Side-channel attacks have recently progressed into software-induced attacks.In particular,a rowhammer attack,which exploits the characteristics of dynamic random access memory(DRAM),can quickly and continuously access...Side-channel attacks have recently progressed into software-induced attacks.In particular,a rowhammer attack,which exploits the characteristics of dynamic random access memory(DRAM),can quickly and continuously access the cells as the cell density of DRAM increases,thereby generating a disturbance error affecting the neighboring cells,resulting in bit flips.Although a rowhammer attack is a highly sophisticated attack in which disturbance errors are deliberately generated into data bits,it has been reported that it can be exploited on various platforms such as mobile devices,web browsers,and virtual machines.Furthermore,there have been studies on bypassing the defense measures of DRAM manufacturers and the like to respond to rowhammer attacks.A rowhammer attack can control user access and compromise the integrity of sensitive data with attacks such as a privilege escalation and an alteration of the encryption keys.In an attempt to mitigate a rowhammer attack,various hardware-and software-based mitigation techniques are being studied,but there are limitations in that the research methods do not detect the rowhammer attack in advance,causing overhead or degradation of the system performance.Therefore,in this study,a rowhammer attack detection technique is proposed by extracting common features of rowhammer attack files through a static analysis of rowhammer attack codes.展开更多
计算机网络缓存侧信道能够间接体现计算机内部状态以及数据传输情况,其受攻击时,用户端信息数据存在泄露风险,因此提出一种基于马尔科夫的计算机网络缓存侧信道攻击检测方法。构建隐马尔科夫模型,对计算机网络缓存侧信道状态改变的概率...计算机网络缓存侧信道能够间接体现计算机内部状态以及数据传输情况,其受攻击时,用户端信息数据存在泄露风险,因此提出一种基于马尔科夫的计算机网络缓存侧信道攻击检测方法。构建隐马尔科夫模型,对计算机网络缓存侧信道状态改变的概率进行计算。通过Baum‐Welch算法估计隐马尔科夫模型最优参数,并计算缓存侧信道状态观测序列输出概率。比较缓存侧信道观测序列输出概率与设定的阈值,判断该序列为计算机网络缓存侧信道攻击信号的可能性,并引入平均信息熵判断计算机缓存侧信道状态是否存在异常,完成计算机网络缓存侧信道攻击检测。通过实验验证得出,该方法用于计算机网络缓存侧信道攻击检测的准确率高,误报率低,在遭受DDoS攻击(Distributed denial of service)时的检测时间较短,对计算机网络缓存侧信道攻击的防御与保护产生了积极影响。展开更多
随着网络的发展,传输控制协议/网际协议(Transmission Control Protocol/Internet Protocol,TCP/IP)架构已经不能适应现实的通信需求,存在诸多弊端。命名数据网络(Named Data Network,NDN)在内容分发、移动性支持以及内生安全等方面具...随着网络的发展,传输控制协议/网际协议(Transmission Control Protocol/Internet Protocol,TCP/IP)架构已经不能适应现实的通信需求,存在诸多弊端。命名数据网络(Named Data Network,NDN)在内容分发、移动性支持以及内生安全等方面具有独特优势,成为未来网络架构方案中极具代表性的一种。NDN网络避免了IP架构中的一系列问题,但也带来了新的安全隐患,如兴趣包泛洪攻击、缓存污染攻击等。针对主流攻击方式的特点,从攻击检测角度出发,剖析现有方案,总结不同检测方案采用的策略类型及其各自的优缺点,并展望其发展前景。展开更多
基金supported by a National Research Foundation of Korea(NRF)Grant funded by the Korean government(MSIT)(No.NRF-2017R1E1A1A01075110).
文摘Side-channel attacks have recently progressed into software-induced attacks.In particular,a rowhammer attack,which exploits the characteristics of dynamic random access memory(DRAM),can quickly and continuously access the cells as the cell density of DRAM increases,thereby generating a disturbance error affecting the neighboring cells,resulting in bit flips.Although a rowhammer attack is a highly sophisticated attack in which disturbance errors are deliberately generated into data bits,it has been reported that it can be exploited on various platforms such as mobile devices,web browsers,and virtual machines.Furthermore,there have been studies on bypassing the defense measures of DRAM manufacturers and the like to respond to rowhammer attacks.A rowhammer attack can control user access and compromise the integrity of sensitive data with attacks such as a privilege escalation and an alteration of the encryption keys.In an attempt to mitigate a rowhammer attack,various hardware-and software-based mitigation techniques are being studied,but there are limitations in that the research methods do not detect the rowhammer attack in advance,causing overhead or degradation of the system performance.Therefore,in this study,a rowhammer attack detection technique is proposed by extracting common features of rowhammer attack files through a static analysis of rowhammer attack codes.
文摘计算机网络缓存侧信道能够间接体现计算机内部状态以及数据传输情况,其受攻击时,用户端信息数据存在泄露风险,因此提出一种基于马尔科夫的计算机网络缓存侧信道攻击检测方法。构建隐马尔科夫模型,对计算机网络缓存侧信道状态改变的概率进行计算。通过Baum‐Welch算法估计隐马尔科夫模型最优参数,并计算缓存侧信道状态观测序列输出概率。比较缓存侧信道观测序列输出概率与设定的阈值,判断该序列为计算机网络缓存侧信道攻击信号的可能性,并引入平均信息熵判断计算机缓存侧信道状态是否存在异常,完成计算机网络缓存侧信道攻击检测。通过实验验证得出,该方法用于计算机网络缓存侧信道攻击检测的准确率高,误报率低,在遭受DDoS攻击(Distributed denial of service)时的检测时间较短,对计算机网络缓存侧信道攻击的防御与保护产生了积极影响。
文摘随着网络的发展,传输控制协议/网际协议(Transmission Control Protocol/Internet Protocol,TCP/IP)架构已经不能适应现实的通信需求,存在诸多弊端。命名数据网络(Named Data Network,NDN)在内容分发、移动性支持以及内生安全等方面具有独特优势,成为未来网络架构方案中极具代表性的一种。NDN网络避免了IP架构中的一系列问题,但也带来了新的安全隐患,如兴趣包泛洪攻击、缓存污染攻击等。针对主流攻击方式的特点,从攻击检测角度出发,剖析现有方案,总结不同检测方案采用的策略类型及其各自的优缺点,并展望其发展前景。
