Browsing by Author "Huang, Shih-Kun"

Now showing 1 - 20 of 27

A Multi-Agent Intelligence Hybrid System Technique for Detection and Defense of DDoS Attacks
(2015-01-01)
Chen, Hsia-Hsiang
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
;
Department of Computer Science
In the paper, we propose the distributed detection and identification multi-agent system (DDIMAS) framework that is the first attempt to apply in solving distributed denial of service (DDoS) problem. It includes three stages which are information heuristic rule, meta-heuristic algorithm and backward and forward search (BFS) rule, respectively. Moreover, the framework is a flexible architecture that can incorporate into other algorithms or rules to improve the overall performance. From the evaluation design, the experiment results show that our method is with higher detection rate and better accuracy than standard repositories. The proposed framework resolves issues in other swarm optimization algorithms and reveals that the performance of DDIMAS is better than existing methods and the adaptive meta-heuristic algorithm framework outperforms other methods for detecting DDoS attacks.
A Novel Massive Deployment Solution Based on the Peer-to-Peer Protocol
(2019-01-02)
Shiau, Steven J. H.
;
Huang, Yu-Chiang
;
Yen, Ching-Hsuan
;
Tsai, Yu-Chin
;
Sun, Chen-Kai
The BitTorrent (BT) is a peer-to-peer (P2P) file sharing protocol that was developed approximately 20 years ago, is becoming increasingly popular, and has been widely accepted. The BT-based mass deployment system can be used to improve performance and scalability that cannot be achieved by the unicasting, broadcasting, and multicasting protocols. However, when the BT-based system is applied in massive deployments, a major issue related to insufficient temporary storage space to store the whole system image before deploying needs to be resolved. Such problems arose because the system is deployed to the disk space, meaning that it cannot be used for temporary storage. Therefore, a novel BT-based solution that can remove the limitations caused by the insufficient temporary storage issue is proposed. The BT-based mass deployment system was designed by using the file system blocks transferring (FSBT) mechanism. The receiver of the FSBT mechanism can obtain the blocks of the file system from other peers. Then, those blocks will be written directly to raw disks or partitions. The sender of the FSBT mechanism can read the blocks of file systems directly from raw disks or partitions. Then, the blocks can be sent to other peers. This approach solves the insufficient temporary storage issue. The novel BT-based mass deployment system was tested and verified for the configuration consisting of at most 32 personal computers (PCs). To demonstrate the achievable performance of the novel BT-based system, comparisons were made between the novel program and the traditional multicast solutions, as well as other solutions for mass deployment. The proposed BT solution can be much faster than the multicast solution when deploying 11 machines or more. The experimental results demonstrated the feasibility and superior performance of the proposed system. Furthermore, performance comparisons of the proposed BT-based mass deployment system versus other solutions demonstrated the feasibility and efficiency of the proposed solution. In the future, the BT parameters can be further optimized, and the simultaneous read and write features can be implemented to improve the deployment performance. In addition, the BT-based mass deployment system can serve as the basis for the development of other mass deployment systems.
A Scalable Privacy Preserving System for Open Data
(2016-01-01)
Yeh, Chao-Chun
;
Wang, Pang-Chieh
;
Pan, Yu-Hsuan
;
Kao, Ming-Chih
;
Huang, Shih-Kun
The citizen considers that data source collecting by the government can be released for more diversity usage. However, to archive the open data dream, sensitive data potentially could be published after the proper privacy preserving processing. In this paper, we present a scalable privacy preserving system for open/big data which leverages K-anonymity algorithm and Hadoop framework. We use an experiment data (i.e., 10 TB) to show our system can handle the high-volume data when increasing the system resource. It is an essential factor for the Government to publish the data with privacy preserving processing.
A Unified Ant Agent Framework for Solving DoS and QoS Problems
(2016-11)
Chen, Hsia-Hsiang
;
Lee, Chien-Hua
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
Anomalous traffic volume can be used for identifying network threats and faults. Denial of service (DoS) and quality of service (QoS) are two contrasting problems of anomalous network traffic. DoS exploits malicious traffic to hinder service availability to normal users, whereas QoS determines if the service provision quality has reached the preset agreement. This paper proposes a unified ant agent framework for identifying the source of these problems: IP traceback for DoS attacks and fault localization for QoS violations. Numerous studies have investigated IP traceback techniques for identifying spoofed IP addresses of attackers. These techniques can identify the attack path from the victim to the attacker. Metaheuristic algorithms that consider slight increments in traffic volume (SITV) are rarely studied for solving the IP traceback problem of DoS attacks. We investigated the malicious and nonmalicious situations for the QoS attack and QoS fault localization problem. This paper proposes a novel ant colony optimization (AGO) method for fast filtering, DoS threat source identification, and QoS fault localization (unified threat identification and fault localization by using ACO, UTFACO). The UTFACO framework was compared with the probabilistic packet marking approach and conventional ant system algorithms. We compared the efficiency of UTFACO with and without a bloom filter (BF). The framework was verified in the QoS attack and QoS fault experiment environments. This study showed that attack or fault detection and identification procedures can be designed and implemented practically. The tests used the dataset of the network topology from the DARPA repository with two cases: one is a general experiment, and the other has various levels of SITV. Perfect accuracy can be achieved for the general experiment, and more than 90% accuracy can be obtained for various levels of SITV. The datasets of the QoS attack and QoS fault were obtained from a real network. Precise fault localization is achieved due to the high detection rate obtained. The results show that UTFACO is an efficient and accurate framework. Moreover, the computation time is considerably reduced by using UTFACO with the BF, and the time is less than five seconds in the framework. Our proposed framework is robust and can solve the problem of identifying the IP address of an attacker and detecting the fault location.
An Efficient Strong Designated Verifier Proxy Signature Scheme for Electronic Commerce
(2012-07-01)
Lin, Han-Yu
;
Wu, Tzong-Sun
;
Huang, Shih-Kun
;
資訊工程學系
;
Department of Computer Science
"A strong designated verifier signature (SDVS) scheme only allows a designated verifier to validate signer's signatures for ensuring confidentiality. At the same time, the designated verifier can not transfer the signature to any third party, since he can also generate another computationally indistinguishable SDVS, which is referred to as non-transferability. A proxy signature scheme is a special type of digital signature schemes, which enables an authorized proxy signer to create a valid proxy signature on behalf of the original one. The resulted proxy signature is publicly verifiable by anyone. In this paper, we elaborate on the merits of SDVS schemes and proxy signature schemes to propose an efficient strong designated verifier proxy signature (SDVPS) scheme in which only a designated verifier can be convinced of the proxy signer's identity. The proposed scheme has crucial benefits in organizational operations and electronic commerce. Compared with related schemes, ours has not only shorter signature length, but also lower computational costs. Moreover, the security requirement of unforgeability against existential forgery under adaptive chosen-message attacks (EF-CMA) is proved in the random oracle model."
Automatic Defense Through Fault Localization and Dynamic Patch Creation
(2016)
Chen, Hsia-Hsiang
;
Zheng, Da-Qun
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
The US Department of Defense has called for contest on automatic attack and defense. The contest is a competition, called Cyber Grand Challenge (CGC), aimed at developing cyber security systems. In accordance with the competition rules, we developed an automatic cyber reasoning system (CRS) that meets the objectives specified in the CGC. Our CRS combines the techniques of fuzz testing, fault localization, and binary patch creation to construct an automatic defense system. From the sample problems in the CGC, we evaluate our system and the binary patch capability by applying them to real programs. We explore two patching methods in five challenges in CGC with partial successes in availability and security.
