Since smartphones have stored diverse sensitive privacy information, including credit card and so on, a great deal of malware are desired to tamper them. As one of the most prevalent platforms, Android contains sensitive resources that can only be accessed via corresponding APIs, and the APIs can be invoked only when user has authorized permissions in the Android permission model. However, a novel threat called privilege escalation attack may bypass this watchdog. It's presented as that an application with less permissions can access sensitive resources through public interfaces of a more privileged application, which is especially useful for malware to hide sensitive functions by dispersing them into multiple programs. We explore privilege-escalation malware evolution techniques on samples from Android Malware Genome Project. And they have showed great effectiveness against a set of powerful antivirus tools provided by VirusTotal. The detection ratios present different and distinguished reduction, compared to an average 61% detection ratio before transformation. In order to conquer this threat model, we have developed a tool called DroidAlarm to conduct a full-spectrum analysis for identifying potential capability leaks and present concrete capability leak paths by static analysis on Android applications. And we can still alarm all these cases by exposing capability leak paths in them.

As a code reuse technique, JIT spraying attack becomes popular on the JITed VM (Virtual Machine) (e.g., Javascript Engine, Flash Engine). Using a bug in web applications, an attacker can reuse the code generated by the JIT (Just-In-Time) compiler, which is used to optimize the performance of web applications. JIT spraying attacks can circumvent DEP and ASLR -- protection mechanisms of modern operating systems. Based on the observation that JIT spraying attack mostly uses the immediate operand of the arithmetic instruction to build a shellcode, we propose RIM, a technique that obfuscates the arithmetic operations in the JITed code and prevents attackers from reusing the native code to construct a malicious code. We implement a prototype on Tamarin flash engine and demonstrate the effectiveness of RIM. Experimental results show that RIM's overhead is very low (less than 1%). And RIM greatly improves the security functionality of JIT compilers.

Return-Oriented Programming (ROP) is a technique which leverages the instruction gadgets in existing libraries/executables to construct Turing complete programs. However, ROP attack is usually composed with gadgets which are ending in ret instruction without the corresponding call instruction. Based on this fact, several defense mechanisms have been proposed to detect the ROP malicious code. To circumvent these defenses, Return-Oriented Programming without returns has been proposed recently, which uses the gadgets ending in jmp instruction but with much diversity. In this paper, we propose an improved ROP techniques to construct the ROP shellcode without returns. Meanwhile we implement a tool to automatically construct the real-world Return-Oriented Programming without returns shellcode, which as demonstrated in our experiment can bypass most of the existing ROP defenses.

Wireless sensor networks (WSNs) deployed in hostile environments are vulnerable to clone attacks. In such attack, an adversary compromises a few nodes, replicates them, and inserts arbitrary number of replicas into the network. Consequently, the adversary can carry out many internal attacks. Previous solutions on detecting clone attacks have several drawbacks. First, some of them require a central control, which introduces several inherent limits. Second, some of them are deterministic and vulnerable to simple witness compromising attacks. Third, in some solutions the adversary can easily learn the critical witness nodes to start smart attacks and protect replicas from being detected. In this paper, we first show that in order to avoid existing drawbacks, replica-detection protocols must be non-deterministic and fully distributed (NDFD), and fulfill three security requirements on witness selection. To our knowledge, only one existing protocol, Randomized Multicast, is NDFD and fulfills the requirements, but it has very high communication overhead. Then, based on random walk, we propose two new NDFD protocols, RAndom WaLk (RAWL) and Table-assisted RAndom WaLk (TRAWL), which fulfill the requirements while having only moderate communication and memory overheads. The random walk strategy outperforms previous strategies because it distributes a core step, the witness selection, to every passed node of random walks, and then the adversary cannot easily find out the critical witness nodes. We theoretically analyze the required number of walk steps for ensuring detection. Our simulation results show that our protocols outperform an existing NDFD protocol with the lowest overheads in witness selection, and TRAWL even has lower memory overhead than that protocol. The communication overheads of our protocols are higher but are affordable considering their security benefits.

