OPUS - Volltextserver Universität Passau
Not a member yet
1021 research outputs found
Sort by
Precise Detection of Injection Attacks in Real-world Applications
No full textCode injection attacks like the one used in the high-profile 2017 Equifax breach, have become increasingly common, ranking at the top of OWASP’s list of critical web application vulnerabilities. The injection attacks can also target embedded applications running on processors like ARM and Xtensa by exploiting memory bugs and maliciously altering the program’s behavior or even taking full control over a system. Especially, ARM’s support of low power consumption without sacrificing performance is leading the industry to shift towards ARM processors, which advances the attention of injection attacks as well.
In this thesis, we are considering web applications and embedded applications (running on ARM and Xtensa processors) as the target of injection attacks. To detect injection attacks in web applications, taint analysis is mostly proposed but the precision, scalability, and runtime overhead of the detection depend on the analysis types (e.g., static vs dynamic, sound vs unsound). Moreover, in the existing dynamic taint tracking approach for Java- based applications, even the most performant can impose a slowdown of at least 10–20% and often far more. On the other hand, considering the embedded applications, while some initial research has tried to detect injection attacks (i.e., ROP and JOP) on ARM, they suffer from high performance or storage overhead. Besides, the Xtensa has been neglected though used in most firmware-based embedded WiFi home automation devices.
This thesis aims to provide novel approaches to precisely detect injection attacks on both the web and embedded applications. To that end, we evaluate JavaScript static analysis frameworks to evaluate the security of a hybrid app (JS & native) from an industrial partner, provide RIVULET – a tool that precisely detects injection attacks in Java-based real-world applications, and investigate injection attacks detection on ARM and Xtensa platforms using hardware performance counters (HPCs) and machine learning (ML) techniques.
To evaluate the security of the hybrid application, we initially compare the precision, scalability, and code coverage of two widely-used static analysis frameworks—WALA and SAFE. The result of our comparison shows that SAFE provides higher precision and better code coverage at the cost of somewhat lower scalability. Based on these results, we analyze the data flows of the hybrid app via taint analysis by extending the SAFE’s taint analysis and detected a potential for injection attacks of the hybrid application.
Similarly, to detect injection attacks in Java-based applications, we provide Rivulet which monitors the execution of developer-written functional tests using dynamic taint tracking. Rivulet uses a white-box test generation technique to re-purpose those functional tests to check if any vulnerable flow could be exploited. We compared Rivulet to the state-of-the-art static vulnerability detector Julia on benchmarks and Rivulet outperformed Julia in both false positives and false negatives. We also used Rivulet to detect new vulnerabilities.
Moreover, for applications running on ARM and Xtensa platforms, we investigate ROP1 attack detection by combining HPCs and ML techniques. We collect data exploiting real- world vulnerable applications and small benchmarks to train the ML. For ROP attack detection on ARM, we also implement an online monitor which labels a program’s execution as benign or under attack and stops its execution once the latter is detected. Evaluating our ROP attack detection approach on ARM provides a detection accuracy of 92% for the offline training and 75% for the online monitoring. Similarly, our ROP attack detection on the firmware-only Xtensa processor provides an overall average detection accuracy of 79%.
Last but not least, this thesis shows how relevant taint analysis is to precisely detect injection attacks on web applications and the power of HPC combined with machine learning in the control flow injection attacks detection on ARM and Xtensa platforms
Hölder’s inequality and its reverse — a probabilistic point of view
No full textIn this article, we take a probabilistic look at Hölder's inequality, considering the ratio of terms in the classical Hölder inequality for random vectors in ℝ. We prove a central limit theorem for this ratio, which then allows us to reverse the inequality up to a multiplicative constant with high probability. The models of randomness include the uniform distribution on balls and spheres. We also provide a Berry–Esseen–type result and prove a large and a moderate deviation principle for the suitably normalized Hölder ratio
Multi-vector optimization scheme for distributed components in energy islands
No full textRecent advancements in energy systems, such as the emergence of prosumers and sector coupling approaches, introduce additional flexibilities over multiple energy sectors, such as heating, electricity, and mobility. Due to the complexity of such distributed systems, the optimization of energy allocation is a non-trivial task, especially considering constraints and limitations introduced by distributed devices or sub-systems. Additionally, the variety of devices forces approaches to be highly situational and not universally applicable. In this paper, a two-level optimization scheme is proposed, which aims at reducing the optimization complexity of sector-coupled systems. The multi-vector optimization embedded in the two-level optimization scheme is formulated as a mixed-integer linear problem, optimizing the energy flow between domains, which are modeled as an abstraction of a sector. Distributed devices are modeled as components that represent an abstraction of devices connected to an energy domain. The optimization process is evaluated based on the data from a residential complex in Ghent, Belgium. It shows that the approach is capable of minimizing costs, CO2 emissions, and dependency on external resources
