Publications

1 4 5 6 7 8 13

Tools for Automated Analysis of Cybercriminal Markets

May 23, 2017

Rebecca S. Portnoff, Sadia Afroz, Greg Durrett, Jonathan K. Kummerfeld, Taylor Berg-Kirkpatrick, Taylor Berg-Kirkpatrick, Damon McCoy, Kirill Levchenko and Vern Paxson.

Underground forums are widely used by criminals to buy and sell a host of stolen items, datasets, resources, and criminal services. These forums contain important resources for understanding cybercrime. However, the number of forums, their size, and the domain expertise required to understand the markets makes manual exploration of these forums unscalable. In this work, we propose an automated, top-down approach for analyzing underground forums. Our approach uses natural language processing and machine learning to automatically generate high-level information about underground forums, first identifying posts related to transactions, and then extracting products and prices.

To Catch a Ratter: Monitoring the Behavior of Amateur DarkComet RAT Operators in the Wild

May 23, 2017

Brown Farinholt , Mohammad Rezaeirad , Paul Pearce , Hitesh Dharmdasani, Haikuo Yin Stevens Le Blondk , Damon McCoy, Kirill Levchenko

Remote Access Trojans (RATs) give remote attackers interactive control over a compromised machine. Unlike largescale malware such as botnets, a RAT is controlled individually by a human operator interacting with the compromised machine remotely. The versatility of RATs makes them attractive to actors of all levels of sophistication: they’ve been used for espionage, information theft, voyeurism and extortion. Despite their increasing use, there are still major gaps in our understanding of RATs and their operators, including motives, intentions, procedures, and weak points where defenses might be most effective. In this work we study the use of DarkComet, a popular commercial RAT.

DeepMasterPrint: Generating Fingerprints for Presentation Attacks

May 21, 2017

Philip Bontrager, Julian Togelius and Nasir Memon

We present two related methods for creating MasterPrints, synthetic fingerprints that a fingerprint verification system identifies as many different people. Both methods start with training a Generative Adversarial Network (GAN) on a set of real fingerprint images. The generator network is then used to search for images that can be recognized as multiple individuals. The first method uses evolutionary optimization in the space of latent variables, and the second uses gradient-based search. Our method is able to design a MasterPrint that a commercial fingerprint system matches to 22% of all users in a strict security setting, and 75% of all users at a looser security setting.

Taking the Pulse of US College Campuses with Location-Based Anonymous Mobile Apps, ACM Transactions on Intelligent Systems and Technology (ACM TIST)

May 19, 2017

Yanqiu Wu, Tehila Minkus, and Keith W. Ross

We deploy GPS hacking in conjunction with location-based mobile apps to passively survey users in targeted geographical regions. Specifically, we investigate surveying students at different college campuses with Yik Yak, an anonymous mobile app that is popular on US college campuses. In addition to being campus-centric, Yik Yak’s anonymity allows students to express themselves candidly without self-censorship.

 

Mind your SMSes: Mitigating social engineering in second factor authentication

May 19, 2017

Hossein Siadati, Toan Nguyen, Payas Gupta, Markus Jakobsson, and Nasir Memon

SMS-based second factor authentication is a cornerstone for many service providers, ranging from email service providers and social networks to financial institutions and online marketplaces. Attackers have not been slow to capitalize on the vulnerabilities of this mechanism by using social engineering techniques to coerce users to forward authentication codes.

Profiling cybersecurity competition participants: Self-efficacy, decision-making and interests predict effectiveness of competitions as a recruitment tool

May 19, 2017

Sciencedirect.com site creating problemsMasooda Bashir, Colin Wee, Nasir Memon, and Boyi Guo

This paper presents the main results of a large-scale survey on cybersecurity competition participants in the past decade. 588 participants of the Cybersecurity Awareness Week (CSAW) competition were surveyed with measures of personality, interests, culture, decision-making and attachment styles in an exploratory study designed to identify the characteristics of cybersecurity competition participants.

DRAW-A-PIN: Authentication using finger-drawn PIN on touch devices

May 19, 2017

Toan Van Nguyen, Napa Sae-Bae, and Nasir Memon

This paper presents Draw-A-PIN, a user authentication system on a device with a touch interface that supports the use of PINs. In the proposed system, the user is asked to draw her PIN on the touch screen instead of typing it on a keypad. Consequently, Draw-A-PIN could offer better security by utilizing drawing traits or behavioral biometrics as an additional authentication factor beyond just the secrecy of the PIN. In addition, Draw-A-PIN inherently provides acceptability and usability by leveraging user familiarity with PINs.

Measuring the Fitness of Fitness Trackers

May 19, 2017

Chealsea G. Bender, Jason C. Hoffstot, Brian T. Combs, Sara Hooshangi, and Justin Cappos.

Data collected by fitness trackers could play an important role in improving the health and well-being of the individuals who wear them. Many insurance companies even offer monetary rewards to participants who meet certain steps or calorie goals. However, in order for it to be useful, the collected data must be accurate and also reflect real-world performance. While previous studies have compared step counts data in controlled laboratory environments for limited periods of time, few studies have been done to measure performance over longer periods of time, while the subject does real-world activities.

Malicious firmware detection with hardware performance counters

May 17, 2017

Xueyang Wang, Charalambos Konstantinou, Michail Maniatakos, Ramesh Karri, Serena Lee, Patricia Robison, Paul Stergiou, and Steve Kim

Critical infrastructure components nowadays use microprocessor-based embedded control systems. It is often infeasible, however, to employ the same level of security measures used in general purpose computing systems, due to the stringent performance and resource constraints of embedded control systems. Furthermore, as software sits atop and relies on the firmware for proper operation, software-level techniques cannot detect malicious behavior of the firmware.

