Journal of Computer Security - Volume 28, issue 5

Authors: Li, Xusheng | Hu, Zhisheng | Wang, Haizhou | Fu, Yiwei | Chen, Ping | Zhu, Minghui | Liu, Peng

Article Type: Research Article

Abstract: Return-oriented programming (ROP) is a code reuse attack that chains short snippets of existing code to perform arbitrary operations on target machines. Existing detection methods against ROP exhibit unsatisfactory detection accuracy and/or have high runtime overhead. In this paper, we present DeepReturn, which innovatively combines address space layout guided disassembly and deep neural networks to detect ROP payloads. The disassembler treats application input data as code pointers and aims to find any potential gadget chains, which are then classified by a deep neural network as benign or malicious. Our experiments show that DeepReturn has high detection rate (99.3%) and …a very low false positive rate (0.01%). DeepReturn successfully detects all of the 100 real-world ROP exploits that are collected in-the-wild, created manually or created by ROP exploit generation tools. DeepReturn is non-intrusive and does not incur any runtime overhead to the protected program. Show more

Keywords: Return-oriented programming, intrusion detection system, disassembly, convolutional neural network

DOI: 10.3233/JCS-191368

Citation: Journal of Computer Security, vol. 28, no. 5, pp. 499-523, 2020

Authors: De Meo, Federico | Viganò, Luca

Article Type: Research Article

Abstract: We propose a formal and automated approach that allows one to (i) reason about vulnerabilities of web applications and (ii) combine multiple vulnerabilities for the identification of complex, multi-stage attacks. We have developed WAFEx, an automatic tool that implements our approach and we show its efficiency by applying it to real-world case studies. WAFEx was able to generate, and exploit, previously unknown attacks.

Keywords: Security testing, vulnerability assessment, penetration testing, model checking, web applications, formal methods, SQL injection, cross-site scripting, cross-site request forgery, file-system related vulnerabilities

DOI: 10.3233/JCS-181262

Citation: Journal of Computer Security, vol. 28, no. 5, pp. 525-576, 2020

Authors: Liu, Rui | Song, Jun | Huang, Zhiming | Pan, Jianping

Article Type: Research Article

Abstract: In recent years, with the rapid development and popularization of e-commerce, the applications of e-coupons have become a market trend. As a typical bar code technique, QR codes can be well adopted in e-coupon-based payment services. However, there are many security threats to QR codes, including the QR code tempering, forgery, privacy information leakage and so on. To address these security problems for real situations, in this paper, we introduce a novel fragment coding-based approach for QR codes using the idea of visual cryptography. Then, we propose a QR code scheme with high security by combining the fragment coding with …the commitment technique. Finally, an enhanced QR code-based secure e-coupon transaction framework is presented, which has a triple-verification feature and supports both online and offline scenarios. The following properties are provided: high information confidentiality, difficult to tamper with and forge, and the ability to resist against collusion attacks. Furthermore, the performance evaluation of computing and communication overhead is given to show the efficiency of the proposed framework. Show more

Keywords: QR code, e-coupon, e-commerce, commitment algorithms, visual cryptography

DOI: 10.3233/JCS-191416

Citation: Journal of Computer Security, vol. 28, no. 5, pp. 577-605, 2020