{"id":1881,"date":"2017-04-07T10:18:03","date_gmt":"2017-04-07T10:18:03","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=1881"},"modified":"2017-04-08T10:09:34","modified_gmt":"2017-04-08T10:09:34","slug":"%e4%b8%ad%e7%a7%91%e9%99%a2%e8%bd%af%e4%bb%b6%e6%89%80inforsec-%e8%bd%af%e4%bb%b6%e6%99%ba%e8%83%bd%e5%88%86%e6%9e%90%e5%ad%a6%e6%9c%af%e6%b2%99%e9%be%99%e7%ac%ac%e4%b8%80%e6%ac%a1","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=1881","title":{"rendered":"\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240&InForSec \u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u4e00\u6b21\u6d3b\u52a8\u9884\u544a"},"content":{"rendered":"

\u4e2d<\/span><\/b>\u79d1\u9662<\/span><\/b>\u8f6f\u4ef6<\/span><\/b>\u6240<\/span><\/b>&<\/span><\/b>InForSec<\/span><\/b><\/p>\n

\u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u4e00\u6b21\u6d3b\u52a8<\/span><\/b>\u9884\u544a<\/span><\/b><\/p>\n

\u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u4e00\u6b21\u6d3b\u52a8\u5c06\u4e8e2017\u5e744\u670814\u65e5\uff08\u661f\u671f\u4e94\u4e0a\u5348\uff099\u70b9\u5728\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u62405\u53f7\u697c334\u4f1a\u8bae\u5ba4\u4e3e\u884c\u3002\u672c\u6b21\u6d3b\u52a8\u7531\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f\u548cInForSec<\/span>\u8bba<\/span>\u575b\u5171\u540c\u4e3e\u529e\uff0c\u9080\u8bf7\u5230\u4e86\u963f\u91cc\u4e91\u674e\u6653\u5b81\u5b89\u5168\u67b6\u6784\u5e08\u3001\u65b0\u52a0\u5761<\/span>\u56fd<\/span>\u7acb\u5927\u5b66\u6881\u632f\u51ef\u6559\u6388\u548c\u534f\u540c\u521b\u65b0\u56e2\u961f\u6210\u5458\u65f6\u78ca\u526f\u7814\u7a76\u5458\uff0c\u4e09\u4f4d\u5b66\u8005\u5c06\u5206\u522b\u5e26\u6765\u7cbe\u5f69\u62a5\u544a\u3002\u62a5\u544a\u5c06\u901a\u8fc7InForSec\u8bba\u575b\u7f51\u4e0a\u5b9e\u65f6\u8f6c\u64ad\uff0c\u656c\u8bf7\u5173\u6ce8\u3002<\/span><\/p>\n

\u4e3b<\/span><\/b>\u529e<\/span><\/b>\uff1a<\/span><\/b>\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f<\/span><\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0<\/span>InForSec<\/span>\u7f51<\/span>\u5b89\u56fd\u9645\u5b66\u672f<\/span>\u8bba<\/span>\u575b<\/span><\/p>\n

\u65f6\u95f4\uff1a<\/span><\/b>2017<\/span>\u5e74<\/span>4<\/span>\u6708<\/span>14<\/span>\u65e5\uff08\u5468\u4e94\uff09\u4e0a\u5348<\/span>9<\/span>:<\/span>0<\/span>0-<\/span>12<\/span>:<\/span>0<\/span>0<\/span><\/p>\n

\u5730\u70b9<\/span><\/strong>\uff1a<\/span><\/b>\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u62405\u53f7\u697c334\u4f1a\u8bae\u5ba4<\/span><\/p>\n

\u4f1a\u8bae\u8bae\u7a0b<\/span><\/b><\/p>\n\n\n\n\n\n\n\n
\n

\u4e8b \u9879<\/b><\/p>\n<\/td>\n

\n

\u4e3b<\/b>\u8bb2<\/b>\u5609\u5bbe<\/b><\/p>\n<\/td>\n

\n

\u4e3b<\/b>\u9898<\/b><\/p>\n<\/td>\n<\/tr>\n

\n

9\uff1a00-12\uff1a00<\/p>\n<\/td>\n

\u4e3b\u6301\u4eba\uff1a\u82cf\u749e\u777f\u00a0\u00a0\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u7814\u7a76\u5458<\/td>\n<\/tr>\n
\n

9:00-10:00<\/p>\n<\/td>\n

\u4e13\u5bb6<\/span>\u62a5\u544a<\/span><\/td>\n\u674e\u6653\u5b81\u00a0\u00a0\u963f\u91cc\u4e91\u5b89\u5168\u67b6\u6784\u5e08<\/td>\nNEVER LET YOUR GUARD DOWN: FINDING UNGUARDED GATES TO BYPASS CONTROL FLOW GUARD WITH BIG DATA<\/span><\/td>\n<\/tr>\n
\n

10<\/span>:<\/span>0<\/span>0-<\/span>11<\/span>:<\/span>00<\/span><\/p>\n<\/td>\n

