Podcasts about in xd

15 agosto 2007: davanti al ristorante "Da Bruno", a Duisburg, vengono uccisi sei italiani. È un bagno di sangue. Nelle ore seguenti i notiziari tedeschi non fanno che parlare di quella che viene già definita una "una faida tra clan". Cristina Giordano ricostruisce il caso con numerose voci, ricordi e dettagli inediti. In questo primo episodio, tra gli altri, il racconto di don Adriano Lucato, il prete italiano che celebrò il funerale di una delle vittime. Von Cristina Giordano.

◎ 1부 [이 정도는 알아야 할 아침 뉴스] - 류밀희 기자 (TBS) ◎ 2부 [인터뷰 제1공장] 한덕수 '김앤장 고문'과 한동훈 '배우자 위장전입' 등 주요 후보자 논란 법리 해석 - 양지열 변호사 (TBS TV '더룸' 진행자) - 전화연결 - 신장식 변호사 (TBS FM '신장개업' 진행자) [인터뷰 제2공장] 박진 장남, 해외 도박 사이트 운영사 ‘설립자' 서명 “공식 자료 통해 확인..후보자 측 해명 납득 안 돼” - 주하은 기자 (시사IN) ◎ 3부 [해뜰날클럽] 공수 바뀐 여야..인사청문회 주요 쟁점과 정국 영향은? - 김성회 (더불어민주당) - 이창근 (국민의힘) - 한창민 (정의당) - 김윤 (국민의당) ◎ 4부 [금요음악회] 비트의 오묘함과 소재의 독특함 실력파 밴드 ‘향니' - 이지향 (보컬) - 이준규 (기타) - 김영대 음악평론가

◎ 1부 [이 정도는 알아야 할 아침 뉴스] - 류밀희 기자 (TBS) ◎ 2부 [인터뷰 제1공장] 한덕수 '김앤장 고문'과 한동훈 '배우자 위장전입' 등 주요 후보자 논란 법리 해석 - 양지열 변호사 (TBS TV '더룸' 진행자) - 전화연결 - 신장식 변호사 (TBS FM '신장개업' 진행자) [인터뷰 제2공장] 박진 장남, 해외 도박 사이트 운영사 ‘설립자' 서명 “공식 자료 통해 확인..후보자 측 해명 납득 안 돼” - 주하은 기자 (시사IN) ◎ 3부 [해뜰날클럽] 공수 바뀐 여야..인사청문회 주요 쟁점과 정국 영향은? - 김성회 (더불어민주당) - 이창근 (국민의힘) - 한창민 (정의당) - 김윤 (국민의당) ◎ 4부 [금요음악회] 비트의 오묘함과 소재의 독특함 실력파 밴드 ‘향니' - 이지향 (보컬) - 이준규 (기타) - 김영대 음악평론가

Lisa ist Anfang 20 und die sexuellen Übergriffe auf Frauen an Silvester 2015 in Köln erschüttern und ängstigen sie. Im Internet gerät sie auf rechtsextreme Seiten und ihre Angst wächst. Lisa entscheidet, dass auch sie gegen Ausländer hetzen muss. Sie wird zur bekannten Influencerin. In BESSER SO spricht sie mit Leon darüber, wie der Hass in ihr gewachsen ist und warum sie heute gegen Rechts kämpft.

Researchers from academia and industry have identifiedinteresting threat vectors against machine learning systems. These threatsexploit intrinsic vulnerabilities in the system, or vulnerabilities that arisenaturally from how the system works rather than being the result of a specificimplementation flaw. In this talk, I present recent results in threats tomachine learning systems from academia and industry, including some of our ownresearch at Riverside Research. Knowing about these threats is only half thebattle, however. We must determine how to transition both the understandinggained by developing attacks and specific defenses into practice to ensure thesecurity of fielded systems. In this talk I leverage my experience working onstandards committees to present an approach for leveraging machine learningprotection requirements on systems that use machine learning.

Vandaag een herhaling  van een aflevering in de serie In Stukken. Bas van Putten en Frank Teunissen buigen zich over de Vierde Symfonie van Anton Bruckner.

