Eavesdroppers can exploit exposed packet headers towards attacks that profile clients and their data flows. In this paper, we propose FOG, a framework for effective full and partial header blinding using MIMO, to thwart eavesdroppers. FOG effectively tracks header bits as they traverse physical (PHY) layer sub-systems that perform functions like scrambling and interleaving. It combines multiple blinding signals for more effective and less predictable obfuscation, as compared to using a fixed blinding signal. We implement FOG on the WARP platform and demonstrate via extensive experiments that it yields better obfuscation than prior schemes that deploy full packet blinding. It causes a bit error rate (BER) of > 40 % at an eavesdropper if two blinding streams are sent during header transmissions. Furthermore, even with full header blinding, FOG incurs a very small throughput hit of ≈5% with one blinding stream (and 9 % with two streams). Full packet blinding incurs much higher throughput hits (25 % with one stream and 50 % with two streams).

VM migration is an effective countermeasure against attempts at malicious co-residency. In this paper, our overarching objectives are: (a) to get an in-depth understanding of the ways and effectiveness with which an attacker can launch attacks toward achieving co-residency and (b) to design migration policies that are very effective in thwarting malicious co-residency, but are thrifty in terms of the bandwidth and downtime costs that are incurred with live migration. Toward achieving our goals, we first undertake an experimental study on Amazon EC2 to obtain an in-depth understanding of the side-channels, through which an attacker can use to ascertain co-residency with a victim. Here, in this paper, we identify a new set of stealthy side-channel attacks which we show to be more effective than the currently available attacks toward verifying co-residency. We also build a simple model that can be used for estimating co-residency times based on very few measurements on a given cloud platform, to account for varying attacker capabilities. Based on the study, we develop a set of guidelines to determine under what conditions the victim VM migrations should be triggered, given the performance costs in terms of bandwidth and downtime, which a user is willing to bear. Through extensive experiments on our private in-house cloud, we show that the migrations, using our guidelines, can limit the fraction of the time that an attacker VM co-resides with a victim VM to about 1% of the time with the bandwidth costs of a few MB and downtimes of a few seconds per day per VM migrated.

Eavesdroppers can exploit exposed packet headers towards attacks that profile clients and their data flows. In this paper, we propose FOG, a framework for effective header blinding using MIMO, to thwart eavesdroppers. FOG effectively tracks header bits as they traverse physical (PHY) layer sub-systems that perform functions like scrambling and interleaving. It combines multiple blinding signals for more effective and less predictable obfuscation, as compared to using a fixed blinding signal. We implement FOG on the WARP platform and demonstrate via extensive experiments that it yields better obfuscation than prior schemes that deploy full packet blinding. It causes a bit error rate (BER) of > 40 % at an eavesdropper if two blinding streams are sent during header transmissions. Furthermore, FOG incurs a very small throughput hit of ≈5 % with one blinding stream (and 9 % with two streams). Full packet blinding incurs much higher throughput hits (25 % with one stream and 50 % with two streams).

Attacker VMs try to co-reside with victim VMs on the same physical infrastructure as a precursor to launching attacks that target information leakage. VM migration is an effective countermeasure against attempts at malicious co-residency. In this paper, we first undertake an experimental study on Amazon EC2 to obtain an in-depth understanding of the side-channels an attacker can use to ascertain co-residency with a victim. Here, we identify a new set of stealthy side-channel attacks which, we show to be more effective than currently available attacks towards verifying co-residency. Based on the study, we develop a set of guidelines to determine under what conditions victim VM migrations should be triggered given performance costs in terms of bandwidth and downtime, that a user is willing to bear. Via extensive experiments on our private in-house cloud, we show that migrations using our guidelines can limit the fraction of the time that an attacker VM co-resides with a victim VM to about 1 % of the time with bandwidth costs of a few MB and downtimes of a few seconds, per day per VM migrated.

Frequent app bugs and low tolerance for loss of functionality create an impetus for self-healing smartphone software. We take a step towards this via on-the-fly error detection and automated patching. Specifically, we add failure detection and recovery to Android by detecting crashes and ``sealing off'' the crashing part of the app to avoid future crashes. In the detection stage, our system dynamically analyzes app execution to detect certain exceptional situations. In the recovery stage, we use bytecode rewriting to alter app behavior as to avoid such situations in the future. When using our implementation, apps can resume operation (albeit with limited functionality) instead of repeatedly crashing. Our approach does not require access to app source code or any system (e.g., kernel-level) modification. Experiments on several real-world, popular Android apps and bugs show that our approach manages to recover the apps from crashes effectively, timely, and without introducing overhead.

In this poster, we describe our experience of designing and executing two different weeklong programs for 10th -- 12th grade students. The goal of our program is to attract students to the field of computing, increase their computing confidence and familiarize them with ways that computing impacts our community. Student groups consist of 32 students for each week with a 1:0.8 male-to-female ratio. No prerequisite knowledge is required to attend. We compare the different facets of the curriculums by evaluating the impact of each week both quantitatively and qualitatively. Our evaluation implies the attraction of cyber security topics to this age group, particularly male students, and presents a curriculum that may help increase confidence in computing concepts, particularly for female students. We solicit feedback and welcome input on our curriculum and evaluation method.

