{"id":4126,"date":"2020-08-02T16:57:29","date_gmt":"2020-08-02T08:12:29","guid":{"rendered":"https:\/\/www.inforsec.org\/wp\/?p=4126"},"modified":"2020-08-02T16:57:29","modified_gmt":"2020-08-02T08:12:29","slug":"%e3%80%90inforsec%e5%ad%a6%e6%9c%af%e6%b4%bb%e5%8a%a8%e3%80%91%e7%bd%91%e7%bb%9c%e7%a9%ba%e9%97%b4%e5%ae%89%e5%85%a8%e5%9b%bd%e9%99%85%e5%ad%a6%e6%9c%af%e6%88%90%e6%9e%9c%e5%88%86%e4%ba%ab%ef%bc%88","status":"publish","type":"post","link":"http:\/\/202.112.238.40\/wp\/?p=4126","title":{"rendered":"\u3010InForSec\u5b66\u672f\u6d3b\u52a8\u3011\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e0b\uff09"},"content":{"rendered":"\n

InForSec\u5b9a\u4e8e2020\u5e748\u670812\u65e5(\u5468\u4e09)\u4e0b\u5348\u53ca8\u670813\u65e5\uff08\u5468\u56db\uff09\u4e0b\u5348\u5728\u7ebf\u4e3e\u529e\u201c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e0b\uff09\u201d\u6d3b\u52a8\u3002\u672c\u6b21\u5b66\u672f\u6d3b\u52a8\u5c06\u9080\u8bf7\u5728\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u9876\u7ea7\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u6587\u7684\u7814\u7a76\u8005\u5206\u4eab\u4ed6\u4eec\u7684\u6700\u65b0\u7814\u7a76\u6210\u679c\uff0c\u5e76\u5c31\u7814\u7a76\u8fc7\u7a0b\u4e2d\u7684\u7075\u611f\u3001\u7ecf\u9a8c\u548c\u4f53\u4f1a\u8fdb\u884c\u6df1\u5165\u4ea4\u6d41\u3002\u6b64\u6b21\u9080\u8bf7\u7684\u8bae\u9898\u8986\u76d6\u7f51\u5b89\u7814\u7a76\u9886\u57df\u7684\u8bf8\u591a\u524d\u6cbf\u95ee\u9898\uff0c\u5305\u62ec\u201c\u79fb\u52a8\u5b89\u5168\uff08Mobile Security\uff09\u201d\u3001\u201c\u5e94\u7528\u5bc6\u7801\uff08Applied Crypto\uff09\u201d\u3001\u201c\u4eba\u5de5\u667a\u80fd\u5b89\u5168\uff08AI Security\uff09\u201d\u4ee5\u53ca\u201c\u7f51\u7edc\u7a7a\u95f4\u5a01\u80c1\uff08Cyber Threat\uff09\u201d\u3002<\/p>\n\n\n\n

\u4e3b\u9898\uff1a<\/strong>\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e0b\uff09<\/p>\n\n\n\n

\u65f6\u95f4\uff1a<\/strong>2020\u5e748\u670812\u65e5~13\u65e5\uff08\u5468\u4e09\uff5e\u56db\uff09<\/p>\n\n\n\n

\u5730\u70b9\uff1a<\/strong>\u5317\u4eac\u56fd\u5bb6\u4f1a\u8bae\u4e2d\u5fc3<\/p>\n\n\n\n

\u4e3b\u529e\uff1a<\/strong>\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u56fd\u9645\u5b66\u672f\u8bba\u575b\uff08InForSec\uff09<\/p>\n\n\n\n

\u627f\u529e\uff1a<\/strong>\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u79d1\u5b66\u4e0e\u7f51\u7edc\u7a7a\u95f4\u7814\u7a76\u9662<\/p>\n\n\n\n

\u00a0 \u00a0 \u00a0 \u00a0 \u590d\u65e6\u5927\u5b66\u8f6f\u4ef6\u5b66\u9662\u7cfb\u7edf\u8f6f\u4ef6\u4e0e\u5b89\u5168\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

\u534f\u529e\uff1a<\/strong>\u5317\u4eac\u4fe1\u606f\u79d1\u5b66\u4e0e\u6280\u672f\u56fd\u5bb6\u7814\u7a76\u4e2d\u5fc3<\/p>\n\n\n\n

         \u6d59\u6c5f\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u7814\u7a76\u4e2d\u5fc3<\/p>\n\n\n\n

         \u5bc6\u7801\u79d1\u5b66\u6280\u672f\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

         \u4e2d\u56fd\u79d1\u5b66\u9662\u8ba1\u7b97\u6280\u672f\u7814\u7a76\u6240\u8ba1\u7b97\u673a\u4f53\u7cfb\u7ed3\u6784\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

         \u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u6240\u53ef\u4fe1\u8ba1\u7b97\u4e0e\u4fe1\u606f\u4fdd\u969c\u5b9e\u9a8c\u5ba4<\/p>\n\n\n\n

         \u767e\u5ea6\u5b89\u5168<\/p>\n\n\n\n

         \u5947\u5b89\u4fe1\u96c6\u56e2<\/p>\n\n\n\n

         \u8682\u8681\u96c6\u56e2
<\/p>\n\n\n\n

\u7b80\u8981\u8bae\u7a0b<\/strong>
<\/p>\n\n\n\n

8\u670812\u65e5<\/strong><\/p>\n\n\n\n

\u00b7 \u56fd\u9645\u5b89\u5168\u9876\u4f1a\u5206\u4eab\u62a5\u544a\u4f1a\uff1aSession 1 \u5e94\u7528\u5bc6\u7801\uff08Applied Crypto\uff09 <\/p>\n\n\n\n

\u00b7 \u56fd\u9645\u5b89\u5168\u9876\u4f1a\u5206\u4eab\u62a5\u544a\u4f1a\uff1aSession 2  \u79fb\u52a8\u5b89\u5168\uff08Mobile Security\uff09<\/p>\n\n\n\n

8\u670813\u65e5<\/strong><\/p>\n\n\n\n

\u00b7 \u56fd\u9645\u5b89\u5168\u9876\u4f1a\u5206\u4eab\u62a5\u544a\u4f1a\uff1aSession 3  \u4eba\u5de5\u667a\u80fd\u5b89\u5168\uff08AI Security\uff09<\/p>\n\n\n\n

\u00b7\u00a0\u56fd\u9645\u5b89\u5168\u9876\u4f1a\u5206\u4eab\u62a5\u544a\u4f1a\uff1aSession 4 \u00a0\u7f51\u7edc\u7a7a\u95f4\u5a01\u80c1\uff08Cyber Threat\uff09<\/p>\n\n\n\n

\u626b\u7801\u62a5\u540d<\/strong><\/p>\n\n\n\n

\"\"<\/figure><\/div>\n\n\n\n

\u9644\uff1a<\/p>\n\n\n\n

\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e0b\uff09\u8bae\u7a0b<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\u4f1a\u8bae\u7ec4\u7ec7\u59d4\u5458\u4f1a<\/strong>
<\/p>\n\n\n\n

  • \u6bb5\u6d77\u65b0\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u6e05\u534e\u5927\u5b66\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/li><\/ul>\n\n\n\n
    • \u6768\u00a0 \u00a0 \u73c9\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u590d\u65e6\u5927\u5b66\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/li><\/ul>\n\n\n\n
      • \u5f20\u00a0 \u00a0 \u6e90\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u590d\u65e6\u5927\u5b66\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/li><\/ul>\n\n\n\n
        • \u7eaa\u5b88\u9886\u00a0 \u00a0 \u00a0 \u00a0 \u00a0 \u00a0\u6d59\u6c5f\u5927\u5b66\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0<\/li><\/ul>\n\n\n\n
          • \u5f20\u00a0 \u00a0 \u6c5f\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u5bc6\u7801\u79d1\u5b66\u6280\u672f\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4\u00a0\u00a0<\/li>
          • <\/li><\/ul>\n\n\n\n

            \u5609\u5bbe\u7b80\u4ecb<\/strong>
            <\/p>\n\n\n\n

            \u7a0b\u8d8a\u5f3a\u00a0\u00a0\u767e\u5ea6\u7814\u7a76\u9662\uff08\u5317\u7f8e\uff09<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aCOIN Attacks: On Insecurity of Enclave Untrusted Interfaces in SGX<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            Intel SGX is a hardware-based trusted execution environment (TEE), which enables an application to compute on confidential data in a secure enclave. SGX assumes a powerful threat model, in which only the CPU itself is trusted; anything else is untrusted, including the memory, firmware, system software, etc. An enclave interacts with its host application through an exposed, enclave-specific, (usually) bi-directional interface. This interface is the main attack surface of the enclave. The attacker can invoke the interface in any order and inputs. It is thus imperative to secure it through careful design and defensive programming.<\/p>\n\n\n\n

            In this work, we systematically analyze the attack models against the enclave untrusted interfaces and summarized them into the COIN attacks — Concurrent, Order, Inputs, and Nested. Together, these four models allow the attacker to invoke the enclave interface in any order with arbitrary inputs, including from multiple threads. We then build an extensible framework to test an enclave in the presence of COIN attacks with instruction emulation and concolic execution. We evaluated ten popular open-source SGX projects using eight vulnerability detection policies that cover information leaks, control-flow hijackings, and memory vulnerabilities. We found 52 vulnerabilities. In one case, we discovered an information leak that could reliably dump the entire enclave memory by manipulating the inputs. Our evaluation highlights the necessity of extensively testing an enclave before its deployment.<\/p>\n\n\n\n