Big Data Platform Configuration Using Machine Learning
(2020-05-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Zhou, Jiazheng
;
Chang, Sheng-An
;
Lin, Xuan-Yi
By ensuring well-developed complex big data platform architectures, data engineers provide data scientists and analysts infrastructure with computational and storage resources to perform their research. Based on such supports, data scientists are provided an opportunity to focus on their domain problems and design the required intelligent modules (i.e., prepare the data; select, train, and tune the machine-learning modules; and validate the results). However, there are still gaps between system engineering and data scientist/engineering teams. Generally, system engineers have limited knowledge on the application domains and the purposes of an analytical program. On the contrary, both data scientists and engineers are usually unfamiliar with the configuration of a computational system, file system, and database. However, the performance of an application can be affected by a system's configuration, and the data scientists and engineers have little information and knowledge about which of the system's properties can affect the application's performance. As a typical example, for Internet-scale applications that have thousands of computing nodes or billions of Internet of Things devices, even a slight improvement may have an enormous influence on energy management and environmental protection issues. To bridge the gap between system engineering and data scientist/engineering teams, we proposed the concept of a configuration layer based on a big data platform, Hadoop. We built a configuration tuner, BigExplorer, to collect and preprocess data. Furthermore, we also created golden configurations for performance improvement. Based on the processed data, we used a semi-automatic feature engineering technique to provide more features for data engineers and developed the performance model using three different machine learning algorithms (i.e., random forest, gradient boosting machine, and support vector machine). Using the commonly used benchmarks of Word-Count, TeraSort, and Pig workloads, our configuration tuner achieved a significant performance improvement of 28%-51% for different workloads than using the rule-of-thumb configuration.
BigExplorer: A Configuration Recommendation System for Big Data Platform
(2016-01-01)
Yeh, Chao-Chun
;
Zhou, Jiazheng
;
Chang, Sheng-An
;
Lin, Xuan-Yi
;
Sun, Yichiao
With the complexity big data platform architectures, data engineer provides the infrastructure with computation and storage resource for data scientist and data analyst. With those supports, data scientists can focus their domain problem and design the intelligence module (e.g., prepare the data, select/train/tune the machine learning modules and validate the result). However, there is still a gap between system engineer team and data scientists/engineers team. For system engineers, they don't have any knowledge about the application domain and the propose of the analytic program. For data scientists/engineers, they don't know the configuration of the computation system, file system and database. Some application performance issues are related with system configurations. Data scientist and data engineer do not have information and knowledge about the system properties. In this paper, we propose a configuration layer with the current big data platform (i.e., Hadoop) and build a configuration recommendation system to collect data, pre-process data. Based on the processed data, we use semi-automatic feature engineer to provide features for data engineers and build the performance model with three different machine learning algorithms (i.e., random forest, gradient boosting machine and support vector regression). With the same two benchmarks (i.e., wordcount and terasort), our recommended configuration archives remarkable improvement than rule of thumb configuration and better than their improvements.
Browser Fuzzing by Scheduled Mutation and Generation of Document Object Models
(2015-01-01)
Lin, Ying-Dar
;
Liao, Feng-Ze
;
Huang, Shih-Kun
;
Lai, Yuan-Cheng
;
資訊工程學系
Internet applications have made our daily life fruitful. However, they also cause many security problems if these applications are leveraged by intruders. Thus, it is important to find and fix vulnerabilities timely to prevent application vulnerabilities from being exploited. Fuzz testing is a popular methodology that effectively finds vulnerabilities in application programs with seed input mutation. However, it is not a satisfied solution for the web browsers. In this work, we propose a solution, called scheduled DOM fuzzing (SDF), which integrates several related browser fuzzing tools and the fuzzing framework called BFF. To explore more crash possibilities, we revise the browser fuzzing architecture and schedule seed input selection and mutation dynamically. We also propose two probability computing methods in scheduling mechanism which tries to improve the performance by determining which combinations of seed and mutation would produce more crashes. Our experiments show that SDF is 2.27 time more efficient in terms of the number of crashes and vulnerabilities found at most. SDF also has the capacity for finding 23 exploitable crashes in Windows 7 within five days. The experimental results reveals that a good scheduling method for seed and mutations in browser fuzzing is able to find more exploitable crashes than fuzzers with the fixed seed input.