Integer-based vulnerability is an extremely serious bug for programs written in languages such as C/C++. However,in practice, very few software security tools can efficiently detect and accurately locate such vulnerability. In addition, previous methods mainly depend on source code analysis and recompilation which are impractical when protecting the program without source code. In this paper,we present the design, implementation, and evaluation of BRICK (binary run-time integer-based vulnerability checker), a tool for run-time detecting and locating integer-based vulnerability. Given an integer-based vulnerability exploit, BRICK is able to catch the value which falls out of the range of its corresponding type, then find the root cause for this vulnerability, and finally locate the vulnerability code and give a warning, based on its checking scheme. BRICK is implemented on the dynamic binary instrumentation framework Valgrind and its type inference plug-in: Catchconv. Preliminary experimental results are quit promising: BRICK can detect and locate most of integer-based vulnerability in real software, and has very low false positives and negatives.

This paper discusses the network covert timing channel. This channel modulates network packet's time properties to transfer information secretly. Much work has been done in inventing and utilizing network covert timing channels, however, there is not so much work in other areas such as detecting and handling covert channels. Covert channel detection is difficult, what's more, it often needs human analysis to confirm whether a suspect is a real covert channel. However, we figured out that we can try to control covert channels without knowing whether there are covert channels in using, which means our approach does not rely on the detection of covert channels at all. A network traffic controller is proposed to undermine the network covert timing channel communication mechanism. We will show how our method works and why our traffic control strategy is especially efficient to handle network covert timing channels.

This paper presents the design of a decentralized storage scheme to support multi-dimensional range queries over sensor networks. We build a distributed k-d tree based index structure over sensor network, so as to efficiently map high dimensional event data to a two-dimensional space of sensors while preserving the proximity of events. We propose a dynamic programming based methodology to control the granularity of the index tree in an optimized approach, and an optimized routing scheme for range query processing to achieve best energy efficiency. The simulation results demonstrate the efficiency of the design.

Sensors' locations are important to many wireless sensor networks (WSNs). When WSNs are deployed in hostile environments, two issues about sensors' locations need to be considered. First, the attackers may attack the localization process to make the estimated locations incorrect. Second, since sensor nodes may be compromised, the base station may not trust the locations reported by sensor nodes. Researchers have proposed two techniques, secure localization and location verification, to solve the two issues respectively. In this paper we describe the attacks against localization and location verification, and survey the state of research of both secure localization and location verification.

Recently with the emergence of mobile sensor networks, localization for such networks has gained much attention, and many localization algorithms have been proposed. Among them the Sequential Monte Carlo (SMC) based algorithms are very popular because of their simplicity and efficiency. However, most current SMC-based localization algorithms implicitly assume there is no attacker in the network, which may not be true in real applications. The attackers, if any, may send false information by themselves or through compromised nodes to disturb the localization. In this paper, we present the design and evaluation of a Secure Monte Carlo Localization algorithm, SecMCL. SecMCL provides authentication to messages and employs a new sampling method to defeat attacks. Simulation results show that SecMCL greatly improves the localization accuracy of existing SMC-based localization method when there are attacks. Also, compared with existing SMC localization method, SecMCL incurs no communication cost (in terms of number of messages) and achieves the same localization accuracy when there is no attack.

Clustering has been widely used in wireless ad hoc networks for various purposes such as routing, broadcasting and Qos. Many clustering algorithms have been proposed. However, most of them implicitly assume that nodes behave honestly in the clustering process. In practice, there might be some malicious nodes trying to manipulate the clustering process to make them serve as clusterheads, which can obtain some special power, e.g., eavesdropping more messages. In this paper we present a secure weighted clustering algorithm (SWCA). SWCA uses the weighted clustering algorithm (WCA) for clustering and TELSA for efficiently authenticating packets. We propose a novel neighbor verification scheme to check whether the values of election-related features (e.g., node degree) are forged by malicious nodes. Also, we theoretically analyze the probability for a malicious node to tamper node degree without being detected and derive a lower bound on the probability. Finally, simulation results show that SWCA is secure but still has comparable performance with WCA. To the best of our knowledge, SWCA is the first algorithm considering the security of 1-hop type clustering (in this type only the clusterhead can communicate with ordinary members directly) in ad hoc networks.

