scispace - formally typeset
Search or ask a question

Showing papers on "Trojan published in 2012"


Proceedings ArticleDOI
16 Apr 2012
TL;DR: This paper utilizes an installed trojan application to stealthily monitor the movement and gesture changes of a smartphone using its on-board motion sensors and presents the design and implementation of TapLogger, a trojanApplication for the Android platform, which stealthily logs the password of screen lock and the numbers entered during a phone call.
Abstract: Today's smartphones are shipped with various embedded motion sensors, such as the accelerometer, gyroscope, and orientation sensors. These motion sensors are useful in supporting the mobile UI innovation and motion-based commands. However, they also bring potential risks of leaking user's private information as they allow third party applications to monitor the motion changes of smartphones. In this paper, we study the feasibility of inferring a user's tap inputs to a smartphone with its integrated motion sensors. Specifically, we utilize an installed trojan application to stealthily monitor the movement and gesture changes of a smartphone using its on-board motion sensors. When the user is interacting with the trojan application, it learns the motion change patterns of tap events. Later, when the user is performing sensitive inputs, such as entering passwords on the touchscreen, the trojan application applies the learnt pattern to infer the occurrence of tap events on the touchscreen as well as the tapped positions on the touchscreen. For demonstration, we present the design and implementation of TapLogger, a trojan application for the Android platform, which stealthily logs the password of screen lock and the numbers entered during a phone call (e.g., credit card and PIN numbers). Statistical results are presented to show the feasibility of such inferences and attacks.

392 citations


Journal ArticleDOI
TL;DR: The simulation results demonstrate that the proposed method can significantly increase Trojan activity and reduce Trojan activation time and the relation between circuit topology, authentication time, and the threshold is carefully studied.
Abstract: Fabless semiconductor industry and government agencies have raised serious concerns about tampering with inserting hardware Trojans in an integrated circuit supply chain in recent years. Most of the recently proposed Trojan detection methods are based on Trojan activation to observe either a faulty output or measurable abnormality on side-channel signals. Time to activate a hardware Trojan circuit is a major concern from the authentication standpoint. This paper analyzes time to generate a transition in functional Trojans. Transition is modeled by geometric distribution and the number of clock cycles required to generate a transition is estimated. Furthermore, a dummy scan flip-flop insertion procedure is proposed aiming at decreasing transition generation time. The procedure increases transition probabilities of nets beyond a specific threshold. The relation between circuit topology, authentication time, and the threshold is carefully studied. The simulation results on s38417 benchmark circuit demonstrate that, with a negligible area overhead, our proposed method can significantly increase Trojan activity and reduce Trojan activation time.

260 citations


Journal ArticleDOI
TL;DR: In this paper, the authors presented updated/new thermal model fits for 478 Jovian Trojan asteroids observed with the Wide-Field Infrared Survey Explorer (WISE) using the fact that the two shortest bands used by WISE, centered on 34 and 46 μm, are dominated by reflected light, derived albedos of a significant fraction of these objects in these bands.
Abstract: We present updated/new thermal model fits for 478 Jovian Trojan asteroids observed with the Wide-field Infrared Survey Explorer (WISE) Using the fact that the two shortest bands used by WISE, centered on 34 and 46 μm, are dominated by reflected light, we derive albedos of a significant fraction of these objects in these bands While the visible albedos of both the C-, P-, and D-type asteroids are strikingly similar, the WISE data reveal that the albedo at 34 μm is different between C-/P- and D-types The albedo at 34 μm can thus be used to classify the objects, with C-/P-types having values less than 10% and D-types have values larger than 10% Classifying all objects larger than 50 km shows that the D-type objects dominate both the leading cloud (L 4), with a fraction of 84%, and trailing cloud (L 5), with a fraction of 71%-80% The two clouds thus have very similar taxonomic distribution for these large objects, but the leading cloud has a larger number of these large objects, L 4/L 5 = 134 The taxonomic distribution of the Jovian Trojans is found to be different from that of the large Hildas, which is dominated by C- and P-type objects At smaller sizes, the fraction of D-type Hildas starts increasing, showing more similarities with the Jovian Trojans If this similarity is confirmed through deeper surveys, it could hold important clues to the formation and evolution of the two populations The Jovian Trojans does have similar taxonomic distribution to that of the Jovian irregular satellites, but lacks the ultra red surfaces found among the Saturnian irregular satellites and Centaur population

