| 8:00 am–9:00 am |
Monday |
Continental Breakfast
|
| 9:00 am–10:30 am |
Monday |
Session Chair: Cynthia Irvine, Naval Postgraduate School
Tanya Flushman, California Polytechnic State University; Mark Gondree, Naval Postgraduate School; Zachary N. J. Peterson, California Polytechnic State University We describe a novel approach to delivering an introductory computer science course for first-year undergraduates, using computer security topics to explore core CS concepts. Our course is a first attempt at merging aspects of capture the flag-style challenges, puzzle-based learning, and alternate reality games (ARGs), with the goal of improving student engagement, increasing awareness of
security as a discipline and professional opportunity, and providing context for the social relevance of security to our lives. Our challenges synthesize hands-on problem solving, immediate feedback on incremental progress, scaffolded learning, a loosely-connective narrative, and a sense of intrigue to draw students into active engagement with course material. In this paper, we motivate the use of ARG characteristics to connect course tasks, we discuss our goals, course design, and a mixed-method evaluation of our objectives (using reflective journaling, cognitive interviews, and pre- and post-surveys using an adaptation of the Computer Attitude Scale instrument), and summarize our preliminary findings.
Andrew Ruef, Michael Hicks, James Parker, Dave Levin, Atif Memon, Jandelyn Plane, and Piotr Mardziel, University of Maryland, College Park There is currently little evidence about what tools, methods, processes, and languages lead to secure software. We present the experimental design of the Build it Break it secure programming contest as an aim to provide such evidence. The contest also provides education value to participants where they gain experience developing programs in an adversarial settings. We show preliminary results from previous runs of the contest that demonstrate the contest works as designed, and provides the data desired. We are in the process of scaling the contest to collect larger data sets with the goal of making statistically significant correlations between various factors of development and software security.
Frederico Araujo, Mohammad Shapouri, Sonakshi Pandey, and Kevin Hamlen, The University of Texas at Dallas Modern cyber security educational programs that emphasize technical skills often omit or struggle to effectively teach the increasingly important science of cyber deception. A strategy for effectively communicating deceptive technical skills by leveraging the new paradigm of honey-patching is discussed and evaluated. Honey-patches mislead attackers into believing that failed attacks against software systems were successful. This facilitates a new form of penetration testing and capture-the-flag style exercise in which students must uncover and outwit the deception in order to successfully bypass the defense. Experiences creating and running the first educational lab to employ this new technique are discussed, and educational outcomes are examined.
|
| 10:30 am–11:00 am |
Monday |
Break with Refreshments
|
| 11:00 am–12:30 pm |
Monday |
Moderator: Adam Aviv, U.S. Naval Academy
Panelists: Aaron Striegel, University of Notre Dame; Will Enck, North Carolina State University; Nicolas Christin, Carnegie Mellon University; Kirk Webb, University of Utah
|
| 12:30 pm–2:00 pm |
Monday |
Luncheon for Workshop Attendees
|
| 2:00 pm–3:30 pm |
Monday |
Session Chair: Stephen Schwab, USC Information Sciences Institute (ISI)
Ang Chen and Andreas Haeberlen, University of Pennsylvania The Internet is producing a wealth of data about its own operation, in the form of NetFlow records, routing table entries, traffic statistics, etc. Several previous works—including, for instance, Clark’s “knowledge plane”— have considered the idea of building a giant distributed database that (at least conceptually) contains all of this information. Such a database could have many attractive
uses, including distributed troubleshooting, attack mitigation, or traffic management. However, so far the idea has not been realized, and it is likely that privacy concerns have played a role.
In this paper, we ask whether differential privacy could provide the strong privacy guarantees that would be needed to put this idea into practice. We discuss some key concerns that have been raised about differential privacy, such as its limited scalability and its finite “privacy budget”, and we point out several characteristics of the Internet that could mitigate these concerns. We also
sketch the design of PRISM, a system for differentially private queries on NetFlow records that could form the basis of a potential “knowledge plane”.