Dr. Clyde Posley Jr. has been the Senior Pastor of the Antioch Baptist Church in Indianapolis, IN This multi-talented man of God has been a highly sought-after evangelist, instructor, conference speaker and forum panelist for over thirty years throughout the country. Dr. Posley has worked as an adjunct professor and visiting Social Science lecturer at several universities across America. Dr, Posley is author of the October 2018 book: More than Icons and Images: Uncovering the Hidden Protest Narrative of American Black Athlete in the 21st Century. He is the president of the Pastors and Ministers Division of Union District Baptist Association, located in Indianapolis, IN, he authored a comprehensive ministerial training curriculum for Christian ministers entitled: Union District Association Pastor’s and Minister’s Conference Ministerial Certificate Program. Currently, Dr. Posley is the coordinator of the Racial and Social Justice division of the Union District Baptist Association of Indianapolis , In. He is also the Senior Editor the Union District quarterly newsletter Dr. Posley has served as Executive Chaplain for Zeta Phi Chapter of Omega Psi Phi Fraternity, Inc. in Indianapolis, IN. Additionally, Dr. Posley currently serves as Executive Chaplain for Pink-4-Ever breast health education servicing organization; servicing the greater Indianapolis area. He and the Antioch Baptist Church are members of the R.E.D. Alliance (Reaching to End Disparities), an organization that addresses systemic intervention and culturally sensitive health information related to the health disparities and treatment of Black women in the greater Indianapolis area. Dr. Posley can also be heard weekly as co-host of his internet -radio show; “Warp & Woof” with Dr. Mark Eckel. Dr. Posley has earned a Ph.D. in interdisciplinary studies from Union Institute and University, in Cincinnati, OH, with concentrations in Humanities, Cultural Studies and M.L. King Scholarship.

Dr. Clyde Posley Jr. has been the Senior Pastor of the Antioch Baptist Church in Indianapolis, IN This multi-talented man of God has been a highly sought-after evangelist, instructor, conference speaker and forum panelist for over thirty years throughout the country. Dr. Posley has worked as an adjunct professor and visiting Social Science lecturer at several universities across America. Dr, Posley is author of the October 2018 book: More than Icons and Images: Uncovering the Hidden Protest Narrative of American Black Athlete in the 21st Century. He is the president of the Pastors and Ministers Division of Union District Baptist Association, located in Indianapolis, IN, he authored a comprehensive ministerial training curriculum for Christian ministers entitled: Union District Association Pastor’s and Minister’s Conference Ministerial Certificate Program. Currently, Dr. Posley is the coordinator of the Racial and Social Justice division of the Union District Baptist Association of Indianapolis , In. He is also the Senior Editor the Union District quarterly newsletter Dr. Posley has served as Executive Chaplain for Zeta Phi Chapter of Omega Psi Phi Fraternity, Inc. in Indianapolis, IN. Additionally, Dr. Posley currently serves as Executive Chaplain for Pink-4-Ever breast health education servicing organization; servicing the greater Indianapolis area. He and the Antioch Baptist Church are members of the R.E.D. Alliance (Reaching to End Disparities), an organization that addresses systemic intervention and culturally sensitive health information related to the health disparities and treatment of Black women in the greater Indianapolis area. Dr. Posley can also be heard weekly as co-host of his internet -radio show; “Warp & Woof” with Dr. Mark Eckel. Dr. Posley has earned a Ph.D. in interdisciplinary studies from Union Institute and University, in Cincinnati, OH, with concentrations in Humanities, Cultural Studies and M.L. King Scholarship.

Dr. Clyde Posley Jr. has been the Senior Pastor of the Antioch Baptist Church in Indianapolis, IN This multi-talented man of God has been a highly sought-after evangelist, instructor, conference speaker and forum panelist for over thirty years throughout the country. Dr. Posley has worked as an adjunct professor and visiting Social Science lecturer at several universities across America. Dr, Posley is author of the October 2018 book: More than Icons and Images: Uncovering the Hidden Protest Narrative of American Black Athlete in the 21st Century. He is the president of the Pastors and Ministers Division of Union District Baptist Association, located in Indianapolis, IN, he authored a comprehensive ministerial training curriculum for Christian ministers entitled: Union District Association Pastor’s and Minister’s Conference Ministerial Certificate Program. Currently, Dr. Posley is the coordinator of the Racial and Social Justice division of the Union District Baptist Association of Indianapolis , In. He is also the Senior Editor the Union District quarterly newsletter Dr. Posley has served as Executive Chaplain for Zeta Phi Chapter of Omega Psi Phi Fraternity, Inc. in Indianapolis, IN. Additionally, Dr. Posley currently serves as Executive Chaplain for Pink-4-Ever breast health education servicing organization; servicing the greater Indianapolis area. He and the Antioch Baptist Church are members of the R.E.D. Alliance (Reaching to End Disparities), an organization that addresses systemic intervention and culturally sensitive health information related to the health disparities and treatment of Black women in the greater Indianapolis area. Dr. Posley can also be heard weekly as co-host of his internet -radio show; “Warp & Woof” with Dr. Mark Eckel. Dr. Posley has earned a Ph.D. in interdisciplinary studies from Union Institute and University, in Cincinnati, OH, with concentrations in Humanities, Cultural Studies and M.L. King Scholarship.