129 citations


Proceedings ArticleDOI
Paul Giura1, Wei Wang1
TL;DR: This paper proposes a model of the APT detection problem as well as a methodology to implement it on a generic organization network and is the first to address the problem of modeling an APT and to provide a possible detection framework.
Abstract: Besides a large set of malware categories such as worms and Trojan horses, Advanced Persistent Threat (APT) is another more sophisticated attack entity emerging in the cyber threats environment In this paper we propose a model of the APT detection problem as well as a methodology to implement it on a generic organization network From our knowledge, the proposed method is the first to address the problem of modeling an APT and to provide a possible detection framework

93 citations


Journal ArticleDOI
TL;DR: The proposed architecture reorders scan cells based on their placement during physical design to reduce circuit switching activity by limiting it into a specific region and helps magnify Trojan contribution to the total circuit transient power by increasing Trojan-to-circuit switching activity (TCA) and Trojan- to-circuits power consumption (TCP).
Abstract: Government agencies and the semiconductor industry have raised serious concerns about malicious modifications to the integrated circuits. The added functionality known as hardware Trojan poses major detection and isolation challenges. This paper presents a new hardware trust architecture to magnify functional Trojans activity. Trojan detection resolution depends on Trojan activity directly and circuit activity reversely. The proposed architecture reorders scan cells based on their placement during physical design to reduce circuit switching activity by limiting it into a specific region. This helps magnify Trojan contribution to the total circuit transient power by increasing Trojan-to-circuit switching activity (TCA) and Trojan-to-circuit power consumption (TCP). The proposed technique aims to improve the efficiency of power-based side-channel signal analysis techniques for detecting hardware Trojans. Our simulation results demonstrate the efficiency of the method in significantly increasing TCA and TCP.

83 citations


Journal ArticleDOI
TL;DR: The minor planet 2002 VE68 was identified as a quasi-satellite of Venus shortly after its discovery and it has remained as such for at least 7000 years after a close fly-by with the Earth as discussed by the authors.
Abstract: The minor planet 2002 VE68 was identified as a quasi-satellite of Venus shortly after its discovery. At that time its data-arc span was only 24 d; now it is 2947 d. Here we revisit the topic of the dynamical status of this remarkable object as well as look into its dynamical past and explore its future orbital evolution which is driven by close encounters with both the Earth–Moon system and Mercury. In our calculations, we use a Hermite integration scheme, the most updated ephemerides and include the perturbations by the eight major planets, the Moon and the three largest asteroids. We confirm that 2002 VE68 currently is a quasi-satellite of Venus, and it has remained as such for at least 7000 yr after a close fly-by with the Earth. Prior to that encounter the object may have already been co-orbital with Venus or moving in a classical, non-resonant near-Earth object (NEO) orbit. The object drifted into the quasi-satellite phase from an L4 Trojan state. We also confirm that, at aphelion, dangerously close encounters with the Earth (under 0.002 au, well inside the Hill sphere) are possible. We find that 2002 VE68 will remain as a quasi-satellite of Venus for about 500 yr more and its dynamical evolution is controlled not only by the Earth, with a non-negligible contribution from the Moon, but by Mercury as well. 2002 VE68 exhibits resonant (or near-resonant) behaviour with Mercury, Venus and the Earth. Our calculations indicate that an actual collision with the Earth during the next 10 000 yr is highly unlikely but encounters as close as 0.04 au occur with a periodicity of 8 yr.

67 citations


Journal ArticleDOI
TL;DR: Using on-chip monitors to significantly improve the sensitivity of side-channel signal analysis techniques to malicious inclusions in integrated circuits known as hardware Trojans is described.
Abstract: This paper describes using on-chip monitors to significantly improve the sensitivity of side-channel signal analysis techniques to malicious inclusions in integrated circuits known as hardware Trojans.

