다중혈관 관상동맥 환자에서 y-문합을 이용하여 양쪽 내흉동맥만을 사용한 우회술의 조기 성적

National Institute of Standards and Technology における超伝導研究及び生活

The popularity and adoption of smart phones has greatly stimulated the spread of mobile malware, especially on the popular platforms such as Android. In light of their rapid growth, there is a pressing need to develop effective solutions. However, our defense capability is largely constrained by the limited understanding of these emerging mobile malware and the lack of timely access to related samples. In this paper, we focus on the Android platform and aim to systematize or characterize existing Android malware. Particularly, with more than one year effort, we have managed to collect more than 1,200 malware samples that cover the majority of existing Android malware families, ranging from their debut in August 2010 to recent ones in October 2011. In addition, we systematically characterize them from various aspects, including their installation methods, activation mechanisms as well as the nature of carried malicious payloads. The characterization and a subsequent evolution-based study of representative families reveal that they are evolving rapidly to circumvent the detection from existing mobile anti-virus software. Based on the evaluation with four representative mobile security software, our experiments show that the best case detects 79.6% of them while the worst case detects only 20.2% in our dataset. These results clearly call for the need to better develop next-generation anti-mobile-malware solutions.

/pdf/dissecting-android-malware-characterization-and-evolution-2euhdmm33o.pdf

Dissecting Android Malware: Characterization and Evolution

The Mirai botnet, composed primarily of embedded and IoT devices, took the Internet by storm in late 2016 when it overwhelmed several high-profile targets with massive distributed denial-of-service (DDoS) attacks. In this paper, we provide a seven-month retrospective analysis of Mirai's growth to a peak of 600k infections and a history of its DDoS victims. By combining a variety of measurement perspectives, we analyze how the botnet emerged, what classes of devices were affected, and how Mirai variants evolved and competed for vulnerable hosts. Our measurements serve as a lens into the fragile ecosystem of IoT devices. We argue that Mirai may represent a sea change in the evolutionary development of botnets--the simplicity through which devices were infected and its precipitous growth, demonstrate that novice malicious techniques can compromise enough low-end devices to threaten even some of the best-defended targets. To address this risk, we recommend technical and nontechnical interventions, as well as propose future research directions.

https://www.usenix.org/system/files/conference/usenixsecurity17/sec17-antonakakis.pdf

Understanding the mirai botnet

Botnets are now the key platform for many Internet attacks, such as spam, distributed denial-of-service (DDoS), identity theft, and phishing. Most of the current botnet detection approaches work only on specific botnet command and control (C&C) protocols (e.g., IRC) and structures (e.g., centralized), and can become ineffective as botnets change their C&C techniques. In this paper, we present a general detection framework that is independent of botnet C&C protocol and structure, and requires no a priori knowledge of botnets (such as captured bot binaries and hence the botnet signatures, and C&C server names/addresses). We start from the definition and essential properties of botnets. We define a botnet as a coordinated group of malware instances that are controlled via C&C communication channels. The essential properties of a botnet are that the bots communicate with some C&C servers/peers, perform malicious activities, and do so in a similar or correlated way. Accordingly, our detection framework clusters similar communication traffic and similar malicious traffic, and performs cross cluster correlation to identify the hosts that share both similar communication patterns and similar malicious activity patterns. These hosts are thus bots in the monitored network. We have implemented our BotMiner prototype system and evaluated it using many real network traces. The results show that it can detect real-world botnets (IRC-based, HTTP-based, and P2P botnets including Nugache and Storm worm), and has a very low false positive rate.

/pdf/botminer-clustering-analysis-of-network-traffic-for-protocol-128yhq3sy0.pdf

BotMiner: clustering analysis of network traffic for protocol- and structure-independent botnet detection