Dr. Clyde Posley Jr. has been the Senior Pastor of the Antioch Baptist Church in Indianapolis, IN This multi-talented man of God has been a highly sought-after evangelist, instructor, conference speaker and forum panelist for over thirty years throughout the country. Dr. Posley has worked as an adjunct professor and visiting Social Science lecturer at several universities across America. Dr, Posley is author of the October 2018 book: More than Icons and Images: Uncovering the Hidden Protest Narrative of American Black Athlete in the 21st Century. He is the president of the Pastors and Ministers Division of Union District Baptist Association, located in Indianapolis, IN, he authored a comprehensive ministerial training curriculum for Christian ministers entitled: Union District Association Pastor’s and Minister’s Conference Ministerial Certificate Program. Currently, Dr. Posley is the coordinator of the Racial and Social Justice division of the Union District Baptist Association of Indianapolis , In. He is also the Senior Editor the Union District quarterly newsletter Dr. Posley has served as Executive Chaplain for Zeta Phi Chapter of Omega Psi Phi Fraternity, Inc. in Indianapolis, IN. Additionally, Dr. Posley currently serves as Executive Chaplain for Pink-4-Ever breast health education servicing organization; servicing the greater Indianapolis area. He and the Antioch Baptist Church are members of the R.E.D. Alliance (Reaching to End Disparities), an organization that addresses systemic intervention and culturally sensitive health information related to the health disparities and treatment of Black women in the greater Indianapolis area. Dr. Posley can also be heard weekly as co-host of his internet -radio show; “Warp & Woof” with Dr. Mark Eckel. Dr. Posley has earned a Ph.D. in interdisciplinary studies from Union Institute and University, in Cincinnati, OH, with concentrations in Humanities, Cultural Studies and M.L. King Scholarship.

◎ 1부 [이 정도는 알아야 할 아침 뉴스] -시사IN 김은지 기자 [잠깐만 인터뷰] - 전화연결 엘리엇 소송 놓고 법무부의 삼성 감싸기 의혹! - 주진우 기자 (시사IN) ◎ 2부 [인터뷰 제1공장] -전화연결 ‘힘없는 자들의 힘’의 승리 … 최고위원 경선 1위로 선출된 소감은? - 박주민 최고위원 (더불어민주당) [인터뷰 제2공장] -전화연결 하루 만에 폼페이오 방북 계획 취소, 그 배경은? - 김준형 교수 (한동대)

◎ 1부 [이 정도는 알아야 할 아침 뉴스] - 시사IN 김은지 기자 [잠깐만 인터뷰] -전화연결 “기무사령관, 박근혜 탄핵 당일 청와대에 들어갔다” - 하어영 기자 (한겨레21) [잠깐만 인터뷰] -전화연결 미국계 헤지펀드 엘리엇, 한국 정부 상대로 8천억원대 소송 제기, 왜? - 주진우 기자 (시사IN) ◎ 2부 [인터뷰 제1공장] 전당대회 D-3, 세대교체가 마땅히 필요한 이유! - 송영길 의원 (더불어민주당)

◎ 1부 [이 정도는 알아야 할 아침 뉴스] - 시사IN 김은지 기자 [잠깐만 인터뷰] -전화연결 “군인권센터 향한 한국당의 비난과 인신공격 … 본질 흐리는 물타기” - 임태훈 소장 (군인권센터) [잠깐만 인터뷰] -전화연결 양승태 사법부의 재판거래 의혹, 한명숙 전 총리도 피해자? - 주진우 기자 (시사IN) ◎ 2부 [하태핫태] 더민주&평화당 차기 당권 주자는? & 바른미래 9.2 전당대회 확정! - 하태경 의원 (바른미래당)