60 citations


Journal ArticleDOI
TL;DR: In this paper, the authors tested the stability of 2008 LC18's orbit through a detailed dynamical study, using test particles spread across the ± 3σ range of orbital uncertainties in a,e,i and Ω.
Abstract: The recent discovery of the first Neptune Trojan at the planet's trailing (L5) Lagrange point, 2008 LC18, offers an opportunity to confirm the formation mechanism of a member of this important tracer population for the Solar system's dynamical history. We tested the stability of 2008 LC18's orbit through a detailed dynamical study, using test particles spread across the ±3σ range of orbital uncertainties in a,e,i and Ω. This showed that the wide uncertainties of the published orbit span regions of both extreme dynamical instability, with lifetimes 1Gyr. The stability of 2008 LC18's clones is greatly dependent on their semimajor axis and only weakly correlated with their orbital eccentricity. Test particles on orbits with an initial semimajor axis of less than 29.91au have dynamical half-lives shorter than 100Myr; in contrast, particles with an initial semimajor axis of greater than 29.91au exhibit such strong dynamical stability that almost all are retained over the 1Gyr of our simulations. More observations of this object are necessary to improve the orbit. If 2008 LC18 is in the unstable region, then our simulations imply that it is either a temporary Trojan capture or a representative of a slowly decaying Trojan population (like its sibling the L4 Neptunian Trojan 2001 QR322), and that it may not be primordial. Alternatively, if the orbit falls into the larger, stable region, then 2008 LC18 is a primordial member of the highly stable and highly inclined component of the Neptune Trojan population, joining 2005 TN53 and 2007 VL305. We attempted to recover 2008 LC18 using the 2.3-m telescope at Siding Spring Observatory to provide this astrometry, but were unsuccessful due to the high stellar density of its current sky location near the Galactic centre. The recovery of this object will require a telescope in the 8-m class.

49 citations


Proceedings ArticleDOI
05 Nov 2012
TL;DR: This work analyzes the impact of Trojans with varied partial activity, area, and location on the proposed ring oscillator structure and demonstrates that stealthyTrojans can be efficiently detected with this technique even while obfuscated by process variations, background noise, and environment noise.
Abstract: The modern integrated circuit (IC) manufacturing process has exposed chip designers to hardware Trojans which threaten circuits bound for critical applications. This paper details the implementation and analysis of a novel ring oscillator network technique for Trojan detection in an application specific integrated circuit (ASIC). The ring oscillator network serves as a power supply monitor by detecting fluctuations in characteristic frequencies due to malicious modifications (i.e. hardware Trojans) in the circuit under authentication. The ring oscillator network was implemented and fabricated in 40 IBM 90nm ASICs with controlled hardware Trojans. This work analyzes the impact of Trojans with varied partial activity, area, and location on the proposed ring oscillator structure and demonstrates that stealthy Trojans can be efficiently detected with this technique even while obfuscated by process variations, background noise, and environment noise.

48 citations


Journal ArticleDOI
TL;DR: In this paper, B. B. revisited views of scholars on the interpolation or the authenticity of the plus lines and dedicates detailed tables in analytically examining the distribution of "new lines" in the papyri of the Iliad; he concludes that the early papyria tend to contain additional lines, but this tendency diminishes in the period fi rst century B.C.E.
Abstract: The Classical Review vol. 62 no. 1 © The Classical Association 2012; all rights reserved the existence of ancient forms in later manuscripts and the long infl uence of oral tradition. The Homeric work presents a different situation from written works, and it must be treated differently. Chapter 3 starts with trivial information on terms such as ‘papyri’ and ‘manuscripts’ and their dating. The graphs demonstrating the chronological distribution of papyri and manuscripts of the Iliad prove that the Ptolemaic papyri represent only 6% of the evidence. B. conventionally defi nes as ‘Ptolemaic’ the papyri which were discovered in Egypt and cover the reigns of the fi rst eight Ptolemies, but a history of their discovery and fi rst editions in combination with the discussion of their provenance reveals problems in defi ning their exact location and date. B. revisits views of scholars on the interpolation or the authenticity of the plus lines and dedicates detailed tables in analytically examining the distribution of ‘new lines’ in the papyri of the Iliad; he concludes that the early papyri tend to contain additional lines, but that this tendency diminishes in the period fi rst century B.C.E. – fi rst century C.E. Although the numerical data may confuse the non-academic reader, the fi gures prove the ‘expansiveness’ of the Ptolemaic papyri with regard to the vulgate. Next, B. tries to prove that many of the plus verses, rather than being inserted into the text, have grown into their current positions and that they are an authentic alternative to our familiar version. The distribution of the plus verses in the books of the Iliad shows how little it is represented by papyri of the Ptolemaic period. It also proves that the books with the additional verses are those which have a high degree of coverage. B. concludes with an examination of both the plus verses and the context of passages from the Ptolemaic papyri in order to demonstrate that the plus verses have been an organic part of the episode. The conclusion is that the papyrus plus verses refl ect live performances with heightened emotionality and dramatic intensity. B. underlines that the papyri preserve indications of the performer’s ability to vary his performance, and hence of multitextuality. All chapters of the book are related to the idea of multitextuality, although much of the trivial information included in the fi rst chapter could have been dispensed with. Bibliography, notes, appendices with instances of multitextuality and glossary of terms and graphs contribute to a deeper understanding. Experts will appreciate Chapter 3; a wider audience might be more interested in Chapters 1 and 2. Overall, the volume will initiate productive discussion for scholars studying multitextuality in Homer.