            \u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

            Yueqiang Cheng is a Senior Staff Security Scientist at Baidu Security Research. His research revolves around building secure systems and software and includes SGX\/SEV security, virtualization security, rowhammer security, and hardware security. He has received 2 Best Paper awards and published several high-quality papers in top security conferences and journals, such as ASPLOS, USENIX Security, NDSS, ICSE, IEEE TIFS, and IEEE TDSC, ACM TISSEC.<\/p>\n\n\n\n

            \u9648\u5385 \u7535\u5b50\u79d1\u6280\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aTokenSope: \u81ea\u52a8\u68c0\u6d4b\u4ee5\u592a\u574a\u4ee3\u5e01\u4e0d\u4e00\u81f4\u884c\u4e3a<\/strong><\/p>\n\n\n\n

            \uff08\u672c\u6587\u53d1\u8868\u5728CCS\u201919\u4e0a\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u6211\u5c06\u5728\u672c\u6b21\u62a5\u544a\u4ecb\u7ecd\u6211\u4eec\u5728CCS 2019\u53d1\u8868\u7684\u4e00\u4efd\u5de5\u4f5c\uff0c\u81ea\u52a8\u68c0\u6d4b\u4ee3\u5e01\u4e0d\u4e00\u81f4\u884c\u4e3a\u3002\u4ee3\u5e01\u884c\u4e3a\u662f\u5426\u4ee3\u5e01\u6807\u51c6\u4e00\u81f4\u662f\u4e00\u4e2a\u672a\u7ecf\u5145\u5206\u7814\u7a76\u7684\u95ee\u9898\uff0c\u4e0d\u4e00\u81f4\u7684\u884c\u4e3a\u4f1a\u8ff7\u60d1\u7528\u6237\u548c\u5bfc\u81f4\u8d22\u4ea7\u635f\u5931\u3002\u6211\u4eec\u63d0\u51fa\u4e86\u4e00\u4e2a\u65b0\u7684\u65b9\u6cd5\u81ea\u52a8\u5316\u7684\u68c0\u6d4b\u4e0d\u4e00\u81f4\u884c\u4e3a\uff0c\u6b64\u65b9\u6cd5\u6bd4\u8f83\u4ece\u6838\u5fc3\u6570\u636e\u7ed3\u6784\u7684\u4fee\u6539\u63a8\u5bfc\u51fa\u7684\u4ee3\u5e01\u884c\u4e3a\u3001\u4ece\u6807\u51c6\u63a5\u53e3\u611f\u77e5\u7684\u4ee3\u5e01\u884c\u4e3a\u548c\u4ece\u6807\u51c6\u4e8b\u4ef6\u63a2\u77e5\u7684\u4ee3\u5e01\u884c\u4e3a\u3002\u6211\u4eec\u5b9e\u73b0\u4e86\u4e00\u4e2a\u65b0\u7684\u5de5\u5177\uff0c\u540d\u4e3aTokenScope\uff0c\u5e76\u5c06\u5176\u7528\u4e8e\u68c0\u6d4b\u6240\u6709\u4ee5\u592a\u574a\u4ea4\u6613\u3002\u6211\u4eec\u68c0\u6d4b\u5230\u4e863,259,001\u6761\u4ea4\u6613\uff0c\u89e6\u53d1\u4e867,472\u4e2a\u4ee3\u5e01\u5408\u7ea6\u7684\u4e0d\u4e00\u81f4\u884c\u4e3a\u3002TokenScope\u7684\u51c6\u786e\u6027\u4e3a99.9%\u3002\u6b64\u5916\uff0c\u6211\u4eec\u53d1\u73b0\u4e86\u4e0d\u4e00\u81f4\u80cc\u540e\u768411\u4e2a\u4e3b\u8981\u539f\u56e0\uff0c\u5305\u62ec\uff1a\u7f3a\u9677\u4ee3\u5e01\u3001\u6807\u51c6\u65b9\u6cd5\u7f3a\u5931\u3001\u7f3a\u5c11\u6807\u51c6\u4e8b\u4ef6\u7b49\u3002\u6211\u4eec\u53d1\u73b0\u4e8650\u4e2a\u6b64\u524d\u672a\u88ab\u62a5\u9053\u7684\u7f3a\u9677\u4ee3\u5e01\u3002
            <\/p>\n\n\n\n

            \u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

            \u9648\u5385\u4e8e2013\u5e74\u83b7\u5f97\u7535\u5b50\u79d1\u6280\u5927\u5b66\u535a\u58eb\u5b66\u4f4d\uff0c\u76ee\u524d\u662f\u7535\u5b50\u79d1\u6280\u5927\u5b66\u8ba1\u7b97\u673a\u79d1\u5b66\u4e0e\u5de5\u7a0b\u5b66\u9662\u526f\u6559\u6388\u3002\u4ed6\u7684\u7814\u7a76\u9886\u57df\u5305\u62ec\u533a\u5757\u94fe\u5b89\u5168\u548c\u8f6f\u4ef6\u5b89\u5168\uff0c\u5728\u77e5\u540d\u7684\u4f1a\u8bae\u548c\u671f\u520a\u53d1\u8868\u591a\u7bc7\u5b66\u672f\u8bba\u6587\uff0c\u5305\u62ec\uff1aCCS 2019\u3001ESEM 2019\u3001ICDCS 2019\u3001ICSE 2018\u3001INFOCOM 2018\u3001USENIX SECURITY 2017\u3001SANER 2017\u3002\u4ed6\u5728\u533a\u5757\u94fe\u9886\u57df\u7684\u7814\u7a76\u83b7\u5f97\u4e86INFOCOM 2018\u6700\u4f73\u8bba\u6587\u5956\u30012018\u4e2d\u56fd\u533a\u5757\u94fe\u6700\u4f73\u8bba\u6587\u5956\u3001ISPEC 2017\u6700\u4f73\u8bba\u6587\u5956\u548cESEM 2019\u6700\u4f73\u8bba\u6587\u63d0\u540d<\/p>\n\n\n\n

            \u5b81\u5efa\u5ef7 \u798f\u5efa\u5e08\u8303\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aPrivDPI: Privacy-Preserving Encrypted Traffic Inspection with Reusable Obfuscated Rules<\/strong><\/p>\n\n\n\n

            \uff08ACM CCS 2019\uff09<\/strong>
            <\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            Network middleboxes perform deep packet inspection (DPI) to detect anomalies and suspicious activities in network traffic. However, increasingly these traffic are encrypted and middleboxes can no longer make sense of them. A recent proposal by Sherry et al. (SIGCOMM 2015), named BlindBox, enables the middlebox to perform inspection in a privacy-preserving manner. BlindBox deploys garbled circuit to generate encrypted rules for the purpose of inspecting the encrypted traffic directly. However, the setup latency (which could be 97s on a ruleset of 3,000 as reported) and overhead size incurred by garbled circuit are high. Since communication can only be commenced after the encrypted rules being generated, such delay is intolerable in many real-time applications. In this work, we present PrivDPI, which reduces the setup delay while retaining similar privacy guarantee. Compared to BlindBox, for a ruleset of 3,000, our encrypted rule generation is 288x faster and requires 290,227x smaller overhead for the first session, and is even 1,036x faster and requires 3424,505x smaller overhead over 20 consecutive sessions. The performance gain is based on a new technique for generating encrypted rules as well as the idea of reusing intermediate results generated in previous sessions across subsequent sessions. This is in contrast to Blindbox which performs encrypted rule generation from scratch for every session. Nevertheless, PrivDPI is 6x slower in generating the encrypted traffic tokens, yet in our implementation, the token encryption rate of PrivDPI is more than 17,271 per second which is sufficient for many real-time applications. Moreover, the intermediate values generated in each session can be reused across subsequent sessions for repeated tokens, which could further speedup token encryption. Overall, our experiment shows that PrivDPI is practical and especially suitable for connections with short flows.<\/p>\n\n\n\n

            \u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n

            \u5b81\u5efa\u5ef7\uff0c\u535a\u58eb\uff0c\u798f\u5efa\u5e08\u8303\u5927\u5b66\u6570\u5b66\u4e0e\u4fe1\u606f\u5b66\u9662\u6559\u6388\uff0cACM\u4f1a\u5458\u30022016\u5e7412\u6708\u83b7\u4e0a\u6d77\u4ea4\u901a\u5927\u5b66\u535a\u58eb\u5b66\u4f4d\uff0c\u5148\u540e\u5728\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u3001\u65b0\u52a0\u5761\u7ba1\u7406\u5927\u5b66\u4ece\u4e8b\u535a\u58eb\u540e\u7814\u7a76\uff0c\u4e3b\u8981\u4ece\u4e8b\u516c\u94a5\u5bc6\u7801\u3001\u7f51\u7edc\u5b89\u5168\u7b49\u65b9\u9762\u7684\u7814\u7a76\uff0c\u7814\u7a76\u5de5\u4f5c\u4ee5\u7b2c\u4e00\u4f5c\u8005\u8eab\u4efd\u53d1\u8868\u4e8eACM CCS\u3001IEEE TIFS\u3001IEEE TDSC\u3001ESORICS\u7b49\u5b66\u672f\u4f1a\u8bae\u548c\u671f\u520a\u3002\u4e3b\u6301\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u9762\u4e0a\u9879\u76ee1\u9879\uff0c\u53c2\u4e0e\u65b0\u52a0\u5761\u4e0e\u4e2d\u56fd\u591a\u9879\u79d1\u7814\u9879\u76ee\uff0c\u5305\u62ec\u65b0\u52a0\u5761\u653f\u5e9c\u3001\u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u3001\u65b0\u52a0\u5761\u7535\u4fe1\u4e09\u65b9\u8054\u5408\u9879\u76ee\u3001\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1A3\u524d\u77bb\u8ba1\u5212\u9879\u76ee\u4e0e\u91cd\u70b9\u9879\u76ee\u7b49\uff0c\u591a\u6b21\u5411\u65b0\u52a0\u5761\u56fd\u9632\u90e8\u3001\u65b0\u52a0\u5761\u7535\u4fe1\u7b49\u673a\u6784\u63d0\u4f9b\u7814\u7a76\u62a5\u544a\uff1b\u62c5\u4efbESORICS\u7b49\u5b66\u672f\u4f1a\u8bae\u7a0b\u5e8f\u59d4\u5458\u4f1a\u59d4\u5458\u3002<\/p>\n\n\n\n

