Browsing by Author "Shieh, Shiuhpyng Winston"

Now showing 1 - 17 of 17

A Batch-Authenticated and Key Agreement Framework for P2P-Based Online Social Networks
(2012-05-01)
Yeh, Lo-Yao
;
Huang, Yu-Lun
;
Joseph, Anthony D.
;
Shieh, Shiuhpyng Winston
;
Tsaur, Woei-Jiunn
Online social networks (OSNs) such as Facebook and MySpace are flourishing because more and more people are using OSNs to share their interests with friends. Because security and privacy issues on OSNs are major concerns, we propose a security framework for simultaneously authenticating multiple users to improve the efficiency and security of peer-to-peer (P2P)-based OSNs. In the proposed framework, three batch authentication protocols are proposed, adopting the one-way hash function, ElGamal proxy encryption, and certificates as the underlying cryptosystems. The hash-based authentication protocol requires lower computational cost and is suitable for resource-limited devices. The proxy-based protocol is based on asymmetric encryption and can be used to exchange more information among users. The certificate-based protocol guarantees nonrepudiation of transactions by signatures. Without a centralized authentication server, the proposed framework can therefore facilitate the extension of an OSN with batched verifications. In this paper, we formally prove that the proposed batch authentication protocols are secure against both passive adversaries and impersonator attacks, can offer implicit key authentication, and require fewer messages to authenticate multiple users. We also show that our protocols can meet important security requirements, including mutual authentication, reputation, community authenticity, nonrepudiation, and flexibility. With these effective security features, our framework is appropriate for use in P2P-based OSNs.
Adaptive Virtual Gestures for GUI Testing on Smartphones
(2017-09-01)
Hsu, Chia-Wei
;
Lee, Shan-Hsin
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Traditional in-depth testing isn't optimal for mobile apps because they're updated frequently in response to bugs and security concerns. To complement such testing, a proposed breadth-first approach employs fast, automated GUI testing for adaptive virtual gestures on various mobile devices.
Cloudebug: A Programmable Online Malware Testbed
(2014-07-01)
Wang, Chi-Wei
;
Wang, Chia-Wei
;
Hsieh, Chu-An
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Virtual machines for malware analysis in current cloud-based debugging services are not easily accessible or operable by end users. Cloudebug allows users to operate its VM directly in the cloud.
Combating Software Piracy in Public Clouds
(2015-10-01)
Wang, Chia-Wei
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
CodeMist is an innovative security framework that leverages both passive and active approaches to prevent piracy of cloud-based rental software.
DeepMemIntrospect: Recognizing Data Structures in Memory with Neural Networks
(2018-01-01)
Chen, Chung-Kuan
;
Ho, E-Lin
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
One yet-to-be-solved but very vital memory forensic problem is to recover data structure information from a specified memory range. Unlike previous studies relying on fixed signature of value or structure, DeepMemIntrospect is the first convolution neural network (CNN) based memory forensic system that can recover data structure information merely from raw memory without relying on signatures. Our experimental results demonstrate high accuracy with over 99% and also show significant performance improvement.
Divergence Detector: A Fine-grained Approach to Detecting VM-Awareness Malware
(2013)
Hsu, Chia-Wei
;
Shih, Fan-Syun
;
Wang, Chi-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Virtualized execution has become an effective mechanism to analyze malware in a dynamic way. To conceal its malicious behaviors, VM-aware malware probes the execution environment for analysis-resistance. These malware programs hide their malicious behaviors if they are launched in a virtual machine (VM). VM awareness becomes a barrier for malware analysis due to the concealment of malicious behaviors. In this paper, we discover that uncertain factors have significant influence on the effectiveness of malware detection. To cope with the problems, a new VM-aware detection scheme, namely Divergence Detector, is proposed to address the swindle of the evolved malware. Unlike conventional schemes, the Divergence Detector reduces the uncertain factors at instruction level, and can detect the divergence of multi-execution traces across heterogeneous virtual machines. The proposed Divergence Detector is implemented across the three commonly used VM platforms, that is, QEMU, Bochs and Xen. It compares the code coverage of the execution traces on various VM platforms to discover the deviation of behavior, thereby precisely detecting the VM-awareness. We will formally predict the effectiveness of Divergence Detector by constructing a mathematic model, which shows the maximum false positive rate is exponentially decreased with respect to the number of multi-executions. Representative samples utilizing seven types of commonly used VM-aware techniques were also employed for evaluation. The evaluation results indicate that the maximum false positive rate complies with our prediction. The uncertain factors play the major role in the VM-awareness detection. To reduce uncertain factors causing false positives, a method is proposed for VM-aware detection. The Divergence Detector can also enable the identification of new types of malware since the benign programs do not need to be aware of execution environment.