48 citations


Journal ArticleDOI
TL;DR: In this article, a detailed thermophysical and dynamical modeling of the Jovian Trojan (1173) Anchises was performed, and it was shown that the dynamical stability of Anchises is not a function of its initial orbital elements, the result of the exceptional precision with which its orbit is known.
Abstract: We have performed detailed thermophysical and dynamical modelling of the Jovian Trojan (1173) Anchises. Our results show that this is the most unusual object. By examining observational data of Anchises taken by IRAS, Akari and WISE at wavelengths between 11.5 and 60 μm, together with the variations in its optical light curve, we find that Anchises is most likely an elongated body, with an axis ratio, a/b, of around 1.4. This results in calculated best-fitting dimensions for Anchises of 170 × 121 × 121 km (or an equivalent diameter of 136 +18/−11 km). We find that the observations of Anchises are best fitted by the object having a retrograde sense of rotation, and an unusually high thermal inertia in the range 25–100 J m−2 s−0.5 K−1 (3σ confidence level). The geometric albedo of Anchises is found to be 0.027 (+0.006/−0.007). Anchises therefore has one of the highest published thermal inertias of any object larger than 100 km in diameter, at such large heliocentric distances, as well as being one of the lowest albedo objects ever observed. More observations (visual and thermal) are needed to see whether there is a link between the very shallow phase curve, with almost no opposition effect, and the derived thermal properties for this large Trojan asteroid. Our dynamical investigation of Anchises’ orbit has revealed it to be dynamically unstable on time-scales of hundreds of millions of years, similar to the unstable Neptunian Trojans 2001 QR322 and 2008 LC18. Unlike those objects, however, we find that the dynamical stability of Anchises is not a function of its initial orbital elements, the result of the exceptional precision with which its orbit is known. Our results are the first to show that a Jovian Trojan is dynamically unstable, and add further weight to the idea that the planetary Trojans likely represent a significant ongoing contribution to the dynamically unstable Centaur population, the parents of the short-period comets. The observed instability (fully half of all clones of Anchises escape the Solar system within 350 Myr) does not rule out a primordial origin for Anchises, but, when taken in concert with the result of our thermophysical analysis, suggest that it would be a fascinating target for a future study.

Proceedings ArticleDOI
12 Mar 2012
TL;DR: The design of an on-chip analog neural network which can be trained to distinguish trusted from untrusted circuit functionality based on simple measurements obtained via on- chip measurement acquisition sensors is discussed.
Abstract: The use of side-channel parametric measurements along with statistical analysis methods for detecting hardware Trojans in fabricated integrated circuits has been studied extensively in recent years, initially for digital designs but recently also for their analog/RF counterparts. Such post-fabrication trust evaluation methods, however, are unable to detect dormant hardware Trojans which are activated after a circuit is deployed in its field of operation. For the latter, an on-chip trust evaluation method is required. To this end, we present a general architecture for post-deployment trust evaluation based on on-chip classifiers. Specifically, we discuss the design of an on-chip analog neural network which can be trained to distinguish trusted from untrusted circuit functionality based on simple measurements obtained via on-chip measurement acquisition sensors. The proposed method is demonstrated using a Trojan-free and two Trojan infested variants of a wireless cryptographic IC design, as well as a fabricated programmable neural network experimentation chip. As corroborated by the obtained experimental results, two current measurements suffice for the on-chip classifier to effectively assess trustworthiness and, thereby, detect hardware Trojans that are activated after chip deployment.

Proceedings ArticleDOI
03 Jun 2012
TL;DR: A high-precision, low-overhead embedded test structure for measuring path delays to detect the delay anomalies introduced by hardware Trojans and is minimally invasive to the design as it leverages the existing scan structures.
Abstract: The horizontal dissemination of the chip fabrication industry has raised new concerns over Integrated Circuit (IC) Trust, in particular, the threat of malicious functionality, i.e., a Hardware Trojan, that is added by an adversary to an IC. In this paper, we propose the use of a high-precision, low-overhead embedded test structure for measuring path delays to detect the delay anomalies introduced by hardware Trojans. The proposed test structure, called REBEL, is minimally invasive to the design as it leverages the existing scan structures. In this work, we integrate REBEL into a structural description of a pipelined Floating Point Unit. Trojan emulation circuits, designed to model internal wire loads introduced by a hardware Trojan, are inserted into the design at multiple places. The emulation cell incorporates an analog control pin to allow a variety of hardware Trojan loading scenarios to be investigated. We evaluate the detection sensitivity of REBEL for detecting hardware Trojans using regression analysis and hardware data collected from 62 copies of the chip fabricated in 90nm CMOS technology.