Sunday, July 31, 2016 Grace Bible Chapel Michawaka, IN I Peter 2:18-25

Sunday, July 31, 2016 Grace Bible Chapel Michawaka, IN I Peter 2:18-25

Processor caches and memory chips are hardware components used by all software programs on a computer system. They are designed, and thereafter fine-tuned over the years, for better performance and power efficiency, but not for strong isolation between mutually distrustful software programs. However, modern computing paradigm has been shifting towards resource sharing without full trust: In multi-tenant public clouds, virtual machines controlled by different customers are scheduled to run on the same cloud servers; in mobile devices, untrusted third-party apps, though isolated using sandboxes, share the same devices with sensitive apps. Our research question is whether sharing of memory resources will introduce new security threats to these systems. In this talk, we highlight a type of security threats that we call cache-memory attacks. These attacks are possible due to insufficient isolation in hardware memory resources (e.g., various levels of caches, memory controllers, buses and chips, etc.) that are shared between malevolent and sensitive software programs. We coin cache-memory attacks as the umbrella terms of side-channel attacks (i.e., confidentiality attacks), row-hammer attacks (i.e., integrity attacks) and resource contention attacks (i.e., availability attacks). We will discuss the root vulnerabilities of these attacks and their exploitation in the context of clouds and mobile devices. We will also cover some defense techniques against these attacks that we have developed over the past few years.

In cyber-attack analysis, it is often highly desirable to understand the meaning of an unknown file or network message in the absence of their consumer (i.e. the program that parses and understands the file/message). For example, a malware may stealthily collect information from a victim machine, store them as a file and later send it to a remote server. P2C is a novel technique that can parse and understand unknown files and network messages. Given a file/message that was generated in the past without the presence of any monitoring techniques, and a set of potential producers of the file/message, P2C systematically explores the execution paths in the producers without requiring any inputs. In the meantime, it tries to transform a producer execution to a consumer execution that closely resembles the ideal consumer execution that can parse the given unknown file/message. In particular, when a write operation is encountered in the original execution, P2C performs the opposite read operation on the unknown file/message and patches the original execution with the loaded value. In order to handle correlations between data fields in the file/message, P2C follows a trial-and-error approach to look for the correct transformation until the file/message can be parsed and the meaning of their fields can be disclosed. Our experiments on a set of real world applications demonstrate P2C is highly effective.

Throughout the world, companies are finding that data breaches have become as common as a cold but far more expensive to treat. With the exception of Germany, companies had to spend more on their investigations, notification and response when their sensitive and confidential information was lost or stolen. As revealed in the 2014 Cost of Data Breach Study: Global Analysis, sponsored by IBM, the average cost to a company was $3.5 million in US dollars and 15 percent more than what it cost last year. Will these costs continue to escalate? Are there preventive measures and controls that will make a company more resilient and effective in reducing the costs? Nine years of research about data breaches has made us smarter about solutions. Critical to controlling costs is keeping customers from leaving. The research reveals that reputation and the loss of customer loyalty does the most damage to the bottom line. In the aftermath of a breach, companies find they must spend heavily to regain their brand image and acquire new customers. Our report also shows that certain industries, such as pharmaceutical companies, financial services and healthcare, experience a high customer turnover. In the aftermath of a data breach, these companies need to be especially focused on the concerns of their customers. As a preventive measure, companies should consider having an incident response and crisis management plan in place. Efficient response to the breach and containment of the damage has been shown to reduce the cost of breach significantly. Other measures include having a CISO in charge and involving the company’s business continuity management team in dealing with the breach. In most countries, the primary root cause of the data breach is a malicious insider or criminal attack. It is also the most costly. In this year’s study, we asked companies represented in this research what worries them most about security incidents, what investments they are making in security and the existence of a security strategy. An interesting finding is the important role cyber insurance can play in not only managing the risk of a data breach but in improving the security posture of the company. While it has been suggested that having insurance encourages companies to slack off on security, our research suggests the opposite. Those companies with good security practices are more likely to purchase insurance. Global companies also are worried about malicious code and sustained probes, which have increased more than other threats. Companies estimate that they will be dealing with an average of 17 malicious codes each month and 12 sustained probes each month. Unauthorized access incidents have mainly stayed the same and companies estimate they will be dealing with an average of 10 such incidents each month. When asked about the level of investment in their organizations’ security strategy and mission, on average respondents would like to see it doubled from what they think will be spent—an average of $7 million to what they would like to spend—an average of $14 million. This may be a tough sell in many companies. However, our cost of data breach research can help IT security executives make the case that a strong security posture can result in a financially stronger company.

