DTAD: A Dynamic Taint Analysis Detector for Information Security

Since computers are universalized in every aspect of modern applications, detecting malware embedded in computer systems is essential in protecting user privacy, robustness of services, and data integrity. With the rapidly growing popularity of cloud computing technologies, although the underlying system virtualization enhances the protection of service systems, it also brings new security challenges. For example, it can be less cost-effective, both to the cloud vendor and the cloud service tenants, to independently execute security services within every virtualized system based on common cloud pricing schemes. Also, malicious tenants may disrupt other tenants' service operations by means such as exhausting shared computing resources. In this paper, we focus on detecting malware running in virtual machines using the virtual machine introspection framework. The malware behaviors, in particular, the sequential system calls translated by the hypervisor of malware-infected virtual machines, are analyzed by tensor factorization techniques. By segmenting the system logs according to execution time or accumulated system call transition counts, our experiments shows that the proposed tensor-based detection approach can detect most types of malware with good accuracy using relatively short log segments.

In the era of big data, the problem of leakage of personal information is becoming more and more serious. With the citizens’ increasing legal awareness, people pay more and more attention to the protection of personal information. In the context of big data, this article is based on the impact of big data on the protection of personal information. By studying the current status of the domestic and international legal protection of personal information, this paper puts forward some proposals for the protection of information, combined with the current status and existing problems of the legal protection of personal information,

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources. User’s data is stored in large database. The stored data can be accessed and modified by the clients over the Internet. The data is monitored by the Third Party Auditor (TPA) on behalf of the client. Therefore, integrity is lacked by the data stored on the servers. The data integrity is ensured by the cloud services that provide trust to the privacy of users. Aiming at the urgent problem of network data security in cloud computing operations, this paper proposed a security situation assessment system to grasp the security situation in real time. A set of cloud computing network data storage security is proposed. Through this model, the extraction of network data storage security situation elements, the design of network data storage security situation assessment scheme and the calculation method of network data storage security situation value are completed. The experimental results show the error of the predicted value obtained by the network data storage security situation assessment system. The effectiveness of the system model and the superiority of the improved algorithm is verified by the experimental results. This paper uses the cloud model to predict the cloud computing network security situation. On the other hand, the security situation value obtained by the situation assessment process can be used directly without training the original situation value. Performance improvement by the proposed technique over existing technique is seen and it is observe that the proposed technique is 23% and 34% better than the existing techniques.

Currently, information protection in automated systems has become an integral part of the vast majority of activities in various fields of human activity. The article examines the impact of threats on objects subject to protection. The main attention is paid to the analysis of the main cases of exposure to threats and the reaction of protective mechanisms to external intervention. Moreover, the protection system is considered as a complex, as several protective mechanisms with possible interrelationships and their own effectiveness in countering certain types of threats. The architecture of the protection system is imperfect and misses some threats in the protection area, which creates a danger to information. Based on the analysis of the main possible cases, a model of the information protection system with full overlap of threats is proposed, which allows taking into account the internal interrelationships of threats, the actual architecture of the protection system and possible objects of protection, and also allows revealing the structure of the information protection system, evaluating its effectiveness barriers to known types of threats or their combinations. The authors carried out a quantitative assessment of the optimal probabilities of protective mechanisms, which allow to ensure the least passage of threats in the area of protection. Unlike known models, the model of the information protection process with full overlap of threats allows you to take into account the internal relationships between threats, information protection systems and protection objects, and also allows you to reveal the structure of the system, highlight and evaluate the effectiveness of barriers that cover areas of vulnerability information protection mechanisms.

As a new type of distributed machine learning technology, federated learning has shown great application potential in the Internet of things, health care, smart home, finance and other fields. Its core advantage is that it can conduct model training without centralized data, effectively reducing the cost of data transmission and storage, and avoiding the risk of privacy disclosure. However, with the wide application of Federated learning, the problems of data security and privacy protection are increasingly apparent, especially in the face of complex network attacks and data leakage risks. This paper deeply analyzes the basic principles and architecture of Federated learning, and discusses the possible privacy threats in data transmission, model updating and participating devices in detail. Combined with the existing security protection technologies, such as differential privacy, encryption algorithm and secure multi-party computing, this paper discusses how to effectively ensure the security of Federated learning. Finally, the article also looks forward to the future development trend of Federated learning in privacy protection, model optimization, computational efficiency and cross domain collaboration, aiming to provide theoretical support and practical guidance for the further development and application of this technology.