Dmail: A Globally Authenticated Email Service
(2014-05-01)
Cheng, Michael
;
Cho, Yi
;
Chen, Pokai
;
Shieh, Shiuhpyng Winston
;
交大名義發表
The global public-key authentication infrastructure standardized in the Domain Name System Security Extension (DNSSEC) paves the way for Dmail (DNSSEC-enabled email), a framework that allows secure email address authentication.
DROIT: Dynamic Alternation of Dual-Level Tainting for Malware Analysis
(2015-01-01)
Wang, Chiwei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Taint analysis for Android malware has received much attention in recent research. Existing taint techniques operate either at Java object level or at deeper instruction level. Object-level tracking is suitable for malware written in Java byte-code, but not for native ones. Instruction-level tracking captures the finest data flow. However, it leads to obscure semantic reconstruction and low performance. In this paper, we present DROIT, a taint tracker which dynamically alternates between object-level and instruction-level tracking on demands. DROIT tracks data flow at Java object level in general. When its Dalvik VM exits the byte-code execution, DROIT automatically switches to instruction-level tracking, and vice versa. The trigger-based DROIT can alternate between the two levels in an efficient manner, and can provide dual-level whole image of the data flow, rather than fragments. Tracking at the dual levels also eases the semantic reconstruction significantly. The experiment with Android information-stealing trojans showed that DROIT can handle Java-based malware, those composed in native code, and those alternating between the two levels (e.g., DroidKungFu), respectively.
Light-Weight CSRF Protection by Labeling User-Created Contents
(2013)
Sung, Yin-Chang
;
Cho, Michael Cheng Yi
;
Wang, Chi-Wei
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng Winston
Cross-site request forgery (CSRF/XSRF) is a serious vulnerability in Web 2.0 environment. With CSRF, an adversary can spoof the payload of an HTTP request and entice the victim's browser to transmit an HTTP request to the web server. Consequently, the server cannot determine legitimacy of the HTTP request. This paper presents a light-weight CSRF prevention method by introducing a quarantine system to inspect suspicious scripts on the server-side. Instead of using script filtering and rewriting approach, this scheme is based on a new labeling mechanism (we called it Content Box) which enables the web server to distinguish the malicious requests from the harmless requests without the need to modify the user created contents (UCCs). Consequently, a malicious request can be blocked when it attempts to access critical web services that was defined by the web administrator. To demonstrate the effectiveness of the proposed scheme, the proposed scheme was implemented and the performance was evaluated.
Mitigating Over-Permissible Transfer for Control Flow Integrity
(2018-01-01)
Chen, Chung-Kuan
;
Chen, Shang-Kuei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Control flow integrity (CFI) is a promising defense mechanism for controlling hijacking attacks. In most situations, CFI prevents the control flow transfer from hijacking by the adversary. However, the over-permissible transfer problem remains a major issue in most CFI systems. By taking advantage of this problem, an adversary can still hijack control flows to the code not designed by the original programmer but intended for execution by the adversary. To eliminate over-permissible transfer, we propose transfer target analysis for the CFI system. With value set analysis and concolic execution, the transfer target analysis is able to construct the precise control flow graph. Given the fine-grained policy, over-permissible transfer can be prohibited. To save memory, the Bloom filter-based policy database is established to store a large number of policies in a compact data structure with low false positive rate. The evaluation uses benign programs from the SPEC CPU2006 benchmarks and the malign programs from the RIPE benchmark. The result shows that all the benign programs can execute normally but all the malign programs are blocked.
MrKIP: Rootkit Recognition With Kernel Function Invocation Pattern
(2015-03-01)
Wang, Chi-Wei
;
Chen, Chong-Kuan
;
Wang, Chia-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
Existing mechanisms tracing user-level activities such as system calls and APIs can be circumvented by the kernel-level rootkits. In this paper, a novel system, MrKIP, is proposed to recognize rootkits based on their kernel-level activities. Our scheme semiautomatically generates suitable locations for analysts to implement checkpoints, which are used to profile kernel-space activities. Then, collected rootkits are executed in an emulator with these checkpoints for behavior profiling. The collected behaviors are clustered and used for model construction. The constructed model can be used to recognize new variants of rootkit families. Our scheme differs from conventional tracers due to its ability to cover kernel-space malware and the whole-system scope. In addition, monitoring at the kernel level raises high barrier for malware to evade, since all tasks are eventually executed through the basic kernel functions.
RAKA: Revocable Authenticated Key Agreement System for Mobile Social Networks
(2016-05)
Ho, Tzu-Hsin
;
Shieh, Shiuhpyng Winston
;
Tseng, Chien-Chao
;
資訊工程學系
;
Department of Computer Science
Mobile social networks (MSNs) provide users with potential indirect relationships such as friends of friends and similar transitive relationships. However, adversaries may be involved in potential relationships, the trustworthiness of the relationships must be ensured. Thus, the disclosure of private information must be well controlled, and users have to be authenticated. In this paper, we propose a revocable authenticated key agreement system (RAKA), which does not require intensive computation for authentication in MSNs. RAKA not only provides a simple rekeying process but also aggregates multiple successive private key update operations into a single rekeying process. The proposed revocation method incurs low communication overhead on mobile devices using a single message broadcast. RAKA is proved to be resilient against malicious attacks.
