This seminar will go over recent, important papers in cyber-security, in the form of `reading group`- each week, one student will present a paper to
the others, using handouts (paper summary, see below). Papers will be in variety of topic in cyber-security (see below - but the list may change, esp.
by student requests). Due to high demand, a pair of students may work on the same paper; higher standards will be expected from pairs.
Student duties:
1. select date and (only) then select paper, both ASAP. (see below instructions and table of time slots and papers)
2. prepare detailed summary of paper, and optional foils. This may require interaction with authors - see below.
3. send summary to lecturer at least on Sunday of the week assigned to student, apply fixes, send revised version, iterate if needed
4. Print copies of final version (double-sided!) and distribute to students at seminar
5. Present paper during seminar, going over summary, optionally using foils. Manage discussion. Collect unresolved questions and comments.
6. Resolve any questions/issues raised during seminar, send to lecturer together with revised summary.
7. Grade is determined based on quality of all these steps, and on participation in lectures.
8. Mandatory to attend lectures. It is be Ok if you really have to be absent from two, or if really unavoidable even three, meetings.
About paper summary: this should be an easy-to-read document explaining the main points in the paper, giving extra examples, making criticism
and complementing with other relevant works, including necessary background. Begin preparing well in advance; often, you may come across
unclear issues that will require interaction with authors. Consult with lecturer as needed (e.g., if you think you may need to contact authors).
Length: about 8-10 pages, in font 12pt (make it readable during lecture).
In addition to the proposed papers (below and in the paper selection form), Students can propose other papers (related to cyber security),
provided they are recent and of high quality (preferably, presented in major conference or journal). Students may also offer to present their own work,
in which case, it is Ok to submit work not yet accepted by any venue or published (recently) in somewhat weaker venue. Lecturer must approve.
Note: after assignment of papers and dates, students are responsible for switching among them if necessary.
Available papers:
Topic
Web security
Detection
Cloud-crypto
Cloud-crypto
Cloud-crypto
PKI
DoS & Routing
Denial-of-Service
Denial-of-Service
Paper
Take This Personally: Pollution Attacks on Personalized Services, Xing et al., Usenix security Aug. '13.
Detecting Stealthy, Distributed SSH Brute-Forcing, ACM-CCS, Oct'14
Efficient Private File Retrieval by Combining ORAM and PIR, Mayberry et al, NDSS, Feb'14
Dynamic Searchable Encryption in Very-Large Databases: Data Structures and Implementation, Cash et al, NDSS, Feb'14
Practical Dynamic Searchable Encryption with Small Leakage, Stefanov et al, NDSS, Feb'14
Enhanced Certificate Transparency and End-to-End Encrypted Email, Mark D. Ryan, NDSS, Feb'14.
The Crossfire Attack, by Kang, Lee and Gligor, in IEEE S&P, May'13.
Amplification Hell: Revisiting Network Protocols for DDoS Abuse, Christian Rossow, NDSS, Feb'14
Schedule (available time slots):
Date
23.4
30.4
7.5
14.5
21.5
28.5
4.6
11.6
18.6
25.6
2.7
9.7
16.7
Topic
welcome lecture
no meeting
DNS & privacy
no meeting
no meeting
no meeting
No meeting - campusfest
Routing security
Denial-of-Service
no meeting
Anonymity (Tor) & Censuring
no meeting
Buffer-overflow, software security
Paper
brief overview of cyber security
(nobody signed up)
"Evaluating the Security of a DNS Query Obfuscation Scheme for Private Web Surfing", Dominik Herrmann, Max Jakob Maass, Hannes Federrath
no meeting (lecturer unavailable)
no meeting (students were not ready)
no meeting (students were not ready)
Losing control of the internet: using the data plane to attack the control plane, Schuchard et al., NDSS, Aug'11.
Amplification Hell: Revisiting Network Protocols for DDoS Abuse, Christian Rossow, NDSS, Feb'14
no meeting (lecturer unavailable)
The Sniper Attack: Anonymously Deanonymizing and Disabling the Tor Network
no meeting (lecturer unavailable)
ROPecker: A Generic and Practical Approach For Defending Against ROP Attacks. Cheng et al., NDSS, Feb'14. Note: this subject requires extensive background on buffer-overflow attacks, ROP etc
Student
by lecturer
Max Maass
Daniel Nowak, Jan-Pascal Kwiotek
Thomas Plumhoff
Michael Stahn, Michael Schulze
Spychalski, Tschürtz