NDLI: After we knew it: empirical study and modeling of cost-effectiveness of exploiting prevalent known vulnerabilities across IaaS cloud

Please wait, while we are loading the content...

Fighting malicious code: an eternal struggle

Letting the puss in boots sweat: detecting fake access points using dependency of clock skews on temperature

$Re^{3}:$ relay reliability reputation for anonymity systems

Maple: scalable multi-dimensional range search over encrypted cloud data with tree-based index

On the effectiveness of risk prediction based on users browsing behavior

Modelling after-the-fact leakage for key exchange

Efficient, context-aware privacy leakage confinement for android applications without firmware modding

On the feasibility of software attacks on commodity virtual machine monitors via direct device assignment

The harvester, the botmaster, and the spammer: on the relations between the different actors in the spam landscape

Practical user authentication leveraging channel state information (CSI)

Evading android runtime analysis via sandbox detection

How many down?: toward understanding systematic risk in networks

Cyber defenses for physical attacks and insider threats in cloud computing

Covert ephemeral communication in named data networking

Design and evaluation of persea, a sybil-resistant DHT

Privacy of outsourced k-means clustering

Protecting users against XSS-based password manager abuse

Practical secret key agreement for full-duplex near field communications

Malware detection with quantitative data flow graphs

After we knew it: empirical study and modeling of cost-effectiveness of exploiting prevalent known vulnerabilities across IaaS cloud

pTwitterRec: a privacy-preserving personalized tweet recommendation framework

Outsourceable two-party privacy-preserving biometric authentication

VirtualSwindle: an automated attack against in-app billing on android

Prover anonymous and deniable distance-bounding authentication

Monkey-in-the-browser: malware and vulnerabilities in augmented browsing script markets

Scanner hunter: understanding HTTP scanning traffic

OTIT: towards secure provenance modeling for location proofs

PIDGIN: privacy-preserving interest and content sharing in opportunistic networks

A three-way investigation of a game-CAPTCHA: automated attacks, relay attacks and usability

Multi-recipient encryption, revisited

Abstract model counting: a novel approach for quantification of information leaks

Prospect: peripheral proxying supported embedded code testing

Shades of gray: a closer look at emails in the gray area

Understanding OSN-based facial disclosure against face authentication systems

DroidRay: a security evaluation system for customized android firmwares

Why eve and mallory (also) love webmasters: a study on the root causes of SSL misconfigurations

IntentFuzzer: detecting capability leaks of android applications

Detection of stealthy malware activities with traffic causality and scalable triggering relation discovery

Privacy-preserving distance computation and proximity testing on earth, done right

S-ORAM: a segmentation-based oblivious RAM

Fully secure key-policy attribute-based encryption with constant-size ciphertexts and fast decryption

ConXsense: automated context classification for context-aware access control

Scanning of real-world web applications for parameter tampering vulnerabilities

Tracing and revoking leaked credentials: accountability in leaking sensitive outsourced data

APKLancet: tumor payload diagnosis and purification for android applications

YourPassword: applying feedback loops to improve security behavior of managing multiple passwords

Remotely wiping sensitive data on stolen smartphones

Towards automated protocol reverse engineering using semantic information

Differential privacy with δ-neighbourhood for spatial and dynamic datasets

Improved anonymous proxy re-encryption with CCA security

Sufficient conditions for vertical composition of security protocols

After we knew it: empirical study and modeling of cost-effectiveness of exploiting prevalent known vulnerabilities across IaaS cloud

Content Provider	ACM Digital Library
Author	Ou, Xinming Zhang, Xinwen Zhang, Su
Abstract	Infrastructure as a Service (IaaS) cloud has been attracting more and more customers as it provides the highest level of flexibility by offering configurable virtual machines (VMs) and computing infrastructures. Public VM images are usually available for customers to customize and launch. However, the 1 to N mapping between VM images and running instances in IaaS makes vulnerabilities propagate rapidly across the entire public cloud. Besides, IaaS cloud naturally comes with a larger and more stable attack surface and more concentrated target resources than traditional surroundings. In this paper, we first identify the threat of exploiting prevalent vulnerabilities over public IaaS cloud with an empirical study in Amazon EC2. We find that attackers can compromise a considerable number of VMs with trivial cost. We then do a qualitative cost-effectiveness analysis of this threat. Our main result is a two-fold observation: in IaaS cloud, exploiting prevalent vulnerabilities is much more cost-effective than traditional in-house computing environment, therefore attackers have stronger incentive; Fortunately, on the other hand, cloud defenders (cloud providers and customers) also have much lower cost-loss ratio than in traditional environment, therefore they can be more effective for defending attacks. We then build a game-theoretic model and conduct a risk-gain analysis to compare exploiting and patching strategies under cloud and traditional computing environments. Our modeling indicates that under cloud environment, both attack and defense become less cost-effective as time goes by, and the earlier actioner can be more rewarding. We propose countermeasures against such threat in order to bridge the gap between current security situation and defending mechanisms. To our best knowledge, we are the first to analyze and model the threat with prevalent known-vulnerabilities in public cloud.
Starting Page	317
Ending Page	328
Page Count	12
File Format	PDF
ISBN	9781450328005
DOI	10.1145/2590296.2590300
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	2014-06-04
Publisher Place	New York
Access Restriction	Subscribed
Subject Keyword	Cloud computing Virtual machine images Vulnerability management Game theory Patching management
Content Type	Text
Resource Type	Article

Central Library (ISO-9001:2015 Certified)
Indian Institute of Technology Kharagpur
Kharagpur, West Bengal, India | PIN - 721302

See location in the Map
03222 282435
Mail: support@ndl.gov.in

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in