            \u5411\u9633\u66e6 \u5317\u4eac\u90ae\u7535\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aHyperService: Interoperability and Programmability Across Heterogeneous Blockchains\uff08\u672c\u6587\u53d1\u8868\u5728CCS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            Blockchain interoperability, which allows state transitions across different blockchain networks, is critical functionality to facilitate major blockchain adoption. Existing interoperability protocols mostly focus on atomic token exchanges between blockchains.However, as blockchains have been upgraded from passive distributed ledgers into programmable state machines (thanks to smart contracts), the scope of blockchain interoperability goes beyond just token exchanges. In this paper, we present HyperService, the first platform that delivers interoperability and programmability across heterogeneous blockchains. HyperService is powered by two innovative designs: (i) a developer-facing programming framework that allows developers to build cross-chain applications in a unified programming model; and (ii) a secure blockchain-facing cryptography protocol that provably realizes those applications on blockchains. We implement a prototype of HyperService in approximately 35,000 lines of code to demonstrate its practicality. Our experiments show that (i) HyperService imposes reasonable latency, in order of seconds, on the end-to-end execution of cross-chain applications; (ii) the HyperService platform is scalable to continuously incorporate new large-scale production blockchains.<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u5411\u9633\u66e6\uff0c\u5317\u4eac\u90ae\u7535\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u5b9e\u9a8c\u73ed\u672c\u79d1\u751f\u3002\u5927\u4e00\u81f3\u5927\u4e09\u670d\u5f79\u4e8e\u5317\u4eac\u90ae\u7535\u5927\u5b66acm\u96c6\u8bad\u961f\uff0c\u83b7icpc\u91d1\u5956\u4e00\u679a\uff0c\u94f6\u5956\u4e24\u679a\u3002\u5bf9\u533a\u5757\u94fe\u7cfb\u7edf\u6709\u8f83\u6df1\u7814\u7a76\u3002<\/p>\n\n\n\n

            \u6d2a\u6f84\u00a0 \u963f\u91cc\u5df4\u5df4\u96c6\u56e2\u5b89\u5168\u603b\u76d1<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a\u5b89\u5168\u591a\u65b9\u8ba1\u7b97\u6280\u672f\u53ca\u5176\u5728\u963f\u91cc\u5df4\u5df4\u7684\u5e94\u7528<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u6570\u636e\u5df2\u7ecf\u6210\u4e3a\u4e92\u8054\u7f51\u65f6\u4ee3\u4f01\u4e1a\u7684\u6838\u5fc3\u7ade\u4e89\u529b\u3002\u6570\u636e\u4f5c\u4e3a\u4e00\u79cd\u65b0\u80fd\u6e90\uff0c\u53ea\u6709\u6d41\u52a8\u8d77\u6765\u624d\u80fd\u4ea7\u751f\u4ef7\u503c\uff0c\u7136\u800c\u5b9e\u9645\u60c5\u51b5\u4e0b\u5927\u591a\u6570\u4f01\u4e1a\u51fa\u4e8e\u6570\u636e\u5b89\u5168\u53ca\u9690\u79c1\u4fdd\u62a4\u7b49\u8003\u8651\uff0c\u4f9d\u7136\u5bf9\u6570\u636e\u5171\u4eab\u6301\u975e\u5e38\u4fdd\u5b88\u7684\u6001\u5ea6\u3002<\/p>\n\n\n\n

            \u5b89\u5168\u591a\u65b9\u8ba1\u7b97\uff08MPC\uff09\u53ef\u4ee5\u6253\u7834\u6570\u636e\u5b64\u5c9b\uff0c\u5b9e\u73b0\u6570\u636e\u7684\u53ef\u63a7\u5171\u4eab\uff0c\u540c\u65f6\u6700\u5c0f\u5316\u6570\u636e\u6cc4\u9732\u98ce\u9669\uff0c\u5177\u6709\u91cd\u8981\u7684\u7406\u8bba\u548c\u73b0\u5b9e\u610f\u4e49\u3002\u76ee\u524d\u90e8\u5206MPC\u6280\u672f\u5df2\u7ecf\u8fdb\u5165\u4e86\u5b9e\u7528\u5316\u9636\u6bb5\u3002\u672c\u62a5\u544a\u5c06\u8bb2\u8ff0\u5b89\u5168\u591a\u65b9\u8ba1\u7b97\u6280\u672f\u53ca\u5176\u5728\u963f\u91cc\u5df4\u5df4\u7ecf\u6d4e\u4f53\u4e1a\u52a1\u4e2d\u7684\u5e94\u7528\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u6d2a\u6f84\uff0c\u963f\u91cc\u5df4\u5df4\u96c6\u56e2\u5b89\u5168\u603b\u76d1\uff0c2006\u5e74\u83b7\u4e2d\u56fd\u79d1\u5b66\u6280\u672f\u5927\u5b66\u8f6f\u4ef6\u5de5\u7a0b\u5b66\u58eb\u5b66\u4f4d\uff0c2012\u5e74\u83b7\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u4fe1\u606f\u5b89\u5168\u535a\u58eb\u5b66\u4f4d\u3002\u7814\u7a76\u5174\u8da3\u5305\u62ec\u6570\u636e\u5e93\u5b89\u5168\u3001\u6570\u636e\u5b89\u5168\u4e0e\u9690\u79c1\u4fdd\u62a4\u3001\u5e94\u7528\u5bc6\u7801\u5b66\u7b49\uff0c\u66fe\u5728EUROCRYPT\uff0cSIGMOD\u3001VLDB\u7b49\u56fd\u5185\u5916\u76f8\u5173\u671f\u520a\u3001\u4f1a\u8bae\u53d1\u8868\u8bba\u658710\u4f59\u7bc7\uff0c\u62c5\u4efb\u5bc6\u7801\u5b66\u62a5\uff0cIEEE Transactions on Dependable and Secure Computing (TDSC) \u7b49\u5ba1\u7a3f\u4eba\u3002\u73b0\u5728\u963f\u91cc\u5b89\u5168\u90e8\u8d1f\u8d23\u5b89\u5168\u591a\u65b9\u8ba1\u7b97\u3001\u540c\u6001\u52a0\u5bc6\u7b49\u524d\u6cbf\u6280\u672f\u7684\u7814\u7a76\uff0c\u53ca\u5176\u5728\u963f\u91cc\u7ecf\u6d4e\u4f53\u7684\u63a8\u5e7f\u5e94\u7528\u3002<\/p>\n\n\n\n

            \u90c1\u6631 \u4e0a\u6d77\u4ea4\u901a\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aLEAF\uff1a\u57fa\u4e8e\u540c\u6001\u52a0\u5bc6\u7684\u9ad8\u6548\u5bc6\u6587\u68c0\u7d22\u6280\u672f<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u5bc6\u6587\u68c0\u7d22\uff08secure search\uff09\u901a\u5e38\u662f\u6307\u901a\u8fc7\u52a0\u5bc6\u6570\u636e\u5e93\u8fdb\u884c\u6570\u636e\u67e5\u8be2\uff0c\u5e76\u4e14\u6570\u636e\u5e93\u670d\u52a1\u65e0\u6cd5\u77e5\u6089\u88ab\u67e5\u8be2\u7684\u5177\u4f53\u5185\u5bb9\u3002\u5c3d\u7ba1\u5bc6\u6587\u68c0\u7d22\u6280\u672f\u5728\u6570\u636e\u9690\u79c1\u7b49\u65b9\u9762\u5177\u5907\u91cd\u8981\u7684\u5e94\u7528\u4ef7\u503c\uff0c\u4f46\u662f\u7531\u4e8e\u5176\u4e3b\u8981\u4f9d\u8d56\u4e8e\u5168\u540c\u6001\u52a0\u5bc6(FHE)\u6280\u672f\uff0c\u6240\u9700\u7684\u540c\u6001\u64cd\u4f5c(\u7279\u522b\u662f\u4e58\u6cd5\u64cd\u4f5c)\u7684\u8ba1\u7b97\u5f00\u9500\u8f83\u9ad8\uff0c\u4f7f\u8be5\u6280\u672f\u96be\u4ee5\u5728\u73b0\u5b9e\u4e2d\u90e8\u7f72\u548c\u5e94\u7528\u3002<\/p>\n\n\n\n

