Smart Information Flow Technologies - cyber defense

Network Policy Enforcement Using Transactions: The NEUTRON Approach

dthomsen — Fri, 29 Jun 2018 20:09:40 +0000

We propose a tool to capture applications requirements with respect to the enforcement of network security policies in an object-oriented design language. Once a design captures clear, concise, easily understood network requirements new technologies become possible, including network transactions and user-driven policies to remove rarely used network permissions until needed, creating a least privilege in time policy. Existing security enforcement policies represent a model of all allowable behavior. Only modeling allowable behavior requires that any entity that may need a permission, be granted it permanently. Refining the modeling to distinguish between common behavior and rare behavior will increase security. The increased security comes with costs, such as requiring users to strongly authenticate more often. This paper discusses those costs and the complexity of increasing security enforcement models.

Citation:

Dan Thomsen and Elisa Bertino. 2018. Network Policy Enforcement Using Transactions: The NEUTRON Approach. In Proceedings of the 23nd ACM on Symposium on Access Control Models and Technologies (SACMAT '18). ACM, New York, NY, USA, 129-136.

Date Published:

Wednesday, June 13, 2018

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Automated Fault Analysis and Filter Generation for Adaptive Cybersecurity

sfriedman — Thu, 10 Sep 2015 18:51:18 +0000

We are developing the FUZZBUSTER system to automatically identify software vulnerabilities and create adaptations that shield or repair those vulnerabilities before attackers can exploit them. Adaptive cybersecurity involves efficiently improv- ing software security to minimize the window of attack, and also preserving software functionality as much as possible. This paper presents new tools that have been integrated into FUZZBUSTER adaptive cybersecurity. These tools produce more general, accurate adaptations, increase the efficiency of FUZZBUSTER’s diagnoses and adaptation operations, and preserve the software’s functionality. We report the results of FUZZBUSTER’s analysis of 16 fault-injected command-line binaries and six previously known bugs in the Apache web server. We compare results over different configurations of FUZZBUSTER to characterize the benefits of the new fuzz-testing tools.

Citation:

David J. Musliner, Scott E. Friedman, Jeffrey M. Rye. (2014). Automated Fault Analysis and Filter Generation for Adaptive Cybersecurity. ADAPTIVE 2014 : The Sixth International Conference on Adaptive and Self-Adaptive Systems and Applications. Venice, Italy. Best Paper Award.

Date Published:

Wednesday, March 5, 2014

Publication File:

adaptive14.pdf

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages:

Improving Automated Cybersecurity by Generalizing Faults and Quantifying Patch Performance

admin — Thu, 06 Aug 2015 19:46:30 +0000

Keywords: cyber defense, adaptive security, security metrics, filter generation.

Abstract: We are developing the FUZZBUSTER system to automatically identify software vulnerabilities and create adaptations that shield or repair those vulnerabilities before attackers can exploit them. FUZZBUSTER’s goal is to minimize the time that vulnerabilities exist, while also preserving software functionality as much as possible. This paper presents new adaptive cybersecurity tools that we have integrated into FUZZBUSTER, as well as new metrics that FUZZBUSTER uses to assess their performance. FUZZBUSTER’s new tools increase the efficiency of its diagnosis and adaptation operations, they produce more general, accurate adaptations, and they effectively preserve software functionality. We present FUZZBUSTER’s analysis of 16 fault-injected commandline binaries and six previously known bugs in the Apache web server. We compare FUZZBUSTER’s results for different adaptation strategies and tool settings, to characterize their benefits.

The PDF document may be downloaded from iariajournals.org

Citation:

Scott E. Friedman, David J. Musliner, Jeffrey M. Rye. (2014). Improving Automated Cybersecurity by Generalizing Faults and Quantifying Patch Performance. International Journal on Advances in Security, 7(3&4). pp. 121-130

Date Published:

Wednesday, August 6, 2014

Workflow: Editor Role:

Request Review

Workflow: Publisher Role:

Publish

Prevent Workflow Messages: