Search CSRC

Journal: IEEE Reliability Society 2010 Annual Technical Report Abstract: Every computer user is familiar with software bugs. Many seem to appear almost randomly, suggesting that the conditions triggering them must be complex, and some famous software bugs have been traced to highly unusual combinations of conditions. For example, the 1997 Mars Pathfinder mission began ex...

Conference: 2010 Electronic Voting Technology Workshop/ Workshop on Trustworthy Elections (EVT/WOTE '10) Abstract: The term "end-to-end verifiability" has been used over the past several years to describe multiple voting system proposals. The term has, however, never been formally defined. As a result, its meaning tends to change from voting system to voting system. We propose a definition for end-to-end verifia...

Conference: IFIP WG 11.3 International Conference on Digital Forensics Abstract: Cloud computing provides benefits such as increased flexibility, scalability and cost savings to enterprises. However, it introduces several challenges to digital forensic investigations. Current forensic analysis frameworks and tools are largely intended for off-line investigations and it is assume...

Conference: Seventh International Conference on Software Security and Reliability (SERE 2013) Abstract: Assessing security of software services on Cloud is complex because the security depends on the vulnerability of infrastructure, platform and the software services. In many systems, the platform or the infrastructure on which the software will actually run may not be known or guaranteed. This implie...

Conference: 2009 WRI World Congress on Computer Science and Information Engineering Abstract: While mobile handheld devices, such as cell phones and PDAs, provide productivity benefits, they also pose new risks. A vital safeguard against unauthorized access to a device s contents is authentication. This paper describes a location-based authentication mechanism that employs trusted servers ca...

Conference: 2012 17th IEEE International Conference on Engineering of Complex Computer Systems (ICECCS 2012) Abstract: Combinatorial testing has been shown to be a very effective testing strategy. Most work on combinatorial testing focuses on t-way test data generation, where each test is an unordered set of parameter values. In this paper, we study the problem of t-way test sequence generation, where each test is a...

Abstract:

The NCCoE has posted two draft Project Descriptions for public comment. Detecting and protecting against data integrity attacks in industrial control systems (ICS) closes July 25th. Continuous Monitoring (for small and medium businesses) is closes on July 26th.

Conference: NDSS Symposium 2020 Abstract: In the era of the Internet of Things, botnet threats are rising, which has prompted many studies on botnet detection. This study aims to detect the early signs of botnet attacks such as massive spam emails and Distributed Denial-of-Service attacks. To that end, this study develops a practical method...

Conference: 11th National Computer Security Conference Abstract: This paper describes a suite of tools used in evaluating software for security certification. The tools are currently being used on software for secure Electronic Funds Transfer, but could be applied to other applications as well.

Abstract: New techniques for reducing the depth of circuits for cryptographic applications are described and applied to the AES S-box. These techniques also keep the number of gates quite small. The result, when applied to the AES S-box, is a circuit with depth 16 and only 128 gates. For the inverse, it is al...

Conference: 2021 IEEE International Conference on Software Testing, Verification and Validation Workshops (ICSTW) Abstract: This short paper defines a combinatorial coverage metric for comparing machine learning (ML) data sets and proposes the differences between data sets as a function of combinatorial coverage. The paper illustrates its utility for evaluating and predicting performance of ML models. Identifying and mea...

Conference: Seventh International Conference on Digital Society (ICDS 2013) Abstract: Virtualized hosts provide abstraction of the hardware resources (i.e., CPU, Memory etc) enabling multiple computing stacks to be run on a single physical machine. The Hypervisor is the core software that enables this virtualization and hence must be configured to ensure security robustness for the e...

Abstract: Many people telework (also known as telecommuting), which is the ability for an organization s employees and contractors to perform work from locations other than the organization s facilities. Teleworkers use various client devices, such as desktop and laptop computers, cell phones, and personal di...

Journal: Cryptography and Communication Abstract: A necessary condition for the security of cryptographic functions is to be “sufficiently distant” from linear, and cryptographers have proposed several measures for this distance. In this paper, we show that six common measures, nonlinearity, algebraic degree, annihilator immunity, algebraic thickne...

Conference: 4th ACM Workshop on Quality of Protection (QoP'08) Abstract: The best-known vulnerability scoring standard, the Common Vulnerability Scoring System (CVSS), is designed to quantify the severity of security-related software flaw vulnerabilities. This paper describes our efforts to determine if CVSS could be adapted for use with a different type of vulnerability...

Abstract: Organizations are concerned about the risks associated with products and services that may potentially contain malicious functionality, are counterfeit, or are vulnerable due to poor manufacturing and development practices within the supply chain. These risks are associated with an enterprise’s decr...

Journal: Cryptography and Communications Abstract: We present techniques to obtain small circuits which also have low depth. The techniques apply to typical cryptographic functions, as these are often specified over the field G F(2), and they produce circuits containing only AND, XOR and XNOR gates. The emphasis is on the linear components...

Journal: Computer (IEEE Computer) Abstract: A panel of seven experts discusses the state of the practice of formal methods (FM) in software development, with a focus on FM's relevance to security. In a 1996 article, formal methods (FM) advocate Tony Hoare asked, "How Did Software Get So Reliable without Proof?"1 Twenty years later, in the sa...

In: Identity & Policy: a Common Platform for a Pervasive Policy Paradigm Abstract: In this chapter, we describe an authorization policy validation framework. Authorization (or access control) policies, just like device policies and privacy policies, are an important class of policies for safeguarding enterprise resources. Specifically, authorization policies provide confidentialit...

Abstract: This document is the Cybersecurity Framework Profile (Profile) developed for the Electric Vehicle Extreme Fast Charging (EV/XFC) ecosystem and the subsidiary functions that support each of the four domains: (i) Electric Vehicles (EV); (ii) Extreme Fast Charging (XFC); (iii) XFC Cloud or Third-Party...

Journal: ACM Journal on Emerging Technologies in Computing Systems (JETC) Abstract: With the rise of Internet of Things (IoT), devices such as smartphones, embedded medical devices, smart home appliances, as well as traditional computing platforms such as personal computers and servers have been increasingly targeted with a variety of cyber attacks. Due to limited hardware resource...

Conference: IEEE Sarnoff Symposium, 2009 (SARNOFF '09) Abstract: In current networks that use EAP and AAA for authenticated admission control, such as WiFi, WiMAX, and various 3G internetworking protocols, a malicious base station can advertise false information to prospective users in an effort to manipulate network access in some way. This can result a number o...

Journal: Computer (IEEE Computer) Abstract: As big data, cloud computing, grid computing, and the Internet of Things reshape current data systems and practices, IT experts are keen to harness the power of distributed systems to boost security and prevent fraud. How can these systems’ capabilities be used to improve processing without inflatin...

Conference: IEEE International Conference on Software Testing Verification and Validation Workshop (ICSTW 20232) Abstract: Fault detection often depends on the specific order of inputs that establish states which eventually lead to a failure. However, beyond basic structural coverage metrics, it is often difficult to determine if the code has been exercised sufficiently to ensure confidence in its functions. Measures ar...