and curity Research Center

New York City, NY, United States

and curity Research Center

New York City, NY, United States
Time filter
Source Type

Li L.,LinkedIn | Mathur S.,and curity Research Center | Coskun B.,and curity Research Center
2013 IEEE Conference on Communications and Network Security, CNS 2013 | Year: 2013

Internet Service Providers and network administrators currently lack effective means for discovering and tracking peer-to-peer (P2P) applications on their networks. This ability would be very useful in various ways such as enforcing security policies on the use of P2P applications (e.g. banning file-sharing networks such as Bit Torrent), mitigating malicious P2P networks (i.e. botnets), or allocating network resources appropriately to improve network performance. To provide this ability, in this work we propose a method to discover P2P networks (both benign and malicious) from network flow records captured at the boundary of a tier-1 Internet backbone provider. The basic idea is that flows belonging to P2P applications can be modeled as observations from a mixed membership statistical model, with P2P applications acting as latent variables. Hence the communication patterns of hosts (who-talks-to-whom), as measured at the edge of a large network, can be decomposed into constituent application-layer P2P communities without any human effort in selecting specific features. This allows for automatic identification and isolation of P2P communities of interest, including those that take deliberate measures to remain hidden, as well as new or evolving ones such as P2P Botnets. In large scale experiments on flow records from a portion of IPv4 space of size /8, we demonstrate that the proposed method is able to detect a number of well known P2P networks, as well as a few evolving malicious P2P botnets. © 2013 IEEE.

Mathur S.,and curity Research Center | Miller R.,Rutgers University | Varshavsky A.,AT and T Labs. | Trappe W.,Rutgers University | Mandayam N.,Rutgers University
MobiSys'11 - Compilation Proceedings of the 9th International Conference on Mobile Systems, Applications and Services and Co-located Workshops | Year: 2011

Forming secure associations between wireless devices that do not share a prior trust relationship is an important problem. This paper presents ProxiMate, a system that allows wireless devices in proximity to securely pair with one another autonomously by generating a common cryptographic key directly from their shared time-varying wireless environment. The shared key synthesized by ProxiMate can be used by the devices to authenticate each others' physical proximity and then to communicate confidentially. Unlike traditional pairing approaches such as Diffie-Hellman, ProxiMate is secure against a computationally unbounded adversary and its computational complexity is linear in the size of the key. We evaluate ProxiMate using an experimental prototype built using an open-source software-defined platform and demonstrate its effectiveness in generating common secret bits. We further show that it is possible to speed up secret key synthesis by monitoring multiple RF sources simultaneously or by shaking together the devices that need to be paired. Finally, we show that ProxiMate is resistant to even the most powerful attacker who controls the public RF source used by the legitimate devices for pairing. © 2011 ACM.

Giura P.,and curity Research Center | De Los Reyes G.,and curity Research Center
Proceedings - International Computer Software and Applications Conference | Year: 2011

Content Distribution Network (CDN) architectures face a wide range of security threats. In this paper, we compare the cost of achieving low and high security for different CDN architectures. We reviewed the existing and emerging systems, identified the threats that they face, defined the general security requirements and considered the mechanisms available to meet the requirements. To assess the security cost, we first defined the process for selecting security mechanisms, and then defined the process for ranking the mechanisms for each architecture. The security comparison result clearly shows that the more the cost of providing service is pushed to the end points, the higher the security cost. To the best of our knowledge, this study is the first effort to assess a security cost comparison of different CDN architectures. Our work is orthogonal to other studies that try to find ways of reducing the content distribution service cost, rather than quantifying the cost to provide service security. © 2011 IEEE.

Gordon S.D.,Columbia University | Katz J.,University of Maryland College Park | Kolesnikov V.,Alcatel - Lucent | Krell F.,Columbia University | And 3 more authors.
Proceedings of the ACM Conference on Computer and Communications Security | Year: 2012

Traditional approaches to generic secure computation begin by representing the function f being computed as a circuit. If f depends on each of its input bits, this implies a protocol with complexity at least linear in the input size. In fact, linear running time is inherent for non-trivial functions since each party must "touch" every bit of their input lest information about the other party's input be leaked. This seems to rule out many applications of secure computation (e.g., database search) in scenarios where inputs are huge. Adapting and extending an idea of Ostrovsky and Shoup, we present an approach to secure two-party computation that yields protocols running in sublinear time, in an amortized sense, for functions that can be computed in sublinear time on a random-access machine (RAM). Moreover, each party is required to maintain state that is only (essentially) linear in its own input size. Our approach combines generic secure two-party computation with oblivious RAM (ORAM) protocols. We present an optimized version of our approach using Yao's garbled-circuit protocol and a recent ORAM construction of Shi et al. We describe an implementation of our resulting protocol, and evaluate its performance for obliviously searching a database with over 1 million entries. Our implementation outperforms off-the-shelf secure-computation protocols for databases containing more than 218 entries. Copyright © 2012 ACM.