We have struggles with others and with ourselves, but our real struggle is with God. In struggling with our problems, we sometimes run from God and doubt his wisdom, unwilling to give him control. Seeing and acknowledging God in the midst of our life situations in faith is an act of worship.

We have struggles with others and with ourselves, but our real struggle is with God. In struggling with our problems, we sometimes run from God and doubt his wisdom, unwilling to give him control. Seeing and acknowledging God in the midst of our life situations in faith is an act of worship.

To hide information within a picture we usually replace the least significant bits. This approach is no longer available if there is only 1 bit/pixel like for Quick Response Codes we meet everyday now. I will talk about theoretical limitation and practical aspects of hiding information in such situations: by generating encoding sequences fulfilling given constraints, for example to enforce resemblance to given picture (grayness of pixel defines probability of using "1" there). If the receiver would know the constraints/picture, we could just use entropy coder for this purpose, but we would like to omit this requirement here. In Kuznetsov-Tsybakov problem only the sender knows simple constraints, but it turns out that we can approach the same channel capacity as if both sides would know them. I will talk about generalizations to statistical constraints and applications for example to picture codes, steganography or lossy compression.

Smart electric meters are meters that can measure electric usage with a pretty high frequency. Smart electric meters pose a substantial threat to the privacy of individuals in their own homes. Combined with a method called non-intrusive load monitors, smart meter data can reveal precise home appliance usage information. An emerging solution to behavior leakage in smart meter measurement data is the use of battery-based load hiding. In this approach, a battery is used to store and supply power to home devices at strategic times to hide appliance loads from smart meters. A few such battery control algorithms have already been studied in the literature. In this talk, we will first consider two well known battery privacy algorithms, Best Effort (BE) and Non-Intrusive Load Leveling (NILL), and demonstrate attacks that recover precise load change information, which can be used to recover appliance behavior information, under both algorithms. We will then introduce a stepping approach to battery privacy algorithms that fundamentally differs from previous approaches by maximizing the error between the load demanded by a home and the external load seen by a smart meter. By design, precise load change recovery attacks are impossible. We also propose mutual-information based measurements to evaluate the privacy of different algorithms. We implement and evaluate four novel algorithms using the stepping approach, and show that under the mutual-information metrics they outperform BE and NILL

We interact with location-aware devices on a daily basis. Such devices range from GPS-enabled cell-phones and tablets, to navigation systems. Each device can report a multitude of location data to centralized servers. Such location information, commonly referred to as geospatial data, can have tremendous benefits if properly processed and analyzed. If shared, such geo-spatial data can have significant impact for research and other uses. Sharing such information, however, can have significant privacy implications. In this talk, we will focus on the problem of releasing static geo-spatial data in a private manner. In particular, we will explore methods of releasing a synopsis of two-dimensional datasets while satisfying differential privacy. The key challenge to anonymizing geospatial datasets while satisfying differential privacy is ensuring the utility of anonymized dataset. In particular, there are two types of error that influence the utility of anonymized datasets. The first is the anonymization noise--a direct byproduct of the differential privacy mechanism. The second is a result of the granularity of data release and the nature of the dataset itself. In this talk, we will explore methods of publishing two-dimensional datasets with utility in mind. We will analyze the current state-of-the-art methods and explore alternative grid-based approaches that best balance the two sources of error.

Over the past two decades, the Internet has become an essential tool in the lives of millions of people. Unfortunately, this success has also attracted cybercriminals who exploit the Internet as a platform for illicit gain. Perhaps the most familiar scam is sending unsolicited advertisements (spam), clogging inboxes and putting people's computers at risk of dangerous malware infections. Understanding the mechanisms and effectiveness of these scams is essential to building effective countermeasures to cybercrime. In this talk, I'll explain the modern spamming landscape and present research that help us better understand how spammers make their money online. One effort uses the technique of botnet infiltration to examine a spam campaign from the point of view of the spammers. Botnet infiltration allows us to measure their operation including the advertisements' effectiveness and the worldwide use of spam filtering techniques. The second effort exploits key information leaks to answer key questions about the modern affiliate marketing-based spam ecosystem, from estimating their worldwide gross revenue, to understanding customer demographics and their most popular products.

