Advanced Detection Tool for PDF Threats

in Proceedings of the sixth International Workshop on Autonomous and Spontaneous Security, RHUL, Egham, U.K., 12th-13th September 2013 (2013, September 13)

In this paper we introduce an efficient application for malicious PDF detection: ADEPT. With targeted attacks rising over the recent past, exploring a new detection and mitigation paradigm becomes ... [more ▼]

In this paper we introduce an efficient application for malicious PDF detection: ADEPT. With targeted attacks rising over the recent past, exploring a new detection and mitigation paradigm becomes mandatory. The use of malicious PDF files that exploit vulnerabilities in well-known PDF readers has become a popular vector for targeted at- tacks, for which few efficient approaches exist. Although simple in theory, parsing followed by analysis of such files is resource-intensive and may even be impossible due to several obfuscation and reader-specific artifacts. Our paper describes a new approach for detecting such malicious payloads that leverages machine learning techniques and an efficient feature selection mechanism for rapidly detecting anomalies. We assess our approach on a large selection of malicious files and report the experimental performance results for the developed prototype. [less ▲]

A semantic firewall for Content Centric Networking

in IFIP/IEEE International Symposium on Integrated Network Management (2013, May)

Content-Centric Networking (CCN) is a promising routing paradigm for content dissemination over a future Internet based on named data instead of named hosts. The CCN architecture has aspects that provide ... [more ▼]

Content-Centric Networking (CCN) is a promising routing paradigm for content dissemination over a future Internet based on named data instead of named hosts. The CCN architecture has aspects that provide more scalability, security, collaborative and pervasive networking. However, several key components that secures the current Internet are still missing in CCN, in particular a firewall able to enforce security policies. We provide a comprehensive study of CCN security requirements from which we design the first CCN-compliant firewall, including syntax and definition of rules. In particular, based on CCN features, our firewall can filter packets according to both their authentication and the semantics of the content name. We also provide a performance evaluation of our prototype. [less ▲]

Model synchronization based on triple graph grammars: correctness, completeness and invertibility

in Software and Systems Modeling (2013)

Triple graph grammars (TGGs) have been used successfully to analyze correctness and completeness of bidirectional model transformations, but a corresponding formal approach to model synchronization has ... [more ▼]

Triple graph grammars (TGGs) have been used successfully to analyze correctness and completeness of bidirectional model transformations, but a corresponding formal approach to model synchronization has been missing. This paper closes this gap by providing a formal synchronization framework with bidirectional update propagation operations. They are generated from a given TGG, which specifies the language of all consistently integrated source and target models. As our main result, we show that the generated synchronization framework is correct and complete, provided that forward and backward propagation operations are deterministic. Correctness essentially means that the propagation operations preserve and establish consistency while completeness ensures that the operations are defined for all possible inputs. Moreover, we analyze the conditions under which the operations are inverse to each other. All constructions and results are motivated and explained by a running example, which leads to a case study, using concrete visual syntax and abstract syntax notation based on typed attributed graphs. [less ▲]

On an Automated Translation of Satellite Procedures Using Triple Graph Grammars

in Duddy, Keith; Kappel, Gerti (Eds.) Theory and Practice of Model Transformations (2013)

Model transformation based on triple graph grammars (TGGs) is a general, intuitive and formally well defined technique for the translation of models [5,6,2]. While previous concepts and case studies were ... [more ▼]

Model transformation based on triple graph grammars (TGGs) is a general, intuitive and formally well defined technique for the translation of models [5,6,2]. While previous concepts and case studies were focused mainly on visual models of software and systems, this article describes an industrial application of model transformations based on TGGs as a powerful technique for software translation using the tool Henshin [1]. The general problem in this scenario is to translate source code that is currently in use into corresponding source code that shall run on a new system. Up to now, this problem was addressed based on manually written converters, parser generators, compiler-compilers or meta-programming environments using term rewriting or similar techniques (see e. g. [4]). [less ▲]

Correctness and Completeness of Generalised Concurrent Model Synchronisation Based on Triple Graph Grammars

in Baudry, Benoit; Dingel, Juergen; Lucio, Levi (Eds.) et al Proc. Int. Workshop on Analysis of Model Transformations 2013 (AMT'13) (2013)

