{"id":3047,"date":"2019-03-02T22:24:50","date_gmt":"2019-03-02T13:39:50","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=3047"},"modified":"2019-03-15T11:19:53","modified_gmt":"2019-03-15T02:34:53","slug":"%e5%be%b7%e5%9b%bdcispa%e4%b8%ad%e5%bf%83%e6%b8%85%e5%8d%8e%e5%a4%a7%e5%ad%a6-%e5%ad%a6%e6%9c%af%e4%ba%a4%e6%b5%81%e4%bc%9a","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=3047","title":{"rendered":"\u5fb7\u56fdCISPA\u4e2d\u5fc3@\u6e05\u534e\u5927\u5b66\u5c06\u4e8e3\u670811\u65e5\u4e3e\u529e\u5b66\u672f\u4ea4\u6d41\u4f1a"},"content":{"rendered":"

\u5fb7\u56fdCISPA\u4e2d<\/b><\/strong>\u5fc3<\/b><\/strong>@\u6e05\u534e<\/b><\/strong>\u5927\u5b66<\/b><\/strong>\u00a0\u5b66\u672f\u4ea4\u6d41\u4f1a<\/b><\/strong><\/p>\n

\u4eba\u5de5\u667a\u80fd\u65f6\u4ee3\u7684\u9690\u79c1\u4fdd\u62a4\u548c\u7f51\u7edc\u7cfb\u7edf\u5b89\u5168<\/b><\/strong>\u00a0<\/b><\/strong><\/p>\n

\u4e3b\u529e\uff1a\u6e05\u534e<\/b><\/strong>\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/b><\/strong><\/p>\n

\u534f\u529e<\/b><\/strong>\uff1a<\/b><\/strong>\u7f51\u5b89\u56fd\u9645\u8bba<\/b><\/strong>\u575b<\/b><\/strong>\uff08InForSec\uff09<\/b><\/strong><\/p>\n

\u65f6\u95f4\uff1a<\/b><\/strong>3<\/b><\/strong>\u6708<\/b><\/strong>11<\/b><\/strong>\u65e5\uff08\u5468\u4e00\uff09\u4e0a\u5348<\/b><\/strong>9<\/b><\/strong>:<\/b><\/strong>0<\/b><\/strong>0~1<\/b><\/strong>2<\/b><\/strong>:<\/b><\/strong>05<\/b><\/strong>\u00a0\u00a0\u00a0<\/b><\/strong><\/p>\n

\u5730\u70b9\uff1a\u6e05\u534e<\/b><\/strong>\u5927\u5b66<\/b><\/strong>FIT\u697c<\/b><\/strong>\u4e8c\u5c42\u591a<\/b><\/strong>\u529f\u80fd<\/b><\/strong>\u5385<\/b><\/strong><\/p>\n

\u00a0\u4f1a\u8bae\u65e5\u7a0b<\/b><\/strong><\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
\n

\u65f6\u95f4<\/b><\/strong><\/p>\n<\/td>\n

\n

\u6f14\u8bb2\u5609\u5bbe<\/b><\/strong><\/p>\n<\/td>\n

\n

\u5de5\u4f5c\u5355\u4f4d<\/b><\/strong><\/p>\n<\/td>\n

\n

\u6f14\u8bb2\u4e3b\u9898<\/b><\/strong><\/p>\n<\/td>\n<\/tr>\n

\n

8:30-9:00<\/p>\n<\/td>\n

\n

\u7b7e\u5230\u00a0<\/p>\n<\/td>\n<\/tr>\n

\n

9:00-12:05<\/p>\n<\/td>\n

\n

\u4e3b\u6301\u4eba\uff1a\u00a0\u6bb5\u6d77\u65b0\u00a0\u00a0\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n<\/td>\n<\/tr>\n

\n

9:00-9:05<\/p>\n<\/td>\n

\n

\u6e05\u534e\u5927\u5b66\u5434\u5efa\u5e73\u9662\u58eb\u81f4\u6b22\u8fce\u8bcd<\/p>\n<\/td>\n<\/tr>\n