Assessing the trustworthiness of location data corresponding to individuals is essential in several applications, such as forensic science and epidemic control. To obtain accurate and trustworthy location data, analysts must often gather and correlate information from several independent sources, e.g., physical observation, witness testimony, surveillance footage, etc. However, such information may be fraudulent, its accuracy may be low, and its volume may be insufficient to ensure highly trustworthy data. On the other hand, recent advancements in mobile computing and positioning systems, e.g., GPS-enabled cell phones, highway sensors, etc., bring new and effective technological means to track the location of an individual. Nevertheless, collection and sharing of such data must be done in ways that do not violate an individual’s right to personal privacy. Previous research efforts acknowledged the importance of assessing location data trustworthiness, but they assume that data is available to the analyst in direct, unperturbed form. However, such an assumption is not realistic, due to the fact that repositories of personal location data must conform to privacy regulations. In this work, we study the challenging problem of refining trustworthiness of location data with the help of large repositories of anonymized information. We show how two important trustworthiness evaluation techniques, namely common pattern analysis and conflict/support analysis, can benefit from the use of anonymized location data. We have implemented a prototype of the proposed privacy-preserving trustworthiness evaluation techniques, and the experimental results demonstrate that using anonymized data can significantly help in improving the accuracy of location trustworthiness assessment.

Privacy Preserving Data Publishing (PPDP) is an evolving research field that is targeted at developing anonymization techniques to enable publishing data so that privacy is preserved while data distortion is minimized. Up until recently most of the research on PPDP considered partition-based anonymization models. The approach in such models is to partition the database records into groups and then homogeneously generalize the quasi-identifiers in all records within a group, as a countermeasure against linking attacks. We describe in this talk alternative anonymization models which are not based on partitioning and homogeneous generalization. Such models extend the set of acceptable anonymizations of a given table, whence they allow achieving similar privacy goals with much less information loss. We shall briefly review the basic models of homogeneous anonymization (e.g. k-anonymity and l-diversity) and then define non-homogeneous anonymization, discuss its privacy, describe algorithms and demonstrate the advantage of such anonymizations in reducing the information loss. We shall then discuss the usefulness of those models for data mining purposes. In particular, we will show that the reduced information loss that characterizes such anonymizations translates also to enhanced accuracy when using the anonymized tables to learn classification models. Based on joint works with Aris Gionis, Arnon Mazza, Mark Last and Sasha Zhmudyak

There is considerable research being conducted on insider threats directed to developing new technologies. At the same time, existing technology is not being fully utilized because of non-technological issues that pertain to economics and the human dimension. Issues related to how insiders actually behave are critical to ensuring that the best technologies are meeting their intended purpose. In our research, we have investigated accepted models of perceptions of risk and characteristics unique to insider threat, and we have introduced ordinal scales to these models to measure insider perceptions of risk. We have also investigated decision theories, leading to a conclusion that prospect theory, developed by Tversky and Kahneman, may be used to describe the risk-taking behavior of insiders and can be accommodated in our model. Our results indicate that there is an inverse relationship between perceived risk and benefit by insiders and that their behavior cannot be explained well by the models that are based on the traditional methods of engineering risk analysis and expected utility. We discuss the results of validating that model with forty-two senior information security executives from a variety of organizations. We also discuss how the model may be used to identify characteristics of insiders’ perceptions of risk and benefit, their risk-taking behavior and how to frame insider decisions. Finally, we recommend understanding risk of detection and creating a fair working environment to reduce the likelihood of committing criminal acts by insiders.

Computing system compromises occur because system integrity is not managed effectively. The various parties that contribute to a system, programmers, OS distributors, and system administrators, do not account for integrity threats comprehensively, leading to recurrence of the same kinds of attacks. The problem is that we lack scalable and automated approaches for these parties to assess the integrity of their individual components that enables one to build upon the efforts of others. In this talk, I will discuss an conceptual approach to composing system-wide integrity from enforcement of multiple system layers. This approach is motivated by various work in information flow security, but we find that managing system-wide integrity requires different inferencing approaches and care in mapping actual components to the model. In particular, we will discuss methods to establish a specifications of integrity, validating the initial integrity of system components and channels, and composing systems from such components that protect runtime integrity. We will demonstrate the use of methods on Xen and Linux systems for deploying cloud computing applications. We show that accounting for integrity in component design can lead to comprehensive system-wide management.

