“Unpaired Image-to-Image Translation using Cycle-Consistent Adversarial Networks”の学習報告

https://www.ftc.gov/sites/default/files/documents/public_comments/2013/07/00031-86244.pdf

On the features and challenges of security and privacy in distributed internet of things

The sharp increase in the number of smartphones on the market, with the Android platform posed to becoming a market leader makes the need for malware analysis on this platform an urgent issue.In this paper we capitalize on earlier approaches for dynamic analysis of application behavior as a means for detecting malware in the Android platform. The detector is embedded in a overall framework for collection of traces from an unlimited number of real users based on crowdsourcing. Our framework has been demonstrated by analyzing the data collected in the central server using two types of data sets: those from artificial malware created for test purposes, and those from real malware found in the wild. The method is shown to be an effective means of isolating the malware and alerting the users of a downloaded malware. This shows the potential for avoiding the spreading of a detected malware to a larger community.

/pdf/crowdroid-behavior-based-malware-detection-system-for-x2tq6w9qk1.pdf

Crowdroid: behavior-based malware detection system for Android

Cyber-security on smart grid: Threats and potential solutions

The rapid developments of the Internet of Things (IoT) and smart mobile devices in recent years have been dramatically incentivizing the advancement of edge computing. On the one hand, edge computing has provided a great assistance for lightweight devices to accomplish complicated tasks in an efficient way; on the other hand, its hasty development leads to the neglection of security threats to a large extent in edge computing platforms and their enabled applications. In this paper, we provide a comprehensive survey on the most influential and basic attacks as well as the corresponding defense mechanisms that have edge computing specific characteristics and can be practically applied to real-world edge computing systems. More specifically, we focus on the following four types of attacks that account for 82% of the edge computing attacks recently reported by Statista: distributed denial of service attacks, side-channel attacks, malware injection attacks, and authentication and authorization attacks. We also analyze the root causes of these attacks, present the status quo and grand challenges in edge computing security, and propose future research directions.

https://ieeexplore.ieee.org/ielaam/5/8789751/8741060-aam.pdf

Edge Computing Security: State of the Art and Challenges

Smart grid (SG) networks are newly upgraded networks of connected objects that greatly improve reliability, efficiency, and sustainability of the traditional energy infrastructure. In this respect, the smart metering infrastructure (SMI) plays an important role in controlling, monitoring, and managing multiple domains in the SG. Despite the salient features of SMI, security, and privacy issues have been under debate because of the large number of heterogeneous devices that are anticipated to be coordinated through public communication networks. This survey paper shows a brief overview of real cyber attack incidents in traditional energy networks and those targeting the smart metering network. Specifically, we present a threat taxonomy considering: 1) threats in system-level security; 2) threats and/or theft of services; and 3) threats to privacy. Based on the presented threats, we derive a set of security and privacy requirements for SG metering networks. Furthermore, we discuss various schemes that have been proposed to address these threats, considering the pros and cons of each. Finally, we investigate the open research issues to shed new light on future research directions in SG metering networks.

/pdf/smart-grid-metering-networks-a-survey-on-security-privacy-ewxtsbvnrk.pdf

Smart Grid Metering Networks: A Survey on Security, Privacy and Open Research Issues

Ideally, security protocol implementations should be formally verified before they are deployed. However, this is not true in practice. Numerous high-profile vulnerabilities have been found in web authentication protocol implementations, especially in single-sign on (SSO) protocols implementations recently. Much of the prior work on authentication protocol verification has focused on theoretical foundations and building scalable verification tools for checking manually-crafted specifications [17, 18, 44]. In this paper, we address a complementary problem of automatically extracting specifications from implementations. We propose AUTHSCAN, an end-to-end platform to automatically recover authentication protocol specifications from their implementations. AUTHSCAN finds a total of 7 security vulnerabilities using off-the-shelf verification tools in specifications it recovers, which include SSO protocol implementations and custom web authentication logic of web sites with millions of users.

/pdf/authscan-automatic-extraction-of-web-authentication-v4790uw8ok.pdf

AUTHSCAN: Automatic Extraction of Web Authentication Protocols from Implementations.

The security of smart phones is increasingly important due to their rapid popularity. Mobile computing on smart phones introduces many new characteristics such as personalization, mobility, pay-for-service and limited resources. These features require additional privacy protection and resource usage constraints in addition to the security and privacy concerns on traditional computers. As one of the leading open source mobile platform, Android is also facing security challenges from the mobile environment. Although many security measures have been applied in Android, the existing security mechanism is coarse-grained and does not take into account the context information, which is of particular interest because of the mobility and personality of a smart phone device.

/pdf/context-aware-usage-control-for-android-4gx7i06rgp.pdf

Context-Aware Usage Control for Android

http://sei.pku.edu.cn/~yaoguo/papers/2010-SecureCOMM_published.pdf

Mobile OSes and applications form a large, complex and vulnerability-prone software stack. In such an environment, security techniques to strongly protect sensitive data in mobile devices are important and challenging. To address such challenges, we introduce the concept of the trusted data vault, a small trusted engine that securely manages the storage and usage of sensitive data in an untrusted mobile device. In this paper, we design and build Droid Vault - the first realization of a trusted data vault on the Android platform. Droid Vault establishes a secure channel between data owners and data users while allowing data owners to enforce strong control over the sensitive data with a minimal trusted computing base (TCB). We prototype Droid Vault via the novel use of hardware security features of ARM processors, i.e., Trust Zone. Our evaluation demonstrates its functionality for processing sensitive data and its practicality for adoption in the real world.

/pdf/droidvault-a-trusted-data-vault-for-android-devices-3kjjajvpfi.pdf

Guangdong Bai

Papers

Smart Grid Metering Networks: A Survey on Security, Privacy and Open Research Issues

AUTHSCAN: Automatic Extraction of Web Authentication Protocols from Implementations.

Context-Aware Usage Control for Android

Context-Aware Usage Control for Android

DroidVault: A Trusted Data Vault for Android Devices