Toward Online Mobile Facility Location on General Metrics
No full textWe introduce an online variant of mobile facility location (MFL) (introduced by Demaine et al. (SODA 258–267 2007)). We call this new problem online mobile facility location (OMFL). In the OMFL problem, initially, we are given a set of k mobile facilities with their starting locations. One by one, requests are added. After each request arrives, one can make some changes to the facility locations before the subsequent request arrives. Each request is always assigned to the nearest facility. The cost of this assignment is the distance from the request to the facility. The objective is to minimize the total cost, which consists of the relocation cost of facilities and the distance cost of requests to their nearest facilities. We provide a lower bound for the OMFL problem that even holds on uniform metrics. A natural approach to solve the OMFL problem for general metric spaces is to utilize hierarchically well-separated trees (HSTs) and directly solve the OMFL problem on HSTs. In this paper, we provide the first step in this direction by solving a generalized variant of the OMFL problem on uniform metrics that we call G-OMFL. We devise a simple deterministic online algorithm and provide a tight analysis for the algorithm. The second step remains an open question. Inspired by the k-server problem, we introduce a new variant of the OMFL problem that focuses solely on minimizing movement cost. We refer to this variant as M-OMFL. Additionally, we provide a lower bound for M-OMFL that is applicable even on uniform metrics
Well-posedness and properties of the flow for semilinear evolution equations
No full textWe derive conditions for well-posedness of semilinear evolution equations with unbounded input operators. Based on this, we provide sufficient conditions for such properties of the flow map as Lipschitz continuity, bounded-implies-continuation property, boundedness of reachability sets, etc. These properties represent a basic toolbox for stability and robustness analysis of semilinear boundary control systems. We cover systems governed by general C0 -semigroups, and analytic semigroups that may have both boundary and distributed disturbances. We illustrate our findings on an example of a Burgers’ equation with nonlinear local dynamics and both distributed and boundary disturbances
Multimodalitäten – Differenzierungen / Konturierungen / Kontexte. Bestandsaufnahme aus textsemiotischer Perspektive
No full textDer Beitrag „Multimodalitäten – Differenzierungen / Konturierungen / Kontexte. Bestandsaufnahme aus textsemiotischer Perspektive“ von Hans Krah bietet eine Bestandaufnahme und Systematisierung dessen, was an Parametern der Beschreibung in multimodalen Kontexten relevant sein könnte, wobei zugleich zum einen der semiotische Zugang grundiert wird und zum anderen Vorschläge einer Differenzierung im Feld von ‚Multimodalitäten‘ gemacht werden
‚The evil of the thriller‘: Multimodalität und Musikvideosemiotik am Beispiel von Michael Jacksons THRILLER
No full textDer Beitrag „‚The evil of the thriller‘: Multimodalität und Musikvideosemiotik am Beispiel von Michael Jacksons THRILLER“ von Stephan Brössel konturiert die Multimodalität des Musikvideos, wobei er in einem ersten Teil anhand eines Aufrisses der aktuellen Forschungslage eine medientheoretische Fundierung der multimodalen Verfasstheit des Formats entwickelt und diese in einem zweiten Teil am Beispiel von Michael Jacksons Thriller von 1983 in einer detaillierten Analyse illustriert und auf ihre Tragfähigkeit überprüft
Rechtsfragen algorithmischer Preisdiskriminierung. Eine rechtsgebietsübergreifende Untersuchung
No full textFelix Rützel legt in seiner Untersuchung der algorithmischen Preisdiskriminierung den Fokus auf die Zusammenhänge zwischen den verschiedenen Rechtsgebieten. Indem er die jeweils bestehenden rechtlichen Rahmenbedingungen skizziert und aufzeigt, wo Änderungsbedarf besteht, um auf diese Preisstrategie zu reagieren, bietet die Analyse des Autors praxisnahe, interessengeleitete Lösungen, die die Lücken der aktuellen Forschung schließen
Populism by the media: Bildtypen in der Darstellung des politischen Personals auf Compact-Covern - eine Forschungsdokumentation
No full textDie vorliegende Forschungsdokumentation stellt die in einer Studie ermittelten Bildtypen auf Covern des Compact-Magazins detailliert mittels der ikonographisch-ikonologischen Analyse vor. Vor dem theoretischen Hintergrund des populism by the media kann aufgezeigt werden, dass sich in der visuellen Darstellung von PolitikerInnen auf den Compact-Titelbildern sowohl Variationen in der visuellen Inszenierung der populistischen Dichotomie zwischen ‚Volk‘ und ‚Elite‘ finden als auch die rechtspopulistische Konstruktion eines ethnokulturell homogenen Volkes
Intermediäre und öffentliche Meinungsbildung – Eine kritische Würdigung des deutschen und europäischen Regulierungskonzepts von NetzDG bis DSA
No full textDie Arbeit untersucht die Wechselwirkungen und Friktionen zwischen verschiedenen Regelwerken auf deutscher und europäischer Ebene, welche die Regulierung der Medien- und Informationsintermediäre im Interesse der öffentlichen Meinungsbildung bezwecken