Mix networks, originally proposed in 1981, provide a way for Internet users to send messages--such as email, blog posts, or tweets--without automatically revealing their identities or their locations. In this talk, we will describe Sphinx, a cryptographic message format used to relay anonymized messages within a mix network. It is the first scheme to support a full set of security features: compactness, efficiency, provable security, indistinguishable replies, hiding the path length and relay position, as well as providing unlinkability for each leg of the message's journey over the network. We will compare Sphinx to other mix formats, and will also briefly outline Sphinx's security reduction proof.

One's last words are revealing as to what one believes is important. In the last chapter of 2nd Peter, Peter reveals what is important to him...the return of Christ. In today's message, Dr. Estep teaches us how to live until He returns again.

Organizations have recently shown increased interest in database activity monitoring and anomaly detection techniques to safeguard their internal databases. Once an anomaly is detected, a response from the database is needed to contain the effects of the anomaly. However, the problem of issuing an appropriate response to a detected database anomaly has received little attention so far. In this work, we propose a framework and a policy language for issuing a response to a database anomaly based on the characteristics of the anomaly. We also propose a novel approach to dynamically change the state of the access control system in order to contain the damage that may be caused by the anomalous request. We have implemented our mechanisms in the PostgreSQL DBMS and we discuss relevant implementation issues. We have also carried out an experimental evaluation to assess the performance overhead introduced by our response mechanism. The experimental results show that the techniques are very efficient.

For sensor networks deployed to monitor and report real events, event source location privacy is an attractive and critical security property, which unfortunately is also very difficult and expensive to achieve. This is not only because adversaries may attack against sensor source privacy through traffic analysis, but also because sensor networks are very limited in resources. In this talk, we will discuss the techniques we have developed for enhancing source location privacy in sensor networks under a global adversarial model. Specifically, we will propose the notion of statistically strong source anonymity, where carefully chosen dummy traffic will be introduced to hide the real event sources. In addition, several privacy-preserving mechanisms will be employed to drop dummy messages on their roads to the base station to prevent explosion of network traffic.

The widespread adoption of home routers by the general public has added a new target for malware and crimeware authors. A router's ability to manipulate essentially all network traffic coming in to and out of a home, means that malware installed on these devices has the ability to launch powerful Man-In-The-Middle (MITM) attacks, a form of attack that has previously been largely ignored. Making matters worse, many homes have deployed wireless routers which are insecure if the attacker has geographic proximity to the router and can connect to it over its wireless channel. However, some have downplayed this risk by suggesting that attackers will be unwilling to spend the time and resources necessary, nor risk exposure to attack a large number of routers in this fashion. In this talk, we will consider the ability of malware to propagate from wireless router to wireless router over the wireless channel, infecting large urban areas where such routers are deployed relatively densely. We develop an SIR epidemiological model, and use it to simulate the spread of malware over major metropolitan centers in the US. Using hobbyist collected wardriving data from Wigle.net and our model, we show the potential for the infection of tens of thousands of routers in short periods of time is quite feasible. We consider simple prescriptive suggestions to minimize the likelihood that such attacks are ever performed. Next, we show a simple yet worrisome attacks that can easily and silently be performed from infected routers. We call this attack 'Trawler Phishing'. The attack generalizes a well understood failure of many web-sites to properly implement SSL, and allows attackers to harvest credentials from victims over a period of time, without the need to use spamming techniques or mimicked, but illegitimate web-sites, as in traditional phishing attacks, bypassing the most effective phishing prevention technologies. Further, it allows attackers to easily form data-portfolios on many victims, making collected data substantially more valuable. We consider prescriptive suggestions and countermeasure for this attack. The work on epidemiological modeling is joint work with Hao Hu, Vittoria Colizza and Alex Vespignani. The work on trawler phishing is joint work Sid Stamm.

Recent rapid development of wireless networks of sensors, actuators and identifiers dictates the digitalization of our physical world and the creation of the "internet of things". In this new internet, each wireless device will sense and provide contextual information, of which crucial component are locations of devices and objects. In this talk, we present recent research results in secure computation and verification of locations of wireless devices: we show that current localization systems are highly vulnerable to attacks and we demonstrate that out solutions can prevent these attacks. We further illustrate how location-awareness can help in solving some of the fundamental security challenges of wireless networks, e.g., enabling authenticated and confidential communication without pre-shared keys of credentials.