\n

9:05-9:25<\/p>\n<\/td>\n

\n

Michael Backes<\/p>\n<\/td>\n

\n

\u5fb7\u56fdCISPA\u4e2d\u5fc3\u4e3b\u4efb<\/p>\n<\/td>\n

\n

Introduction to CISPA Helmholtz Center for Information Security<\/p>\n<\/td>\n<\/tr>\n

\n

9:25-9:50<\/p>\n<\/td>\n

\n

\u5218\u83b9<\/p>\n<\/td>\n

\n

\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u526f\u9662\u957f<\/p>\n<\/td>\n

\n

Introduction to Institute for Network Science and Cyberspace of Tsinghua Univ.<\/p>\n<\/td>\n<\/tr>\n

\n

9:50-10:00<\/p>\n<\/td>\n

\n

\u8336\u6b47<\/p>\n<\/td>\n<\/tr>\n

\n

10:00-10:25<\/p>\n<\/td>\n

\n

Yang Zhang<\/p>\n<\/td>\n

\n

\u5fb7\u56fdCISPA\u4e2d\u5fc3\u7814\u7a76\u5458<\/p>\n<\/td>\n

\n

Quantifying Privacy Risks of Machine Learning Models and Biomedical Data<\/p>\n<\/td>\n<\/tr>\n

\n

10:25-10:50<\/p>\n<\/td>\n

\n

\u5f20\u8d85<\/p>\n<\/td>\n

\n

\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u526f\u6559\u6388<\/p>\n<\/td>\n

\n

Discover vulnerabilities with fuzzing<\/p>\n<\/td>\n<\/tr>\n

\n

10:50-11:15<\/p>\n<\/td>\n

\n

Mario Fritz<\/p>\n<\/td>\n

\n

\u5fb7\u56fdCISPA\u4e2d\u5fc3\u6559\u5e08<\/p>\n<\/td>\n

\n

The Bright and Dark Sides of Computer Vision: Challenges and Opportunities for Privacy and Security<\/p>\n<\/td>\n<\/tr>\n

\n

11:15-11:40<\/p>\n<\/td>\n

\n

Sven Bugiel<\/p>\n<\/td>\n

\n

\u5fb7\u56fdCISPA\u4e2d\u5fc3\u6559\u5e08<\/p>\n<\/td>\n

\n

Quantifying and Mitigating the Threat of Third-party Libraries on Android<\/p>\n<\/td>\n<\/tr>\n

\n

11:40-12:05<\/p>\n<\/td>\n

\n

\u6bb5\u6d77\u65b0<\/p>\n<\/td>\n

\n

\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662\u6559\u6388<\/p>\n<\/td>\n

\n

Boxes In The Middle(BITM) of End-To-End Communication\u2014\u2014Blessing or Curse\uff1f<\/p>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

\u00a0<\/b><\/strong>\u6f14\u8bb2<\/b><\/strong>\u4eba\u53ca\u6f14\u8bb2\u5185\u5bb9\u6458\u8981<\/b><\/strong><\/p>\n

1\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba<\/b><\/strong>:<\/b><\/strong>Michael Backes\uff08\u5fb7\u56fdCISPA\u4e2d\u5fc3\u4e3b\u4efb\uff09<\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2\u4e3b<\/b><\/strong>\u9898:<\/b><\/strong>\u00a0Introduction to CISPA Helmholtz Center for Information Security<\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981:\u00a0<\/b><\/strong>The Helmholtz Center for Information Security (CISPA) is a German national science Institution within the Helmholtz Association. CISPA seeks to have strong and decisive global impact on research, transfer, and innovation by combining cutting-edge, often disruptive foundational research with innovative application-oriented research, corresponding technology transfer and societal outreach. Thematically, it covers the full spectrum from theory to empirical research. CISPA serves as a distinguished center of excellence for cybersecurity and privacy research of highest international renown, and as an elite training ground for the next generation of cybersecurity experts and scienti\ufb01c leaders in this \ufb01eld. During the past 3 years, CISPA researchers have published 45 papers in the leading security conferences IEEE S&P, ACM CCS, Usenix Security, and NDSS. CISPA is constantly ranked top-3 in the field worldwide, see, e.g., CSrankings.org: (http:\/\/csrankings.org\/#\/index?sec&world<\/a>).<\/p>\n

