Detection of Intrusions and Malware, and Vulnerability Assessment: 19th International Conference, DIMVA 2022, Cagliari, Italy, June 29 –July 1, 2022, ... (Lecture Notes in Computer Science, 13358)

Description

This book constitutes the proceedings of the 19th International Conference on Detection of Intrusions and Malware, and Vulnerability Assessment, DIMVA 2022, held in Cagliari, Italy, in June – July 2021. The 10 full papers and 1 short paper presented in this volume were carefully reviewed and selected from 39 submissions.  Preface Organization Contents Hybrid Pruning: Towards Precise Pointer and Taint Analysis 1 Introduction 2 Background 2.1 Flow-Sensitive, Static Points-To Analysis 2.2 Static Taint Tracking 3 Motivation 3.1 Running Example 3.2 Imprecision in Vanilla Static Analysis 3.3 Precision Gain Due to Hybrid Pruning 4 Hybrid Pruning 4.1 Generation of Dynamic Facts 4.2 Domain Re-mapping 4.3 Injection of Dynamic Facts 4.4 Vulnerability Detection 4.5 Implementation 5 Evaluation 5.1 Evaluation Setup 5.2 Vulnerability Detection 5.3 Effect of Dynamic Trace 6 Limitations and Discussion 7 Related Work 8 Conclusion References Establishing the Contaminating Effect of Metadata Feature Inclusion in Machine-Learned Network Intrusion Detection Models 1 Introduction 2 Related Work 2.1 Shortcut Learning 2.2 State of the Art Datasets 2.3 Proposed ML-IDS Systems 3 Evaluation Methodology 3.1 Two Notes on Methodological Design Choices 4 Results 4.1 NSL-KDD 4.2 ISCX-IDS2012 4.3 CTU-13 4.4 UNSW-NB15 4.5 CIDDS Collection 4.6 CIC Collection 4.7 Other Metadata Features 5 Discussion 6 Conclusion 7 Future Work References Extended Abstract: Effective Call Graph Fingerprinting for the Analysis and Classification of Windows Malware 1 Introduction 2 Background and Related Work 3 Methodology 3.1 Pre-processing and Analysis 3.2 Feature Extraction 3.3 Classification 4 Experimental Evaluation 5 Conclusions and Future Work References COBRA-GCN: Contrastive Learning to Optimize Binary Representation Analysis with Graph Convolutional Networks 1 Introduction 2 Related Work 3 Approach 3.1 Approach Overview 3.2 Assembly Instruction Embeddings 3.3 Function Embeddings 3.4 Program Embeddings 4 Datasets 5 Evaluation and Results 5.1 Assembly Embeddings 5.2 Function Embeddings 5.3 Program Similarity 6 Limitations and Future Work 7 Conclusion References Prioritizing Antivirus Alerts on Internal Enterprise Machines 1 Introduction 2 Background 3 Proposed Method 3.1 Overview 3.2 Notations 3.3 Training an AE Model (Ranker) 3.4 Applying the AE Models to Rank Sensitive Events 4 Evaluation 4.1 Experimental Setup 4.2 Results 5 Related Work 6 Conclusions References VANDALIR: Vulnerability Analyses Based on Datalog and LLVM-IR 1 Introduction 2 Background 3 Design 3.1 Overview 3.2 Knowledge Base 3.3 Core Analyses 3.4 Vulnerability Detection 4 Evaluation 4.1 Juliet Test Suite Results 4.2 Real World Results 4.3 Performance 5 Limitations 6 Related Work 7 Conclusion References Branch Different - Spectre Attacks on Apple Silicon 1 Introduction 2 Background and Related Work 3 Building Blocks 3.1 High-resolution Timing 3.2 Cache Maintenance 4 Fast Covert Channel 5 Spectre Exploit 6 Evaluation 6.1 High-Resolution Timing 6.2 Cache Maintenance 6.3 Spectre-PHT Proof of Concept 7 Discussion 8 Conclusion A Code B Library Functions References MPKAlloc: Efficient Heap Meta-data Integrity Through Hardware Memory Protection Keys 1 Introduction 2 Background and Threat Model 2.1 Memory Protection Keys 2.2 Related Work 2.3 Design Assumptions and Threat Model 3 System Overview 3.1 Indirect Meta-data Corruption 3.2 Code Domain Partitioning 3.3 Detecting Domain Violations 4 Implementation 4.1 Meta-data in tcmalloc and PartitionAlloc 4.2 Code Domain Partitioning 4.3 Detecting Corruptions 5 Evaluation 5.1 Experimental Set Up 5.2 SPEC CPU2006 Benchmarks 5.3 Hardening Chromium with MPKAlloc 5.4 Detecting Heap Meta-data in Chromium 5.5 Corrupting Meta-data in Chromium 5.6 Impact on Page Load Times 6 Conclusion References A Human in Every APE: Delineating and Evaluating the Human Analysis Systems of Anti-Phishing Entities 1 Introduction 2 System Description 2.1 System Overview 2.2 CAPTCHAs for Honey Sites 2.3 Experimental Setup 3 Delineation of Human Analysis Systems 3.1 Filtering Automated Crawler Visits 3.2 Human Systems' Impact Analysis 4 Evaluation of Human Analysis Systems 4.1 Geolocation-Based Evasion Attacks 4.2 User Agents 4.3 Timing Blind Spots 4.4 Sensor API-based Mobile Evasion Attacks 5 Discussion 6 Related Work 7 Conclusion References Amplification Chamber: Dissecting the Attack Infrastructure of Memcached DRDoS Attacks 1 Introduction 2 Threat Model 3 Real-World Observations 3.1 Observing Memcached DRDoS Attacks 3.2 Amplification Request and Factor 4 Attack Infrastructure Analysis 4.1 Back-End of Attack Infrastructure 4.2 Front-End of Attack Infrastructure 4.3 Infrastructure Hotspots 4.4 Memcached Servers in the Wild 5 Discussion 5.1 Ethical Consideration 5.2 Limitations 5.3 Dataset 6 Related Work 7 Conclusion References Consistency is All I Ask: Attacks and Countermeasures on the Network Context of Distributed Honeypots 1 Introduction 2 Related Work 3 Threat Model 4 Network Context Cross-Checking Attacks 4.1 Pre-exploitation Reconnaissance 4.2 Post-exploitation Reconnaissance 4.3 Artifacts Cross-Checking 4.4 Attack Effectiveness 5 HoneyPortal: The Countermeasure 5.1 System Design 5.2 Implementation of HoneyPortal 6 Evaluation 6.1 Defense Effectiveness 6.2 Processing Latency 6.3 System Overhead 7 Discussion 8 Conclusion References Author Index