Einführung Unsere Gesellschaft hängt in umfassendem Maße vom zuverlässigen Funktionieren technischer Systeme und vom jederzeit möglichen Zugriff auf authentische und korrekte Informationen ab. Innerhalb dieser technischen Systeme spielen informationsspeichernde bzw. -verarbeitende Systeme eine immer größere Rolle; in einzelnen Branchen tragen sie mittlerweile über 50 % zur Wertschöpfung bei [1]. Diese Systeme, egal wo sie eingesetzt werden (z. B. in Rechenzentren, Banken, Autos usw.) sollen im Folgenden als IT-Systeme (kurz für: informationstechnische Systeme) bezeichnet werden. Durch ihre Funktion können sich technische Systeme in allen Lebensbereichen und auf alle vorstellbaren Werte auswirken, die sämtliche für Nutzer bedeutsame Aspekte umfassen, etwa menschliches Leben, Gesundheit und Unversehrtheit, Vermögen, Wissen, Gegenstände und persönliche Daten beteiligter ebenso wie nur mittelbar beteiligter Personen. Im Allgemeinen muss man davon ausgehen, dass technische Systeme nicht immer fehlerlos sind und arbeiten, sondern dass sie von Beginn an bestehende oder erst mit der Zeit auftretende Schwachstellen enthalten. Schwachstellen können selbst bei bestimmungsgemäßem Gebrauch eines technischen Systems zu Fehlfunktionen führen, durch die Personen, Umwelt, Infrastruktur oder Daten geschädigt werden. Erst recht kann die funktional falsch verstandene oder grundsätzlich unsachgemäße Benutzung technischer, auch korrekt funktionierender Systeme die oben genannten Werte beeinträchtigen. Die vielfältigen Probleme und Aspekte bezüglich der Sicherung von IT-Systemen gegen derartige Effekte gewinnen zunehmend an Bedeutung. Im Arbeitskreis ,,Begriffsbildung“ des GIFachbereichs ,,Sicherheit“ ist in den letzten Jahren in intensiven Diskussionen versucht worden, Grundbegriffe zur Charakterisierung dieses Problembereichs, die in der Fachöffentlichkeit mit

Technische Sicherheit und Informationssicherheit

Dynamic analysis of malicious software (malware) is a powerful tool in countering modern threats on the Internet. In dynamic analysis, a malware sample is executed in a controlled environment and its actions are logged. Through dynamic analysis, an analyst can quickly obtain an overview of malware behavior and can decide whether or not to indulge into tedious manual analysis of the sample. However, usual dynamic analysis exposes the Internet to the threats of an executed malware (like portscans) because advanced concealment techniques of malware often require full Internet access. For example, a missing link to the Internet or the unavailability of a specific server often causes the malware to not trigger its malicious behavior. In this paper, we present TRUMANBOX, a technique to emulate relevant parts of the Internet to enhance dynamic malware analysis. We show that TRUMANBOX not only prevents many threats but also enlarges the scope of the types of malware that can be analyzed dynamically.

TRUMANBOX: improving dynamic malware analysis by emulating the internet

With the expansion of the Internet of Things (IoT), the number of security incidents due to insecure and misconfigured IoT devices is increasing. Especially on the consumer market, manufacturers focus on new features and early releases at the expense of a comprehensive security strategy. Hence, experts have started calling for regulation of the IoT consumer market, while policymakers are seeking for suitable regulatory approaches. We investigate how manufacturers can be incentivized to increase sustainable security efforts for IoT products. We propose mandatory security update labels that inform consumers during buying decisions about the willingness of the manufacturer to provide security updates in the future. Mandatory means that the labels explicitly state when security updates are not guaranteed. We conducted a user study with more than 1,400 participants to assess the importance of security update labels for the consumer choice by means of a conjoint analysis. The results show that the availability of security updates (until which date the updates are guaranteed) accounts for 8% to 35% impact on overall consumers' choice, depending on the perceived security risk of the product category. For products with a high perceived security risk, this availability is twice as important as other high-ranked product attributes. Moreover, provisioning time for security updates (how quickly the product will be patched after a vulnerability is discovered) additionally accounts for 7% to 25% impact on consumers' choices. The proposed labels are intuitively understood by consumers, do not require product assessments by third parties before release, and have a potential to incentivize manufacturers to provide sustainable security support.

Security Update Labels: Establishing Economic Incentives for Security Patching of IoT Consumer Products.

We present a modular redesign of TrustedPals, a smart card-based security framework for solving Secure Multiparty Computation (SMC). Originally, TrustedPals assumed a synchronous network setting and allowed to reduce SMC to the problem of fault-tolerant consensus among smart cards. We explore how to make TrustedPals applicable in environments with less synchrony and show how it can be used to solve asynchronous SMC. Within the redesign we investigate the problem of solving consensus in a general omission failure model augmented with failure detectors. To this end, we give novel definitions of both consensus and the class oP of failure detectors in the omission model, which we call ◇P(om), and show how to implement ◇P(om) and have consensus in such a system with very weak synchrony assumptions. The integration of failure detection and consensus into the TrustedPals framework uses tools from privacy enhancing techniques such as message padding and dummy traffic.

Felix C. Freiling

Papers

Technische Sicherheit und Informationssicherheit

TRUMANBOX: improving dynamic malware analysis by emulating the internet

Security Update Labels: Establishing Economic Incentives for Security Patching of IoT Consumer Products.

Secure Failure Detection and Consensus in TrustedPals

Forensic analysis of YAFFS2