December 3-7, 2018 | The CondadoPlaza Hilton | San Juan, Puerto … · December 3-7, 2018 | The...

December 3-7, 2018 | The Condado Plaza Hilton | San Juan, Puerto Rico, USA

ACSAC 34

Welcome to ACSAC 34 !!

https://www.acsac.org/2018/proceedings



ACSAC 34

Welcome to The Condado Plaza Hilton !!

http://www.condadoplaza.com/, https://www.booking.com/hotel/pr/plaza-de-armas-san-juan.html


ACSAC 34

David Balenson, Conference ChairAdministrative Announcements

Juan Caballero, Program Co-ChairTechnical Program and Distinguished Paper Awards

Mary Ellen Zurko, ACSA SWSIS Scholarship Presentations

Michelle Dennedy, Distinguished Practitioner KeynoteWhy Privacy Engineering Matters Now


ACSAC 34

Maslow’s Hierarchy of Needs

Esteem

Belonging

Safety

Physiological

Self-actualization


ACSAC 34

Maslow’s Hierarchy of Needs

Esteem

Belonging

Safety

Physiological

Esteem

Belonging

Safety

Physiological

Wi-Fi

Self-actualization

L


ACSAC 34

Wi-Fi Access

• The hotel provides Wi-Fi access from the meeting rooms:

SSID: HILTON MEETING ROOMS ONLYPassword: ACSAC2018

• There is a limited number of connections, so please restrict

your Wi-Fi access in the meeting rooms to one device at a

time (e.g., laptop, tablet, or smartphone).


ACSAC 34

Program At-a-Glance (Wednesday)• Breakfast• Welcome• Distinguished Practitioner Keynote• Break• Multi-track Sessions• Lunch• Multi-track Sessions• Break• Multi-track Sessions• Conference Dinner w/ Entertainment


ACSAC 34

Program At-a-Glance (Thursday)• Breakfast• Keynote• Break• Multi-track Sessions• Lunch• Multi-track Sessions• Break• Multi-track Sessions• Works-in-Progress• Poster Reception with Light Refreshments


ACSAC 34

Program At-a-Glance (Friday)• Breakfast

• Multi-track Sessions• Break

• Multi-track Sessions• Closing with Prize Giveaway

• Optional Social Events– Arecibo Observatory (Radio Telescope) ß SPACES STILL AVAILABLE– Bioluminescent Bay ß PLEASE SEE JEREMY EPSTEIN ASAP


ACSAC 34

National Interest Track• Panel: Blockchain Security and Applications: Promises and Pitfalls• Panel: Summary of ACSAC 2018 Workshops• NITRD Panel: ML/AI and Cybersecurity• Panel: Technical Perspectives on Election 2018• Case Studies:

– Creating Failure Scenarios for Natural Gas Critical Infrastructure,– Model-based Secure Design Method to Address Business Logic Vulnerabilities in E-

commerce Applications– Password Sequence (PSQ) - A Novel Approach for Implementing Long Passwords– Encrypting Configuration Sections in ASP.NET 4.5 Using DPAPI

• NITRD Panel: Needs and Research Objectives in Deidentification


ACSAC 34

Wed Evening Conference Dinner• Outside overlooking the ocean

• Features a live Caribbean dance performance at 8:30pmDON’T LEAVE EARLY!!

• Reminders:– Tell the waiter if you have

dietary restrictions

– Look for signs by the food for ingredients

– Bring your drink tickets!

http://www.moonlightcaribbean.com/artists.php?artists=folkloricballet


ACSAC 34

Arecibo Observatory• Still spaces available!• SIGN UP AT REGISTRATION DESK

BY 12:00 NOON ON THURSDAY• Cost: $85

– Bus to/from the observatory– Box lunch– Admission to the Visitor’s Center

• Features a self-guided tour with exhibits, a movie, a talk from a tour guide, and viewing of the telescope from the observation deck

• Special discussion with the Head of the IT Department• BUSES LEAVE THE HOTEL AT 12:30PM – DON”T BE LATE!!