Certificate-Based Secure Three-Party Signcryption Scheme With Low Costs
(2012-07-01)
Lin, Han-Yu
;
Wu, Tzong-Sun
;
Huang, Shih-Kun
;
資訊工程學系
;
Department of Computer Science
"A signcryption scheme combining public key encryptions and digital signatures can simultaneously satisfy the security requirements of confidentiality, integrity, authenticity and non-repudiation. In a three-party communication environment, a message signcrypted by one party might have to be securely delivered to the other two and they usually independently decrypt the ciphertext and verify recovered signature. Consequently, traditional signcryption schemes of single-recipient setting are not applicable. In this paper, we elaborate on the certificate-based cryptosystem to propose a provably secure three-party signcryption scheme from bilinear pairings. The security requirement of confidentiality against indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2) and that of unforgeability against existential forgery under adaptive chosen-message attacks (EF-CMA) are proved in the random oracle model. Moreover, our scheme enables each recipient to solely reveal the signer's original signature for public verification without extra computational efforts when the case of a later dispute over repudiation occurs. To the best of our knowledge, the proposed scheme is the first provably secure signcryption considering three-party communication environments."
CovDroid: A Black-Box Testing Coverage System for Android
(2015)
Yeh, Chao-Chun
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
;
Department of Computer Science
In android ecosystem, the Apps marketplace vendor faces huge number of Apps with irregular quality. Besides bug finding, coverage index is neglected for the current Android testing services. However it is also a challenge to measure the testing coverage without source code. In this paper, we provide a systematic approach to measure the App testing coverage for black-box testing and implement CovDroid, a black-box coverage system for android. Furthermore, we use a App with different test cases to prove our concept that coverage index can improve the App and measure test cases quality for App market or testing vendors.
CRAXDroid: Automatic Android System Testing by Selective Symbolic Execution
(2014-01-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Chen, Chun-Yen
;
Khor, Kee-Kiat
;
Huang, Shih-Kun
Mobile devices such as smart phones and tablet PCs are becoming common personal devices. The business model of a central software market is also thriving and turning into a major distribution source of software packages on those devices. However, these devices often contain personal private information and can be used to conduct operations involving data leakage and payment events like sending SMS. As a result, the quality of software on mobile devices becomes a critical issue. We aim at checking whether software off the shelf contains defective behavior or potential vulnerabilities, and aiding the official APP or third party markets to ensure their software without privacy issues. We have built a platform for android APP testing, by revising our software quality assurance and exploit generation platform, called CRAX, to apply in the Android platform. It is called the CRAXDroid that allows any inputs to be the testing sources to the APP without source code. These approaches are based on the symbolic execution technique and android emulator. By automatically exploring execution paths, we can find potential software defects. We perform several experiments on Android applications to prove the feasibility of our method.
CRAXfuzz: Target-Aware Symbolic Fuzz Testing
(2015)
Yeh, Chao-Chun
;
Chung, Hsiang
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
Vulnerabilities are caused by implementation bugs, such as buffer overflow, integer overflow, uncontrolled format strings, and command injection flaws. They are often exploited to intrude software systems. In order to reduce software bugs, testing techniques are proposed. The recent technique to discover security-related bugs is fuzz testing. However, traditional fuzzers can only find bugs when program exceptions, especially crashes, raised. Some security threats may pass these tests due to insufficient code coverage. In this paper, we introduce a software testing framework based on symbolic execution using (SE)-E-2, a whole system symbolic execution engine. When a program executes our pre-defined security sensitive functions, such as malloc, strcpy or printf, our framework will initiate a triage process. The process will determine whether any related security vulnerabilities would possibly occur in these functions automatically. We successfully and efficiently reproduce 12 previously known vulnerabilities from normal input data within 100 seconds for large applications such as Tiff, VIM, and MPlayer. Our tool can help developers locate bugs faster, and improve the efficiency of software quality maintenance.