Journal ArticleDOI
TL;DR: In this article, the first Earth Trojan has been observed and found to be on an interesting orbit close to the Lagrange point L4, and a detailed investigation of the stability of its orbit and moreover extend the study to give an idea of the probability of finding additional Earth Trojans.
Abstract: The first Earth Trojan has been observed and found to be on an interesting orbit close to the Lagrange point L4. In the present study, we therefore perform a detailed investigation of the stability of its orbit and moreover extend the study to give an idea of the probability of finding additional Earth Trojans. Our results are derived using three different approaches. In the first, we derive an analytical mapping in the spatial elliptic restricted three-body problem to find the phase space structure of the dynamical problem. We then explore the stability of the asteroid in the context of the phase space geometry, including the indirect influence of the additional planets of our Solar system. In the second approach, we use precise numerical methods to integrate the orbit forward and backward in time in different dynamical models. On the basis of a set of 400 clone orbits, we derive the probability of capture and escape of the Earth Trojan asteroid 2010 TK7. To this end, in the third approach we perform an extensive numerical investigation of the stability region of the Earth’s Lagrangian points. We present a detailed parameter study of possible stable tadpole and horseshoe orbits of additional Earth Trojans, i.e. with respect to the semi-major axes and inclinations of thousands of fictitious Trojans. All three approaches lead to the conclusion that the Earth Trojan asteroid 2010 TK7 finds itself in an unstable region on the edge of a stable zone; additional Earth Trojan asteroids may be found in this regime of stability.

Proceedings ArticleDOI
05 Nov 2012
TL;DR: A novel minimal test point insertion methodology that provisions a provably complete detection of hardware Trojans by noninvasive timing characterization by creating a satisfiability-based input vector selection for sensitizing and characterizing each single timing path.
Abstract: This paper proposes a novel minimal test point insertion methodology that provisions a provably complete detection of hardware Trojans by noninvasive timing characterization. The objective of test point insertion is to break the reconvergent paths so that target routes for Trojan delay testing are specifically observed. We create a satisfiability-based input vector selection for sensitizing and characterizing each single timing path. Evaluations on benchmark circuits demonstrate that the test point-based Trojan detection can cover all circuit locations and can detect Trojans accurately with less than 5% performance overhead.

Proceedings ArticleDOI
19 Nov 2012
TL;DR: This paper presents an efficient method to detect hardware Trojans under high levels of process variations, by measuring delays for vectors generated using a minimally delay-invasive Trojan model.
Abstract: In this paper we present an efficient method to detect hardware Trojans under high levels of process variations, by measuring delays for vectors generated using a minimally delay-invasive Trojan model. Our method focuses on various sources of process variations and significantly reduces the effects of variations on delays by calibrating delays measured on each fabricated chip. Using test structures and additional measurements on these, our approach significantly reduces the number of chips that we need to test to detect minimally-invasive Trojans with a desired level of confidence. Our approach for tackling high levels of process variations can be used in conjunction with any other type of parametric Trojan detection strategy to significantly improve its efficiency.

Proceedings ArticleDOI
12 Mar 2012
TL;DR: A framework which is based on adding a set of detection sensors to a design which are integrated in the free spaces on the layout and fabricated on the same die to show its effectiveness in realizing a self-authentication process which is independent of a GIC.
Abstract: This work offers a framework which does not rely on a Golden IC (GIC) during hardware Trojan (HT) detection. GIC is a Trojan-free IC which is required, in all existing HT frameworks, as a reference point to verify the responses obtained from an IC under authentication. However, identifying a GIC is not a trivial task. A GIC may not even exist, since all the fabricated ICs may be HT-infected. We propose a framework which is based on adding a set of detection sensors to a design which are integrated in the free spaces on the layout and fabricated on the same die. After fabrication, a self-authentication procedure is proposed in order to determine if a Trojan is inserted in a set of arbitrarily-selected paths in the design. The detection process uses on-chip measurements on the sensors and the design paths in order to evaluate the correlation between a set of actual and predicted delay ranges. Error in the on-chip measurement infrastructure is considered. If our framework determines that a Trojan is (or is not) inserted on a considered path, then it is accurate. In our computational experiments, conducted for challenging cases of small Trojan circuits in the presence of die-to-die and within-die process variations, we report a high detection rate to show its effectiveness in realizing a self-authentication process which is independent of a GIC.