http://www.naic.edu/ao/sites/default/files/ao014.jpg


ACSAC 34

Conference Sessions (Lobby Level)

999 Ashford Avenue | San Juan, Puerto Rico | 00907 | T: +1 787 721 1000 | F: +1 787 722 7955 | condadoplaza.com

FLOOR PLAN

SKY BRIDGE

TOLAGOONTOWER

HORIZONTE

PONCE DE LEON

BALLROOM A

PONCE DE LEON

BALLROOM B

PONCE DE LEON

BALLROOM C

PONCE DE LEON FOYER

LOBBY

ALME

NDRO

S

STAGE

W MCAFÉ CARIBE

PIKAYO

ELEV

ELEV

ELEV

EIGH

T NOO

DLE

BAR

ESCALATOR

GRAND BALLROOM

ROOMS ENDING IN 01-44THE

LOUNGE

LOBBY

PANTRY

LAGUNA II

LAGUNA I

LAGUNA III

PREFUNCTION

MIRAMAR I

MIRAMAR II

BUSINESSCENTER

MEETINGROOM I

MEETINGROOM II

BOARDROOM

I

BOARDROOM

III

BOARDROOM

IICONDADO

PREFUNCTION

SAN JUANHOSPITALITY

SUITE

TERRACE

M W

M W

ELEV ELEV

BRIDGE TO

OCEAN TOWER

ROOMS ENDING IN 51-84

OCEAN GARDENBRISAS DEL MAR TERRACE

BRISASDEL MAR

ASHFORDSPORTS LOUNGE

OCEAN TERRACE

AQUA

BAR

& G

RILL

TO POOLFRONT DESK

VIAGGI(SUNDRY SHOP) LOBBY LOBBYESCALATOR

MAIN ENTRANCE

DRIVEWAY

GROUP ENTRANCE

ENTRANCERENT-A-CARSTARBUCKS

M

W

WM

ELEV ELEV

ELEV

STAIRS

MOONBAR

ELEV

FIREETERNAL

YOU ARE HERE

RESTROOMS

FITNESS CENTER

DENNY’S

M

W

LAGOON POOL

ROYAL BALLROOM STAGE

ELEV ELEV

ROYALBALLROOM

FOYER

Ocean Tower MEZZANINE LEVEL

Lagoon Tower MEZZANINE LEVEL

Lagoon Tower LOBBY LEVEL

Ocean Tower LOBBY LEVEL

PlenariesTrack 2WiPs

BreaksPosters


ACSAC 34

Conference Sessions (Mezzanine Level)