CRAXTriage: A Coverage Based Triage System
(2017-01-01)
Yeh, Chao-Chun
;
Lu, Han-Lin
;
Lee, Yi-Hsuan
;
Chou, Wei-Sheng
;
Huang, Shih-Kun
Software is getting complicated due to the changing needs and flourishing development of software industry. To better improve software quality, we have to find the major reasons which cause the program crash. However, debugging by software developer is not an efficient method, especially in large software. Many automated tools are developed to enhance the fault localization efficiency and reduce the maintenance cost. Most researches focus on improving the software testing process, and the primary triage method is based on the stack-trace hash (e.g., smartfuzz, basic fuzzing framework and Failure Observation engine), and is unchanged for a long time. Therefore, we propose a new triage method based on binary block coverage. Our triage method is designed by analyzing the binary level coverage results, on every time the input causes the program crash. For the same crash input, we also use traditional stack-trace hash method to contrast the flaws with our method. Our experiment results reveal that our proposed method based on code coverage exhibits better triages in terms of the number of unique bugs identified and correct classifications of faults.
CRAXweb: Automatic Web Application Testing and Attack Generation
(2013)
Huang, Shih-Kun
;
Lu, Han-Lin
;
Leong, Wai-Meng
;
Liu, Huan
;
資訊技術服務中心
This paper proposes to test web applications and generate the feasible exploits automatically, including cross-site scripting and SQL injection attacks. We test the web applications with initial random inputs by detecting symbolic queries to SQL servers or symbolic responses to HTTP servers. After symbolic outputs detected, we are able to generate attack strings and reproduce the results, emulating the manual attack behavior. In contrast with other traditional detection and prevention methods, we can determine the presence of vulnerabilities and prove the feasibility of attacks. This automatic generation process is based on a dynamic software testing method-symbolic execution by (SE)-E-2. We have applied this automatic process to several known vulnerabilities on large-scale open source web applications, and generated the attack strings successfully. Our method is web platform independent, covering PHP, JSP, Rails, and Django due to the supports of the whole system environment of (SE)-E-2.
Detection and diagnosis of control interception
(2007)
Tsai, Chang-Hsien
;
Huang, Shih-Kun
;
資訊工程學系
;
Department of Computer Science
Crash implies that a software is unstable and possibly vulnerable. Stack overflow is one of many causes of crashes. This kind of bug is often hard to debug because of the corrupted stack, so that debuggers cannot trace the control flow of the programs. A control-type crash caused by stack overflow is easy to be developed as a control interception attack. We develop a method to locate this attack and implement it as a plug-in of Valgrind [1]. This tool can be used in the honeypot to detect and diagnose zero-day exploits. We use it to detect several vulnerabilities and automatically locate the bugs.
Diagnosing SDN Network Problems by Using Spectrum-based Fault Localization Techniques
(2015)
Chen, Hsia-Hsiang
;
Lu, Han-Lin
;
Huang, Shih-Kun
;
Gao, Ruizhi
;
Wong, W. Eric
Software-defined network (SDN) is the recent advances of mitigation on improving network management flexibility and dynamic configurability. It is due to the separation of control plane and data plane and the controller software for arbitrary network configurations. However, such a flexible architecture still suffers from the inherent traits of software quality issues. Software testing and software related fault localization methods should be applied. To the best of our knowledge, we are the first to apply spectrum-based fault localization (SFL) techniques for SDN problems and propose the SFL system framework to find the illogic rules and related procedure faults in SDN. We conduct evaluations on the standard SDN environment in OpenFlow and compare the related SFL techniques. The results show that the fault locations can be found precisely. In addition, we also develop a debugging tool that can search the error causes and feedback the information to the SDN controller for fixing the faulty conditions in time.
