| 1. |
- Afzal, Zeeshan, 1991-, et al.
(författare)
-
Slice Distance : An Insert-Only Levenshtein Distance with a Focus on Security Applications
- 2018
-
Ingår i: Proceedings of NTMS 2018 Conference and Workshop. - New York : IEEE. - 9781538636626 - 9781538636633 ; , s. 1-5
-
Konferensbidrag (refereegranskat)abstract
- Levenshtein distance is well known for its use in comparing two strings for similarity. However, the set of considered edit operations used when comparing can be reduced in a number of situations. In such cases, the application of the generic Levenshtein distance can result in degraded detection and computational performance. Other metrics in the literature enable limiting the considered edit operations to a smaller subset. However, the possibility where a difference can only result from deleted bytes is not yet explored. To this end, we propose an insert-only variation of the Levenshtein distance to enable comparison of two strings for the case in which differences occur only because of missing bytes. The proposed distance metric is named slice distance and is formally presented and its computational complexity is discussed. We also provide a discussion of the potential security applications of the slice distance.
|
|
| 2. |
- Asplund, Mikael, 1981-, et al.
(författare)
-
In-store payments using Bitcoin
- 2018
-
Ingår i: 9th IFIP International Conference on New Technologies, Mobility and Security (NTMS). - : IEEE. - 9781538636626 - 9781538636633
-
Konferensbidrag (refereegranskat)abstract
- The possibility of in-store payments would further increase the potential usefulness of cryptocurrencies. However, this would require much faster transaction verification than current solutions provide (one hour for Bitcoin) since customers are likely not prepared to wait a very long time for their purchase to be accepted by a store. We propose a solution for enabling in-store payments with waiting times in the order of a few seconds, which is still compatible with the current Bitcoin protocol. The idea is based on a payment card in combination with a protocol for ensuring that losing a card does not mean losing the money on it. We analyse the required transaction verification delay and also the potentially added risks that the solution brings compared to current systems.
|
|
| 3. |
- Garcia, Johan, 1970-
(författare)
-
A Fragment Hashing Approach for Scalable and Cloud-Aware Network File Detection
- 2018
-
Ingår i: Proceedings of NTMS 2018 Conference and Workshop. - New York : IEEE. - 9781538636626 - 9781538636633 ; , s. 1-5
-
Konferensbidrag (refereegranskat)abstract
- Monitoring networks for the presence of some particular set of files can, for example, be important in order to avoid exfiltration of sensitive data, or combat the spread of Child Sexual Abuse (CSA) material. This work presents a scalable system for large-scale file detection in high-speed networks. A multi-level approach using packet sampling with rolling and block hashing is introduced. We show that such approach together with a well tuned implementation can perform detection of a large number of files on the network at 10 Gbps using standard hardware. The use of packet sampling enables easy distribution of the monitoring processing functionality, and allows for flexible scaling in a cloud environment. Performance experiments on the most run-time critical hashing parts shows a single-thread performance consistent with 10Gbps line rate monitoring. The file detectability is examined for three data sets over a range of packet sampling rates. A conservative sampling rate of 0.1 is demonstrated to perform well for all tested data sets. It is also shown that knowledge of the file size distribution can be exploited to allow lower sampling rates to be configured for two of the data sets, which in turn results in lower resource usage.
|
|
| 4. |
- Garcia, Johan, 1970-
(författare)
-
Duplications and Misattributions of File Fragment Hashes in Image and Compressed Files
- 2018
-
Ingår i: Proceedings of NTMS 2018 Conference and Workshop. - New York : IEEE. - 9781538636626 - 9781538636633 ; , s. 1-5
-
Konferensbidrag (refereegranskat)abstract
- Hashing is used in a wide variety of security contexts. Hashes of parts of files, fragment hashes, can be used to detect remains of deleted files in cluster slack, to detect illicit files being sent over a network, to perform approximate file matching, or to quickly scan large storage devices using sector sampling. In this work we examine the fragment hash uniqueness and hash duplication characteristics of five different data sets with a focus on JPEG images and compressed file archives. We consider both block and rolling hashes and evaluate sizes of the hashed fragments ranging from 16 to 4096 bytes. During an initial hash generation phase hash metadata is created for each data set, which in total becomes several several billion hashes. During the scan phase each other data set is scanned and hashes checked for potential matches in the hash metadata. Three aspects of fragment hashes are examined: 1) the rate of duplicate hashes within each data set, 2) the rate of hash misattribution where a fragment hash from the scanned data set matches a fragment in the hash metadata although the actual file is not present in the scan set, 3) to what extent it is possible to detect fragments from files in a hashed set when those files have been compressed and embedded in a zip archive. The results obtained are useful as input to dimensioning and evaluation procedures for several application areas of fragment hashing.
|
|