 

BandiTS: Dynamic timing speculation using multi-armed bandit based optimization

May 15, 2017

Jeff Jun Zhang and Siddharth Garg

Timing speculation has recently been proposed as a method for increasing performance beyond that achievable by conventional worst-case design techniques. Starting with the observation of fast temporal variations in timing error probabilities, we propose a run-time technique to dynamically determine the optimal degree of timing speculation (i.e., how aggressively the processor is over-clocked) based on a novel formulation of the dynamic timing speculation problem as a multi-armed bandit problem.

Inspiring trust in outsourced integrated circuit fabrication

May 15, 2017

Siddharth Garg

The fabrication of integrated circuits (ICs) is typically outsourced to an external semiconductor foundry to reduce cost. However, this can come at the expense of trust. How can a designer ensure the integrity of the ICs fabricated by an external foundry? The talk will discuss a new approach for inspiring trust in outsourced IC fabrication by complementing the untrusted (outsourced) with an IC fabricated at a low-end but trusted foundry. This approach is referred to as split fabrication. We present two different ways in which split fabrication can be used to enhance security: logic obfuscation and verifiable ASICs.

A game-theoretic analysis of label flipping attacks on distributed support vector machines

May 15, 2017

Rui Zhang and Quanyan Zhu


Distributed machine learning algorithms play a significant role in processing massive data sets over large networks. However, the increasing reliance on machine learning on information and communication technologies makes it inherently vulnerable to cyber threats. This work aims to develop secure distributed algorithms to protect the learning from adversaries. We establish a game-theoretic framework to capture the conflicting goals of a learner who uses distributed support vector machines (DSVM) and an attacker who is capable of flipping training labels.

Minimax robust optimal control of multiscale linear-quadratic systems

May 15, 2017

Hamza Anwar and Quanyan Zhu

With a growing system complexity in the IoT framework, many networked cyber-physical systems work in a hierarchical fashion. Layers of information outputs and command inputs are available. An active area of research is in optimizing the design of policies and control command that influence information flow for such multi-layered systems. Our focus in current research is to first formulate the control command flow for hierarchical systems in the form of multiscale state-space models on a tree, and then the design of an optimal control law under constraints that relate the states of information across the system layers.

What to Lock?: Functional and Parametric Locking

May 12, 2017

Muhammad Yasin, Abhrajit Sengupta, Benjamin Carrion Schafer, Yiorgos Makris, Ozgur Sinanoglu and Jeyavijayan (JV) Rajendran

Logic locking is an intellectual property (IP) protection technique that prevents IP piracy, reverse engineering and overbuilding attacks by the untrusted foundry or end-users. Existing logic locking techniques are all based on locking the functionality; the design/chip is nonfunctional unless the secret key has been loaded. Existing techniques are vulnerable to various attacks, such as sensitization, key-pruning, and signal skew analysis enabled removal attacks. In this paper, we propose a tenacious and traceless logic locking technique, TTlock, that locks functionality and provably withstands all known attacks, such as SAT-based, sensitization, removal, etc.

The Need for Declarative Properties in Digital IC Security

May 12, 2017

Mohamed El Massad, Frank Imeson, Siddharth Garg and Mahesh Tripunitara.

We emphasize the need to articulate precise, declarative properties in the context of securing Digital ICs. We do this by discussing two pieces of our work on securing Digital ICs. In one, we discuss a seemingly compelling approach to protecting Intellectual Property — IC camouflaging. We demonstrate that an adversary can carry out a decamouflaging attack, in practice, much more efficiently than previously thought. Underlying our attack is strong foundations: an identification of the computational-complexity of the problems an attacker faces, and how they can be addressed using off-the-shelf constraint solvers.

On the Difficulty of Inserting Trojans in Reversible Computing Architectures

May 2, 2017

Xiaotong Cui, Samah Saeed, Alwin Zulehner, Robert Wille, Rolf Drechsler, Kaijie Wu and Ramesh Karri

Fabrication-less design houses outsource their designs to 3rd party foundries to lower fabrication cost. However, this creates opportunities for a rogue in the foundry to introduce hardware Trojans, which stay inactive most of the time and cause unintended consequences to the system when triggered. Hardware Trojans in traditional CMOS-based circuits have been studied and Design-for-Trust (DFT) techniques have been proposed to detect them. Different from traditional circuits in many ways, reversible circuits implement one-to-one, bijective input/output mappings.

Proactive Population-Risk Based Defense Against Denial of Cyber-Physical Service Attacks

May 1, 2017

Jeffrey Pawlick and Quanyan Zhu

—While the Internet of things (IoT) promises to improve areas such as energy efficiency, health care, and transportation, it is highly vulnerable to cyberattacks. In particular, DDoS attacks work by overflowing the bandwidth of a server. But many IoT devices form part of cyber-physical systems (CPS). Therefore, they can be used to launch a “physical” denial-ofservice attack (PDoS) in which IoT devices overflow the “physical bandwidth” of a CPS.

Towards Reverse Engineering Reversible Logic

April 27, 2017

Samah Mohamed Saeed, Xiaotong Cui, Robert Wille, Alwin Zulehner, Kaijie Wu, Rolf Drechsler, and Ramesh Karri

Reversible logic has two main properties. First, the number of inputs is equal to the number of outputs. Second, it implements a one-to-one mapping; i.e., one can reconstruct the inputs from the outputs. These properties enable its applications in building quantum computing architectures.