Dynamic Path Pruning in Symbolic Execution
(2018-01-01)
Chen, Ying-Shen
;
Chen, Wei-Ning
;
Wu, Che-Yu
;
Hsiao, Hsu-Chun
;
Huang, Shih-Kun
To alleviate path explosion in symbolic execution, path pruning removes unsatisfiable paths at an early stage before they multiply. Although existing symbolic execution platforms have implemented several path pruning strategies to determine whether and when to check a path's satisfiability, it remains unclear how effective these strategies are because the time to check a path's satisfiability is non-negligible and may vary drastically. This work proposes dynamic path pruning (DPP), a strategy that aims to minimize the overall exploration time by dynamically adjusting the path checking rate. DPP assigns a higher checking rate to paths that are more likely to be unsatisfiable, and the likelihood is estimated based on the observed program's characteristics, such as the observed percentage of satisfiable paths. DPP is implemented on top of an open source symbolic execution platform in only a few hundred lines. Our evaluation confirms that DPP consistently achieves near-optimal exploration time for a wide spectrum of programs, whereas existing static path pruning strategies suffer from unacceptable worstcase performance due to their program-independent behaviors. Compared with static strategies, DPP performs best in 84% (110 out of 131) of CGC binaries, and the exploration time is within 100-124% of the best static strategy in 95% of the tested handcrafted and coreutils binaries.
Effective Test Generation for Combinatorial Decision Coverage
(2016)
Gao, Ruizhi
;
Hu, Linghuan
;
Wong, W. Eric
;
Lu, Han-Lin
;
Huang, Shih-Kun
Complex software systems present significant challenges to existing software testing techniques. Simply applying exhaustive testing will lead to the execution of a prohibitively large number of test cases. Furthermore, many testing techniques today provide neither promising coverage achievement nor reliable fault detection strength. In this paper, we propose a technique, which represents an innovative synthesis of combinatorial testing and symbolic execution, to generate test cases based on a novel coverage criterion, namely combinatorial decision coverage (CDC). Strength t (or t-way) CDC requires each t-tuple of decision outcomes to be executed by at least one test case. Given a program, our CDC-based technique first uses a revised version of a symbolic executor, (SE)-E-2, to collect all program decisions with symbolic variables as well as their corresponding constraints and then applies a combinatorial test generation tool, ACTS, to generate t-way combinations for the outcomes of these decisions. A test case can be generated with respect to each combination that represents a single path-condition of the program. Case studies were conducted on three versions of photo editing applications. Our results indicate that a test set generated using the proposed technique has higher statement, decision, and all-use coverage as well as better fault detection strength than a test set of the same size generated by random testing and genetic algorithm-based test generation.
Efficient proxy signcryption scheme with provable CCA and CMA security
(2010-10-01)
Lin, Han-Yu
;
Wu, Tzong-Sun
;
Huang, Shih-Kun
;
Yeh, Yi-Shiung
;
資訊工程學系
For facilitating the confidential transaction with delegation such as on-line proxy auction and business contract signing by an authorized proxy, we propose an efficient proxy signcryption scheme from pairings. Our scheme allows an original signer to delegate his signing power to a proxy one such that the latter can signcrypt a plaintext on behalf of the former. The signcrypted message can only be decrypted by a designated recipient who is also responsible for verifying the recovered proxy signature. To deal with a later dispute over repudiation, the designated recipient can easily announce the ordinary proxy signature for public verification without extra computational efforts. To guarantee the realistic applicability, we demonstrate that our scheme outperforms previous works in terms of functionalities and computational efficiency. Moreover, the security requirement of confidentiality against indistinguishability under adaptive chosen-ciphertext attacks (IND-CCA2) and that of unforgeability against existential forgery under adaptive chosen-message attacks (EF-CMA) are proved in random oracle models. (C) 2010 Elsevier Ltd. All rights reserved.