Proceedings ArticleDOI
03 Oct 2012
TL;DR: It is shown that an adversary can design a low-overhead hard-to-detect Trojan that can leak either secret keys stored in a processor, the code running in it, or the data being processed.
Abstract: Growing threat of hardware Trojan attacks in untrusted foundry or design house has motivated researchers around the world to analyze the threat and develop effective countermeasures. In this paper, we focus on analyzing a specific class of hardware Trojans in embedded processor that can be enabled by software or data to leak critical information. These Trojans pose a serious threat in pervasively deployed embedded systems. An attacker can trigger these Trojans to extract valuable information from a system during field deployment. We show that an adversary can design a low-overhead hard-to-detect Trojan that can leak either secret keys stored in a processor, the code running in it, or the data being processed.

Journal ArticleDOI
TL;DR: A low-cost solution for hardware IP protection during evaluation is proposed, by embedding a hardware Trojan inside an IP in the form of a finite state machine that effectively puts an expiry date on the usage of the IP.
Abstract: The authors propose a low-cost solution for hardware IP protection during evaluation, by embedding a hardware Trojan inside an IP in the form of a finite state machine. The Trojan disrupts the normal functional behavior of the IP on occurrence of a sequence of rare events, thereby effectively putting an expiry date on the usage of the IP.

Patent
04 Jul 2012
TL;DR: In this paper, the authors proposed a method for detecting and detecting webpage hanging trojans and a method to extract a corresponding code from a web page. But the method is not suitable for web pages with a large number of URLs.
Abstract: The invention relates to a webpagehanging trojan detecting and protecting method and a webpagehanging trojan detecting and protecting system, as well as a method for extracting a corresponding code. The system injects a section of script code for automatically extracting a tag into an intercepted Web page and sends the Web page to a client side; the client side runs the script code, extracts the code of the tag related to the webpage hanging horse, and sends the code and a URL (Uniform Resource Locator) of the Web page to the system; and the system can match a URL to be detected with a safe URL in a corresponding baseline, if match is failed, abnormal detection is carried out on the URL to be detected, so that the security level is confirmed. The webpagehanging trojan detecting and protecting method and the webpagehanging trojan detecting and protecting system as well as the method for extracting the corresponding code have small dependence on the environment, failure in report can be reduced, and the code of the tag can be effectively extracted.

Patent
18 Jul 2012
TL;DR: In this article, the authors proposed a method and device for detecting intranet Trojans. But, their method was based on the communication behavior characteristics of the TrojANS.
Abstract: The invention provides a method and device for detecting intranet Trojans. The method for detecting the intranet Trojans comprises the following steps: S1, collecting network data packets; S2, identifying baleful domain names by using D1-D3, wherein D1 is for identifying the domain names of DNS request data with abnormal heartbeats, D2 is for judging whether the domain names pointing to special IPs are skipped to be DNS requests pointing to normal IP, and D3 is for judging whether the domain names accessed by the DNS appear in browser access domain names; and S3, identifying the Trojans by using D4-D5, wherein D4 is for judging whether reverse traffic appears, if yes, identifying to be the Trojan, and D5 is for judging whether a request packet or a response packet in the traffic accords with RFC provisions, if not, identifying to be the Trojan. According to the method and device for detecting the intranet Trojans disclosed by the invention, comprehensive detection is performed based on communication behavior characteristics of the Trojans, the unknown Trojans can be found timely and alarmed more accurately, and failure in alarm can be reduced.

Journal ArticleDOI
TL;DR: In this article, the authors derived an analytical mapping in the spatial elliptic restricted three-body problem to find the phase space structure of the dynamical problem and used precise numerical methods to integrate the orbit forward and backward in time in different dynamical models.
Abstract: Recently the first Earth Trojan has been observed (Mainzer et al., ApJ 731) and found to be on an interesting orbit close to the Lagrange point L4 (Connors et al., Nature 475). In the present study we therefore perform a detailed investigation on the stability of its orbit and moreover extend the study to give an idea of the probability to find additional Earth-Trojans. Our results are derived using different approaches: a) we derive an analytical mapping in the spatial elliptic restricted three-body problem to find the phase space structure of the dynamical problem. We explore the stability of the asteroid in the context of the phase space geometry, including the indirect influence of the additional planets of our Solar system. b) We use precise numerical methods to integrate the orbit forward and backward in time in different dynamical models. Based on a set of 400 clone orbits we derive the probability of capture and escape of the Earth Trojan asteroids 2010 TK7. c) To this end we perform an extensive numerical investigation of the stability region of the Earth's Lagrangian points. We present a detailed parameter study in the regime of possible stable tadpole and horseshoe orbits of additional Earth-Trojans, i.e. with respect to the semi-major axes and inclinations of thousands of fictitious Trojans. All three approaches underline that the Earth Trojan asteroid 2010 TK7 finds himself in an unstable region on the edge of a stable zone; additional Earth-Trojan asteroids may be found in this regime of stability.