Symbolic Execution of Satellite Control Procedures in Graph-Transformation-Based EMF Ecosystems

in Boulanger, Frédéric; Famelis, Michalis; Ratiu, Daniel (Eds.) MoDeVVa@MoDELS (2013)

Symbolic execution is a well-studied technique for analysing the behaviour of software components with applications to test case generation. We propose a framework for symbolically executing satellite ... [more ▼]

Symbolic execution is a well-studied technique for analysing the behaviour of software components with applications to test case generation. We propose a framework for symbolically executing satellite control procedures and generating test cases based on graph transformation techniques. A graph-based operational symbolic execution semantics is defined and the executed procedure models are used for generating test cases by performing model transformations. The approach is discussed based on a prototype implementation using the Eclipse Modelling Framework (EMF), Henshin and ECLiPSe-CLP tool ecosystem. [less ▲]

Security monitoring for Content Centric Networking

in Data Privacy Management and Autonomous Spontaneous Security (2013)

Content-Centric Networking (CCN) is one of the most promising research area for a future Internet. The goal is to obtain a more scalable, secure, collaborative Internet supporting context-aware services ... [more ▼]

Content-Centric Networking (CCN) is one of the most promising research area for a future Internet. The goal is to obtain a more scalable, secure, collaborative Internet supporting context-aware services. However, as a new overlay infrastructure, CCN raises the need of a new monitoring architecture to assess security of CCN devices. In particular, the stateful nature of CCN routers introduces new attack threats that need to be addressed. We propose in this paper a monitoring approach for the instrumentation of CCN enabled network nodes. The rationale of our monitoring approach is demonstrated through real experimentations to detect and mitigate network level attacks against CCN. [less ▲]

A Study on Highway Traffic Flow Optimization using Partial Velocity Synchronization

in Proceedings of the 1st GI/ITG KuVS Fachgespräch Inter-Vehicle Communication (FG-IVC 2013) Technical Report CCS-2013-01 (2013)

In this paper we present a study of highway traffic flow optimization using Partial Velocity Synchronization (PVS). PVS is a Cellular Automaton (CA) model that is extended by a communication layer ... [more ▼]

In this paper we present a study of highway traffic flow optimization using Partial Velocity Synchronization (PVS). PVS is a Cellular Automaton (CA) model that is extended by a communication layer providing the ability to exchange relevant information between vehicles. We show that it is possible to enhance traffic flow on highways significantly with a small number of velocity recommendations computed from the traffic conditions ahead. Furthermore we show that only a limited number of hops in an information chain is necessary to reschedule the vehicles on a given highway segment to avoid the formation of shockwaves. Our results show that traffic flow will be increased while travel time and emissions will be reduced dramatically. [less ▲]

Semantic based DNS Forensics

in Proceedings of the IEEE International Workshop on Information Forensics and Security (2012, December)

In network level forensics, Domain Name Service (DNS) is a rich source of information. This paper describes a new approach to mine DNS data for forensic purposes. We propose a new technique that leverages ... [more ▼]

In network level forensics, Domain Name Service (DNS) is a rich source of information. This paper describes a new approach to mine DNS data for forensic purposes. We propose a new technique that leverages semantic and natural language processing tools in order to analyze large volumes of DNS data. The main research novelty consists in detecting malicious and dangerous domain names by evaluating the semantic similarity with already known names. This process can provide valuable information for reconstructing network and user activities. We show the efficiency of the method on experimental real datasets gathered from a national passive DNS system. [less ▲]

Large Scale DNS Analysis

in 6th IFIP WG 6.6 International Conference on Autonomous Infrastructure, Management, and Security, Luxembourg, June 4-8 2012 (2012, June)

In this paper we present an architecture for large scale DNS monitoring. The analysis of DNS traffic is becoming of first importance currently, as it allows to monitor the main part of the interactions on ... [more ▼]

In this paper we present an architecture for large scale DNS monitoring. The analysis of DNS traffic is becoming of first importance currently, as it allows to monitor the main part of the interactions on the Internet. DNS traffic can reveal anomalies such as worm infected hosts, botnets or spam participating hosts. The efficiency and the speed of detection of such anomalies rely on the capacity of DNS monitoring system to treat quickly huge quantity of data. We propose a system that leverages distributed processing and storage facilities. [less ▲]