Software Security

CompSci 725 S2C 09
Clark Thomborson
Handout 3: Suggestions for Oral Reports

Version 1.11, 29 July 2009

1.      Detection and Response (DR)

[DR Ba08] Y. Bai, X. Sun, G. Sun, X. Deng, X. Zhou, “Dynamic k-gram based software birthmark”, in 19th Australian Conference on Software Engineering (ASWEC 2008), pp. 644-649, 2008.  DOI: 10.1109/ASWEC.2008.4483257.  Abstract.

[DR Fr08] G. Frantzeskou, S. MacDonell, E. Stamatatos, S. Gritzalis, “Examining the significance of high-level programming features in source code author classification”, in Journal of Systems and Software 81:3, pp. 447-460, 2008.  DOI: 10.1016/j.jss.2007.03.004.  Abstract.

[DR Ka05] M.E. Karim, A. Walenstein, A. Lakhotia, L. Parida, “Malware phylogeny generation using permutations of code”, in Journal in Computer Virology 1:1-2, pp. 13-23, 2005.  DOI: 10.1007/s11416-005-0002-9.  Abstract.

[DR Zh08] J. Zhang, P. Porras, J. Ullrich, “Highly predictive blacklisting”, in USENIX Security Symposium, pp. 107-122, 2008.  Abstract.

2.      Privacy (Pr)

[Pr Be05] C. Bettini, X.S. Wang, S. Jajodia, “Protecting privacy against location-based personal identification”, in Secure Data Management (SDM 2005), pp. 185-199, 2005.  DOI: 10.1007/11552338_13.  Abstract.

[Pr Bu04] M. Burmester, Y. Desmedt, R. Wright, A. Yasinsac, “Accountable privacy”, in Security Protocols Workshop, LNCS 3957, pp. 83-95, 2004.  DOI: 10.1007/11861386_10.  Abstract.

[Pr Li06] K. Liu, C. Giannella, H. Kargupta, “An attacker’s view of distance preserving maps for privacy preserving data mining”, in Knowledge Discovery for Databases (PKDD 2006), LNCS 4213, pp. 297-308, 2006.  DOI: 10.1007/11871637_30.  Abstract.

[Pr Si09] L. Siksnys, J. Thomsen, S. Saltenis, M. Yiu, O. Andersen, “A location privacy aware friend locator”, to appear in Advances in Spatial and Temporal Databases (SSTD 2009), LNCS 5644, 2009.  Available: http://www.cs.aau.dk/~mly/SSTD09_friendloc.pdf, 20 July 2009.  Abstract.

3.      Trustworthy Systems (TS)

[TS Bi08] A. Birgisson, M. Dhawan, Ϊ. Erlingsson, V. Ganapathy, L. Iftode, “Enforcing authorization policies using transaction memory introspection”, in Proc. 15th ACM Conference on Computer and Communications Security (CCS ’08), pp. 223-234, 2008.  DOI: 10.1145/1455770.1455800.  Abstract.

[TS Mi00] M. Miller, C. Morningstar, B. Frantz, “Capability-based financial instruments”, in Financial Cryptography, LNCS 1962, pp. 349-378, 2000.  Abstract.

[TS Ra08] M. Radhakrishnan, J. Solworth, “NetAuth: Supporting user-based network services”, in USENIX Security Symposium, pp. 227-242, 2008.  Abstract.

[TS Sc09] S. Schulz, A.-R. Sadeghi, “Secure VPNs for trusted computing environments”, in Trusted Computing, LNCS 571, pp. 197-216, 2009.  DOI: 10.1007/978-3-642-00587-9. Abstract .

[TS Wa08] Q. Wang, N. Li, H. Chen, “On the security of delegation in access control systems”, in 13th European Symposium on Research in Computer Security (ESORICS 2008), LNCS 5283, pp. 317-332, 2008.  DOI: 10.1007/978-3-540-88313-5_21.  Abstract.

[TS We05] R. Weaver, G. Despotou, T. Kelly, J. McDermid, “Combining software evidence: arguments and assurance”, SIGSOFT Software Engineering Notes 30:4, pp. 1-7, 2005.  DOI: 10.1145/1082983.108318.  Abstract.

4.      Vulnerabilities and Attacks (VA)

[VA Ba08] A. Barth, C. Jackson, J. Mitchell, “Robust defences for cross-site request, in Proc. 15th ACM Conference on Computer and Communications Security (CCS ’08), pp. 75-88, 2008.  DOI: 10.1145/1455770.1455782.  Abstract.

[VA An98] R.J. Anderson, F.A.P. Petitcolas, “On the limits of steganography”, IEEE Journal on Selected Areas in Communication 16:4, pp. 474-481, May 1998.  DOI: 10.1109/49.668971.  Abstract.

[VA Du08] L. Duflot, “CPU bugs, CPU backdoors and consequences on security”, in 13th European Symposium on Research in Computer Security (ESORICS 2008), LNCS 5283, pp. 580-599, 2008.  DOI: 10.1007/978-3-540-88313-5_37.  Abstract.

[VA Ga08] F. Garcia, G. de Koning Gans, R. Muijrers, P. van Rossum, R. Verdult, R. Schreur, B. Jacobs, “Dismantling MIFARE Classic”, in 13th European Symposium on Research in Computer Security (ESORICS 2008), LNCS 5283, pp. 97-114, 2008.  DOI: 10.1007/978-3-540-88313-5_7.  Abstract.

[VA Je09] M. Jelasity, V. Bilicky, “Towards automated detection of peer-to-peer botnets: On the limits of local approaches”, in 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ’09), 2009. Abstract.

[VA Kr09] C. Kreibach, C. Kanich, K. Levchenko, B. Enright, G. Voelker, V. Paxon, S. Savage, “Spamcraft: An inside look at spam campaign orchestration

”, in 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ’09), 2009. Abstract.

[VA Pa09] M. Polychronakis, K. Anagnostakis, E. Markatos, “An empirical study of real-world polymorphic code injection attacks”, in 2nd USENIX Workshop on Large-Scale Exploits and Emergent Threats (LEET ’09), 2009. Abstract.

[VA Ta08] G. Tan, J. Croft, “An empirical study of the native code in the JDK”, in USENIX Security Symposium, pp. 365-378, 2008.  Abstract.