Poster

file

Visible to the public Accelerating Block Propogation in PoW Blockchain Networks with Pipelining and Chunking (PiChu)

Blockchain is an open, verifiable, and distributed consensus of transactions among different parties, relying on P2P technology for connectivity between nodes. However, the long time of block propagation limits inceptions of another consensus. We propose a novel method that accelerates block propagation in PoW blockchain networks by pipelining message transaction and verifications in parallel over a network with chunks of a block (PiChu). We have conducted extensive evaluations to present the significance of the network pipelining with many parallel chunk connections.

file

Visible to the public Vulnerability Trends in Web Servers and Browsers

In previous work we have looked at trends in vulnerabilities due to ordinary programming errors. This analysis focuses on two of the most widely used types of software in today's internet, web browsers and web servers. In addition to reports of vulnerabilities, we were able to consider market share and approximate numbers of each server or browser in use, and thus able to infer some information about the impact of vulnerabilities. The key questions we sought to address are:

file

Visible to the public How to Swap Instructions Midstream: An Embedding Algorithm for Program Steganography

In this work, we propose an encoding/decoding algorithm for pro-gram executable steganography. Some salient features of our ap-proach is that unlike previous work it does not require the intro-duction of new instructions, which may be detectable. Furthermore, our scheme does not require storing the locations of where changes in the program executable are made.

Ryan Gabrys is a scientist at the Naval Information Warfare Center Pacific. His research interests include theoretical computers science with applications to cyber security and information storage.

file

Visible to the public Improving Architectures for Automating Network Security Using Specification-Based Protocols

The proliferation of the Internet of Things continues to be a critical issue today. The current landscape provides security with mini-mal oversight and is furthermore inadequate due to unaccounted human behavior in the design flow and management of personal networks. As a result, these inherently insecure devices exponen-tially increase the attack surface of our critical infrastructure. This research leverages a specification-based protocol called Manufac-turer Usage Description or MUD that is designed to automate access control at the "edge" of the network where IoT devices reside.

file

Visible to the public Approaches to Ethical Hacking: Expanding Conceptual Frameworks for Research

The ever-changing digital landscape remains more vulnerable than ever. Cybersecurity has become increasingly important to the suc-cess of the global, digital economy and its stakeholders. With in-creasing use of models such as cloud computing, mobile computing and IoT systems, understanding how tools and methodologies for security testing have evolved is an important task[1]. In particu-lar, more sophisticated approaches to vulnerability assessment are necessary to address more complex, integrated systems.

file

Visible to the public Time Series Anomaly Detection in Medical Break The Glass

The high availability (fail-open) requirement and real-time nature of the communication in distributed medical systems makes it hard to limit clinicians access to bare minimum permissions that are essential to perform life-saving activities in an emergency access (Break the Glass) session. After a BTG session is ended, healthcare facilities perform post-hoc audit to determine the reasons (legiti-macy) for overriding access control. Unfortunately, this does not proactively protect against misuse, but provides for identification and punishment of a culprit.

file

Visible to the public An Infrastructure for Faithful Execution of Remote Attestation Protocols

Experience shows that even with a well-intentioned user at the keyboard, a motivated attacker can compromise a computer system at a layer below or adjacent to the shallow forms of authentica-tion that are now accepted as commonplace[3]. Therefore, rather than asking "Can we trust the person behind the keyboard", a still better question might be: "Can we trust the computer system un-derneath?". An emerging technology for gaining trust in a remote computing system is remote attestation.