Journal ArticleDOI
TL;DR: A detailed dynamical study of the recently identified Neptunian Trojan 2004 KV18 was performed in this paper, and it was found that the Trojan was most likely captured from the Centaur population at some point in the last 1 Myr, having originated in the scattered disc, beyond the orbit of Neptune.
Abstract: We have performed a detailed dynamical study of the recently identified Neptunian Trojan 2004 KV18, only the second object to be discovered librating around Neptune's trailing Lagrange point, L5. We find that 2004 KV18 is moving on a highly unstable orbit, and was most likely captured from the Centaur population at some point in the last 1 Myr, having originated in the scattered disc, beyond the orbit of Neptune. The instability of 2004 KV18 is so great that many of the test particles studied leave the Neptunian Trojan cloud within just 0.1-0.3 Myr, and it takes just 37 Myr for half of the 91 125 test particles created to study its dynamical behaviour to be removed from the Solar system entirely. Unlike the other Neptunian Trojans previously found to display dynamical instability on 100-Myr time-scales (2001 QR322 and 2008 LC18), 2004 KV18 displays such extreme instability that it must be a temporarily captured Trojan, rather than a primordial member of the Neptunian Trojan population. As such, it offers a fascinating insight into the processes through which small bodies are transferred around the outer Solar system, and represents an exciting addition to the menagerie of the Solar system's small bodies.

Proceedings ArticleDOI
30 Sep 2012
TL;DR: This work developed and presented 10 processor-level hardware Trojans with various impacts, such as altering instruction memory, modifying the communication channel, stealing user information, changing interrupt handler location and RC-5 encryption algorithm checking of a medium complexity micro-processor (8051).
Abstract: This work seeks to expose the vulnerability of un-trusted computing platforms used in critical systems to hardware Trojans and combined hardware/software attacks. As part of our entry in the Cyber Security Awareness Week (CSAW) Embedded System Challenge hosted by NYU-Poly in 2011, we developed and presented 10 such processor-level hardware Trojans. These are split in five categories with various impacts, such as altering instruction memory, modifying the communication channel, stealing user information, changing interrupt handler location and RC-5 encryption algorithm checking of a medium complexity micro-processor (8051). Our work serves as a good starting point for researchers to develop Trojan detection and prevention methodologies on modern processor and to ensure trustworthiness of computing platforms.

Journal ArticleDOI
TL;DR: The solutions summarized in this article provide general guidelines for theorists and practitioners to use side channels constructively to achieve designs that are robust against detection and removal.
Abstract: Since the introduction of the first side-channel analyses in academia about 15 years ago, several physical attacks have been presented that exploit side-channel leakages to break implementations of cryptographic algorithms. This article deals with the same physical property of electronic devices, but focuses on the art of tailoring it for constructive uses. More precisely, two scenarios, i.e., hardware Trojans and IP watermarking, are illustrated in which the designer of an electronic circuit can add functionality by considering side channels as part of the available design space. Both applications use the same concept, i.e., deliberately leaking a secret through a side channel while keeping the introduced side channel hidden from adversaries and attackers. This article provides a broad overview of the existing works for both applications and should serve as a comprehensible introduction to the underlying field of research. This includes many subtle details that have not been discussed in literature yet, including existing shortcomings and possible improvements to the existing works. The solutions summarized in this article provide general guidelines for theorists and practitioners to use side channels constructively to achieve designs that are robust against detection and removal. Furthermore, we present an entirely new design of a Trojan side-channel. This architecture demonstrates the potential of a Trojan side-channel that is neatly tailored to the targeted implementation. The new design removes all non-invasive starting points a third party could use to analyze or get access to the secret-channel.