FLOOR PLAN

SKY BRIDGE

TOLAGOONTOWER

HORIZONTE

PONCE DE LEON

BALLROOM A

PONCE DE LEON

BALLROOM B

PONCE DE LEON

BALLROOM C

PONCE DE LEON FOYER

LOBBY

ALME

NDRO

S

STAGE

W MCAFÉ CARIBE

PIKAYO

ELEV

ELEV

ELEV

EIGH

T NOO

DLE

BAR

ESCALATOR

GRAND BALLROOM


LOUNGE

LOBBY

PANTRY

LAGUNA II

LAGUNA I

LAGUNA III

PREFUNCTION

MIRAMAR I

MIRAMAR II

BUSINESSCENTER

MEETINGROOM I

MEETINGROOM II

BOARDROOM

I

BOARDROOM

III

BOARDROOM

IICONDADO

PREFUNCTION

SAN JUANHOSPITALITY

SUITE

TERRACE

M W

M W

ELEV ELEV

BRIDGE TO

OCEAN TOWER



BRISASDEL MAR


OCEAN TERRACE

AQUA

BAR

& G

RILL

TO POOLFRONT DESK


MAIN ENTRANCE

DRIVEWAY

GROUP ENTRANCE


M

W

WM

ELEV ELEV

ELEV

STAIRS

MOONBAR

ELEV

FIREETERNAL

YOU ARE HERE

RESTROOMS

FITNESS CENTER

DENNY’S

M

W

LAGOON POOL


ELEV ELEV

ROYALBALLROOM

FOYER





Track 3

Track 1

Regi

stra

tion


ACSAC 34

Meals


FLOOR PLAN

SKY BRIDGE

TOLAGOONTOWER

HORIZONTE

PONCE DE LEON

BALLROOM A

PONCE DE LEON

BALLROOM B

PONCE DE LEON

BALLROOM C

PONCE DE LEON FOYER

LOBBY

ALME

NDRO

S

STAGE

W MCAFÉ CARIBE

PIKAYO

ELEV

ELEV

ELEV

EIGH

T NOO

DLE

BAR

ESCALATOR

GRAND BALLROOM


LOUNGE

LOBBY

PANTRY

LAGUNA II

LAGUNA I

LAGUNA III

PREFUNCTION

MIRAMAR I

MIRAMAR II

BUSINESSCENTER

MEETINGROOM I

MEETINGROOM II

BOARDROOM

I

BOARDROOM

III

BOARDROOM

IICONDADO

PREFUNCTION

SAN JUANHOSPITALITY

SUITE

TERRACE

M W

M W

ELEV ELEV

BRIDGE TO

OCEAN TOWER



BRISASDEL MAR


OCEAN TERRACE

AQUA

BAR

& G

RILL

TO POOLFRONT DESK


MAIN ENTRANCE

DRIVEWAY

GROUP ENTRANCE


M

W

WM

ELEV ELEV

ELEV

STAIRS

MOONBAR

ELEV

FIREETERNAL RESTROOMS

FITNESS CENTER

DENNY’S

M

W

LAGOON POOL


ELEV ELEV

ROYALBALLROOM

FOYER





BreakfastLunch

Wed Dinner


ACSAC 34

Mobile Program

• Access the full program from your mobile device

• https://www.acsac.org/2018/openconf/mobile/

https://www.acsac.org/2018/openconf/mobile/


ACSAC 34

Proceedings

https://www.acsac.org/2018/proceedingshttps://dl.acm.org/citation.cfm?id=3274694

Proceedings

34th Annual Computer Security

Applications Conference

ACSAC 2018

Technical Program

Software Hardening

Shredder: Breaking Exploits through API Specialization . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1Shachee Mishra, Michalis Polychronakis

Type-after-Type: Practical and Complete Type-Safe Memory Reuse . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17Erik van der Kouwe, Taddeus Kroes, Chris Ouwehand, Herbert Bos, Cristiano Giuffrida

On the Effectiveness of Type-based Control Flow Integrity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28Reza Mirzazade Farkhani, Saman Jafari, Sajjad Arshad, William Robertson, Engin Kirda, Hamed

Okhravi

Practical Integrity Protection with Oblivious Hashing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40Mohsen Ahmadvand, Anahit Hayrapetyan, Sebastian Banescu, Alexander Pretschner

Authentication

Typing-Proof: Usable, Secure and Low-Cost Two-Factor Authentication Based on Keystroke Timings . 53Ximing Liu, Yingjiu Li, Robert H. Deng

Latent Typing Biometrics in Online Collaboration Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66Shane McCulley, Vassil Roussev

Beware of Your Screen: Anonymous Fingerprinting of Device Screens for Off-line Payment Protection 77Zhe Zhou, Di Tang, Wenhao Wang, Xiaofeng Wang, Zhou Li, Kehuan Zhang

A Measurement Study of Authentication Rate-Limiting Mechanisms of Modern Websites . . . . . . . . . . . . 89Bo Lu, Xiaokuan Zhang, Ziman Ling, Yinqian Zhang, Zhiqiang Lin

ML-Based Defenses

Accurate Malware Detection by Extreme Abstraction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101Fady Copty, Matan Danos, Orit Edelstein, Cindy Eisner, Dov Murik, Benjamin Zeltser

Using Loops For Malware Classification Resilient to Feature-unaware Perturbations . . . . . . . . . . . . . . . . 112Aravind Machiry, Nilo Redini, Eric Gustafson, Yanick Fratantonio, Yung Ryn Choe, Christopher

Kruegel, Giovanni Vigna

MADE: Security Analytics for Enterprise Threat Detection . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124Alina Oprea, Zhou Li, Robin Norris, Kevin Bowers