S-AKA: A Provable and Secure Authentication Key Agreement Protocol for UMTS Networks
(2011-11-01)
Huang, Yu-Lun
;
Shen, Chih-Ya
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
電機工程學系
The authentication and key agreement (AKA) protocol of Universal Mobile Telecommunication System (UMTS), which is proposed to solve the vulnerabilities found in Global System for Mobile Communications (GSM) systems, is still vulnerable to redirection and man-in-the-middle attacks. An adversary can mount these attacks to eavesdrop or mischarge the subscribers in the system. In this paper, we propose a secure AKA (S-AKA) protocol to cope with these problems. The S-AKA protocol can reduce bandwidth consumption and the number of messages required in authenticating mobile subscribers. We also give the formal proof of the S-AKA protocol to guarantee its robustness.
Security Semantics Modeling with Progressive Distillation
(2017-11-01)
Shen, Zong-Xian
;
Hsu, Chia-Wei
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
The prevalence of Android platform has attracted adversaries to craft malicious payloads for illegal profit. Such malicious artifacts are frequently reused and embedded in benign, paid apps to lure victims that the apps have been cracked for free. To discover these fraudulent apps, administrators of app markets desire an automated scanning process to maintain the health of app ecosystem. However, conventional approaches cannot be efficiently applied due to the lack of a scalable, effective approach to malware characteristics aggregation. On the other hand, the vast number of apps significantly increases the analysis complexity. In this paper, we propose Petridish which generates discriminative models against the repacked malicious apps. These representative models of malicious semantics can be progressively distilled with malign and benign samples. These models can further detect repacked malicious apps. Our experiment shows that, after two retraining rounds, Petridish achieved an average of 28 percent progressive detection improvement from 63 to 91.2 percent for the large families, exceeding 38 test samples in size. With noise reduction, it accomplished 88 percent detection rate and 1.7 percent false alarm rate. The characteristics aggregation approach will become critical in the age of app explosion.
Shellcode Detector for Malicious Document Hunting
(2017-01-01)
Chen, Chong-Kuan
;
Lan, Shen-Chieh
;
Shieh, Shiuhpyng Winston
;
資訊工程學系
;
Department of Computer Science
Advanced Persistent Threat (APT) attacks became a major network threat in recent years. Among APT attack techniques, sending a phishing email with malicious documents attached is considered one of the most effective ones. Although many users have the impression that documents are harmless, a malicious document may in fact contain shellcode to attack victims. To cope with the problem, we design and implement a malicious document detector called Forensor to differentiate malicious documents. Forensor integrates several open-source tools and methods. It first introspects file format to retrieve objects inside the documents, and then automatically decrypts simple encryption methods, e.g., XOR, rot and shift, commonly used in malware to discover potential shellcode. The emulator is used to verify the presence of shellcode. If shellcode is discovered, the file is considered malicious. The experiment used 9,000 benign files and more than 10,000 malware samples from a well-known sample sharing website. The result shows no false negative and only 2 false positives.
SWIFT: Decoupled System-Wide Information Flow Tracking and its Optimizations
(2015-07-01)
Wang, Chiwei
;
Shieh, Shiuhpyng Winston
;
交大名義發表
;
National Chiao Tung University
Information flow analysis is a widely-adopted technique in software testing and malware analysis. For information flow analysis, a system-level emulator equipped with dynamic information flow tracking capability, DIFT, is needed. However, its effectiveness comes at a price of severe performance degradation due to interleaved system emulation and DIFT analysis. In this paper, a decoupled system-wide information flow tracking scheme, SWIFT, is proposed. Through decoupling system-wide information flow tracking from emulation, SWIFT regains the memory locality and code optimization. The proposed methods are able to aggressively eliminate dependency between the system-level emulator and the analysis thread. Our performance evaluation indicates that, under the same hardware specifications, SWIFT runs 2.74 similar to 7.48 times faster than the conventional interleaved design while being benchmarked by Pass Mark Performance Test 6.0. The performance improvement consequently makes the online analysis feasible in practice.
Web Application Security: Threats, Countermeasures, and Pitfalls
(2017-06-01)
Huang, Hsiu-Chuan
;
Zhang, Zhi-Kai
;
Cheng, Hao-Wen
;
Shieh, Shiuhpyng Winston
;
交大名義發表
Penetration testing is a crucial defense against common web application security threats such as SQL injection and cross-site scripting attacks. A proposed web vulnerability scanner automatically generates test data with combinative evasion techniques, significantly expanding test coverage and revealing more vulnerabilities.