            Akavia\u7b49\u5b66\u8005\u5728\u6b64\u524d\u7684\u5de5\u4f5c[CCS 2018, PETS 2019]\u4e2d\u63d0\u51fa\u4e86\u65b0\u7684\u65b9\u6cd5\uff0c\u4f7f\u5f97\u68c0\u7d22\u7b97\u6cd5\u4e2d\u7684\u4e58\u6cd5\u64cd\u4f5c\u6570\u91cf\u4eceO(n^2)\u964d\u5230\u4e86$O(n log^2 n)$, \u4ee5\u53ca\u8fdb\u4e00\u6b65\u964d\u5230\u4e86$O(n log n)$\uff0c\u5176\u4e2dn\u662f\u6570\u636e\u5e93\u4e2d\u6570\u636e\u8bb0\u5f55\u7684\u6570\u91cf\u3002\u672c\u6587\u63d0\u51fa\u4e86\u4e00\u79cd\u57fa\u4e8e\u5168\u540c\u6001\u52a0\u5bc6\u7684\u79f0\u4e3a\u201cLEAF\u201d\u7684\u5168\u65b0\u7684\u5b89\u5168\u68c0\u7d22\u534f\u8bae\uff0c\u5c06\u4e58\u6cd5\u64cd\u4f5c\u6570\u91cf\u9996\u6b21\u964d\u4f4e\u5230O(n)\u7684\u590d\u6742\u5ea6\u3002\u65b0\u534f\u8bae\u4e2d\uff0c\u5f15\u5165\u4e86\u4e09\u79cd\u65b0\u7684\u65b9\u6cd5\u2014\u2014\u201c\u672c\u5730\u5316\u201d\u3001\u201c\u62bd\u53d6\u201d\u3001\u548c\u201c\u91cd\u6784\u201d\uff0c\u5e76\u4e14\u5728\u7f51\u7edc\u5c42\u9762\u4e5f\u5177\u5907\u975e\u5e38\u4f4e\u7684\u901a\u4fe1\u5f00\u9500\u3002\u901a\u8fc7LEAF\u6280\u672f\uff0c\u67e5\u8be2\u65b9\u4ec5\u9700\u5728\u672c\u5730\u6267\u884c\u89e3\u5bc6\u64cd\u4f5c\uff0c\u76f8\u6bd4\u6b64\u524d\u7684\u65b9\u6cd5\uff0c\u5927\u5927\u7f13\u51cf\u4e86\u67e5\u8be2\u65b9\u7684\u8ba1\u7b97\u538b\u529b\uff0c\u4f7f\u5f97\u5728\u5bc6\u6587\u68c0\u7d22\u573a\u666f\u4e2d\u652f\u6301\u5f31\u8ba1\u7b97\u80fd\u529b\u7684\u79fb\u52a8\u8bbe\u5907\u6210\u4e3a\u53ef\u80fd\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u90c1\u6631\uff0c\u4e0a\u6d77\u4ea4\u901a\u5927\u5b66\uff0c\u6559\u6388\uff0c\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u5305\u62ec\u5bc6\u7801\u57fa\u7840\u7406\u8bba\u3001\u540e\u91cf\u5b50\u5bc6\u7801\u548c\u9690\u79c1\u4fdd\u62a4\u8ba1\u7b97\u7b49\u3002\u90c1\u6631\u5148\u540e\u4ece\u590d\u65e6\u5927\u5b66\u8ba1\u7b97\u673a\u7cfb\u548c\u5357\u6d0b\u7406\u5de5\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u83b7\u5f97\u4e86\u5b66\u58eb\u548c\u535a\u58eb\u5b66\u4f4d\uff0c\u4e4b\u540e\u5728\u6bd4\u5229\u65f6\u9c81\u6c76\u5927\u5b66\u4ece\u4e8b\u535a\u58eb\u540e\u7814\u7a76\u5de5\u4f5c\u3002\u90c1\u535a\u58eb\u591a\u9879\u7814\u7a76\u6210\u679c\u5728\u56fd\u9645\u5bc6\u7801\u5b66\u4f1a\u4e09\u5927\u5bc6\u7801\u4f1a\u3001\u56db\u5927\u4e13\u9898\u5bc6\u7801\u4f1a\u8bae\u3001S&P\u3001 CCS\u7b49\u5bc6\u7801\u4e0e\u4fe1\u606f\u5b89\u5168\u7684\u9876\u7ea7\u4f1a\u8bae\u4e0a\u3002\u4ed6\u76ee\u524d\u62c5\u4efb\u4e86\u4e2d\u56fd\u5bc6\u7801\u5b66\u4f1a\u6570\u5b66\u7406\u8bba\u4e13\u59d4\u4f1a\u59d4\u5458\u3001ASIACRYPT\u6307\u5bfc\u59d4\u5458\u4f1a\u59d4\u5458\u548c\u56fd\u9645\u5bc6\u7801\u5b66\u4f1a\u7406\u4e8b\u4f1a\u89c2\u5bdf\u5458\u3002<\/p>\n\n\n\n

            \u59da\u8fdc \u5357\u4eac\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>DeepIntent: Deep Icon-Behavior Learning for Detecting Intention-Behavior Discrepancy in Mobile Apps \uff08<\/strong>\u672c\u6587\u53d1\u8868\u5728ACM CCS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u5206\u6790\u5b89\u5353\u5e94\u7528\u7684GUI\u610f\u56fe\u4e0e\u5176\u80cc\u540e\u7a0b\u5e8f\u884c\u4e3a\u7684\u4e00\u81f4\u6027\u662f\u53d1\u73b0\u6076\u610f\u884c\u4e3a\u7684\u91cd\u8981\u624b\u6bb5\u3002\u7136\u800c\u5728GUI\u610f\u56fe\u5efa\u6a21\u4e0e\u7a0b\u5e8f\u884c\u4e3a\u5206\u6790\u7b49\u65b9\u9762\u5747\u5b58\u5728\u4e00\u5b9a\u7684\u6311\u6218\u3002\u672c\u6587\u4ece\u4eba\u5de5\u667a\u80fd\u4e0e\u8f6f\u4ef6\u5de5\u7a0b\u7684\u6709\u673a\u534f\u540c\u89d2\u5ea6\u51fa\u53d1\uff0c\u9996\u5148\u901a\u8fc7\u7a0b\u5e8f\u9759\u6001\u5206\u6790\u6280\u672f\u83b7\u53d6GUI\u56fe\u6587\u4e0e\u5176\u89e6\u53d1\u7684\u9690\u79c1\u4f7f\u7528\uff0c\u7136\u540e\u57fa\u4e8e\u4e92\u6ce8\u610f\u529b\u673a\u5236\u5bf9GUI\u56fe\u6587\u610f\u56fe\u4e0e\u9690\u79c1\u4f7f\u7528\u8fdb\u884c\u5efa\u6a21\uff0c\u5e76\u901a\u8fc7\u5f02\u5e38\u68c0\u6d4b\u7684\u624b\u6bb5\u53d1\u73b0\u5b58\u5728\u6f5c\u5728\u9690\u79c1\u6cc4\u9732\u7684GUI\u63a7\u4ef6\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u59da\u8fdc\uff0c\u5357\u4eac\u5927\u5b66\u526f\u7814\u7a76\u5458\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u8f6f\u4ef6\u667a\u80fd\u5316\u3001\u793e\u4ea4\u5a92\u4f53\u6570\u636e\u5206\u6790\u7b49 ;<\/p>\n\n\n\n

            \u9648\u6021 \u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a<\/strong>Devils in the Guidance: Predicting Logic Vulnerabilities in Payment Syndication Services through Automated Documentation Analysis  \uff08<\/strong>\u672c\u6587\u53d1\u8868\u5728USENIX Security 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u903b\u8f91\u6f0f\u6d1e\u7684\u6316\u6398\u901a\u5e38\u4f1a\u5229\u7528\u8f6f\u4ef6\u6587\u6863\u4e2d\u7684\u4fe1\u606f\u53bb\u8fdb\u884c\u4ee3\u7801\u5206\u6790\u3002\u6211\u4eec\u7684\u7814\u7a76\u53d1\u73b0\uff0c\u5728\u505a\u4ee3\u7801\u5206\u6790\u4e4b\u524d\uff0c\u8f6f\u4ef6\u6587\u6863\u672c\u8eab\u5df2\u7ecf\u5305\u542b\u4e86\u4e00\u4e9b\u4fe1\u606f\u53ef\u4ee5\u76f4\u63a5\u9884\u6d4b\u51fa\u903b\u8f91\u6f0f\u6d1e\u3002\u5728\u6211\u7684\u62a5\u544a\u4e2d\uff0c\u4f1a\u4ee5\u805a\u5408\u652f\u4ed8\u4e3a\u4f8b\uff0c\u4ecb\u7ecd\u5982\u4f55\u4ec5\u5229\u7528\u7b2c\u4e09\u65b9\u652f\u4ed8\uff08\u5fae\u4fe1\u3001\u652f\u4ed8\u5b9d\uff09\u5f00\u53d1\u6587\u6863\u548c\u805a\u5408\u652f\u4ed8\u5f00\u53d1\u6587\u6863\u6765\u53d1\u73b0\u805a\u5408\u652f\u4ed8\u7684\u903b\u8f91\u6f0f\u6d1e\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u9648\u6021\uff0c2020\u5e74\u83b7\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u535a\u58eb\u5b66\u4f4d\u3002\u7814\u7a76\u5174\u8da3\u5305\u62ec\u57fa\u4e8e\u6570\u636e\u9a71\u52a8\u7684\u5b89\u5168\u53d1\u73b0\u3001\u79fb\u52a8\u5b89\u5168\u3001\u9690\u79c1\u4fdd\u62a4\u7b49\u3002\u66fe\u5728\u4fe1\u606f\u5b89\u5168\u9876\u7ea7\u4f1a\u8baeS&P\u3001CCS\u3001USENIX\u4e0a\u53d1\u8868\u591a\u7bc7\u8bba\u6587\u3002<\/p>\n\n\n\n

