Readings
Paper Response Guidelines
Write a ~400 word critical response and comments to each required paper. Focus on the following:
- State the problem that they try to solve and the main contributions.
- Describe the key insight or novelty of their proposed work or approach.
- What are the weakness/limitations of the paper? Write the criticisms.
- Any improvements or related ideas that you can suggest?
Your most important task is to demonstrate that you've read the paper and thought carefully about the topic. No copy and paste of the original paper text!
Paper responses are due before the start of class via Canvas Assignments.
Discussion Lead and Extra Points
Please take a look at the papers in each session. If you are interested in leading the discussion of any session, you should sign up on the sign-up sheet in Canvas and get extra points for doing so. As a discussion lead, two tasks are expected: 1) You will summarize the papers in class (with or without slides) for 10-min each. 2) You should prepare yourself by reading the technical details carefully and coming up with a list of discussion points. The discussion points should be designed to engage students in critical and creative thinking. Think about the points ahead of time and be prepared to answer questions other students may throw at you.Send ahead of time your discussion points to me on Canvas and get feedback from me. Please allow 2 days to receive the feedback. This will be a good opportunity for you to learn to discuss ideas around a research topic and it generally helps your presentation/communication skills.
Reading List
Most papers should be publicly accessible. If any links are broken, please search for them. If any of them require paid subscription, you can access them for free when connecting on campus. For off-campus access, try UCI VPN.
Week 1
Tuesday, April 2
- Introduction.
- The Security Mindset, Bruce Schneier. 2008.
Thursday, April 4 – Software Security I
- Smashing the Stack for Fun and Profit. Aleph One. Phrack 49(14), Nov. 1996.
Week 2
Tuesday, April 9 – Software Security II
- StackGuard: Automatic Adaptive Detection and Prevention of Buffer-Overflow Attacks. Cowan, Pu, Maier, Hinton, Walpole, Bakke, Beattie, Grier, Wagle, and Zhang. Usenix Security 1998.
- On the Effectiveness of Address-Space Randomization. Shacham, Page, Pfaff, Goh, Modadugu, and Boneh. CCS 2004.
- A First Step Towards Automated Detection of Buffer Overrun Vulnerabilities, Wagner, Foster, Brewer, and Aiken. NDSS 2000
Thursday, April 11 – Software Security III
- Form your project group by today!
- The Geometry of Innocent Flesh on the Bone: Return-into-libc without Function Calls (on the x86). Hovav Shacham. CCS 2007.
- Control Flow Integrity for COTS Binaries. Zhang and Sekar. Usenix Security 2013.
- N-Variant Systems: A Secretless Framework for Security through Diversity, Cox, Evans, Filipi, Rowanhill, Hu, Davidson, Knight, Nguyen-Tuong, Hiser. USENIX Security 2006
- Modular Control-Flow Integrity. Niu and Tan. PLDI 2014.
Week 3
Tuesday, April 16 – Malware
- Understanding Linux Malware. Cozzi, Graziano, Fratantonio, Balzarotti. IEEE S&P 2018.
- Reflections on Trusting Trust. Ken Thompson. Communications of the ACM, 27(8), Aug. 1984.
Thursday, April 18 – Isolation
- SchrodinText: Strong Protection of Sensitive Textual Content of Mobile Applications. Ardalan Amiri Sani. Mobisys 2017.
- ret2dir: Rethinking Kernel Isolation. Kemerlis, Polychronakis, Keromytis. USENIX Security 2014.
- From Collision To Exploitation: Unleashing Use-After-Free Vulnerabilities in Linux Kernel. Xu, Li, Shu, Yang. CCS 2015.
Week 4
Tuesday, April 23 – Network Security: Guest Lecture, Prof. Zhou Li (EECS)
- Detection of Early-Stage Enterprise Infection by Mining Large-Scale Log Data. Oprea, Li, Yen, Chin, and Alrwais. DSN 2015.
- Beyond Blacklists: Learning to Detect Malicious Web Sites from Suspicious URLs. Ma, Saul, Savage, and Voelker. KDD 2009.
- Learning to Detect Phishing Emails, Fette, Sadeh, and Tomasic, WWW 2007.
Thursday, April 25 – Pre-Proposal Presentation
- No readings!
Week 5
Tuesday, April 30 – Smartphone Systems Security I
-
DREBIN:
Effective and Explainable Detection of Android Malware in Your Pocket.
DArp, Spretzenbarth, Huner, Gascon, and Rieck.
NDSS 2014.
- Dissecting Android Malware: Characterization and Evolution. Zhou and Jiang. IEEE S&P 2012.
- DroidScope: Seamlessly Reconstructing the OS and Dalvik Semantic Views for Dynamic Android Malware Analysis. Yan and Yin. Usenix Security 2012.
Thursday, May 2 – Smartphone Systems Security
II: Guest Lecture, Prof. Joshua
Garcia (Informatics)
- Written proposal due on Friday, May
3!
