Publications

Refine Results

(Filters Applied) Clear All

Visualization evaluation for cyber security: trends and future directions(1.22 MB)

Published in:
Proceedings of the Eleventh Workshop on Visualization for Cyber Security

Summary

The Visualization for Cyber Security research community (VizSec) addresses longstanding challenges in cyber security by adapting and evaluating information visualization techniques with application to the cyber security domain. In this paper, we survey and categorize the evaluation metrics, components, and techniques that have been utilized in the past decade of VizSec research literature.
READ LESS

Summary

The Visualization for Cyber Security research community (VizSec) addresses longstanding challenges in cyber security by adapting and evaluating information visualization techniques with application to the cyber security domain. In this paper, we survey and categorize the evaluation metrics, components, and techniques that have been utilized in the past decade of...

READ MORE

On the challenges of effective movement

Published in:
ACM Workshop on Moving Target Defense (MTD 2014), 3 November 2014.

Summary

Moving Target (MT) defenses have been proposed as a gamechanging approach to rebalance the security landscape in favor of the defender. MT techniques make systems less deterministic, less static, and less homogeneous in order to increase the level of effort required to achieve a successful compromise. However, a number of challenges in achieving effective movement lead to weaknesses in MT techniques that can often be used by the attackers to bypass or otherwise nullify the impact of that movement. In this paper, we propose that these challenges can be grouped into three main types: coverage, unpredictability, and timeliness. We provide a description of these challenges and study how they impact prominent MT techniques. We also discuss a number of other considerations faced when designing and deploying MT defenses.
READ LESS

Summary

Moving Target (MT) defenses have been proposed as a gamechanging approach to rebalance the security landscape in favor of the defender. MT techniques make systems less deterministic, less static, and less homogeneous in order to increase the level of effort required to achieve a successful compromise. However, a number of...

READ MORE

Information leaks without memory disclosures: remote side channel attacks on diversified code

Published in:
CCS 2014: Proc. of the ACM Conf. on Computer and Communications Security, 3-7 November 2014.

Summary

Code diversification has been proposed as a technique to mitigate code reuse attacks, which have recently become the predominant way for attackers to exploit memory corruption vulnerabilities. As code reuse attacks require detailed knowledge of where code is in memory, diversification techniques attempt to mitigate these attacks by randomizing what instructions are executed and where code is located in memory. As an attacker cannot read the diversified code, it is assumed he cannot reliably exploit the code. In this paper, we show that the fundamental assumption behind code diversity can be broken, as executing the code reveals information about the code. Thus, we can leak information without needing to read the code. We demonstrate how an attacker can utilize a memory corruption vulnerability to create side channels that leak information in novel ways, removing the need for a memory disclosure vulnerability. We introduce seven new classes of attacks that involve fault analysis and timing side channels, where each allows a remote attacker to learn how code has been diversified.
READ LESS

Summary

Code diversification has been proposed as a technique to mitigate code reuse attacks, which have recently become the predominant way for attackers to exploit memory corruption vulnerabilities. As code reuse attacks require detailed knowledge of where code is in memory, diversification techniques attempt to mitigate these attacks by randomizing what...

READ MORE

Spectral anomaly detection in very large graphs: Models, noise, and computational complexity(92.92 KB)

Published in:
Proceedings of Seminar 14461: High-performance Graph Algorithms and Applications in Computational Science, Wadern, Germany

Summary

Anomaly detection in massive networks has numerous theoretical and computational challenges, especially as the behavior to be detected becomes small in comparison to the larger network. This presentation focuses on recent results in three key technical areas, specifically geared toward spectral methods for detection.
READ LESS

Summary

Anomaly detection in massive networks has numerous theoretical and computational challenges, especially as the behavior to be detected becomes small in comparison to the larger network. This presentation focuses on recent results in three key technical areas, specifically geared toward spectral methods for detection.

READ MORE

Optical phased-array ladar

Published in:
Appl. Opt., Vol. 53, No. 31, 1 November 2014, pp. 7551-5.

Summary

We demonstrate a ladar with 0.5 m class range resolution obtained by integrating a continuous-wave optical phased-array transmitter with a Geiger-mode avalanche photodiode receiver array. In contrast with conventional ladar systems, an array of continuous-wave sources is used to effectively pulse illuminate a target by electro-optically steering far-field fringes. From the reference frame of a point in the far field, a steered fringe appears as a pulse. Range information is thus obtained by measuring the arrival time of a pulse return from a target to a receiver pixel. This ladar system offers a number of benefits, including broad spectral coverage, high efficiency, small size, power scalability, and versatility.
READ LESS

Summary

We demonstrate a ladar with 0.5 m class range resolution obtained by integrating a continuous-wave optical phased-array transmitter with a Geiger-mode avalanche photodiode receiver array. In contrast with conventional ladar systems, an array of continuous-wave sources is used to effectively pulse illuminate a target by electro-optically steering far-field fringes. From...

READ MORE

Finding good enough: a task-based evaluation of query biased summarization for cross language information retrieval

Published in:
EMNLP 2014, Proc. of Conf. on Empirical Methods in Natural Language Processing, 25-29 October, 2014, pp. 657-69.