            \u5201\u6587\u745e \u5c71\u4e1c\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aBadBluetooth: Breaking Android Security Mechanisms via Malicious Bluetooth Peripherals  \uff08<\/strong>\u672c\u6587\u53d1\u8868\u5728NDSS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u84dd\u7259\u662f\u4e00\u79cd\u5e7f\u6cdb\u4f7f\u7528\u7684\u901a\u4fe1\u6280\u672f\uff0c\u4e0e\u4e3b\u673a\u8bbe\u5907\u914d\u5bf9\u540e\uff0c\u84dd\u7259\u8bbe\u5907\u4fbf\u53ef\u4ee5\u4e0e\u4e3b\u673a\u4ea4\u6362\u6570\u636e\u548c\u6307\u4ee4\u3002\u4e8e\u6b64\u7c7b\u6570\u636e\u548c\u6307\u4ee4\u7684\u654f\u611f\u6027\uff0c\u84dd\u7259\u534f\u8bae\u4e2d\u5df2\u7ecf\u8bbe\u8ba1\u4e86\u4e00\u4e9b\u5b89\u5168\u9632\u62a4\u63aa\u65bd\uff0c\u4f8b\u5982\u8eab\u4efd\u9a8c\u8bc1\u3001\u52a0\u5bc6\u3001\u6388\u6743\u7b49\u3002\u7136\u800c\uff0c\u6211\u4eec\u53d1\u73b0Android\u4e0a\u7684\u84dd\u7259\u534f\u8bae\u5b9e\u73b0\u5b58\u5728\u8bbe\u8ba1\u7f3a\u9677\uff0c\u4f8b\u5982profile\u6587\u4ef6\u7684\u8eab\u4efd\u8ba4\u8bc1\u8fc7\u7a0b\u5b58\u5728\u4e0d\u4e00\u81f4\u4e0e\u7c97\u7c92\u7c97\u95ee\u9898\uff0c\u53ef\u80fd\u4f1a\u5bfc\u81f4\u4e25\u91cd\u7684\u5b89\u5168\u95ee\u9898\u3002\u4e3a\u4e86\u6df1\u5165\u7406\u89e3\u6b64\u95ee\u9898\uff0c\u6211\u4eec\u7cfb\u7edf\u7814\u7a76\u4e86profile\u6587\u4ef6\u7684\u90e8\u7f72\u673a\u5236\uff0c\u5e76\u63d0\u51fa\u4e86\u5b9e\u9645\u653b\u51fb\u65b9\u6cd5\uff0c\u4ee5\u8bc1\u660e\u6b64\u7c7b\u84dd\u7259\u8bbe\u8ba1\u7f3a\u9677\u7684\u6f5c\u5728\u5371\u5bb3\u3002\u7ed3\u679c\u8868\u660e\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u7ed5\u8fc7Android\u7684\u73b0\u6709\u4fdd\u62a4\u63aa\u65bd\uff08\u4f8b\u5982\uff0c\u6743\u9650\uff0c\u9694\u79bb\u7b49\uff09\uff0c\u53d1\u8d77\u4e2d\u95f4\u4eba\u653b\u51fb\uff0c\u63a7\u5236\u53d7\u5bb3\u5e94\u7528\u548c\u7cfb\u7edf\uff0c\u7a83\u53d6\u654f\u611f\u4fe1\u606f\u7b49\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u5201\u6587\u745e\uff0c2017\u5e74\u535a\u58eb\u6bd5\u4e1a\u4e8e\u9999\u6e2f\u4e2d\u6587\u5927\u5b66\uff0c\u73b0\u4efb\u5c71\u4e1c\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\u201c\u9f50\u9c81\u9752\u5e74\u5b66\u8005\u201d\u7279\u8058\u6559\u6388\uff0c\u4e3b\u8981\u7814\u7a76\u9886\u57df\u4e3a\u79fb\u52a8\u5e73\u53f0\u5b89\u5168\u4e0e\u7269\u8054\u7f51\u7cfb\u7edf\u5b89\u5168\u3002\u7814\u7a76\u6210\u679c\u591a\u6b21\u53d1\u8868\u4e8eIEEE S&P\u3001ACM CCS\u3001NDSS\u3001RAID\u3001ESORICS\u3001DSN\u7b49\u7cfb\u7edf\u5b89\u5168\u9886\u57df\u9876\u7ea7\u4f1a\u8bae\u4e0e\u6743\u5a01\u4f1a\u8bae\u3002<\/p>\n\n\n\n

            \u90ed\u751f\u5065 \u00a0\u767e\u5ea6\u7814\u7a76\u9662\uff08\u7f8e\u56fd\u7845\u8c37\uff09\u5b89\u5168\u7ec4<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aMUZZ: Thread-aware Grey-box Fuzzing for Effective Bug Hunting in Multithreaded Programs<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            Grey-box fuzz testing has revealed thousands of vulnerabilities in real-world software owing to its lightweight instrumentation, fast coverage feedback, and dynamic adjusting strategies. However, directly applying grey-box fuzzing to input-dependent multithreaded programs can be extremely inefficient. In practice, multithreading-relevant bugs are usually buried in the sophisticated program flows. Meanwhile, existing grey-box fuzzing techniques do not stress thread-interleavings that affect execution states in multithreaded programs. Therefore, mainstream grey-box fuzzers cannot adequately test problematic segments in multithreaded software, although they might obtain high code coverage statistics.<\/p>\n\n\n\n

            To this end, we propose Muzz, a new grey-box fuzzing technique that hunts for bugs in multithreaded programs. Muzz owns three novel thread-aware instrumentations, namely coverage-oriented instrumentation, thread-context instrumentation, and schedule-intervention instrumentation. During fuzzing, these instrumentations engender runtime feedback to accentuate execution states caused by thread interleavings. By leveraging such feedback in the dynamic seed selection and execution strategies, Muzz preserves more valuable seeds that expose bugs under a multithreading context.<\/p>\n\n\n\n

            We evaluate Muzz on twelve real-world multithreaded programs. Experiments show that Muzz outperforms AFL in both multithreading-relevant seed generation and concurrency-vulnerability detection. Further, by replaying the target programs against the generated seeds, Muzz also reveals more concurrency-bugs (e.g., data-races, thread-leaks) than AFL. In total, Muzz detected eight new concurrency-vulnerabilities and nineteen new concurrency-bugs. At the time of writing, four reported issues have received CVE IDs.<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u90ed\u751f\u5065\u535a\u58eb\u7cfb\u767e\u5ea6\u7814\u7a76\u9662\uff08\u7f8e\u56fd\u7845\u8c37\uff09\u5b89\u5168\u7ec4\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\uff0c\u5176\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u529f\u80fd\u7279\u6027\u9a71\u52a8\u7684\u591a\u7ebf\u7a0b\/\u591a\u4efb\u52a1\u8f6f\u4ef6\u7684\u72b6\u6001\u7a7a\u95f4\u89c4\u7ea6\u53ca\u526a\u679d\uff0c\u9762\u5411\u5de5\u4e1a\u7ea7\u65e0\u4eba\u9a7e\u9a76\u8f6f\u4ef6\u7cfb\u7edf\u7684\u5b89\u5168\u5206\u6790\uff0c\u57fa\u4e8e\u7b26\u53f7\u6267\u884c\u7684CPU\u7f13\u5b58\u4fa7\u4fe1\u9053\u6cc4\u9732\u7684\u5206\u6790\u548c\u68c0\u6d4b\uff0c\u4ee5\u53ca\u57fa\u4e8eFuzzing\u7684\u6df7\u5408\u6d4b\u8bd5\u53ca\u6f0f\u6d1e\u68c0\u6d4b\u3002\u90ed\u535a\u58eb\u8fd1\u5e74\u6765\u5728\u8f6f\u4ef6\u5de5\u7a0b\u4ee5\u53ca\u5b89\u5168\u9886\u57dfA\u7c7b\u4f1a\u8bae\u53d1\u8868\u7814\u7a76\u957f\u6587\u5341\u4f59\u7bc7\uff0c\u662f\u8f6f\u5de5\u9876\u4f1aFSE 2018\u7684 Distinguished Paper Award\u4ee5\u53ca\u767e\u5ea62019\u5e74\u5ea6TPG TC\u6280\u672f\u521b\u65b0\u5956\u83b7\u5f97\u8005\u3002<\/p>\n\n\n\n