\u6f14\u8bb2\u4eba<\/b><\/strong>\u4ecb\u7ecd\uff1a<\/b><\/strong>Michael Backes is the Founding Director and CEO of the Helmholtz Center for Information Security (CISPA). His current research focuses on the development of methods for protecting personal data, especially medical data; investigating trustworthy methods for Machine Learning as well as universal solutions in Software and System Security. Over the last years, Mr. Backes has significantly shaped the scientific field of Cybersecurity \u2013 on a national as well as an international level. His research findings are documented in over 250 peer-reviewed publications in prestigious international journals and conference proceedings and have been honored with highly renowned awards, in particular the ERC Synergy Grant, the EU\u2019s most distinguished research award. In 2009, Mr. Backes was Germany\u2019s first researcher to receive the MIT TR35 Award: the best 35 researchers worldwide below the age of 35, across all disciplines, whose \u201caccomplishments are poised to have a dramatic impact on the world as we know it\u201d. He is the youngest member to date in acaTech, the National Academy of Science and Engineering, is regularly listed in numerous rankings as one of Germany\u00b4s most influential IT personalities, and was distinguished by the former Federal Minister Johanna Wanka as one of Germany\u2019s digital heads. He has received a honorary doctorate by Universit\u00e9 de Lorraine and is an IEEE Fellow.<\/p>\n

2<\/b><\/strong>\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba\uff1a<\/b><\/strong>Yang Zhang\uff08\u5fb7\u56fdCISPA\u4e2d<\/b><\/strong>\u5fc3\uff09<\/b><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2\u4e3b<\/b><\/strong>\u9898\uff1a<\/b><\/strong>Title: Quantifying Privacy Risks of Machine Learning Models and Biomedical Data\u00a0<\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981<\/b><\/strong>\uff1a<\/b><\/strong>The advancement of modern technologies has totally changed people’s lives during the past decade. While keeping on improving our life quality, these new technologies raise severe concerns about people\u2019s privacy. In this talk, I will cover our recent work on assessing privacy risks stemming from machine learning models and biomedical data. First, I will talk about membership inference attacks against machine learning models. We show how to relax adversary\u2019s assumptions to achieve a model and data independent membership inference attack. Then, I will discuss our ongoing works on attacking online learning systems. We propose five effective attacks in this surface ranging from predicting attributes of the dataset used to update a machine learning model to reconstructing the updating dataset itself. Second, I will talk about our research on assessing the privacy risks of biomedical data. In particular, I will cover our recent work on establishing a beacon system for sharing DNA methylation data following a privacy-by-design approach.\u00a0<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba\u7b80\u4ecb<\/b><\/strong>\uff1aYang Zhang is an independent research group leader at CISPA Helmholtz Center for Information Security, Saarbruecken, Germany. Previously, he was a postdoc working in the group of Prof. Michael Backes at CISPA from January, 2017 to December, 2018. Dr. Zhang obtained his Ph.D. degree from University of Luxembourg on November, 2016 under the supervision of Prof. Sjouke Mauw and Dr. Jun Pang. Prior to that, he obtained his bachelor (2009) and master (2012) degrees from Shandong University. Dr. Zhang\u2019s research mainly concentrates on data privacy. Topics include machine learning privacy, biomedical privacy, social network privacy, and location privacy. Besides, he also works on urban computing, social media analysis, and data mining. \u00a0Dr. Zhang has published multiple papers at top venues in computer science including WWW, CCS, and NDSS. His work has received NDSS 2019 distinguished paper award. Dr. Zhang has served in the technical program committee of ACM CCS 2019 and ISMB 2019.<\/p>\n