LOBO - Evaluation of Generalization Deficiencies in Twitter Bot Classifiers . . . . . . . . . . . . . . . . . . . . . . . 137Juan Echeverria, Emiliano De Cristofaro, Nicolas Kourtellis, Ilias Leontiadis, Gianluca Stringhini,

Shi Zhou

Side Channels

Side-Channel Analysis of SM2: A Late-Stage Featurization Case Study . . . . . . . . . . . . . . . . . . . . . . . . . . . 147Nicola Tuveri, Sohaib ul Hassan, Cesar Pereida García, Billy Bob Brumley

MicroWalk: A Framework for Finding Side Channels in Binaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 161Jan Wichelmann, Ahmad Moghimi, Thomas Eisenbarth, Berk Sunar

Analyzing Cache Side Channels Using Deep Neural Networks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174Tianwei Zhang, Yinqian Zhang, Ruby B. Lee

MemCloak: Practical Access Obfuscation for Untrusted Memory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187Weixin Liang, Kai Bu, Ke Li, Jinhong Li, Arya Tavakoli

vi


https://dl.acm.org/citation.cfm?id=3274694


ACSAC 34

Keep Up with ACSAC on Social Media

Twitter

– @ACSAC_Conf

– https://twitter.com/ACSAC_Conf

Facebook

– https://www.facebook.com/acsaconf/

– https://www.facebook.com/groups/acsacattendees/

LinkedIn

– https://www.linkedin.com/in/acsac-chair/

https://twitter.com/ACSAC_Conf

https://www.facebook.com/acsaconf/

https://www.facebook.com/groups/acsacattendees/

https://www.linkedin.com/in/acsac-chair/


ACSAC 34

Organizing Committee• David Balenson, SRI International (Conference Chair, ACSA

Government Liaison)• Juan Caballero, IMDEA Software Institute (Program Chair)• Guofei Gu, Texas A&M University (Program Co-Chair)• Larry Wagoner, NSA (Case Studies Co-Chair)• Randy Smith, The Boeing Company (Case Studies Co-Chair)• Charles Payne, Adventium (National Interest Track Chair)• Suzanne McIntosh, NYU Courant Institute (Panels Chair)• Thomas Moyer, UNC at Charlotte (Posters & WiP Co-Chair)• Adam Aviv, USNA (Posters & WiP Co-Chair) • Daniel P. Faigin, Aerospace (Prof. Development Co-Chair)• Michael Clifford, Noblis (Prof. Development Co-Chair)• Harvey Rubinovitz, MITRE (Workshops Chair)

• Dan Thomsen, SIFT (Knowledge Coordinator)• Jeremy Epstein, NSF (Local Arrangements)• Adam Hahn, WSU (Proceedings Co-Coordinator)• Ali Tamimi, WSU(Proceedings Co-Coordinator)• Daniel Zappala, Brigham Young (Publicity Coordinator)• Karen Davis, (Registration Coordinator)• Hassan Takabi, UNT (Student Conferenceships Chair)• Robert H’obbes’ Zakon, Zakon Group LLC (Web Advisor)• Marshall Abrams, Retired (ACSAC Curmudgeon and

Treasurer)

• Mike Moshell, Carole Mann, Sharri Hanacek, Registration Systems Lab (Registration)


ACSAC 34

Steering Committee• Marshall Abrams, MITRE• David Balenson, SRI International• Davide Balzarotti, Eurecom• Kevin Butler, Univ. of Florida• Juan Caballero, IMDEA Software Institute• Jeremy Epstein, National Science Foundation• Daniel P. Faigin, The Aerospace Corporation• Carrie Gates, Bank of America

• Ann Marmor-Squires, The Sq Group• Charles Payne, Adventium Labs• Wil Robertson, Northeastern Univ. • Harvey Rubinovitz, MITRE• Steve Schwab, USC-ISI• Cristina Serban, AT&T Security Research Center• Dan Thomsen, SIFT• Robert H’obbes’ Zakon, Zakon Group LLC


ACSAC 34

Thank You !!