- No readings!
- Android Permissions Remystified: A Field Study on Contextual Integrity. Wijesekera, Baokar, Hosseini, Egelman, Wagner, and Beznosov. USENIX Security 2015.
- Android Permissions Demystified. Felt, Chin, Hanna, Song, and Wagner. CCS 2011.
- PScout: Analyzing the Android Permission Specification. Au, Zhou, Huang, and Lie. CCS 2011 .
Week 6
Tuesday, May 7 – Smartphone Systems Security III
- Peeking into Your App without Actually Seeing It: UI State Inference and Novel Android Attacks. Chen, Qian, and Mao. Usenix Security 2014.
- What the App is That? Deception and Countermeasures in the Android User Interface. Bianchi, Corbetta, Invernizzi, Fratantonio, Kruegel, and Vigna. IEEE S&P 2015.
- Cloak and Dagger: From Two Permissions to Complete Control of the UI Feedback Loop. Fratantonio, Qian, Chung, and Lee. IEEE S&P 2017.
Thursday, May 9 – IoT/CPS Systems Security I
- ContexIoT: Towards Providing Contextual Integrity to Appified IoT Platforms. Jia, Chen, Wang, Rahmati, Fernandes, Mao, and Prakash. NDSS 2017.
- Security Analysis of Emerging Smart Home Applications. Fernandes, Jung, and Prakash. IEEE S&P 2016.
- SoK: Security Evaluation of Home-Based IoT Deployments. Alrawi, Lever, Antonakakis, and Monrose. IEEE S&P 2019.
Week 7
Tuesday, May 14 – IoT/CPS Systems Security II
- Comprehensive Experimental Analyses of Automotive Attack Surfaces. Checkoway, McCoy, Kantor, Anderson, Shacham, Savage, Koscher, Czeskis, Roesner, and Kohno. Usenix Security 2011.
- Experimental Security Analysis of a Modern Automobile. Koscher, Czeskis, Roesner, Patel, Kohno, Checkoway, McCoy, Kantor, Anderson, Shacham, and Savage. IEEE S&P 2010.
- Remote Exploitation of an Unaltered Passenger Vehicle. Miller and Valasek. DEF CON 23, Aug. 2015.
Thursday, May 16 – IoT/CPS Systems Security III
- Exposing Congestion Attack on Emerging Connected Vehicle based Traffic Signal Control. Chen, Yin, Feng, Mao, and Liu. NDSS 2018.
- Green Lights Forever: Analyzing the Security of Traffic Infrastructure. Ghena, Beyer, Hillaker, Pevarnek, and Halderman. Usenix WOOT 2014.
Week 8
Tuesday, May 21 – Machine Learning Security I
- Towards Evaluating the Robustness of Neural Networks. Carlini, and Wagner. IEEE S&P 2017.
- Distillation as a Defense to Adversarial Perturbations against Deep Neural Networks. Papernot, McDaniel, Wu, Jha and Swami. IEEE S&P 2016.
Thursday, May 23 – Machine Learning Security II
- Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks. Wang, Yao, Shan, Li, Viswanath, Zheng, and Zhao. IEEE S&P 2019.
- Certified Robustness to Adversarial Examples with Differential Privacy. Lecuyer, Atlidakis, Geambasu, Hsu, and Jana. IEEE S&P 2019.
- Formal Security Analysis of Neural Networks using Symbolic Intervals. Wang, Pei, Whitehouse, Yang, and Jana. Usenix Security 2018.
Week 9
Tuesday, May 28 – Sensor/Analog Security
- Adversarial Sensor Attack on LiDAR-based Perception in Autonomous Driving. Cao, Xiao, Cyr, Zhou, Park, Rampazzi, Chen, Fu, and Mao. CCS 2019.
- DolphinAttack: Inaudible Voice Commands. Zhang, Yan, Ji, Zhang, Zhang, and Xu. CCS 2017.
- Illusion and Dazzle: Adversarial Optical Channel Exploits against Lidars for Automotive Applications. Shin, Kim, Kwon, and Kim. CHES 2017.
- Injected and Delivered: Fabricating Implicit Control over Actuation Systems by Spoofing Inertial Sensors. Tu, Lin, Li, and Hei. Usenix Security 2018.
Thursday, May 30 – Physical Security
- An Introduction to Lock Picking: How to Pick Pin Tumbler Locks -- No summary required; Just read this and come to class
- Reconsidering Physical Key Secrecy: Teleduplication via Optical Decoding. Laxton, Wang, and Savage. CCS, 2008.
- Cryptology and Physical Security: Rights Amplification in Master-Keyed Mechanical Locks. Matt Blaze. IEEE Security and Privacy, 2003.
- Security Analysis of a Widely Deployed Locking System. Weiner, Massar, Tews, Giese, and Wieser. CCS 2013.
Week 10
Tuesday, June 4 – Project Presentation
- No readings!
Thursday, June 6 – Project Presentation
- No readings!