends residue numbering to support fast modular reductions and homomorphic syndromes for detecting random errors inside homomorphic ALUs and data memories.

Cyber– Physical Systems Security and Privacy

June 30, 2017

Guest Editors: Michail Maniatakos, Ramesh Karri and Alvaro A. Cardenas

During the past decade, several catch-phrases have been used to emphasize the increasing importance of cyber–physical systems (CPS) in our everyday life: Internet-of-Things, Internet-of-Everything, Smart-Cities, Smart-X, Intelligent-X, etc. All such systems, in their core, consist of networked computing (cyber) devices continuously interacting with the physical world. From fitness trackers and smart thermostats, to traffic light control and smart-grid devices, CPS have increased efficiency, enabled interesting applications and introduced major technological advancements. At the same time, due to their criticality, CPS have become a lucrative target for malicious actors.

SafetyNets: Verifiable Execution of Deep Neural Networks on an Untrusted Cloud

June 30, 2017

Zahra Ghodsi, Tianyu Gu and Siddharth Garg

Inference using deep neural networks is often outsourced to the cloud since it is a computationally demanding task. However, this raises a fundamental issue of trust. How can a client be sure that the cloud has performed inference correctly? A lazy cloud provider might use a simpler but less accurate model to reduce its own computational load, or worse, maliciously modify the inference results sent to the client. We propose SafetyNets, a framework that enables an untrusted server (the cloud) to provide a client with a short mathematical proof of the correctness of inference tasks that they perform on behalf of the client.

Throughput maximization of large-scale secondary networks over licensed and unlicensed spectra

June 29, 2017

Manjesh K. Hanawal, Yezekael Hayel and Quanyan Zhu.

Throughput of a mobile ad hoc network (MANET) operating on an unlicensed spectrum can increase if nodes can also transmit on a (shared) licensed spectrum. However, the transmissions on the licensed spectrum has to be limited to avoid degradation of quality of service (QoS) to primary users (PUs). We address the problem of how the nodes of a MANET or secondary users (SUs) should spread their transmissions on both licensed and unlicensed spectra to maximize network throughput, and characterize ‘throughput gain’ achieved in such spectrum sharing systems. We show that the gain can be significant and is increasing in the density of the SUs.

IoT-enabled Distributed Cyber-attacks on Transmission and Distribution Grids.

June 22, 2017

Yury Dvorkin and Siddharth Garg

The Internet of things (IoT) will make it possible to interconnect and simultaneously control distributed electrical loads. Various technical and regulatory concerns have been raised that IoT-operated loads are being deployed without appropriately considering and systematically addressing potential cyber-security challenges. Hence, one can envision a hypothetical scenario when an ensemble of IoT-controlled loads can be hacked with malicious intentions of compromising operations of the electrical grid. Under this scenario, the attacker would use geographically distributed IoT-controlled loads to alternate their net power injections into the electrical grid in such a way that may disrupt normal grid operations.

ObfusCADe: Obfuscating Additive Manufacturing CAD Models Against Counterfeiting: Invited

June 22, 2017

Nikhil Gupta, Fei Chen,Nektarios Georgios Tsoutsos and Michail Maniatakos

As additive manufacturing (AM) becomes more pervasive, its supply chains shift towards distributed business models that heavily rely on cloud resources. Despite its countless benefits, this paradigm raises significant concerns about the trustworthiness of the globalized process, as there exist several classes of cybersecurity attacks that can undermine its security guarantees. In this work, we focus on the protection of the intellectual property (IP) of 3D designs, and introduce ObfusCADe, which is a novel protection method against counterfeiting, by embedding special features in CAD models.

Security as a Service for Cloud-Enabled Internet of Controlled Things under Advanced Persistent Threats: A Contract Design Approach

June 21, 2017

Juntao Chen and Quanyan Zhu

In this paper, we aim to establish a holistic framework that integrates the cyber-physical layers of a cloud-enabled Internet of Controlled Things (IoCT) through the lens of contract theory. At the physical layer, the device uses cloud services to operate the system. The quality of cloud services is unknown to the device, and hence the device designs a menu of contracts to enable a reliable and incentive-compatible service. Based on the received contracts, the cloud service provider (SP) serves the device by determining its optimal cyber defense strategy. A contract-based FlipCloud game is used to assess the security risk and the cloud quality of service (QoS) under advanced persistent threats.