In this paper we review the problem of packet loss as it pertains to Network Intrusion Detection, seeking to answer two fundamental research questions which are stepping stones towards building a model that can be used to predict the rate of alert loss based upon the rate of packet loss. The first question deals with how the packet loss rate affects the sensor alert rate, and the second considers how the network traffic composition affects the results of the first question. Potential places where packet loss may occur are examined by dividing the problem into network, host, and sensor based packets loss. We posit theories about how packet loss may present itself and develop the Packet Dropper that induces packet loss into a dataset. Drop rates ranging from 0% to 100% are applied to four different data sets and the resulting abridged data sets are analyzed with Snort to collect alert loss rate. Conclusions are drawn about the importance of the distribution of packet loss and the effect of the network traffic composition.

XACML (extensible access control markup language) is an access control policy language standardized by the OASIS (Organization for Advancement of Structured Information Standards). We have extended the standard XACML languages and processing models to allow the access control policies be embedded with digital content in the same XACML-like document. The original content can be further divided into multiple parts, each of which is encapsulated by its own XACML statements that specify the access control policy specific to this part, such that different policies can be applied to and enforced for different parts of the digital content. These embedded and fine-grained access control policy capabilities can be used to facilitate the protection, management and sharing of information no matter where the information resides. We have also developed an initial prototype of this XACML based mechanism for proof-of-concept purpose.

We present a rate insensitive method for detecting steganography using plusmn1 embedding. plusmn1 embedding is generally considered to be difficult to detect. In prior work, we developed a high performing method based on statistics computed by a lossless image compressor. However, the method suffered a weakness that the embedding rate needed to be known. In this work, we introduce improved classifiers that work without knowing the rate. The overall classification rate is excellent for the database of images studied.

We present a method for detecting steganography using plusmn1 embedding. The method uses a lossless compression technique to compress the last two bitplanes in an effort to model the image structure where the data may be hidden. A small number of statistics are then computed using the model and fed into a support vector machine to classify detection results. Results presented are obtained using k-fold cross-validation method using a large set of never compressed grayscale images. Detection results show improvement over current plusmn1 steganalysis methods.

Today's applications are highly mobile; we download software from the Internet, machine executable code arrives attached to electronic mail, and Java applets increase the functionality and appearance of Web pages. This movement has stirred a great deal of research in the area of mobile code security. The fact remains that a newly arrived program to a local host has the potential to inflict significant damage to the local host and local resources. Perhaps the new program originated from a charlatan host masquerading as a trusted server, or has been modified by a malicious party during transit from the trusted server to the local host. In light of this risk, security models that address mobile code are in high demand. We have developed a framework named SECRYT, which enables users of a mobile application to validate the application with integrity and authentication data while simplifying the management and distribution of the authentication data.

In this paper, we present a new method of digital steganography, entitled spread spectrum image steganography (SSIS). Steganography, which means "covered writing" in Greek, is the science of communicating in a hidden manner. Following a discussion of steganographic communication theory and review of existing techniques, the new method, SSIS, is introduced. This system hides and recovers a message of substantial length within digital imagery while maintaining the original image size and dynamic range. The hidden message can be recovered using appropriate keys without any knowledge of the original image. Image restoration, error-control coding, and techniques similar to spread spectrum are described, and the performance of the system is illustrated. A message embedded by this method can be in the form of text, imagery, or any other digital signal. Applications for such a data-hiding scheme include in-band captioning, covert communication, image tamperproofing, authentication, embedded control, and revision tracking.

We present a new method of embedding information within digital images, called spread spectrum image steganography (SSIS). Steganography, which means "covered writing" in Greek, is the science of communicating in a hidden manner. SSIS conceals a message of substantial length within digital imagery while maintaining the original image size and dynamic range. The hidden message can be recovered using the appropriate keys without any knowledge of the original image. Image processing, error control coding, and spread spectrum techniques used to conceal the hidden data are described, and the performance of the technique is illustrated. The message embedded by this method can be in the form of text, imagery, or any other digital signal. Applications for such a data-hiding scheme include in-band captioning, hidden communication, image tamperproofing, authentication, invisible map overlays, embedded control, and revision tracking.

Robust source coding provides both compression and noise mitigation without channel coding. Two methods of robust source coding are presented. The first is DPCM incorporating a nonlinear filter; the second is predictive trellis-coded quantization (PTCQ), whose prediction filter is also nonlinear. Findings show that the incorporation of the nonlinear filter provides the ability to conceal the effects of noise and minimize the propagation of error. A comparison is made between the performance of the two methods in a noisy environment. It is demonstrated that the PTCQ scheme provides a method of least distortion at low BER. However, at higher BER the DPCM scheme outperforms PTCQ. Robust source coding of images employing PTCQ or DPCM with the nonlinear prediction filter exhibits low sensitivity to bit errors and yields, visually, a better reconstructed image after transmission over very noisy channels.