Arman Noroozian, Maciej Korczynski, Samaneh Tajalizadehkhoob, and Michel van Eeten, Delft University of Technology Research into cybercrime often points to concentrations of abuse at certain hosting providers. The implication is that these providers are worse in terms of security; some are considered ‘bad’ or even ‘bullet proof’.
Remarkably little work exists on systematically comparing the security performance of providers. Existing metrics typically count instances of abuse and sometimes normalize these counts by taking into account the advertised address space of the provider. None of these attempts have worked through the serious methodological challenges that plague metric design.
In this paper we present a systematic approach for metrics development and identify the main challenges: (i) identification of providers, (ii) abuse data coverage and quality, (iii) normalization, (iv) aggregation and (v) metric interpretation. We describe a pragmatic approach to deal with these challenges. In the process, we answer an urgent question posed to us by the Dutch police: ‘which are the worst providers in our jurisdiction?’. Notwithstanding their limitations, there is a clear need for security metrics for hosting providers in the fight against cybercrime.
Devin Cook and Yung Ryn Choe, Sandia National Laboratories; John A. Hamilton, Jr., Mississippi State University Developers and security analysts have been using static analysis for a long time to analyze programs for defects and vulnerabilities. Generally a static analysis tool is run on the source code for a given program, flagging areas of code that need to be further inspected by a human analyst. These tools tend to work fairly well – every year they find many important bugs. These tools are more
impressive considering the fact that they only examine the source code, which may be very complex. Now consider the amount of data available that these tools do not analyze. There are many additional pieces of information available that would prove useful for finding bugs in code, such as a history of bug reports, a history of all changes to the code, information about committers, etc. By leveraging all this additional data, it is possible to find more bugs with less user interaction, as well as track useful metrics such as number and type of defects injected by committer. This paper provides a method for
leveraging development metadata to find bugs that would otherwise be difficult to find using standard static analysis tools. We showcase two case studies that demonstrate the ability to find new vulnerabilities in large and small software projects by finding new vulnerabilities in the cpython and Roundup open source projects.
|
| 3:30 pm–4:00 pm |
Monday |
Break with Refreshments
|
| 4:00 pm–5:00 pm |
Monday |
Session Chair: Tudor Dumitras, University of Maryland, College Park
Andrew Miller, University of Maryland; Rob Jansen, U.S. Naval Research Laboratory We describe a new methodology that enables the direct execution of multi-threaded applications inside of Shadow, an existing parallel discrete-event network simulation framework. Our methodology utilizes function interposition and an application-layer thread library to emulate the ordinary thread interface to the application. Using this methodology, we implement a new Shadow plug-in that directly executes the Bitcoin reference client software. To demonstrate the usefulness of this tool, we present novel denial-of-service attacks against the Bitcoin software that exploit low-level implementation artifacts in the Bitcoin reference client; our deterministic simulator was helpful in developing and demonstrating these attacks. We describe optimizations that enable scalable execution of thousands of Bitcoin nodes on a single machine, and discuss how to model the Bitcoin network for experimental purposes.
Yuping Li, Sathya Chandran Sundaramurthy, Alexandru G. Bardas, Xinming Ou, and Doina Caragea, Kansas State University; Xin Hu and Jiyong Jang, IBM Research Malware triaging is the process of analyzing malicious software applications’ behavior to develop detection signatures. This task is challenging, especially due to the enormous number of samples received by the vendors with limited amount of analyst time. Triaging usually starts with an analyst classifying samples into known and unknown malware. Recently, there have been various attempts
to automate the process of grouping similar malware using a technique called fuzzy hashing – a type of compression functions for computing the similarity between individual digital files. Unfortunately, there has been no rigorous experimentation or evaluation of fuzzy hashing algorithms for malware similarity analysis in the research literature. In this paper, we perform extensive study of existing fuzzy hashing algorithms with the goal of understanding their applicability in clustering similar malware. Our experiments indicate that current popular fuzzy hashing algorithms suffer from serious limitations
that preclude them from being used in similarity analysis. We identified novel ways to construct fuzzy hashing algorithms and experiments show that our algorithms have better performance than existing algorithms.
|
CSET '15 Paper Archive (ZIP)
CSET '15 Attendee List (PDF)