The relevance of the article lies in the fact that legal regulation is an important area in ensuring the information security of the bodies of the National Police of Ukraine. It is it that secures the legal status of the departmental information space, the legal status of the subjects of information legal relations and makes it possible to lawfully apply various forms and methods of ensuring information security in the police. Inappropriate legal regulation, which contains gaps and conflicts, violates human and civil rights and freedoms, or has an ambiguous interpretation - leads to problems in the law enforcement sphere. The article displays the main legal acts regulating the formation and use of information and databases in the bodies of the National Police of Ukraine. The emphasis is placed on domestic sources of legal regulation, which have been qualified and characterized by legal force. It was found that the Law of Ukraine "On Information Protection in Information and Telecommunication Systems" regulates relations in the field of information protection in information, telecommunication and information and telecommunication systems. The law clearly defines that the objects of protection in the system are the information processed in it, and the software that is designed to process this information. It was determined that by-laws and regulations are aimed at detailing certain provisions of the Constitution and laws of Ukraine. They have a substantive direction and regulate a specific area of public relations or the direction of work of government bodies. To ensure the information security of the National Police, they play a key role, since they act as a mechanism for the implementation of legislative requirements. Here it is important to emphasize the importance of quality control over the departmental rule-making of public authorities in order to prevent the adoption of provisions that may contradict each other or even legislative acts.

The development of the information sphere and the corresponding increase in its volume and cost is accompanied by the introduction of advanced information technologies in all spheres of public life of the state, which leads to an increase in the frequency of attacks and potential losses from information leakage. As a result, the complexity of protection systems and an increase in their cost. In these conditions, the task to efficiently distribute limited financial resources to protect the information of business entities becomes more and more important and largely determines the level of financial and economic security of the enterprise and the state as a whole. Of particular relevance is the development of issues of optimisation of indicators of the information security system in a dynamic confrontation. Such indicators can be the amount of damage caused from the implementation of information threats, which determines the effectiveness of the protection system, the profit from making investments in information protection, their profitability, and the like. It was established that it is necessary to determine the total amount of protection resources, which minimises the total losses from possible information leakage in conditions of instability. The authors believe that the optimal control mechanism is the distribution of resources between objects that contain a different share of information and are distinguished by natural security, dynamic vulnerability, and the probability of an attack with the allocation of a certain amount of resources. The practical significance of the study lies in determining the optimal moment for the introduction of defence resources – after the direction and intensity of attacks and, accordingly, the possible level of losses was clarified.

Live migration of virtual machine (VM) is a desirable feature for distributed computing such as grid computing and recent cloud computing by facilitating fault tolerance, load balance, and hardware maintenance. Virtual machine monitor (VMM) enforced process protection is a newly advocated approach to provide a trustworthy execution environment for processes running on commodity operating systems.While VMM-enforced protection systems extend protection to the processes in the virtual machine (VM), it also breaks the mobility of VMs since a VM is more closely bound to the VMM. Furthermore, several security vulnerabilities exists in migration, especially live migration of such systems that may degrade the protection strength or even break the protection.In this paper, we propose a secure migration system that provides live migration capability to VMs in VMM-enforced process protection systems, while not degrading the protection level. We implemented a prototype system base on Xen and GNU Linux to evaluate the design. The results shows that no serious performance degradation is incurred comparing to Xen live migration system.

Multiple instances of virtual machines can run on a single physical host sharing hardware and software resources in cloud computing. One of the resources that is shared among multiple Virtual Machines (VM) in the cloud is Cache. Such Virtual machines are targeted for an abnormal activity like side channel attack. Cache-based side channel attack is one of the side channel attack in cloud environment which leaks the private information of the client. The proposed approach includes the detection and mitigation of cache-based side channel attack in cloud infrastructure. The proposed approach comprises of three components: a collection of virtual machine status, the Fuzzy controller to detect attack and mitigation. The fuzzy rule-based controller is incorporated in this approach to identify the cache-attack on the log file. This system works dynamically to prevent cache attacks on the cloud environment and will incur very small overhead in performance.

Cloud computing creates exciting opportunities like reduced costs and flexibility to the users. It also comprises of some risks like data security within the cloud. Several common security threats like data leakage, insecure API's, and malicious inside users are applicable to cloud computing environment as well. In this paper, the authors consider a cloud computing service where multiple Virtual Machines (VM's) are co-located on the same physical server. In such systems, physical resources are transparently shared by the VMs belonging to multiple users. In systems like these, a malicious user having control of a VM can try to gain control over other VM's resources or utilize all system resources leading to denial of resource attack over other VM users. A malicious user can also try to steal the data of other users located on the same server by compromising hypervisor file system (logical volumes). In this paper, security threats associated with cloud computing environment are evaluated. Authors also explore how such co-existent of VM's can be exploited to gain access over other user's data or deny service and propose constructive security measures that can be deployed to avoid such attacks.

