Advanced Topics in Computer Security (Reading Group; 790-091)

Meeting Times

Tuesdays/Thursday,   2 - 3:15 pm, SN155. Also involves independent one-on-one in-office meetings.

Description

We focus on selected topics in Computer Security. We will examine several research papers in various topic areas. Participants will be required to be prepared to discuss each of the papers, and provide constructive feedback on the scientific merit, novelty, and thoroughness of the work. In particular, participants are required to read all asigned papers and be able to competently discuss the material in class. Each participant will be responsible for leading at least one discussion on a paper (and hence work with me on preparing a comprehensive review of the topic suitable for a 1 hour talk). Additionally, each participant is responsible for submitting a summary of the main paper of the week, which should include (1) its contributions (in your own words), strengths and weaknesses, (2) at least two thought-provoking questions (3) and 1 extension on the ideas / topic presented in the paper. Questions should critically evaluate the paper (e.g., questioning the assumptions, questioning whether the experiments are lacking (and why), flaws in the analysis, etc). These questions will be raised and discussed in class.

Grading

This is intended to be an interactive reading group, and as such, in-class participation will play a significant role in my grading criteria. Participants will be graded on the presentation of their assigned papers, their participation in discussions and questions, and the thoroughness of their reviews.

Reading List (Subject to change!)

Date
Topic Leader


Course Introduction, selection of presenters, brief discussions on papers/topics

9/2

Wright et al. Spot me if you can: recovering spoken phrases in encrypted VoIP conversations. In Proceedings of IEEE Security and Privacy, 2008

related readings:

  • Wright et al. Language Identification of Encrypted VoIP Traffic: Alejandra y Roberto or Alice and Bob?
    Proceedings of USENIX Security, 2007

Fabian
9/9

Guest Lecture: Michael Bailey (Umich)

related readings:

  • Chen et al. Towards an Understanding of Anti-virtualization and Anti-debugging Behavior in Modern Malware
    DSN, 2008

Michael
9/18

Jha et al. Towards Practical Privacy for Genomic Computations. In Proceedings of IEEE Security and Privacy, 2008

related readings:

  • Szajda et al. Toward a practical data privacy scheme for a distributed implementation of the Smith-Waterman genome sequence comparison algorithm. In NDSS'06.

Andy
9/23

Anderson et al. Characterizing Internet Scam Hosting Infrastructure. In Proceedings of USENIX Security Symposium, 2007

related readings:

  • Kreibich et al. On the Spam campaign trail. In LEET'08.
  • Venkataraman et al. Exploiting Network Structure for Proactive Spam Mitigation. USENIX Sec'07

Alana
10/2

Cui et al. Discoverer: Automatic Protocol Reverse Engineering from Network Traces. In Proceedings of USENIX Security Symposium, 2007

related readings:

  • Small et al. To Catch A Predator: A Natural Language Approach for Eliciting Malicious Payloads. In Proceedings of USENIX Security Symposium, 2008
  • Leita et al. Automatic handling of protocol dependencies and reaction to 0-day attacks. In RAID'06

Josh
10/9

Trestian et al. Unconstrained Endpoint Profiling (Googling the Internet). In Proceedings of ACM SIGCOMM, 2008

related readings:

  • Chow et al. Detecing Privacy Leaks using Corpus-based Association Rules. In Proceedings of KDD'2008.
  • Ribeiro et al. Analyzing Privacy in Enterprise Packet Trace Anonymization.

Scott
10/21

Criswell et al. Secure Virtual Architecture: A safe execution environment for commodity OSes. In proceedings of ACM SOSP'07

related readings:

  • Chen et al. Overshadow: A Virtualization-based Approach for retrofitting Protection in Commodity Operating Systems. In ASPLOS'08.

Srinivas
no class

Week of ACM CCS

11/6

Xavier Boyen. Halting Password Puzzles. In Proceedings of USENIX Security Symposium, 2007

related readings:

  • Florincio et al. Do Strong Web Passwords Accomplish anything? In HotSec'07
  • Clark et al. Panic Passwords: Authenticating under Duress. In HotSec'08

Danny
11/13

Anderson et al. Lest we remember: Cold Boot Attacks on Encryption Keys. In Proceedings of USENIX Security Symposium, 2008

related readings:

  • Chow et al. Shredding your garbage: reducing data lifetime through secure deallocation. USENIX Security, 2005
Andy/Fabian
11/20

Zander et al. An Improved Clock-skew Measurement Technique for Revealing Hidden Services. In Proceedings of USENIX Security Symposium, 2008

related readings:

  • T. Kohno, A. Broido, and kc claffy. Remote physical device fingerprinting. In Proceedings of IEEE Security and Privacy, 2005.
  • S. J. Murdoch. Hot or not: Revealing hidden services by their clock skew. In proceedings of CCS'06
Xin
12/4

Kirvoski, Sinclair and Wilson. The Martini Synch: Joint Fuzzy Hashing

related readings:

  • Kirovski et al. The Martini Synch: Device pairing via Joint Quantization (more details than first paper).
  • Shake them up! A movement-based pairing protocol for CPU-constrained devices
Alana/Srinivas
makeup?

Godefroid et al. Automated White-box Fuzzing. In Proceedings of NDSS, 2008

related readings:


Sam


Other topics :