            \u674e\u8fdb\u950b \u963f\u91cc\u5df4\u5df4<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a\u9488\u5bf9\u73b0\u5b9e\u5e94\u7528\u7684\u6587\u672c\u5bf9\u6297\u653b\u51fb\u7814\u7a76\uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eNDSS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u968f\u7740\u6df1\u5ea6\u5b66\u4e60\u6280\u672f\u7684\u53d1\u5c55\uff0c\u57fa\u4e8e\u6df1\u5ea6\u5b66\u4e60\u7684\u6587\u672c\u7406\u89e3\u6280\u672f\u88ab\u5e7f\u6cdb\u5730\u5e94\u7528\u4e8e\u8bb8\u591a\u98ce\u9669\u654f\u611f\u578b\u4efb\u52a1\u4e2d\uff0c\u5982\u60c5\u611f\u5206\u6790\u3001\u6709\u5bb3\u6587\u672c\u5185\u5bb9\u68c0\u6d4b\u7b49\u3002\u7136\u800c\uff0c\u56fe\u50cf\u9886\u57df\u6700\u65b0\u7814\u7a76\u8868\u660e\uff0c\u6df1\u5ea6\u795e\u7ecf\u7f51\u7edc\u5bb9\u6613\u53d7\u5230\u5bf9\u6297\u6837\u4f8b\u653b\u51fb\u3002\u90a3\u4e48\uff0c\u81ea\u7136\u8bed\u8a00\u5904\u7406\u9886\u57df\u662f\u5426\u4e5f\u5b58\u5728\u5bf9\u6297\u6837\u4f8b\u5462\uff1f\u5b9e\u9645\u90e8\u7f72\u5e94\u7528\u81ea\u7136\u8bed\u8a00\u5904\u7406\u7cfb\u7edf\u80fd\u5426\u62b5\u5fa1\u6587\u672c\u5bf9\u6297\u6837\u4f8b\u653b\u51fb\u5462\uff1f\u5728\u672c\u6587\u4e2d\uff0c\u6211\u4eec\u9996\u5148\u63ed\u793a\u4e86\u6df1\u5ea6\u6587\u672c\u7406\u89e3\u7cfb\u7edf\u9488\u5bf9\u5bf9\u6297\u6587\u672c\u7684\u8106\u5f31\u6027\u3002\u63a5\u7740\uff0c\u6211\u4eec\u63d0\u51fa\u4e86\u4e00\u4e2a\u901a\u7528\u7684\u5bf9\u6297\u6587\u672c\u751f\u6210\u6846\u67b6TextBugger\uff0c\u8be5\u6846\u67b6\u53ef\u4ee5\u9488\u5bf9\u73b0\u5b9e\u5e94\u7528\u6709\u6548\u5730\u3001\u9ad8\u6548\u5730\u751f\u6210\u5177\u6709\u9ad8\u53ef\u7528\u6027\u7684\u5bf9\u6297\u6587\u672c\u3002\u6700\u540e\uff0c\u6211\u4eec\u5229\u7528TextBugger\u8bc4\u4f30\u4e8615\u4e2a\u4e1a\u754c\u9886\u5148\u7684\u6df1\u5ea6\u6587\u672c\u7406\u89e3\u7cfb\u7edf\u7684\u5b89\u5168\u6027\uff0c\u540c\u65f6\u5411\u76f8\u5173\u516c\u53f8\u62a5\u544a\u4e86\u6211\u4eec\u53d1\u73b0\u7684\u6a21\u578b\u5b89\u5168\u98ce\u9669\u5e76\u6536\u5230\u4e86\u79ef\u6781\u53cd\u9988\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u674e\u8fdb\u950b\uff0c\u963f\u91cc\u5df4\u5df4\u96c6\u56e2\u7b97\u6cd5\u5de5\u7a0b\u5e08\uff0c2020\u5e74\u83b7\u5f97\u6d59\u6c5f\u5927\u5b66\u8ba1\u7b97\u673a\u6280\u672f\u7855\u58eb\u5b66\u4f4d\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u4eba\u5de5\u667a\u80fd\u5b89\u5168\u3001\u6570\u636e\u9a71\u52a8\u5b89\u5168\u3001\u795e\u7ecf\u7f51\u7edc\u53ef\u89e3\u91ca\u6027\u7b49\u3002<\/p>\n\n\n\n

            \u51cc\u7965 \u6d59\u6c5f\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a\u9762\u5411\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\u7684\u5b89\u5168\u6027\u8bc4\u4f30\u7cfb\u7edf\uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eIEEE S&P 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u968f\u7740\u6df1\u5ea6\u5b66\u4e60\u6280\u672f\u7684\u4e0d\u65ad\u53d1\u5c55\u4e0e\u5e7f\u6cdb\u5e94\u7528\uff0c\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\u7684\u5b89\u5168\u6027\u9762\u4e34\u65e5\u76ca\u4e25\u91cd\u7684\u5b89\u5168\u5a01\u80c1\u3002\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\u672c\u8d28\u4e0a\u5bb9\u6613\u53d7\u5230\u5bf9\u6297\u6837\u672c\u7684\u653b\u51fb\uff0c\u5373\u6076\u610f\u4ea7\u751f\u7684\u8f93\u5165\u6837\u672c\u53ef\u4ee5\u4f7f\u5f97\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\u7684\u8f93\u51fa\u5f02\u5e38\u3002\u867d\u7136\u5f53\u524d\u4e0d\u65ad\u6709\u65b0\u7684\u5bf9\u6297\u6837\u672c\u653b\u51fb\u65b9\u6cd5\u4e0e\u9632\u5fa1\u65b9\u6cd5\u63d0\u51fa\uff0c\u4f46\u662f\u5982\u4f55\u7406\u89e3\u8fd9\u4e9b\u653b\u51fb\u548c\u9632\u5fa1\u65b9\u6cd5\u4f9d\u7136\u5b58\u5728\u5f88\u591a\u969c\u788d\u3002\u4f8b\u5982\uff0c\u5bf9\u653b\u51fb\u800c\u8a00\uff0c\u54ea\u79cd\u653b\u51fb\u65b9\u6cd5\u5bf9\u9632\u5fa1\u65b9\u6cd5\u7684\u89c4\u907f\u6027\u66f4\u9ad8\uff1f\u54ea\u79cd\u653b\u51fb\u65b9\u6cd5\u4e0d\u53d7\u6570\u636e\u9884\u5904\u7406\u5e72\u6270\uff1f\u54ea\u79cd\u653b\u51fb\u4ea7\u751f\u7684\u5bf9\u6297\u6837\u672c\u8fc1\u79fb\u6027\u66f4\u597d\uff1f\u5bf9\u4e8e\u9632\u5fa1\u65b9\u6cd5\u800c\u8a00\uff0c\u54ea\u79cd\u9632\u5fa1\u65b9\u6cd5\u5bf9\u653b\u51fb\u66f4\u6709\u6548\uff1f\u54ea\u79cd\u9632\u5fa1\u65b9\u6cd5\u7684\u6cdb\u5316\u80fd\u529b\u66f4\u5f3a\uff1f\u6a21\u578b\u878d\u5408\u5bf9\u9632\u5fa1\u65b9\u6cd5\u662f\u5426\u771f\u6709\u6548\uff1f\u672c\u8bba\u6587\u9996\u5148\u7b80\u8981\u63a2\u8ba8\u5bf9\u6297\u6837\u672c\u653b\u51fb\u4e0e\u9632\u5fa1\u7684\u7814\u7a76\u8fdb\u5c55\uff0c\u7136\u540e\u4ecb\u7ecd\u6211\u4eec\u63d0\u51fa\u7684\u9762\u5411\u6df1\u5ea6\u5b66\u4e60\u6a21\u578b\u7684\u5b89\u5168\u6027\u8bc4\u4f30\u7cfb\u7edf\u2014DEEPSEC\uff0c\u6700\u540e\u603b\u7ed316\u79cd\u4ee3\u8868\u6027\u5bf9\u6297\u6837\u672c\u653b\u51fb\u65b9\u6cd5\u4e0e13\u79cd\u9632\u5fa1\u65b9\u6cd5\u7684\u8bc4\u4f30\u7ed3\u679c\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u51cc\u7965\uff0c\u6d59\u6c5f\u5927\u5b66\u8ba1\u7b97\u673a\u5b66\u9662\u5728\u8bfb\u535a\u58eb\u751f\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u6570\u636e\u9a71\u52a8\u5b89\u5168\uff0c\u6df1\u5ea6\u5b66\u4e60\u5b89\u5168\uff0c\u56fe\u795e\u7ecf\u7f51\u7edc\u7b49\u3002<\/p>\n\n\n\n