The Internet of Things (IoT) is gradually stepping out of its infancy into maturity. Its widespread applications cover from tiny wearable devices to large industrial systems. Although many security solutions have been introduced to address data security and privacy problems caused by the unique characteristics of IoT, how to simultaneously achieve data confidentiality, protect the privacy of access control policy, and provide reasonable data source identification has been a challenging problem. Moreover, lacking one of the above properties may result in serious issues (e.g., leakage information and forging identity), and the situation grows steadily worse with the expansion of “things” scale. To address the above issues, we propose a new cryptographic primitive named certificateless matchmaking encryption (CL-ME), which inherits the security properties of certificateless cryptosystem and matchmaking encryption. Meanwhile, we also present two effective concrete constructions with formal security proofs based on the standard hard assumptions. The basic construction is the first instance of CL-ME based on bilinear pairing, and the enhanced construction is a pairing-free lightweight solution. Finally, we implement our proposed schemes using popular cryptography library and compare their performance with existing works. Theoretical analysis and experimental evaluations demonstrate that our proposed schemes are more suitable for IoT environment.

Recently, a new concept called desktop cloud emerged, which was developed to offer cloud computing services on non-dedicated resources. Similarly to cloud computing, desktop clouds are based on virtualization, and like other computational systems, may experience faults at any time. As a consequence, reliability has become a concern for researchers. Fault-tolerance strategies focused on independent virtual machines include snapshots (checkpoints) to resume the execution from a healthy state of a virtual machine on the same or another host, which is trivial because hypervisors provide this function. However, it is not trivial to obtain a global snapshot of a distributed system formed by applications that communicate among them because the concept of global clock does not exist, so it can not be guaranteed that snapshots of each VM will be taken at the same time. Therefore, some protocol is needed to coordinate the participants to obtain a global snapshot. In this paper, we propose a global snapshot protocol called UnaCloud Snapshot for its application in the context of desktop clouds over TCP/IP networks. That differs from other proposals that use a virtual network to inspect and manipulate the traffic circulating among virtual machines making it difficult to apply them to more realistic environments. We obtain a consistent global snapshot for a general distributed system running on virtual machines that maintains the semantics of the system without modifying applications running on virtual machines or hypervisors. A first prototype was developed and the preliminary results of our evaluation are presented.

Many modern use cases of relational databases involve multi-tenancy. To allow a tenant to only access its data, relational database systems (RDBMSs) introduced row-level security (RLS). RLS enables specifying per-row access controls, which the database enforces by rewriting tenant queries to add an RLS policy filter that filters out rows the tenant is not allowed to view. Unfortunately, while RLS blocks queries from returning unauthorized data, side-effects of query execution can form a side-channel that leaks information about such secret data. This paper investigates how RLS query execution time can leak information about rows that the querying tenant is restricted from viewing. We show that in PostgreSQL and SQL Server, an attacker can craft index-using queries to learn whether a value they are not authorized to view exists in an RLS-protected table, and in some cases, how many times such a value exists in the table. Our attack succeeds in a realistic cloud setting: we successfully attack managed PostgreSQL and SQL Server database instances on AWS from virtual machines in the same and different data centers. To block the RLS time side-channel, we design a data-oblivious query scheme for the case of unique keys. We also analyze the trade-offs created by the data-oblivious approach for non-unique keys. To facilitate the evaluation of RLS attacks and defenses, we introduce a benchmark that supports multi-tenancy and RLS, which are not supported by established benchmarks such as YCSB. We implement our solution in PostgreSQL and show that it achieves security with minimal performance impact.

Multi-tenancy of the cloud maximizes the utility of computation and storage resources by multiplexing the underlying hardware infrastructure amongst cloud customers; however, it also introduces significant security issues such as information leakage between two virtual machines (VMs) even if certain access control policy (e.g., Chinese Wall security policy) has been deployed in the cloud. Physical resource isolation between VMs is an effective mechanism to remove the covert channels in the cloud and prevent information leakage; however, due to economic concerns or negligence, some cheap-and-lazy cloud providers are not motivated to enforce the physical resource isolation as they promised. In this paper, we first develop a mechanism to check the co-residency of two files on local hard disk(s) by measuring the file access time, and then extend our mechanism to check data storage co-residency on Amazon S3 cloud storage.

As embedded systems take more important roles at many places, it is more important for them to be able to show the evidences of system failures. Providing such evidences makes it easier to investigate the root causes of the failures and to prove the responsible parties. This paper proposes simultaneous logging and replaying of a system that enables recording evidences of system failures. The proposed system employs two virtual machines, one for the primary execution and the other for the backup execution. The backup virtual machine maintains the past state of the primary virtual machine along with the log to make the backup the same state as the primary. When a system failure occurs on the primary virtual machine, the VMM saves the backup state and the log. The saved backup state and the log can be used as an evidence. By replaying the backup virtual machine from the saved state following the saved log, the execution path to the failure can be completely analyzed. We developed such a logging and replaying feature in a VMM. It can log and replay the execution of the Linux operating system. The experiment results show the overhead of the primary execution is only fractional.