3<\/b><\/strong>\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba\uff1a\u5f20\u8d85<\/b><\/strong>\uff08\u6e05\u534e<\/b><\/strong>\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/b><\/strong>\u526f<\/b><\/strong>\u6559\u6388\uff09<\/b><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u00a0<\/b><\/strong>\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898:<\/b><\/strong>\u00a0Discover vulnerabilities with fuzzing<\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981<\/b><\/strong>:Memory corruption vulnerabilities in software are one of the most severe threats to cyber security, allowing attackers to alter the program\u2019s behavior or take full control of it by hijacking its control flow. Vulnerability discovery is therefore critical for both defenders and attackers. Fuzzing is one of the most popular solutions nowadays. A lot of progresses are made by both industry and academia in recent years. In this talk, the speaker will review some recent advances in fuzzing, and present his team\u2019s work in vulnerability discovery.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba\u4ecb\u7ecd<\/b><\/strong>: Dr. Chao Zhang is an Associate Professor at Tsinghua University. Prior to joining Tsinghua, he graduated from Peking University and did postdoc research in UC Berkeley with Dawn Song. His research interest lies in system and software security, especially in vulnerability and malware analysis. His defense solution FPGate won the Special Recognition Award in Microsoft’s BlueHat Prize Contest in 2012. He co-led a team CodeJitsu from UC Berkeley and built a system Glactica able to perform automated binary analysis, vulnerability detection, assessment and defense, which did excellently in the Cyber Grand Challenge launched by DARPA in 2016. He is the coach of the CTF team Blue-Lotus.<\/p>\n

\u00a0<\/b><\/strong>4<\/b><\/strong>\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba\uff1a<\/b><\/strong>Mario Fritz\uff08\u5fb7\u56fdCISPA\u4e2d\u5fc3\u6559\u5e08\uff09<\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898: <\/b><\/strong>The Bright and Dark Sides of Computer Vision: Challenges and Opportunities for Privacy and Security<\/p>\n

\u5185\u5bb9\u6458<\/b><\/strong>\u8981<\/b><\/strong>: Computer vision and machine learning as a whole have made great progress in past years and — in particular with the advances in deep learning — has reached a qualitatively different level of performance. On of my goals is to understand the implication on privacy and security aspects of these new approaches. I will talk about our work towards a Visual Privacy Advisor that aims at assessing private information in images, giving advice to users and redacting unwanted information from images. Second, I\u2019ll outline how our recent work on modeling uncertainty in deep learning plays a key role in order to facilitate future goals such as safe autonomous driving. Third, I will describe how our latest work on reverse engineering and model stealing provides a better understanding of threats to intellectual property and security of machine learning models.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba\u4ecb\u7ecd\uff1a<\/b><\/strong>\u00a0Mario Fritz is faculty member at the CISPA Helmholtz Center for Information Security, Saarbruecken, Germany. Previously, he was senior researcher at the Max Planck Institute for Informatics and post-doc at UC Berkeley and the International Computer Science Institute on a Feodor Lynen Research Fellowship of the Alexander von Humboldt Foundation. His research focus is at the intersection of Artificial Intelligence & Machine Learning with Security & Privacy. His recent work focuses on Deep Learning techniques that allow end-to-end training of complex and multi-modal approaches. He has over 90 publications \u2014 50 in top venues. His key contributions include work on visual domain adaptation, latent factor models, the Visual Turing Test and privacy in visual data. He has served as area chair for ECCV and ICCV, is associate editor of TPAMI and is member of the ACM Europe Technology Policy Committee.<\/p>\n

5<\/b><\/strong>\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba\uff1a<\/b><\/strong>Sven Bugiel\uff08\u5fb7\u56fdCISPA\u4e2d\u5fc3\u6559\u5e08\uff09<\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2\u4e3b<\/b><\/strong>\u9898:<\/b><\/strong>\u00a0Quantifying and Mitigating the Threat of Third-party Libraries on Android<\/p>\n

