Browsing by Author "Cho, Michael Cheng Yi"

Now showing 1 - 6 of 6

Can Malware Be Exterminated by Better Understanding Its Roots?
(2014-11-01)
Cho, Michael Cheng Yi
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng
;
Wang, Chi-Wei
;
資訊工程學系
Combating Software Piracy in Public Clouds
(2015-10-01)
Wang, Chia-Wei
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
CodeMist is an innovative security framework that leverages both passive and active approaches to prevent piracy of cloud-based rental software.
Fast Discovery of VM-Sensitive Divergence Points with Basic Block Comparison
(2014-01-01)
Liu, Yen-Ju
;
Chen, Chong-Kuan
;
Cho, Michael Cheng Yi
;
Shich, Shiuhpyng
;
資訊工程學系
To evade VM-based malware analysis systems, VM-aware malware equipped with the ability to detect the presence of virtual machine has appeared. To cope with the problem, detecting VM-aware malware and locating VM-sensitive divergence points of VM-aware malware is in urgent need. In this paper, we propose a novel block-based divergence locator. In contrast to the conventional instruction-based schemes, the block-based divergence locator divides malware program into basic blocks, instead of binary instructions, and uses them as the analysis unit. The block-based divergence locator significantly decrease the cost of behavior logging and trace comparison, as well as the size of behavior traces. As the evaluation showed, behavior logging is 23.87-39.49 times faster than the conventional schemes. The total number of analysis unit, which is highly related to the cost of trace comparisons, is 11.95%-16.00% of the conventional schemes. Consequently, VM-sensitive divergence points can be discovered more efficiently. The correctness of our divergence point discovery algorithm is also proved formally in this paper.
Identifying and Authenticating IoT Objects in a Natural Context
(2015-08-01)
Zhang, Zhi-Kai
;
Cho, Michael Cheng Yi
;
Wu, Zong-Yu
;
Shieh, Shiuhpyng-Winston
;
資訊工程學系
A proposed property-aware name service simultaneously supports what, where, and when properties of each IoT object through unique, text-based, and human-readable identity assignments.
IoT Security: Ongoing Challenges and Research Opportunities
(2014-01-01)
Zhang, Zhi-Kai
;
Cho, Michael Cheng Yi
;
Wang, Chia-Wei
;
Hsu, Chia-Wei
;
Chen, Chong-Kuan
The Internet of Things (IoT) opens opportunities for wearable devices, home appliances, and software to share and communicate information on the Internet. Given that the shared data contains a large amount of private information, preserving information security on the shared data is an important issue that cannot be neglected. In this paper, we begin with general information security background of IoT and continue on with information security related challenges that IoT will encountered. Finally, we will also point out research directions that could be the future work for the solutions to the security challenges that IoT encounters.
Light-Weight CSRF Protection by Labeling User-Created Contents
(2013)
Sung, Yin-Chang
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng Winston
Cross-site request forgery (CSRF/XSRF) is a serious vulnerability in Web 2.0 environment. With CSRF, an adversary can spoof the payload of an HTTP request and entice the victim's browser to transmit an HTTP request to the web server. Consequently, the server cannot determine legitimacy of the HTTP request. This paper presents a light-weight CSRF prevention method by introducing a quarantine system to inspect suspicious scripts on the server-side. Instead of using script filtering and rewriting approach, this scheme is based on a new labeling mechanism (we called it Content Box) which enables the web server to distinguish the malicious requests from the harmless requests without the need to modify the user created contents (UCCs). Consequently, a malicious request can be blocked when it attempts to access critical web services that was defined by the web administrator. To demonstrate the effectiveness of the proposed scheme, the proposed scheme was implemented and the performance was evaluated.