Many secure localization algorithms have been proposed. In these algorithms, collusion attack is usually considered as the strongest attack when evaluating their performance. Also, for ensuring correct localization under the collusion attack, a necessary number of normal beacons are needed and a lower bound on this number has been established (assuming the errors of distance measurements are ignorable). In this paper, we introduce pollution attack, a more powerful attack which can succeed even when the number of normal beacons is more than the lower bound. In this attack, victim node is misled to a special chosen location, which results in a confusion of compromised beacon with normal beacon. We propose a new metric to measure the vulnerability of a normal location reference set to pollution attack, and develop two algorithms to efficiently compute the value of the proposed metric. We also present a method to judge whether the output of the localization algorithm is credible under pollution attack. Simulation results show that the pollution attack can succeed with high probability.

Most of the proposed communication protocols for wireless sensor networks focus on the energy efficiency. However, it often brings poor latency performance. In this paper, we develop a novel cross-layer designed asynchronous protocol EEFF (Energy Efficient and Fast Forwarding) for wireless sensor networks regarding low latency and energy efficiency. EEFF improves low power listening approach and introduces dynamical routing selection to reduce the latency. We evaluate the performance of the EEFF protocol in a testbed of 16 MICAZ motes and perform larger scale experiments with NS-2. These experiments demonstrate that EEFF significantly improves the latency and energy performance compared with state-of-art asynchronous protocols, and it's especially suitable for large scale dense wireless sensor networks.

Data-centric storage is an effective and important technique in sensor networks, however, most data-centric storage schemes may not be energy efficient and load balanced due to non-uniform event and query distributions. This paper proposes EEBASS, it utilizes an approximation algorithm to solve the optimal storage placement problem according to the variance of event and query distributions, aiming to minimize the total energy consumption for data-centric storage scheme. And it further leverages a ring based replication structure to achieve the load balance goal. Simulation results show that EEBASS is more energy efficient and balanced than traditional data-centric storage mechanisms in sensor network.

Service composition is an effective method to achieve flexible pervasive application. According to the relationship of messages and behaviors, we define a message oriented activity based Petri net (Moap) model to describe service, which supports concurrent processes and the reuse of composite service. And user's loose requirement is denoted as goal which is composed of expected input, output and key behaviors. Based on Moap, an automatic service composition algorithm autoSC is proposed to automatically create a specification of composite process to achieve goal. Finally, we analyze the effectiveness of autoSC and give a detailed comparison with other methods.

Topology control for fault tolerant communication is one of the important issues in wireless sensor networks. This paper presents a simple mechanism of fault tolerant topology control for generating undirected scale-free networks, where the network evolution is determined by the rules of growth and preferential attachment. The authors prove that this mechanism produces scale-free networks with degree exponent gamma = 1. The dynamic analysis found that this evolution model can maintain the character of scale-free networks and can improve the uniformity of the degree distribution of the networks as compared with Barabasi and Albert model.

Many security attacks are caused by software vulnerabilities such as buffer overflow. How to eliminate or mitigate these vulnerabilities, in particular with unstoppable software, is a great challenge for security researchers and practitioners. In this paper, we propose a practical framework to immunize software security vulnerabilities on the fly. We achieve the vulnerability immunization by using a security antibody, which can be implemented independently from the protected software and is used to defend against vulnerability exploitation attacks. And we employ in-core patching technique to attach the antibody quietly into running process, and hence we neither need to re-compile nor re-execute the protected software. The effectiveness of our framework depends on the effectiveness of the antibody that is implemented by redirecting flaw functions into secure ones. As a proof of concept, we have built a prototype and applied it to prevent the software from buffer overflow attacks. Preliminary experimental results show that our framework is practical and efficient for the dynamical immunization of software security vulnerabilities.

Abstract In a Grid‐based services system facing a large number of requests with different services and profits significance, there is always a trade‐off between the system profits and the Quality of Service (QoS). In such systems, admission control plays an important role: the system has to employ a proper strategy to make admission control decisions and reserve resources for the coming requests thus to achieve greater profits without violating the QoS of the requests already admitted. In this paper, we introduce three essential admission control strategies with threshold on resource reservation and a newly proposed strategy with layered threshold. Through comprehensive theoretical analyses and extensive simulations, we demonstrate that the strategy with layered threshold is more efficient and flexible than the existing strategies for Grid‐based multimedia services systems. Copyright © 2006 John Wiley & Sons, Ltd.