The Internet is facing threats from increasingly stealthy and sophisticated malware. Recent reports have suggested that new computer worms and malware deliberately avoid fast massive propagation. Instead, they lurk in infected machines and inflict contaminations over time, such as rootkit and backdoor installation, botnet creation, and data/identity theft. In defense against Internet malware, the following tasks are critical: (1) raising timely alerts to trigger a malware investigation, (2) determining the break-in point of malware, i.e. the vulnerable software via which the malware initially infiltrates the victim, and (3) identifying all contaminations inflicted by the malware during its residence in the victim. In this talk, I will present Process Coloring, an information flow-preserving, provenance-aware approach to malware investigation. In particular, I will demonstrate that through the preservation and tainting of malware break-in provenance along OS-level information flows, malware investigators will be able to improve the efficiency and effectiveness of existing log-based intrusion investigation tools. Furthermore, process coloring brings the new capability of runtime malware alert, which cannot be achieved by existing log-based tools. I will also present results of our experiments with a number of real-world Internet worms as well as a highly tamper-resistant implementation of process coloring using virtualization-based techniques.

Many multicast overlay networks maintain application-specific performance goals such as bandwidth, latency, jitter and loss rate by dynamically changing the overlay structure using measurement- based adaptation mechanisms. This results in an unstructured overlay where no neighbor selection constraints are imposed. Although such networks provide resilience to benign failures, they are susceptible to attacks conducted by adversaries that compromise overlay nodes. Previous defense solutions proposed to address attacks against overlay networks rely on strong organizational constraints and are not effective for unstructured overlays. In this work, we identify, demonstrate and mitigate insider attacks against measurement-based adaptation mechanisms in unstructured multicast overlay networks. The attacks target the overlay network construction, maintenance, and availability and allow malicious nodes to control significant traffic in the network, facilitating selective forwarding, traffic analysis, and overlay partitioning. We propose techniques to decrease the number of incorrect or unnecessary adaptations by using outlier detection. We demonstrate the attacks and mitigation techniques in the context of a mature, operationally deployed overlay multicast system, ESM, through real- life deployments and emulations conducted on the PlanetLab and DETER testbeds, respectively.

Cryptology is typically defined as cryptography (the construction of cryptographic algorithms) and cryptanalysis (attacks on these algorithms). Both are important, but the latter is more fun. Cryptographic hash functions are one of the core building blocks within both security protocols and other application domains. In the last few decades a wealth of these functions have been developed, but the two in most widespread usage are MD5 and SHA1. Recently, there has been a great deal of activity regarding the cryptanalysis of MD5. We survey the recent attacks on the MD5 hash function from the modest progress in the mid 90s to the startling recent results instigated by Xiaoyun Wang. We will look at the details of these attacks, some recent improvements, two applications, and discuss the current outlook on cryptographic hashing.

How can one automatically identify classified documents? This is a vital question for the Department of Energy (DOE), which is reviewing millions of classified documents for possible declassification, and for Los Alamos National Laboratory (LANL), which is checking its unclassified computing storage systems for the presence of classified documents. The DOE, having already developed an expert rule system for automatic document classification, provided LANL with a small set of documents with which to explore a statistical classifier as an alternative. We represented documents as vectors of character trigram frequencies, used a chi-square statistic to select the optimal trigrams, and trained a linear classifier to distinguish classified and unclassified documents. Results ranged from 60% to 87% accuracy, depending on the training set size and other variables. In contrast, the LANL effort started "from scratch" and needed to be moved rapidly into large-scale production. We implemented an expert system tailored to the classified documents of most concern to LANL. The talk will discuss the practical issues that arose in canvassing large amounts of files in a variety of formats, and the security issues involved in the sampling, analysis, and notification processes.

In the past several years there has been an explosive growth in digital imaging technology and applications. Digital images and video are now widely distributed on the Internet and via CD-ROM. One problem with a digital image is that an unlimited number of copies of an "original" can be easily distributed and/or forged. This presents problems if the image is copyrighted. The protection and enforcement of intellectual property rights has become an important issue in the "digital world." Many approaches are available for protecting digital images and video; traditional methods include encryption, authentication and time stamping. In this talk we describe algorithms for image authentication and forgery prevention known as digital watermarking. A digital watermark is a signal that is embedded in a digital image or video sequence that allows one to establish ownership, identify a buyer or provide some additional information about the digital content. In this talk we will review the current state of watermarking and describe some of the open research problems.