\u4e13\u5bb6\u62a5\u544a<\/td>\n\u6881<\/span>\u632f\u51ef<\/span>\u00a0\u65b0<\/span>\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u6559\u6388<\/span><\/td>\nOpen and Intelligent Binary Analysis<\/span><\/td>\n<\/tr>\n
\n

11<\/span>:<\/span>0<\/span>0-<\/span>12<\/span>:<\/span>0<\/span>0<\/span><\/p>\n<\/td>\n

\u4e13\u5bb6\u62a5\u544a<\/td>\n\u65f6\u78ca<\/span>\u00a0<\/span>\u00a0\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f<\/span>\u526f<\/span>\u7814\u7a76\u5458<\/span><\/td>\nVisual Analytics and Its Applications to Software Anomaly Detection<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\uff08\u8bba<\/span>\u575b\u53c2\u4e0e\u56de\u6267<\/span>\u201c<\/span><\/span>\u59d3\u540d+\u5355\u4f4d<\/span>+<\/span>\u624b\u673a<\/span>+<\/span>\u90ae\u7bb1<\/span>\u201d<\/span>\u8bf7\u53d1\u9001\u5230<\/span><\/span>\uff1a<\/span>inforsec@g<\/span><\/u>mail.<\/u>com<\/span><\/u><\/span>\uff09<\/span><\/p>\n

\u5185\u5bb9\u6458\u8981<\/span><\/b>\u53ca\u5609\u5bbe<\/span><\/b>\u4ecb\u7ecd<\/span><\/b><\/p>\n

1\u3001<\/span>\u00a0<\/span>\u6f14\u8bb2<\/span><\/b>\u5609\u5bbe<\/span><\/b>\uff1a<\/span><\/b>\u674e<\/span>\u6653\u5b81<\/span>\u00a0\u00a0\u963f<\/span>\u91cc\u4e91<\/span>\u5b89\u5168<\/span>\u67b6\u6784\u5e08<\/span><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/span><\/b>\u4e3b\u9898\uff1aNEVER LET YOUR GUARD DOWN: FINDING UNGUARDED GATES TO BYPASS CONTROL FLOW GUARD WITH BIG DATA<\/span><\/b><\/p>\n

\u5185\u5bb9<\/span><\/b>\u6458\u8981\uff1a<\/span><\/b><\/p>\n

Control Flow Guard (CFG) is a security mechanism to prevent indirect branches (indirect call\/jmp) to redirect control flow to unexpected locations. It was originally released by Microsoft with Windows 8.1 and currently implemented in Window 10 as an enhanced security feature. CFG works by inserting a control-flow check-function before each critical indirect branch at compiling time, while the check-function will validate the target address using CFG bitmap at runtime.<\/span>
\nAlthough there have been multiple updates of CFG which fixed most of the vulnerabilities reported, our study is able to find more weak spots that can lead to CFG’s bypass under the most recently updated Windows 10, using a very efficient tool set we developed.<\/span>
\nWe use performance-monitor-unit (PMU) based instrumentation tool to collect the context information of all indirect calls at runtime by triggering interrupt when each indirect call takes place. Then SPARK-based big data approach is used for data screening and analysis.<\/span>
\nIn summary, with such method and toolset, we are able to find multiple vulnerabilities that can lead to CFG’s bypass in different applications running under Windows 10. This talk will present not only the results, but also the methodology and tools used to find such vulnerabilities.<\/span><\/p>\n

\u5609\u5bbe<\/span><\/b>\u7b80\u4ecb<\/span><\/b>\uff1a<\/span><\/b><\/p>\n

Xiaoning Li is chief security architect at Alibaba cloud and previously worked as security research and architect at Intel labs focused on analyzing\/detecting\/preventing 0 day\/malware with existing\/new processor features. For the past 10+ years, his work has been focusing on both hardware\/software security system co-design and advanced threat research. Xiaoning holds 20+ grant\/filling patents in security areas including processor\/system security and has published more than 20+ conference\/invited talks including BlackHat, CanSecWest, ShmooCon, Source etc.<\/span><\/p>\n

2\u3001<\/span>\u00a0<\/span>\u6f14\u8bb2<\/span><\/b>\u5609\u5bbe<\/span><\/b>\uff1a<\/span><\/b>\u6881<\/span>\u632f\u51ef<\/span>\u00a0\u00a0\u65b0<\/span>\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u6559\u6388<\/span><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/span><\/b>\u4e3b\u9898<\/span><\/b>\uff1a<\/span><\/b>Open and Intelligent Binary Analysis<\/span><\/b><\/p>\n