Summary

In this paper we present our task-based evaluation of query biased summarization for cross-language information retrieval (CLIR) using relevance prediction. We describe our 13 summarization methods each from one of four summarization strategies. We show how well our methods perform using Farsi text from the CLEF 2008 shared-task, which we translated to English automatically. We report precision/recall/F1, accuracy and time-on-task. We found that different summarization methods perform optimally for different evaluation metrics, but overall query biased word clouds are the best summarization strategy. In our analysis, we demonstrate that using the ROUGE metric on our sentence-based summaries cannot make the same kinds of distinctions as our evaluation framework does. Finally, we present our recommendations for creating much-needed evaluation standards and databases.
READ LESS

Summary

In this paper we present our task-based evaluation of query biased summarization for cross-language information retrieval (CLIR) using relevance prediction. We describe our 13 summarization methods each from one of four summarization strategies. We show how well our methods perform using Farsi text from the CLEF 2008 shared-task, which we...

READ MORE

Bayesian discovery of threat networks

Published in:
IEEE Trans. Signal Process., Vol. 62, No. 20, 15 October 2014, pp. 5324-38.

Summary

A novel unified Bayesian framework for network detection is developed, under which a detection algorithm is derived based on random walks on graphs. The algorithm detects threat networks using partial observations of their activity, and is proved to be optimum in the Neyman-Pearson sense. The algorithm is defined by a graph, at least one observation, and a diffusion model for threat. A link to well-known spectral detection methods is provided, and the equivalence of the random walk and harmonic solutions to the Bayesian formulation is proven. A general diffusion model is introduced that utilizes spatio-temporal relationships between vertices, and is used for a specific space-time formulation that leads to significant performance improvements on coordinated covert networks. This performance is demonstrated using a new hybrid mixed-membership blockmodel introduced to simulate random covert networks with realistic properties.
READ LESS

Summary

A novel unified Bayesian framework for network detection is developed, under which a detection algorithm is derived based on random walks on graphs. The algorithm detects threat networks using partial observations of their activity, and is proved to be optimum in the Neyman-Pearson sense. The algorithm is defined by a...

READ MORE

Increasing the coherence time in a magnetically-sensitive stimulated Raman transition in 85Rb

Published in:
FIO 2014: Frontiers in Optics, 14 October 2014.

Summary

We experimentally study the Ramsey, spin echo, and CPMG pulse sequences of a magnetically sensitive transition of a cold 85Rb gas. We can increase the coherence time by up to a factor of 10 by using CPMG pulse sequences as compared to Ramsey or spin echo.
READ LESS

Summary

We experimentally study the Ramsey, spin echo, and CPMG pulse sequences of a magnetically sensitive transition of a cold 85Rb gas. We can increase the coherence time by up to a factor of 10 by using CPMG pulse sequences as compared to Ramsey or spin echo.

READ MORE

Energy efficiency benefits of subthreshold-optimized transistors for digital logic

Published in:
2014 IEEE SOI-3D-Subthreshold Microelectronics Technology Unified Conf. (S3S), 6-9 October 2014.

Summary

The minimum energy point of an integrated circuit (IC) is defined as the value of the supply voltage at which the energy per operation of the circuit is minimized. Several factors influence what the value of this voltage can be, including the topology of the circuit itself, the input activity factor, and the process technology in which the circuit is implemented. For application-specific ICs (ASICs), the minimum energy point usually occurs at a subthreshold supply voltage. Advances in subthreshold circuit design now permit correct circuit operation at, or even below, the minimum energy point. Since energy consumption is proportional to the square of the supply voltage, circuit design techniques and process technology choices that reduce the minimum energy point inherently improve the energy efficiency of ICs. Previous research has shown that optimizing process technology for subthreshold operation can improve IC energy efficiency. This, coupled with the energy efficiency advantages offered by fully-depleted silicon-on-insulator (FDSOI) processes, have led to the development of a subthreshold-optimized FDSOI process at MIT Lincoln Laboratory (MITLL) called xLP (Extreme Low Power). However, to date there has not been a quantitative estimate of the energy efficiency benefit of xLP or other analagous technology for complex digital circuits. This paper will show via simulation that the xLP process technology enables energy efficiency improvements that exceed that of process scaling by one generation. Specifically, the process is shown to improve power delay product by 57% vs. the IBM 90nm low power bulk process, and by 9% vs. the IBM 65 nm low power bulk technology at 0.3V.
READ LESS

Summary

The minimum energy point of an integrated circuit (IC) is defined as the value of the supply voltage at which the energy per operation of the circuit is minimized. Several factors influence what the value of this voltage can be, including the topology of the circuit itself, the input activity...

READ MORE

Quantitative evaluation of dynamic platform techniques as a defensive mechanism

Published in:
RAID 2014: 17th Int. Symp. on Research in Attacks, Intrusions, and Defenses, 17-19 September 2014.

Summary

Cyber defenses based on dynamic platform techniques have been proposed as a way to make systems more resilient to attacks. These defenses change the properties of the platforms in order to make attacks more complicated. Unfortunately, little work has been done on measuring the effectiveness of these defenses. In this work, we first measure the protection provided by a dynamic platform technique on a testbed. The counter-intuitive results obtained from the testbed guide us in identifying and quantifying the major effects contributing to the protection in such a system. Based on the abstract effects, we develop a generalized model of dynamic platform techniques which can be used to quantify their effectiveness. To verify and validate out results, we simulate the generalized model and show that the testbed measurements and the simulations match with small amount of error. Finally, we enumerate a number of lessons learned in our work which can be applied to quantitative evaluation of other defensive techniques.
READ LESS

Summary

Cyber defenses based on dynamic platform techniques have been proposed as a way to make systems more resilient to attacks. These defenses change the properties of the platforms in order to make attacks more complicated. Unfortunately, little work has been done on measuring the effectiveness of these defenses. In this...

READ MORE