TTLock: Tenacious and traceless logic locking

June 19, 2017

Muhammad Yasin, Bodhisatwa Mazumdar, Jeyavijayan J V Rajendran and Ozgur Sinanoglu

Logic locking is an intellectual property (IP) protection technique that prevents IP piracy, reverse engineering and overbuilding attacks by the untrusted foundry or endusers. Existing logic locking techniques are all vulnerable to various attacks, such as sensitization, key-pruning and signal skew analysis enabled removal attacks. In this paper, we propose TTLock that provably withstands all known attacks. TTLock protects a designer-specified number of input patterns, enabling a controlled and provably-secure trade-off between key-pruning attack resilience and removal attack resilience. All the key-bits converge on a single signal, creating maximal interference and thus resisting sensitization attacks.

On Mitigation of Side-Channel Attacks in 3D ICs: Decorrelating Thermal Patterns from Power and Activity

June 19, 2017

Johann Knechtel and Ozgur Sinanoglu

Various side-channel attacks (SCAs) on ICs have been successfully demonstrated and also mitigated to some degree. In the context of 3D ICs, however, prior art has mainly focused on efficient implementations of classical SCA countermeasures. That is, SCAs tailored for up-and-coming 3D ICs have been overlooked so far. In this paper, we conduct such a novel study and focus on one of the most accessible and critical side channels: thermal leakage of activity and power patterns. We address the thermal leakage in 3D ICs early on during floorplanning, along with tailored extensions for power and thermal management.

Distributed Transfer Linear Support Vector Machines

June 15, 2017

Rui Zhang and Quanyan Zhu

Transfer learning has been developed to improve the performances of different but related tasks in machine learning. However, such processes become less efficient with the increase of the size of training data and the number of tasks. Moreover, privacy can be violated as some tasks may contain sensitive and private data, which are communicated between nodes and tasks. We propose a consensus-based distributed transfer learning framework, where several tasks aim to find the best linear support vector machine (SVM) classifiers in a distributed network.

A Mean-Field Stackelberg Game Approach for Obfuscation Adoption in Empirical Risk Minimization

June 8, 2017

Jeffrey Pawlick and Quanyan Zhu

Data ecosystems are becoming larger and more complex due to online tracking, wearable computing, and the Internet of Things. But privacy concerns are threatening to erode the potential benefits of these systems. Recently, users have developed obfuscation techniques that issue fake search engine queries, undermine location tracking algorithms, or evade government surveillance. Interestingly, these techniques raise two conflicts: one between each user and the machine learning algorithms which track the users, and one between the users themselves. In this paper, we use game theory to capture the first conflict with a Stackelberg game and the second conflict with a mean field game.

Security and Privacy in Cyber-Physical Systems: A Survey of Surveys

May 29, 2017

Jairo Giraldo, Esha Sarkar, Alvaro Cardenas, Michail Maniatakos and Murat Kantarcioglu

Cyber-Physical Systems (CPS) are engineered systems combining computation, communications, and physical resources. Over the last decade—alongside technical advances in CPS—a vibrant and active community of security and privacy researchers have proposed and developed a mature research agenda addressing fundamental problems and risks of CPS deployments. The field has matured to a point where there are now several CPS security surveys. In this paper we highlight the diversity of research presenting by a meta-survey of CPS security and privacy surveys.

Under the Shadow of Sunshine: Understanding and Detecting Bulletproof Hosting on Legitimate Service Provider Networks

May 24, 2017

Sumayah Alrwais, Xiaojing Liao , Xianghang Mi , Peng Wang , XiaoFeng Wang , Feng Qian , Raheem Beyah and Damon McCoy

BulletProof Hosting (BPH) services provide criminal actors with technical infrastructure that is resilient to complaints of illicit activities, which serves as a basic building block for streamlining numerous types of attacks.In this paper, we present the first systematic study on this new trend of BPH services. By collecting and analyzing a large amount of data (25 Whois snapshots of the entire IPv4 address space, 1.5 TB of passive DNS data, and longitudinal data from several blacklist feeds), we are able to identify a set of new features that uniquely characterizes BPH on sub-allocations and are costly to evade. Based upon these features, we train a classifier for detecting malicious sub-allocated network blocks, achieving a 98% recall and 1.5% false discovery rates according to our evaluation.

Tools for Automated Analysis of Cybercriminal Markets

May 23, 2017

Rebecca S. Portnoff, Sadia Afroz, Greg Durrett, Jonathan K. Kummerfeld, Taylor Berg-Kirkpatrick, Taylor Berg-Kirkpatrick, Damon McCoy, Kirill Levchenko and Vern Paxson.

Underground forums are widely used by criminals to buy and sell a host of stolen items, datasets, resources, and criminal services. These forums contain important resources for understanding cybercrime. However, the number of forums, their size, and the domain expertise required to understand the markets makes manual exploration of these forums unscalable. In this work, we propose an automated, top-down approach for analyzing underground forums. Our approach uses natural language processing and machine learning to automatically generate high-level information about underground forums, first identifying posts related to transactions, and then extracting products and prices.