Journal ArticleDOI
TL;DR: In this paper, the authors investigated the capture efficiency and the stability of the captured objects in the 1:1 mean-motion resonance, especially in the case of the outer giant planets.
Abstract: The paper is devoted to investigate the capture of asteroids by Venus, Earth and Mars into the 1:1 mean-motion resonance, especially into Trojan orbits. Current theoretical studies predict that Trojan asteroids are a frequent by-product of the planet formation. This is not only the case for the outer giant planets, but also for the terrestrial planets in the inner Solar System. By using numerical integrations, we investigated the capture efficiency and the stability of the captured objects. We found out that the capture efficiency is larger for the planets in the inner Solar System compared to the outer ones, but most of the captured Trojan asteroids are not long term stable. These temporary captures caused by chaotic behaviour of the objects were investigated without any dissipative forces. They show an interesting dynamical behaviour of mixing, like jumping from one Lagrange point to the other one.

Journal ArticleDOI
TL;DR: A long-term stable L5 (trailing) Neptune Trojan was discovered in data acquired to search for candidate Trans-Neptunian objects for the New Horizons spacecraft to fly by during an extended post-Pluto mission.
Abstract: We present the discovery of a long-term stable L5 (trailing) Neptune Trojan in data acquired to search for candidate Trans-Neptunian objects for the New Horizons spacecraft to fly by during an extended post-Pluto mission. This Neptune Trojan, 2011 HM102, has the highest inclination (29.4 degrees) of any known member of this population. It is intrinsically brighter than any single L5 Jupiter Trojan at H~8.18. We have determined its gri colors (a first for any L5 Neptune Trojan), which we find to be similar to the moderately red colors of the L4 Neptune Trojans, suggesting similar surface properties for members of both Trojan clouds. We also present colors derived from archival data for two L4 Neptune Trojans (2006 RJ103 and 2007 VL305), better refining the overall color distribution of the population. In this document we describe the discovery circumstances, our physical characterization of 2011 HM102, and this object's implications for the Neptune Trojan population overall. Finally, we discuss the prospects for detecting 2011 HM102 from the New Horizons spacecraft during their close approach in mid- to late-2013.

Journal ArticleDOI
TL;DR: Nondispersive localized Trojan wave packets are created and transported to localized near-circular Trojan states of higher n, n(f) ~ 600, by driving with a linearly polarized sinusoidal electric field whose period is slowly increased.
Abstract: Nondispersive localized Trojan wave packets with ${n}_{i}\ensuremath{\sim}305$ moving in near-circular Bohr-like orbits are created and transported to localized near-circular Trojan states of higher $n$, ${n}_{f}\ensuremath{\sim}600$, by driving with a linearly polarized sinusoidal electric field whose period is slowly increased. The protocol is remarkably efficient with over 80% of the initial atoms being transferred to the higher $n$ states, a result confirmed by classical trajectory Monte Carlo simulations.

Proceedings ArticleDOI
07 May 2012
TL;DR: This paper investigates the attacking vector of the Trojan type malware in OSNs and suggests adjustment to the current model for malware propagation in scale-free networks to consider the effect of clustering coefficient and the user behaviors.
Abstract: Online Social Networks (OSNs) are generally based on real social relations. Hence, malware writers are taking advantage of this fact to propagate their viral code into OSNs. In recent years, major OSNs, such as Facebook, were extensively under malware attacks. These attacks commonly lead to hundreds of thousands of compromised accounts that may bear personal and even confidential information. In this paper, different types of malware in OSNs are discussed. Then, this paper investigates the attacking vector of the Trojan type malware in OSNs. First, the clustering coefficient which is one of the main OSN graph characteristics is examined through simulation. It is shown that the clustering coefficient has a linear effect on the speed of Trojans. Second, the effect of user behavior is studied using different user reactions to malicious posts. Through simulations, we show that, if Trojans try to deceive users by choosing interesting topics, the speed of propagation will be increased exponentially. This effect raises the significance of giving security knowledge to avoid designated social engineered posts. Finally, we suggest adjustment to the current model for malware propagation in scale-free networks to consider the effect of clustering coefficient and the user behaviors.

Proceedings ArticleDOI
30 Sep 2012
TL;DR: This paper explores the cost in both area and power consumption of several small, focused attacks on an Intel 8051 microcontroller implemented with a standard cell library, and finds that a more focused attack can potentially avoid detection.
Abstract: Many experimental hardware Trojans from the literature explore the potential threat vectors, but do not address the stealthiness of the malicious hardware. If a Trojan requires a large amount of area or power, then it can be easier to detect. Instead, a more focused attack can potentially avoid detection. This paper explores the cost in both area and power consumption of several small, focused attacks on an Intel 8051 microcontroller implemented with a standard cell library. The resulting cost in total area varied from a 0.4% increase in the design, down to a 0.150% increase in the design. Dynamic and leakage power showed similar results.