Helmholtz Center for Information Security
CISPA – Helmholtz-Zentrum für InformationssicherheitNot a member yet
3406 research outputs found
Sort by
Accurate and Diverse Sampling of Sequences Based on a “Best of Many” Sample Objective
No full textFor autonomous agents to successfully operate in the real world, anticipation of future events and states of their environment is a key competence. This problem has been formalized as a sequence extrapolation problem, where a number of observations are used to predict the sequence into the future. Real-world scenarios demand a model of uncertainty of such predictions, as predictions become increasingly uncertain -- in particular on long time horizons. While impressive results have been shown on point estimates, scenarios that induce multi-modal distributions over future sequences remain challenging. Our work addresses these challenges in a Gaussian Latent Variable model for sequence prediction. Our core contribution is a ``Best of Many'' sample objective that leads to more accurate and more diverse predictions that better capture the true variations in real-world sequence data. Beyond our analysis of improved model fit, our models also empirically outperform prior work on three diverse tasks ranging from traffic scenes to weather data
Reflectance and Natural Illumination from Single-Material Specular Objects Using Deep Learning
No full text—In this paper, we present a method that estimates reflectance and illumination information from a single image depicting a
single-material specular object from a given class under natural illumination. We follow a data-driven, learning-based approach trained on
a very large dataset, but in contrast to earlier work we do not assume one or more components (shape, reflectance, or illumination) to be
known. We propose a two-step approach, where we first estimate the object’s reflectance map, and then further decompose it into
reflectance and illumination. For the first step, we introduce a Convolutional Neural Network (CNN) that directly predicts a reflectance
map from the input image itself, as well as an indirect scheme that uses additional supervision, first estimating surface orientation and
afterwards inferring the reflectance map using a learning-based sparse data interpolation technique. For the second step, we suggest a
CNN architecture to reconstruct both Phong reflectance parameters and high-resolution spherical illumination maps from the reflectance
map. We also propose new datasets to train these CNNs. We demonstrate the effectiveness of our approach for both steps by extensive
quantitative and qualitative evaluation in both synthetic and real data as well as through numerous applications, that show improvements
over the state-of-the-art
MemScrimper: Time- and Space-Efficient Storage of Malware Sandbox Memory Dumps
Get PDFWe present MemScrimper, a novel methodology to compress memory dumps of malware sandboxes. MemScrimper is built on
the observation that sandboxes always start at the same system state
(i.e., a sandbox snapshot) to analyze malware. Therefore, memory dumps
taken after malware execution inside the same sandbox are substantially
similar to each other, which we can use to only store the differences introduced by the malware itself. Technically, we compare the pages of
those memory dumps against the pages of a reference memory dump
taken from the same sandbox and then deduplicate identical or similar
pages accordingly. MemScrimper increases data compression ratios by
up to 3894.74% compared to standard compression utilities such as 7zip,
and reduces compression and decompression times by up to 72.48% and
41.44%, respectively. Furthermore, MemScrimper’s internal storage allows to perform analyses (e.g., signature matching) on compressed memory dumps more efficient than on uncompressed dumps. MemScrimper
thus significantly increases the retention time of memory dumps and
makes longitudinal analysis more viable, while also improving efficiency
Datenschutz durch Technikgestaltung für Genomdaten
No full textKlinische genetische Tests und Endverbraucher-Genetik, wie sie z.B. von 23andme angeboten wird, sind auf dem Weg zum Massenmarkt. Im Umfeld der klinischen Genetik haben die Patienten jedoch oft kaum Kontrolle über ihre eigenen genetischen Daten, während viele der am Markt tätigen privaten Anbieter von Genanalysen einer Vielzahl von Datenschutzbedenken begegnen. Der Artikel 25 DSGVO bietet in diesem Kontext nun gesetzliche Anreize, durch datenschutzfreundliche Technikgestaltung die Kontrolle über die Verwendung ihrer genetischen Daten in die Hände der Patienten zu legen.
Der Beitrag gibt einen Einblick in die interdisziplinäre Forschung zu Datenschutz durch Technikgestaltung auf Basis neuer Verfahren speziell für medizinische Daten. Wir stellen rechtliche und technische Überlegungen einer interdisziplinären Forschungsstudie von Rechtswissenschaftlern, Medizinern und Informatikern vor. Das gemeinsam entwickelte Systemdesign für eine sichere Forschungsplattform für Genomdaten unter der Kontrolle der Patienten ist geeignet, die Anforderungen der DSGVO insbesondere an Datenminimierung und Zweckbindung mit Hilfe kryptographischer Verfahren innovativ umzusetzen
You Are Where You APP: An Assessment on Location Privacy of Social APPs
Get PDFThe development of positioning technologies has digitalized people's mobility traces for the first time in history. GPS sensors resided in people's mobile devices allow smart apps to access location data. This large amount of mobility data can help to build appealing applications. Meanwhile, location privacy has become a major concern. In this paper, we design a general system to assess whether an app is vulnerable to location inference attacks. We utilize a series of automatic testing mechanisms including UI match and API analysis to extract the location information an app provides. According to different characteristics of these apps, we classify them into two categories corresponding to two kinds of attacks, namely attack with distance limitation (AWDL) and attack without distance limitation (AWODL). After evaluating 800 apps, of which 109 passed automated testing, we found that 24.7% of the passing apps are vulnerable to AWDL and 11.0% to AWODL. Moreover, some apps even allow us to modify the parameters in http requests which largely increases the scope of the attacks. Our system demonstrates the severity of location privacy leakage to mobile devices and can serve as an auditing tool for future smart apps
DECIM: Detecting Endpoint Compromise In Messaging
Get PDFWe present DECIM, an approach to solve the challenge of detecting endpoint compromise in messaging. DECIM manages and refreshes encryption/decryption keys in an automatic and transparent way: it makes it necessary for uses of the key to be inserted in an append-only log, which the device owner can interrogate in order to detect misuse. We propose a multi-device messaging protocol that exploits our concept to allow users to detect unauthorised usage of their device keys. It is co-designed with a formal model, and we verify its core security property using the Tamarin prover. We present a proof-of-concept implementation providing the main features required for deployment. We find that DECIM messaging is efficient even for millions of users. The methods we introduce are not intended to replace existing methods used to keep keys safe (such as hardware devices, careful procedures, or key refreshment techniques). Rather, our methods provide a useful and effective additional layer of security