Security and Privacy in Communication Networks


Book Description

This book constitutes the thoroughly refereed post-conference proceedings of the 5th International ICST Conference, SecureComm 2009, held in September 2009 in Athens, Greece. The 19 revised full papers and 7 revised short papers were carefully reviewed and selected from 76 submissions. The papers cover various topics such as wireless network security, network intrusion detection, security and privacy for the general internet, malware and misbehavior, sensor networks, key management, credentials and authentications, as well as secure multicast and emerging technologies.







Automatic Malware Analysis


Book Description

Malicious software (i.e., malware) has become a severe threat to interconnected computer systems for decades and has caused billions of dollars damages each year. A large volume of new malware samples are discovered daily. Even worse, malware is rapidly evolving becoming more sophisticated and evasive to strike against current malware analysis and defense systems. Automatic Malware Analysis presents a virtualized malware analysis framework that addresses common challenges in malware analysis. In regards to this new analysis framework, a series of analysis techniques for automatic malware analysis is developed. These techniques capture intrinsic characteristics of malware, and are well suited for dealing with new malware samples and attack mechanisms.




Secure Coding in C and C++


Book Description

Learn the Root Causes of Software Vulnerabilities and How to Avoid Them Commonly exploited software vulnerabilities are usually caused by avoidable software defects. Having analyzed tens of thousands of vulnerability reports since 1988, CERT has determined that a relatively small number of root causes account for most of the vulnerabilities. Secure Coding in C and C++, Second Edition, identifies and explains these root causes and shows the steps that can be taken to prevent exploitation. Moreover, this book encourages programmers to adopt security best practices and to develop a security mindset that can help protect software from tomorrow’s attacks, not just today’s. Drawing on the CERT’s reports and conclusions, Robert C. Seacord systematically identifies the program errors most likely to lead to security breaches, shows how they can be exploited, reviews the potential consequences, and presents secure alternatives. Coverage includes technical detail on how to Improve the overall security of any C or C++ application Thwart buffer overflows, stack-smashing, and return-oriented programming attacks that exploit insecure string manipulation logic Avoid vulnerabilities and security flaws resulting from the incorrect use of dynamic memory management functions Eliminate integer-related problems resulting from signed integer overflows, unsigned integer wrapping, and truncation errors Perform secure I/O, avoiding file system vulnerabilities Correctly use formatted output functions without introducing format-string vulnerabilities Avoid race conditions and other exploitable vulnerabilities while developing concurrent code The second edition features Updates for C11 and C++11 Significant revisions to chapters on strings, dynamic memory management, and integer security A new chapter on concurrency Access to the online secure coding course offered through Carnegie Mellon’s Open Learning Initiative (OLI) Secure Coding in C and C++, Second Edition, presents hundreds of examples of secure code, insecure code, and exploits, implemented for Windows and Linux. If you’re responsible for creating secure C or C++ software–or for keeping it safe–no other book offers you this much detailed, expert assistance.




Resource Proportional Software Design for Emerging Systems


Book Description

Efficiency is a crucial concern across computing systems, from the edge to the cloud. Paradoxically, even as the latencies of bottleneck components such as storage and networks have dropped by up to four orders of magnitude, software path lengths have progressively increased due to overhead from the very frameworks that have revolutionized the pace of information technology. Such overhead can be severe enough to overshadow the benefits from switching to new technologies like persistent memory and low latency interconnects. Resource Proportional Software Design for Emerging Systems introduces resource proportional design (RPD) as a principled approach to software component and system development that counters the overhead of deeply layered code without removing flexibility or ease of development. RPD makes resource consumption proportional to situational utility by adapting to diverse emerging needs and technology systems evolution. Highlights: Analysis of run-time bloat in deep software stacks, an under-explored source of power-performance wastage in IT systems Qualitative and quantitative treatment of key dimensions of resource proportionality Code features: Unify and broaden supported but optional features without losing efficiency Technology and systems evolution: Design software to adapt with changing trade-offs as technology evolves Data processing: Design systems to predict which subsets of data processed by an (analytics or ML) application are likely to be useful System wide trade-offs: Address interacting local and global considerations throughout software stacks and hardware including cross-layer co-design involving code, data and systems dimensions, and non-functional requirements such as security and fault tolerance Written from a systems perspective to explore RPD principles, best practices, models and tools in the context of emerging technologies and applications This book is primarily geared towards practitioners with some advanced topics for researchers. The principles shared in the book are expected to be useful for programmers, engineers and researchers interested in ensuring software and systems are optimized for existing and next generation technologies. The authors are from both industry (Bhattacharya and Voigt) and academic (Gopinath) backgrounds.




Secure Data Science


Book Description

Secure data science, which integrates cyber security and data science, is becoming one of the critical areas in both cyber security and data science. This is because the novel data science techniques being developed have applications in solving such cyber security problems as intrusion detection, malware analysis, and insider threat detection. However, the data science techniques being applied not only for cyber security but also for every application area—including healthcare, finance, manufacturing, and marketing—could be attacked by malware. Furthermore, due to the power of data science, it is now possible to infer highly private and sensitive information from public data, which could result in the violation of individual privacy. This is the first such book that provides a comprehensive overview of integrating both cyber security and data science and discusses both theory and practice in secure data science. After an overview of security and privacy for big data services as well as cloud computing, this book describes applications of data science for cyber security applications. It also discusses such applications of data science as malware analysis and insider threat detection. Then this book addresses trends in adversarial machine learning and provides solutions to the attacks on the data science techniques. In particular, it discusses some emerging trends in carrying out trustworthy analytics so that the analytics techniques can be secured against malicious attacks. Then it focuses on the privacy threats due to the collection of massive amounts of data and potential solutions. Following a discussion on the integration of services computing, including cloud-based services for secure data science, it looks at applications of secure data science to information sharing and social media. This book is a useful resource for researchers, software developers, educators, and managers who want to understand both the high level concepts and the technical details on the design and implementation of secure data science-based systems. It can also be used as a reference book for a graduate course in secure data science. Furthermore, this book provides numerous references that would be helpful for the reader to get more details about secure data science.




Information and Communications Security


Book Description

The11thInternationalConferenceonInformationandCommunicationsSecurity (ICICS 2009) was held in Beijing, China during December 14–17, 2009. The ICICS conferenceseriesis anestablished forum that bringstogether people from universities,researchinstitutes, industry and governmentinstitutions, who work in a range of ?elds within information and communications security. The ICICS conferencesgiveattendeestheopportunitytoexchangenewideasandinvestigate developments in the state of the art. In previous years, ICICS has taken place in the UK (2008), China (2007, 2005, 2003, 2001 and 1997), USA (2006), Spain (2004), Singapore (2002), and Australia (1999). On each occasion, as on this one, the proceedings have been published in the Springer LNCS series. In total, 162 manuscripts from 20 countries and districts were submitted to ICICS 2009, and a total of 37 (31 regular papers plus 6 short papers) from 13 countries and districts were accepted (an acceptance rate of 23%). The accepted papers cover a wide range of disciplines within information security and applied cryptography. Each submission to ICICS 2009 was anonymously reviewed by three or four reviewers. We are very grateful to members of the Program C- mittee, which was composed of 44 members from 14 countries; we would like to thank them, as well as all the external referees, for their time and their valuable contributions to the tough and time-consuming reviewing process.