Murynets I.,and curity Research Center | Piqueras Jover R.,and curity Research Center
Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC | Year: 2012

The Short Messaging Service (SMS), one of the most successful cellular services, generates millions of dollars in revenue for mobile operators. Estimates indicate that billions of text messages are traveling the airwaves daily. Nevertheless, text messaging is becoming a source of customer dissatisfaction due to the rapid surge of messaging abuse activities. Although spam is a well tackled problem in the email world, SMS spam experiences a yearly growth larger than 500%. In this paper we present, to the best of our knowledge, the first analysis of SMS spam traffic from a tier-1 cellular operator. Communication patterns of spammers are compared to those of legitimate cell-phone users and Machine to Machine (M2M) connected appliances. The results indicate that M2M systems exhibit communication profiles similar to spammers, which could mislead spam filters. Beyond the expected results, such as a large load of text messages sent out to a wide target list, other interesting findings are made. For example, the results indicate that the great majority of the spammers connect to the network with just a handful of different hardware models. We find the main geographical sources of messaging abuse in the US. We also find evidence of spammer mobility, voice and data traffic resembling the behavior of legitimate customers. © 2012 ACM.

Bickford J.,and curity Research Center | Giura P.,and curity Research Center
Proceedings - 2nd IEEE International Conference on Cyber Security and Cloud Computing, CSCloud 2015 - IEEE International Symposium of Smart Cloud, IEEE SSC 2015 | Year: 2015

With the proliferation of Internet access across the globe, as well as the advancement of many new devices and next generation networks, there is no surprise that malware infection via web browsing is still one of the most significant threats to Internet users today. Over the past several years we have also seen the increase in advanced targeted attacks against corporations which steal intellectual property and sensitive customer information. This problem is amplified as security is bypassed for work productivity and usability, while mobile devices increasingly access sensitive information. Though many organizations are beginning to invest significantly into securing their internal corporate network, users are typically given access to the Internet for web browsing purposes, leaving the enterprise vulnerable to drive-by downloads and data exfiltration attacks.In this work we propose a new method to safely browse the Internet by redirecting web requests to a cloud-based Transparent Virtual Browser. Web browsing requests are automatically redirected to the Transparent Virtual Browser via a transparent network proxy, protecting against user configuration errors or malware running on the device. The virtual browsing session is streamed back to the user securely, while maintaining a seamless user experience. Experiments show that our architecture can isolate web-attacks from a user's machine, protecting enterprises from most of the attacks to which they are vulnerable today. Using a small user trial we tested our solution with several popular web browsers on various operating systems and report on their feedback. Our testing also shows that our prototype only incurs a small initial delay when browsing to a webpage while maintaining a seamless browsing experience for the rest of the browsing session. © 2015 IEEE.

Sun Y.,Huawei | Jover R.P.,and curity Research Center | Wang X.,Columbia University
IEEE Transactions on Wireless Communications | Year: 2012

Femtocell networks, consisting of a conventional macro cellular deployment and overlaying femtocells, forming a hierarchical cell structure, constitute an attractive solution to improving the macrocell capacity and coverage. However, the inter- and intra-tier interferences in such systems can significantly reduce the capacity and cause an unacceptably high level of outage. This paper treats the uplink interference problem in orthogonal frequency-division multiple-access (OFDMA)-based femtocell networks with partial cochannel deployment. We first propose an inter-tier interference mitigation strategy without the femtocell users power control by forcing the femto-interfering macrocell users to use only some dedicated subcarriers. The non-interfering macrocell users, on the other hand, can use either the dedicated subcarriers, or the shared subcarriers which are also used by the femtocell users. We then propose subcarrier allocation schemes based on the auction algorithm for macrocell users and femtocell users, respectively, to independently mitigate the intra-tier interference. The proposed interference mitigation scheme for femtocell networks offers significant performance improvement over the existing methods by substantially reducing the inter- and intra-tier inferences in the system. © 2012 IEEE.