\u5185\u5bb9\u6458<\/b><\/strong>\u8981:<\/b><\/strong>\u00a0Third-party code has become an indispensable aspect of modern app development. It simplifies repetitive and everyday tasks, eases integration of services (like social media, etc.), and allows developers to share their knowledge conveniently. However, third-party code is a double-edged sword. For Android, research has repeatedly shown that third-party libraries not only increase their host apps\u2019 attack surface and putting user data at risk but sometimes even act surreptitiously against the users\u2019 interests. In this talk, we will present recent results on detecting third-party libraries version-specific within Android applications, allowing us for the first time to quantify their impact on the Android ecosystem and outlining possible paths for improving the status quo of outdated libraries in apps. We further introduce a compiler-based application instrumentation framework, developed at CISPA, and show how it can be used to automatically compartmentalize third-party libraries on Android to establish better protection of user privacy. Lastly, we briefly introduce object capabilities as a paradigm shift for representing privileges on Android to facilitate app compartmentalization more efficiently.<\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4eba\u4ecb\u7ecd\uff1a<\/b><\/strong>Sven Bugiel is a tenure-track faculty at CISPA and since 2016 heads the Trusted Systems Group. Sven did his PhD at Saarland University\/CISPA under the supervision of Prof. Michael Backes. Sven\u2019s primary research interest is mobile security, with a strong focus on system security solutions, such as mandatory access control and integration of hardware security primitives. More recently, he extended his research focus to empirical, large-scale analysis of the mobile ecosystem as well as security and usability aspects of human authentication.<\/p>\n

6<\/b><\/strong>\u3001\u6f14\u8bb2<\/b><\/strong>\u4eba\uff1a<\/b><\/strong>\u6bb5<\/b><\/strong>\u6d77\u65b0<\/b><\/strong>\uff08\u6e05\u534e<\/b><\/strong>\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/b><\/strong>\u6559\u6388<\/b><\/strong>\uff09<\/b><\/strong><\/p>\n

\"\"<\/a><\/p>\n

\u6f14\u8bb2<\/b><\/strong>\u4e3b\u9898<\/b><\/strong>: Boxes In The Middle(BITM) of End-To-End Communication\u2014\u2014Blessing or Curse\uff1f\u00a0<\/p>\n

\u5185\u5bb9<\/b><\/strong>\u6458\u8981\uff1a<\/b><\/strong>The most popular protocols, like HTTP and TLS, are designed following the End-to-End principle, which was cherished by most pioneers of Internet. However, with the evolutionary development of the Internet, \u00a0middle boxes (firewall, cache, proxy, CDN and etc.) have been extensively deployed in current Internet communication, especially in DNS \u00a0and web applications. While Box-In-The-Middle(BITM) improves security, performance and availability, it introduces many new vulnerabilities as well. Professor Duan will introduce security threats of BITM \u00a0in web communications, including injection of Ads or malicious content, leakage of privacy, cache poisoning and denial of service. He will also give some mitigation solutions for the threats which might be helpful for Internet applications designers, developers and service providers. \u00a0\u00a0<\/p>\n

\u00a0\u6f14\u8bb2\u4eba<\/b><\/strong>\u4ecb\u7ecd\uff1a<\/b><\/strong>Dr Haixin Duan is a professor at the Institute for Network Science and Cyberspace, Tsinghua University. He was once a visiting scholar at UC Berkeley and a senior scientist in International Computer Science Institute(ICSI). \u00a0Dr. Duan \u00a0has been working on network security for more than 20 years. His recent research interests include protocol security, intrusion detection, underground economy detection and etc. \u00a0Some of his research results were deployed by industries like Baidu and Huawei, and \u00a0published in top security conferences like Security & Privacy, USENIX Security, CCS, NDSS and SIGCOMM.\u00a0<\/p>\n

\u00a0<\/p>\n\n\n

<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

\u5fb7\u56fdCISPA\u4e2d\u5fc3@\u6e05\u534e\u5927\u5b66\u00a0\u5b66\u672f\u4ea4\u6d41\u4f1a \u4eba\u5de5\u667a\u80fd\u65f6\u4ee3\u7684\u9690\u79c1\u4fdd\u62a4\u548c\u7f51\u7edc\u7cfb\u7edf\u5b89\u5168\u00a0 \u4e3b\u529e\uff1a\u6e05\u534e\u5927\u5b66\u7f51\u7edc… Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3047","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3047","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3047"}],"version-history":[{"count":8,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3047\/revisions"}],"predecessor-version":[{"id":3078,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/3047\/revisions\/3078"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3047"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3047"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3047"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}