            \u9648\u5b87\u98de \u897f\u5b89\u4ea4\u901a\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1a\u9488\u5bf9\u673a\u5668\u89c6\u89c9\u6570\u636e\u9884\u5904\u7406\u7684\u7ef4\u5ea6\u53d8\u6362\u653b\u51fb\uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eUSENIX Security 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u4e3a\u4e86\u5e94\u5bf9\u4e0d\u540c\u6765\u6e90\u7684\u8f93\u5165\u56fe\u50cf\uff0c\u673a\u5668\u89c6\u89c9\u5e94\u7528\u9700\u8981\u501f\u52a9\u6570\u636e\u7ef4\u5ea6\u53d8\u6362\u6765\u5f97\u5230\u6807\u51c6\u5316\u8f93\u5165\u3002\u672c\u5de5\u4f5c\u5c55\u793a\u4e86\u4e00\u79cd\u9488\u5bf9\u6570\u636e\u7ef4\u5ea6\u53d8\u6362\u64cd\u4f5c\u7684\u6570\u636e\u6d41\u653b\u51fb\u3002\u653b\u51fb\u8005\u901a\u8fc7\u6539\u53d8\u8f93\u5165\u56fe\u50cf\u7ef4\u5ea6\u7279\u6027\uff0c\u4f7f\u5176\u5728\u7ecf\u8fc7\u5c3a\u5bf8\u7ef4\u5ea6\u53d8\u6362\u540e\u8bed\u4e49\u5185\u5bb9\u53d1\u751f\u660e\u663e\u6539\u53d8\uff0c\u5bfc\u81f4\u4eba\u4e0e\u673a\u5668\u7684\u8ba4\u77e5\u5dee\u5f02\uff0c\u4ece\u800c\u5b9e\u73b0\u6b3a\u9a97\u3001\u9003\u9038\u68c0\u6d4b\u7b49\u653b\u51fb\u6548\u679c\u3002\u4e0d\u540c\u4e8e\u73b0\u6709\u5bf9\u6297\u6837\u672c\u76f8\u5173\u7814\u7a76\u5de5\u4f5c\uff0c\u8be5\u653b\u51fb\u65b9\u6cd5\u4e0d\u4f9d\u8d56\u4e8e\u7279\u5b9a\u6a21\u578b\uff0c\u6f5c\u5728\u5f71\u54cd\u8303\u56f4\u66f4\u5e7f\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u9648\u5b87\u98de\uff0c\u897f\u5b89\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\u5728\u8bfb\u535a\u58eb\u751f\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u4eba\u5de5\u667a\u80fd\u7cfb\u7edf\u5b89\u5168\uff0c\u79fb\u52a8\u7ec8\u7aef\u4eba\u673a\u884c\u4e3a\u5206\u6790\u7b49\u3002<\/p>\n\n\n\n

            \u8d75\u6708 \u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aSeeing isn\u2019t Believing: Towards More Robust Adversarial Attack Against Real World Object Detectors \uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eACM CCS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u968f\u7740AI\u6280\u672f\u7684\u5feb\u901f\u53d1\u5c55\u548c\u5e94\u7528\u843d\u5730\uff0c\u76ee\u6807\u68c0\u6d4b\u5df2\u5e94\u7528\u4e8e\u4eba\u8138\u8bc6\u522b\u3001\u667a\u80fd\u76d1\u63a7\u4ee5\u53ca\u6c7d\u8f66\u81ea\u52a8\u9a7e\u9a76\u7b49\u5bf9\u5b89\u5168\u8981\u6c42\u8f83\u9ad8\u7684\u9886\u57df\u4e2d\u3002\u56e0\u6b64\u4eba\u4eec\u5f00\u59cb\u5173\u6ce8\u5bf9\u6297\u6837\u672c\u5bf9\u667a\u80fd\u5e94\u7528\u5b89\u5168\u7684\u5a01\u80c1\uff0c\u800c\u76ee\u524d\u591a\u6570\u5bf9\u6297\u653b\u51fb\u7684\u7814\u7a76\u5de5\u4f5c\u4e3b\u8981\u5173\u6ce8\u6570\u5b57\u9886\u57df\uff0c\u57fa\u4e8e\u6570\u5b57\u9886\u57df\u7684\u5bf9\u6297\u6837\u672c\u901a\u5e38\u6613\u53d7\u5230\u7269\u7406\u73af\u5883\u7684\u52a8\u6001\u4ee5\u53ca\u566a\u58f0\u5f71\u54cd\u800c\u5931\u6548\uff0c\u56e0\u6b64\u672c\u6587\u63d0\u51fa\u9488\u5bf9\u76ee\u6807\u68c0\u6d4b\u5668\u7684\u7269\u7406\u5bf9\u6297\u653b\u51fb\uff0c\u80fd\u591f\u5b9e\u73b0\u8fdc\u8ddd\u79bb\uff08>20m\uff09\u3001\u5bbd\u89d2\u5ea6\u4ee5\u53ca\u4e0d\u540c\u5149\u7ebf\u4e0e\u80cc\u666f\u4e0b\u7684\u9c81\u68d2\u6027\u5bf9\u6297\u653b\u51fb\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u8d75\u6708\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u5728\u8bfb\u535a\u58eb\u751f\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u56fe\u50cf\u4e0e\u8bed\u97f3\u7684\u5bf9\u6297\u653b\u9632\u3001\u540e\u95e8\u68c0\u6d4b\u3001\u795e\u7ecf\u7f51\u7edc\u53ef\u89e3\u91ca\u6027\u7814\u7a76\u7b49\u3002<\/p>\n\n\n\n

            \u674e\u7426 \u6e05\u534e\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aDetecting Fake Accounts in Online Social Networks at the Time of Registrations\uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eCCS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u5728\u7ebf\u793e\u4ea4\u7f51\u7edc(\u5982\u5fae\u4fe1\u3001Twitter\u3001Facebook \u7b49)\u6613\u53d7\u5230\u865a\u5047\u8d26\u53f7\u653b\u51fb\u3002\u653b\u51fb\u8005\u901a\u8fc7\u6ce8\u518c\u5927\u91cf\u7684\u865a\u5047\u8d26\u53f7, \u5728\u793e\u4ea4\u5e73\u53f0\u4e0a\u8fdb\u884c\u5404\u79cd\u6076\u610f\u6d3b\u52a8\uff0c\u4e25\u91cd\u5f71\u54cd\u4e86\u5728\u7ebf\u793e\u4ea4\u7f51\u7edc\u7528\u6237\u7684\u5b89\u5168\u548c\u9690\u79c1\u3002\u672c\u62a5\u544a\u9996\u6b21\u63d0\u51fa\u4e86\u5229\u7528\u7528\u6237\u6ce8\u518c\u6570\u636e\u8fdb\u884c\u865a\u5047\u8d26\u53f7\u68c0\u6d4b\uff0c\u6709\u6548\u904f\u5236\u865a\u5047\u8d26\u53f7\u7684\u5f71\u54cd\u3002\u6211\u4eec\u57fa\u4e8e\u5fae\u4fe1\u7684\u771f\u5b9e\u8d26\u53f7\u6ce8\u518c\u6570\u636e\u8fdb\u884c\u6570\u636e\u5206\u6790,\u53d1\u73b0\u865a\u5047\u8d26\u53f7\u5b58\u5728\u660e\u663e\u7684\u540c\u6b65\u548c\u5f02\u5e38\u6ce8\u518c\u6a21\u5f0f\u3002\u57fa\u4e8e\u6ce8\u518c\u8d26\u53f7\u7684\u540c\u6b65\u548c\u5f02\u5e38\u6a21\u5f0f\u63d0\u51fa\u4e86\u57fa\u4e8e\u56fe\u7684\u865a\u5047\u8d26\u53f7\u68c0\u6d4b\u673a\u5236\u3002\u57fa\u4e8e\u5fae\u4fe1\u771f\u5b9e\u6570\u636e\u7684\u68c0\u6d4b\u7ed3\u679c\u663e\u793a\u6bcf\u767e\u4e07\u7528\u6237\u53ef\u4ee5\u68c0\u6d4b\u8d85\u8fc740\u4e07\u7684\u865a\u5047\u8d26\u53f7\uff0c\u5e76\u53ef\u4ee5\u83b7\u5f9796%\u7684\u68c0\u6d4b\u7cbe\u786e\u7387\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u674e\u7426\u76ee\u524d\u4e3a\u6e05\u534e\u5927\u5b66\u526f\u6559\u6388\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u4e92\u8054\u7f51\u548c\u4e91\u5b89\u5168\u3001\u79fb\u52a8\u5b89\u5168\u4ee5\u53ca\u5927\u6570\u636e\u5b89\u5168\u3002\u53d1\u8868\u8bba\u6587\u5305\u62ecUSENIX Security\u3001ACM CCS\u3001ISOC NDSS\u53caIEEE\/ACM\u6c47\u520a\u7b49\u4f1a\u8bae\u548c\u671f\u520a\u8bba\u6587\u3002\u66fe\u83b7\u5f972017\u5e74\u5317\u4eac\u5e02\u79d1\u5b66\u6280\u672f\u4e8c\u7b49\u5956\u548cSECURECOMM\u6700\u4f73\u8bba\u6587\u7b49\u591a\u9879\u8363\u8a89\u3002\u76ee\u524d\u62c5\u4efbIEEE TDSC\u548cACM DTRAP\u7b49\u56fd\u9645\u671f\u520a\u7684\u7f16\u59d4\uff0c\u4ee5\u53caS&P\u548cNDSS\u7b49\u4f1a\u8bae\u7684\u7a0b\u5e8f\u6216\u7ec4\u7ec7\u59d4\u5458\u4f1a\u59d4\u5458\u3002<\/p>\n\n\n\n

