EAGER: Collaborative: Towards Understanding the Attack Vector of Privacy Technologies

EAGER：协作：了解隐私技术的攻击向量

基本信息

批准号：
1643207
负责人：
David Mohaisen
金额：
$ 12.5万
依托单位：
SUNY at Buffalo
依托单位国家：
美国
项目类别：
Standard Grant
财政年份：
2016
资助国家：
美国
起止时间：
2016-09-01 至 2017-12-31
项目状态：
已结题

来源：
https://www.nsf.gov/awardsearch/showAward?AWD_ID=1643207&HistoricalAwards=false
关键词：
EAGER Collaborative Towards Understanding Attack

项目摘要

Advances in privacy-enhancing technologies, including cryptographic mechanisms, standardized security protocols, and infrastructure, significantly improved privacy and had a significant impact on society by protecting users. At the same time, the success of such infrastructure has attracted abuse from illegal activities, including sophisticated botnets and ransomware, and has become a marketplace for drugs and contraband; botnets rose to be a major tool for cybercrime and their developers proved to be highly resourceful. It is contended that the next waves of botnets will extensively attempt to subvert privacy infrastructure and cryptographic mechanisms, which has the potential of both undermining their legal basis and future performance. This project will develop the theoretical and experimental foundations for analyzing, monitoring and mitigating the next generation of botnets that subvert privacy-enhancing technologies. Towards that goal, the project will develop tools for: 1) Analytical framework: the project develops a concrete strategy for approaching the detection, characterization, and mitigation of abuse of privacy infrastructure by crystallizing an analytical framework for reasoning about such botnets. This includes the identification&#8232;and formalization of their key properties (e.g., traceback and tomography resiliency, stealthy monetization), enabling mechanisms (e.g., IP address de-coupling, control/data traffic indistinguishability), fundamental limitations, and evaluation metrics. The project will explore analogous scenarios of abuse in future Internet architectures where anonymity is facilitated by design. 2) Monitoring and analysis: the project develops an experimental framework to track activities of the next generation of botnets for scalable and effective mitigation. Such framework will exploit their ideal design and behavioral properties, and draws on various preliminary measurement results in related contexts. 3) Mitigation: The project has the ultimate&#8232;goal of proactively developing an arsenal of mitigation techniques grounded in a sound theoretical foundation, analyzed within the theoretical framework, and evaluated within the experimental framework. The mitigation techniques span the gamut of increasing the cost of operating such botnets, to actively containing&#8232;and neutralizing bots, to proposing modifications to the privacy-enhancing protocols. The results of this project will be communicated with the concerned communities for having a direct and immediate impact on existing and future privacy infrastructure. The project will also develop educational material to train students in the foundations and systems for enabling privacy enhancing technologies.

隐私增强技术的进步，包括加密机制，标准化的安全协议和基础架构，大大改善了隐私，并通过保护用户对社会产生了重大影响。同时，这种基础设施的成功吸引了非法活动的虐待，包括精致的僵尸网络和勒索软件，并已成为毒品和违禁品的市场。僵尸网络成为网络犯罪的主要工具，其开发人员被证明是足智多谋的。有人认为，接下来的僵尸网络将广泛地试图颠覆隐私基础架构和加密机制，这既有可能破坏其法律基础和未来的绩效。该项目将开发理论和实验基础，用于分析，监测和减轻颠覆隐私增强技术的下一代僵尸网络。为了实现这一目标，该项目将开发以下工具：1）分析框架：该项目通过将分析框架结晶为对此类植物网络的推理来制定检测，表征和缓解滥用隐私基础设施的策略。这包括标识＆＃8232;以及其关键特性的形式化（例如，追溯和断层扫描弹性，隐形货币化），启用机制（例如，IP地址偶联，控制/数据流量不可区分性），基本限制和评估指标。该项目将在未来的互联网体系结构中探索滥用的类似情况，在这些互联网架构中，设计促进了匿名性。 2）监视和分析：该项目开发了一个实验框架，以跟踪下一代僵尸网络的活动，以进行可扩展有效的缓解。这种框架将利用其理想的设计和行为属性，并利用相关环境中各种初步测量结果。 3）缓解：该项目的最终目标是积极开发基于声音理论基础，在理论框架内进行分析并在实验框架内进行评估的缓解技术的库。缓解技术涵盖了增加操作此类僵尸网络的成本，积极地包含＆＃8232;中和机器人的范围，以提出对隐私增强协议的修改。该项目的结果将与有关社区传达，以直接和直接影响现有和未来的隐私基础设施。该项目还将开发教育材料，以培训学生在基础和系统中，以增强隐私技术。

项目成果

期刊论文数量（5）

专著数量（0）

科研奖励数量（0）

会议论文数量（0）

专利数量（0）

Leakage of .onion at the DNS Root: Measurements, Causes, and Countermeasures

DNS 根处的 .onion 泄漏：测量、原因和对策

DOI：
10.1109/tnet.2017.2717965
发表时间：
2017
期刊：
IEEE/ACM Transactions on Networking
影响因子：
0
作者：
Mohaisen, Aziz;Ren, Kui
通讯作者：
Ren, Kui

Privacy Implications of DNSSEC Look-Aside Validation

DNSSEC 旁视验证的隐私影响

DOI：
10.1109/icdcs.2017.147
发表时间：
2017
期刊：
ICDCS 2017
影响因子：
0
作者：
Mohaisen, Aziz;Gu, Zhongshu;Ren, Kui
通讯作者：
Ren, Kui

You Can Hear But You Cannot Steal: Defending against Voice Impersonation Attacks on Smartphones

DOI：
10.1109/icdcs.2017.133
发表时间：
2017-01-01
期刊：
2017 IEEE 37TH INTERNATIONAL CONFERENCE ON DISTRIBUTED COMPUTING SYSTEMS (ICDCS 2017)
影响因子：
0
作者：
Chen, Si;Ren, Kui;Mohaisen, Aziz
通讯作者：
Mohaisen, Aziz

Large-scale invisible attack on AFC systems with NFC-equipped smartphones