\u5185\u5bb9<\/span><\/b>\u6458\u8981\uff1a<\/span><\/b>Binary analysis helps to understand binary programs and make connections about program behaviors. It is a fundamental technique for system security. However, the advancement of binary analysis techniques cannot match the pace at which attacks are evolving in sophistication. We examine the challenges faced by binary analysis and new potentials of binary analysis to address the challenges. In particular, we focus on the dimensions of openness and intelligence. To make better reasoning about security problems, binary analysis tools need better interoperability. We discuss the difficulty faced in our research and the need for an open architecture. Meanwhile, machine-learning techniques have shown their potential in understanding binaries. We will examine the potential and limitations of adopting such techniques in binary analysis.<\/span><\/p>\n

\u5609\u5bbe\u7b80\u4ecb<\/span><\/b>\uff1a<\/span><\/b><\/p>\n

Zhenkai Liang is an Associate Professor of the School of Computing, National University of Singapore. His main research interests are in system and software security, web security, mobile security, and program analysis. He has served as the technical program committee members of many system security conferences, including the ACM Conference on Computer and Communications Security (CCS), USENIX Security Symposium and the Network and Distributed System Security Symposium (NDSS). He is also an associate editor of the IEEE Transaction on Dependable and Secure Computing. As a co-author, he received the Best Paper Award in ICECCS 2014, the Best Paper Award in W2SP 2014, the ACM SIGSOFT Distinguished Paper Award at ESEC\/FSE 2009, the Best Paper Award at USENIX Security Symposium 2007, and the Outstanding Paper Award at ACSAC 2003.\u00a0 He also won the Annual Teaching Excellence Award of NUS in 2014 and 2015.\u00a0 He received his Ph.D. degree in Computer Science from Stony Brook University in 2006, and B.S. degrees in Computer Science and Economics from Peking University in 1999.<\/span><\/p>\n

3\u3001<\/span>\u00a0<\/span>\u6f14\u8bb2<\/span><\/b>\u5609\u5bbe<\/span><\/b>\uff1a<\/span><\/b>\u65f6<\/span>\u78ca<\/span>\u00a0\u00a0\u00a0<\/span>\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f<\/span>\u526f<\/span>\u7814\u7a76\u5458<\/span><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/span><\/b>\u4e3b\u9898\uff1a<\/span><\/b>Visual Analytics and Its Applications to Software Anomaly Detection<\/span><\/p>\n

\u5185\u5bb9<\/span><\/b>\u6458\u8981\uff1a<\/span><\/b><\/p>\n

Visual analytics is an interdisciplinary research area blending information science, graphic design, software engineering, and human-computer interaction. The fundamental methodology is to bridge the cutting edge computational data analysis techniques (e.g., machine learning and data mining) with the gifted analytics capability of human through intuitive and interactive visualization interfaces. In the past decade, the prolific research outputs in this area have demonstrated its success in solving \u201chard\u201d data analysis problems, notably, the exploratory analysis task over big and complex data sets. On the other hand, anomaly detection is known as a generic research problem in many domains, whose goal is to find patterns in data that do not conform to normal behaviors. Anomaly detection is hard mainly because there is often no well-defined model of normality and the potential states to check grow exponentially in number as the scope of anomaly detection expands. In many ways, visual analytics based methods have shown their superiority than both algorithm-only and visualization-only solutions. In this talk, after brief introductions on visual analytics and anomaly detection, I will focus on the application of visual analytics techniques to software anomaly detection in domains such as Internet of Things, social media and security. Several real-life examples are described to illustrate the effectiveness of this technique. Future directions are also discussed.<\/span><\/p>\n

\u5609\u5bbe\u7b80\u4ecb<\/span><\/b>\uff1a<\/span><\/b><\/p>\n

Lei Shi is an associate research professor in the State Key Laboratory of Computer Science, Institute of Software, Chinese Academy of Sciences. Before that, he was a research staff member and research manager at IBM Research – China. He holds B.S. (2003), M.S. (2006) and Ph.D. (2008) degrees from Department of Computer Science and Technology, Tsinghua University. His research interests span Information Visualization, Visual Analytics, Data Mining and Networked Systems, with more than 70 papers published in interdisciplinary venues, such as IEEE TVCG, TC, VIS, ICDM, Infocom, ACM Sigcomm and CSCW. He is the recipient of IBM Research Accomplishment Award on “Visual Analytics” and the IEEE VAST Challenge Award twice in 2010 and 2012.<\/span><\/p>\n

\"\"<\/a><\/span><\/p>\n

\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u534f\u540c\u521b\u65b0\u56e2\u961f<\/span><\/b><\/p>\n

\u626b\u63cf\u5173\u6ce8<\/span><\/p>\n

\u00a0<\/span><\/p>\n

\u00a0<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

\u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240&InForSec \u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f\u6c99\u9f99\u7b2c\u4e00\u6b21\u6d3b\u52a8\u9884\u544a \u201c\u8f6f\u4ef6\u667a\u80fd\u5206\u6790\u201d\u5b66\u672f… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-1881","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1881","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1881"}],"version-history":[{"count":6,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1881\/revisions"}],"predecessor-version":[{"id":1892,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/1881\/revisions\/1892"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1881"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1881"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1881"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}