Presented by In cooperation with

Sponsors Published by


ACSAC 34

Program Chair Opening Remarks


ACSAC 34

100119

102119

135

197

132

191173

224 227

195

231

171

236

193210

244

299

0

50

100

150

200

250

300

350

2000200120022003200420052006200720082009201020112012201320142015201620172018

ACSAC Submissions

2018: 299 Submissions à 22% increase over previous highest!


ACSAC 34

42

38

3336 35

45

40 41 4244

39 39

44

34

47 47 48 48

60

0

10

20

30

40

50

60

70

2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

ACSAC Accepted Papers

2018: 60 Accepted Papers à 25% increase, largest program ever!

Presentations shortened to 20 minutes + 2.5 minutes for questions


ACSAC 34

0.00%

5.00%

10.00%

15.00%

20.00%

25.00%

30.00%

35.00%

40.00%

45.00%

2000 2002 2004 2006 2008 2010 2012 2014 2016 2018

ACSAC Acceptance Rate

2018: 20.1% Acceptance Rate à Keeps stable


ACSAC 34Un

ited

Stat

esCh

ina

Germ

any

Israe

lSi

ngap

ore

Neth

erla

nds

Sout

h Ko

rea

Unite

d Ki

ngdo

mFr

ance

Indi

aJa

pan

Aust

riaAu

stra

liaBe

lgiu

mCa

nada

Gree

ceHo

ng K

ong

Italy

Qat

arSw

eden

Finl

and

Luxe

mbo

urg

Port

ugal

Iran

Spai

nTu

nisia

0

20

40

60

80

100

120

140

160

0%

10%

20%

30%

40%

50%

60%

70%

80%

90%

100%

Submissions by Contact Author Country

26 Countries


ACSAC 34

Top 5 Submitting Countries1. US 44%2. China 15%3. Germany 9%4. Israel 3%5. Singapore 3%

Others 26%


ACSAC 34

Hard Topic Theme

24% Submissions related to hard topic


ACSAC 34

0

10

20

30

40

50

60

70

Software Security

Machine Learning For Security

Privacy & D

ata ProtectionN

etwork Security

Malw

areIntrusion D

etectionM

obile/Wireless Security

Big Data for Security

Web Security

Access ControlSecurity ArchitecturesCloud SecurityApplied CryptographyU

sability and Hum

anD

istributed Systems Security

Cyber-Physical Systems

Embedded System

s SecurityLarge-Scale D

ata ProcessingSecurity EngineeringIoT Security and PrivacyO

S SecuritySecurity case studiesSecurity PoliciesCyber Threat IntelligenceReverse EngineeringTrustw

orthy Computing

Adversarial Machine Learning

Denial of Service

Anonymity and Anonym

izationD

igital ForensicsAutonom

ous Vehicle

SensorsD

eceptionIntegrityTrust M

anagement

Virtualization SecurityEnterprise Security M

anagement

ResilienceAdvanced Persistent ThreatsAuditInsider Threat and ProtectionAutom

ated Decision M

akingBiom

etricsPrivilege M

anagement

Software

Threat Hunting

AssuranceAttribution A

nd Non-Attribution

Supply Chain SecurityIntellectual PropertyM

ultimedia Security

Event CorrelationIncident ResponseM

oving Target Defense

Red Teaming Techniques

Number of Submissions Marking a Topic


ACSAC 34

0.00%

5.00%

10.00%

15.00%

20.00%

25.00%

SoftwareSecurity

MachineLearning For

Security

Privacy & DataProtection

NetworkSecurity

Malware

Top 5 Topics

5

4 26

1


ACSAC 34

Review Process• Two phase process– 2 reviews in Round 1– 1/3 of papers rejected after Round 1– 1 or 2 additional reviews in Round 2– Online discussion

• 63 PC Members from 14 countries• Over 950 reviews!