Wang W.,and curity Research Center | Murynets I.,and curity Research Center | Bickford J.,and curity Research Center | Wart C.V.,and curity Research Center | Xu G.,and curity Research Center
Security and Communication Networks | Year: 2013

Because of the always connected nature of mobile devices, as well as the unique interfaces they expose, such as short message service (SMS), multimedia messaging service (MMS), and Bluetooth, classes of mobile malware tend to propagate using means unseen in the desktop world. In this paper, we propose a lightweight malware detection system on mobile devices to detect, analyze, and predict malware propagating via SMS and MMS messages. We deploy agents in the form of hidden contacts on the device to capture messages sent from malicious applications. Once captured, messages can be further analyzed to identify a message signature as well as potentially a signature for the malicious application itself. By feeding the observed messages over time to a latent space model, the system can estimate the current dynamics and predict the future state of malware propagation within the mobility network. One distinct feature of our system is that it is lightweight and suitable for wide deployment. The system shows a good performance even when only 10% of mobile devices are equipped with three agents on each device. Moreover, the model is generic and independent of malware propagation schemes. We prototype the system on the Android platform in a universal mobile telecommunications system laboratory network to demonstrate the feasibility of deploying agents on mobile devices as well as collecting and blocking malware-carrying messages within the mobility network. We also show that the proposed latent space model estimates the state of malware propagation accurately, regardless of the propagation scheme. © 2012 John Wiley & Sons, Ltd.

Juma A.,Mozilla Corporation | Vahlis Y.,and curity Research Center | Yung M.,Columbia University
Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics) | Year: 2012

Understanding and modeling leakage in the context of cryptographic systems (connecting physical protection of keys and cryptographic operation) is an emerging area with many missing issues and hard to understand aspects. In this work we initiate the study of leakage out of cryptographic devices when the operation is inherently replicated in multiple locations. This setting (allowing the adversary access to leakage at different locations) arises naturally in cases like protocols, where different parties activate the same cryptographic function, or in the case of a global service providers (like cloud operators) which need to replicate the cryptographic function to allow for accessible and responsive services. We specifically deal with the theoretical setting of "leakage resilient cryptography," (modeling leakage as a bound associated with algorithmic steps), and in the most general model of continual leakage on memory, randomness (and thus computation) with periods of operation and refresh of private keys between them. We first investigate public-key cryptography, and construct a multi-location leakage resilient signature scheme (with unbounded number of locations) with optimal (i.e., total n (1 - o(1)) leakage) in a period, and O(log n) leakage during updates (n is the key size). The new crucial issue behind our scheme is how to maintain leakage at each location at the level of key leakage in the single location variant, even under parallel adaptive leakage at the different locations. We then construct a shared-symmetric-key authenticated session protocol that is resilient to leakage on both the sender and the receiver, and tolerates O(log n) bits of leakage per computation. We construct and utilize a single-location pseudorandom generator which is the first to tolerate continual leakage with only an efficient pseudorandom function as a primitive component. This protocol highlights the importance of protocol level "per message synchronization" against leakage adversaries. Interestingly, the construction is secure in spite of the entire randomness used in the refresh processes being publicly available. © 2012 International Association for Cryptologic Research.

Giura P.,and curity Research Center | Murynets I.,and curity Research Center | Jover R.P.,and curity Research Center | Vahlis Y.,Bionym Inc.
CODASPY 2014 - Proceedings of the 4th ACM Conference on Data and Application Security and Privacy | Year: 2014

The increased popularity of mobile devices widens opportunities for a user either to lose the device or to have the device stolen and compromised. At the same time, user interaction with a mobile device generates a unique set of features such as dialed numbers, timestamps of communication activities, contacted base stations, etc. This work proposes several methods to identify the user based on her communications history. Specifically, the proposed methods detect an abnormality based on the behavior fingerprint generated by a set of features from the network for each user session. We present an implementation of such methods that use features from real SMS, and voice call records from a major tier 1 cellular operator. This can potentially trigger a rapid reaction upon an unauthorized user gaining control of a lost or stolen terminal, preventing data compromise and device misuse. The proposed solution can also detect background malicious traffic originated by, for example, a malicious application running on the mobile device. Our experiments with annonymized data from 10,000 users, representing over 14 million SMS and voice call detail records, show that the proposed methods are scalable and can continuously identify millions of mobile users while preserving data privacy, and achieving low false positives and high misuse detection rates with low storage and computation overhead. Copyright 2014 ACM.

Loading and curity Research Center collaborators
Loading and curity Research Center collaborators