ACSAC 34

PC CommitteeEhab Al-ShaerMagnus AlmgrenManos AntonakakisElias AthanasopoulosAdam AvivLeyla BilgeKevin ButlerLorenzo CavallaroJuan Caballero (PC Chair)Gabriella CiocarlieAdam DoupePetros EfstathopoulosManuel EgeleYanick FratantonioCarrie GatesNeil GongGuofei Gu (PC Co-chair)Christophe HauserAmir HoumansadrHongxin HuMartin Johns

Alexandros KapravelosVasileios KermelisFlorian KerschbaumBoris KoepfKatharina KrombholzYonghwi KwonAndrea LanziSangho LeeZhiqiang LinXiapu LuoFederico MaggiEvangelos MarkatosCollin MullinerDaniela OliveiraNicolas PapernotGiancarlo PellegrinoRoberto PerdisciZachary PetersonMichalis PolychronakisKonrad RieckKevin Alejandro Roundy

Kent SeamonsSeungwon ShinClaudio SorienteBen StockGianluca StringhiniJuan TapiadorAbhradeep Guha ThakurtaMichel van EetenJulien VanegueHayawardh VijayakumarGang WangMaverick WooCharles WrightFabian YamaguchiDanfeng (Daphne) YaoAttilla Altay YavuzHeng YinKatsunari YoshiokaDaniel ZappalaFengwei ZhangJialong Zhang


ACSAC 34

Artifact Submissionhttps://www.acsac.org/2018/artifacts/


ACSAC 34

Artifact Submission Committee

1. Aselya Aliyeva - Boston University2. William Blair - Boston University3. Quan Chen - North Carolina State University4. James Conners - Brigham Young University5. Ali Davanian - UC Riverside6. Aurore Fass - CISPA7. Irfan Ul Haq - IMDEA Software Institute8. Rasoul Jahanshah - Boston University9. Gordon Meiser - CISPA10. Dario Nisi - Eurecom11. Alexander Oleinik - Boston University12. Feargus Pendlebury - Royal Holloway

13. Fabio Pierazzi - Royal Holloway14. Marcello Pogliani - Politecnico di Milano15. Andrea Possemato - Eurecom16. Zhenxiao Qi – UC Riverside17. Mohammed Rashed - Universidad Carlos III

de Madrid18. Shaown Sarker - North Carolina State U.19. Mishra Shachee - Stony Brook U.20. Marius Steffens - CISPA21. Binghui Wang - Iowa State U.22. Christian Wressnegger - TU Braunschweig23. Onur Zungur - Boston University

Manuel Egele (Boston University)


ACSAC 34

Artifact Evaluation

• 60 papers accepted• 23 papers submitted artifact (38%)

– 2017: 25% à 13 point increase!• 21 papers with accepted artifact (35%)

No 4%

Submission

Not Sure 46% We plan to share 50%


ACSAC 34

Distinguished Paper Awards


ACSAC 34

Selection Process• 13 top scored papers pre-selected• PC members upvote/downvote those 13• 2 top voted receive Distinguished Paper Award


ACSAC 34

Top 4 Runners Up• # 17. Hiding in the Shadows: Empowering ARM for

Stealthy Virtual Machine Introspection

• # 76. Tracking Users across the Web via TLS Session Resumption

• # 99. An Historical Analysis of the SEAndroid Policy Evolution

• #186. Side-Channel Analysis of SM2: A Late-Stage Featurization Case Study


ACSAC 34

Final Author Instructions• Present yourselves to session chair

• Android/Web Security chairs swapped

• Presentation is 20 minutes strictly enforced– Plus 2 minutes of questions

• Prepare when questions start for previous• Test your slides at break


ACSAC 34

SWSIS Awards


ACSAC 34

Keynotes


ACSAC 34

Distinguished Practitioner Keynote

Why Privacy Engineering Matters Now

Michelle Dennedy,Vice President and Chief Privacy Officer, Cisco


ACSAC 34

Keynote

AI in Cybersecurity: Applications, Open Problems, and Future

Alina Oprea,Professor of Computer Science, Northeastern University

December 3-7, 2018 | The CondadoPlaza Hilton | San Juan, Puerto … · December 3-7, 2018 | The...

Documents

Transcript of December 3-7, 2018 | The CondadoPlaza Hilton | San Juan, Puerto … · December 3-7, 2018 | The...