            \u5218\u798f\u627f \u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aLog2vec\uff1a\u57fa\u4e8e\u5f02\u6784\u56fe\u5d4c\u5165\u7684\u7f51\u7edc\u7a7a\u95f4\u5a01\u80c1\u68c0\u6d4b\uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eACM CCS 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u5185\u90e8\u653b\u51fb\u548cAPT\u653b\u51fb\u5bf9\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u6784\u6210\u4e86\u4e25\u91cd\u5a01\u80c1\uff0c\u6709\u6548\u53d1\u73b0\u548c\u68c0\u6d4b\u8fd9\u4e9b\u9ad8\u7ea7\u5a01\u80c1\u4ecd\u9762\u4e34\u5de8\u5927\u6311\u6218\u3002\u672c\u62a5\u544a\u4ecb\u7ecd\u4e86\u6211\u4eec\u5728ACM CCS 2019\u7684\u6700\u65b0\u5de5\u4f5c\uff0c\u63d0\u51fa\u4e86\u57fa\u4e8e\u5f02\u6784\u56fe\u5d4c\u5165\u7684\u5a01\u80c1\u68c0\u6d4b\u7cfb\u7edflog2vec\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u5218\u798f\u627f\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u5728\u8bfb\u535a\u58eb\u3002\u7814\u7a76\u5174\u8da3\u5305\u62ec\u5a01\u80c1\u68c0\u6d4b\u3001APT\u68c0\u6d4b\u548c\u6570\u636e\u6316\u6398\u3002<\/p>\n\n\n\n

            \u9648\u6021 \u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aDevils in the Guidance: Predicting Logic Vulnerabilities in Payment Syndication Services through Automated Documentation Analysis<\/strong>\uff08\u672c\u6587\u53d1\u8868\u5728USENIX Security 2019\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u903b\u8f91\u6f0f\u6d1e\u7684\u6316\u6398\u901a\u5e38\u4f1a\u5229\u7528\u8f6f\u4ef6\u6587\u6863\u4e2d\u7684\u4fe1\u606f\u53bb\u8fdb\u884c\u4ee3\u7801\u5206\u6790\u3002\u6211\u4eec\u7684\u7814\u7a76\u53d1\u73b0\uff0c\u5728\u505a\u4ee3\u7801\u5206\u6790\u4e4b\u524d\uff0c\u8f6f\u4ef6\u6587\u6863\u672c\u8eab\u5df2\u7ecf\u5305\u542b\u4e86\u4e00\u4e9b\u4fe1\u606f\u53ef\u4ee5\u76f4\u63a5\u9884\u6d4b\u51fa\u903b\u8f91\u6f0f\u6d1e\u3002\u5728\u6211\u7684\u62a5\u544a\u4e2d\uff0c\u4f1a\u4ee5\u805a\u5408\u652f\u4ed8\u4e3a\u4f8b\uff0c\u4ecb\u7ecd\u5982\u4f55\u4ec5\u5229\u7528\u7b2c\u4e09\u65b9\u652f\u4ed8\uff08\u5fae\u4fe1\u3001\u652f\u4ed8\u5b9d\uff09\u5f00\u53d1\u6587\u6863\u548c\u805a\u5408\u652f\u4ed8\u5f00\u53d1\u6587\u6863\u6765\u53d1\u73b0\u805a\u5408\u652f\u4ed8\u7684\u903b\u8f91\u6f0f\u6d1e\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u9648\u6021\uff0c2020\u5e74\u83b7\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u535a\u58eb\u5b66\u4f4d\u3002\u7814\u7a76\u5174\u8da3\u5305\u62ec\u57fa\u4e8e\u6570\u636e\u9a71\u52a8\u7684\u5b89\u5168\u53d1\u73b0\u3001\u79fb\u52a8\u5b89\u5168\u3001\u9690\u79c1\u4fdd\u62a4\u7b49\u3002\u66fe\u5728\u4fe1\u606f\u5b89\u5168\u9876\u7ea7\u4f1a\u8baeS&P\u3001CCS\u3001USENIX\u4e0a\u53d1\u8868\u591a\u7bc7\u8bba\u6587\u3002<\/p>\n\n\n\n

            \u674e\u632f\u6e90 \u6d59\u6c5f\u5927\u5b66<\/strong><\/p>\n\n\n\n

            \"\"<\/figure>\n\n\n\n

            \u6f14\u8bb2\u4e3b\u9898\uff1aEffective and Light-Weight Deobfuscation and Semantic-Aware Attack Detection for PowerShell Scripts  \uff08<\/strong>\u672c\u6587\u53d1\u8868\u4e8eCCS’ 19\uff09<\/strong><\/p>\n\n\n\n

            \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n

            \u8d8a\u6765\u8d8a\u591a\u7684\u62a5\u9053\u663e\u793a\uff0cPowerShell\u88ab\u5e7f\u6cdb\u7684\u7528\u4e8e\u5404\u79cd\u7f51\u7edc\u653b\u51fb\u3002\u8fd9\u4e9b\u653b\u51fb\u5305\u62ec\u9ad8\u7ea7\u6301\u7eed\u6027\u5a01\u80c1\u3001\u52d2\u7d22\u75c5\u6bd2\u3001\u7f51\u7edc\u9493\u9c7c\u90ae\u4ef6\u7b49\u7b49\u3002\u57fa\u4e8ePowerShell\u7684\u653b\u51fb\uff0c\u5229\u7528\u4e86PowerShell\u7684\u52a8\u6001\u6027\uff0c\u6784\u9020\u4e86\u590d\u6742\u7684\u6df7\u6dc6\u6a21\u5f0f\uff0c\u7ed5\u8fc7\u4e86\u68c0\u6d4b\u3002\u4e3a\u4e86\u514b\u670d\u8fd9\u4e00\u96be\u9898\uff0c\u6211\u4eec\u63d0\u51fa\u6765\u7b2c\u4e00\u4e2a\u8f7b\u91cf\u4e14\u6709\u6548\u7684\u89e3\u6df7\u6dc6\u65b9\u6848\uff0c\u5e76\u57fa\u4e8e\u89e3\u6df7\u6dc6\u540e\u7684\u811a\u672c\u6784\u9020\u4e86\u57fa\u4e8e\u653b\u51fb\u8bed\u4e49\u7684\u68c0\u6d4b\u7cfb\u7edf\u3002\u5b9e\u9a8c\u663e\u793a\uff0c\u901a\u8fc7\u89e3\u6df7\u6dc6\uff0c\u6211\u4eec\u53ef\u4ee5\u5c06\u6df7\u6dc6\u540e\u811a\u672c\u548c\u539f\u59cb\u811a\u672c\u4e4b\u95f4\u7684\u76f8\u4f3c\u5ea6\u4ece\u4ec50.5\uff05\u63d0\u9ad8\u5230\u4e86\u8fd180\uff05\u3002\u540c\u65f6\u89e3\u6df7\u6dc6\u8fc7\u7a0b\u6709\u6548\u7684\u6539\u5584\u4e86\u5df2\u6709\u7cfb\u7edf\u7684\u68c0\u6d4b\u6548\u7387\uff0cWindows Defender\u548cVirusTotal\u7684\u653b\u51fb\u68c0\u6d4b\u7387\u5206\u522b\u4ece0.3\uff05\u548c2.65\uff05\u5927\u5e45\u589e\u52a0\u523075.0\uff05\u548c90.0\uff05\u3002<\/p>\n\n\n\n

            \u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n

            \u674e\u632f\u6e90\uff0c\u6d59\u6c5f\u5927\u5b66\u5728\u8bfb\u535a\u58eb\uff0c\u7814\u7a76\u5174\u8da3\u5305\u62ec\u7ec8\u7aef\u5b89\u5168\uff0c\u5165\u4fb5\u68c0\u6d4b\uff0c\u5a01\u80c1\u5206\u6790\u7b49\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"

            InForSec\u5b9a\u4e8e2020\u5e748\u670812\u65e5(\u5468\u4e09)\u4e0b\u5348\u53ca8\u670813\u65e5\uff08\u5468\u56db\uff09\u4e0b\u5348\u5728\u7ebf\u4e3e\u529e\u201c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\uff08\u4e0b\uff09\u201d\u6d3b\u52a8\u3002\u672c\u6b21\u5b66\u672f\u6d3b\u52a8\u5c06\u9080\u8bf7\u5728\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u9876\u7ea7\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u6587\u7684\u7814\u7a76\u8005\u5206\u4eab\u4ed6\u4eec\u7684\u6700\u65b0\u7814\u7a76\u6210\u679c\uff0c\u5e76\u5c31\u7814\u7a76\u8fc7\u7a0b\u4e2d\u7684\u7075\u611f\u3001\u7ecf\u9a8c\u548c\u4f53\u4f1a\u8fdb\u884c\u6df1\u5165\u4ea4\u6d41\u3002\u6b64\u6b21\u9080\u8bf7\u7684\u8bae\u9898\u8986\u76d6\u7f51\u5b89\u7814\u7a76\u9886\u57df\u7684\u8bf8\u591a\u524d\u6cbf\u95ee\u9898\uff0c\u5305\u62ec\u201c\u79fb\u52a8\u5b89\u5168\uff08Mobile Security\uff09\u201d\u3001\u201c\u5e94\u7528\u5bc6\u7801\uff08Applied Crypto\uff09\u201d\u3001\u201c\u4eba\u5de5\u667a\u80fd\u5b89\u5168\uff08AI Security\uff09\u201d\u4ee5\u53ca\u201c\u7f51\u7edc\u7a7a\u95f4\u5a01\u80c1\uff08Cyber Threat\uff09\u201d\u3002 Continue reading → <\/span><\/a><\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-4126","post","type-post","status-publish","format-standard","hentry","category-events"],"_links":{"self":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4126","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=4126"}],"version-history":[{"count":5,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4126\/revisions"}],"predecessor-version":[{"id":4153,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=\/wp\/v2\/posts\/4126\/revisions\/4153"}],"wp:attachment":[{"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=4126"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=4126"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/202.112.238.40\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=4126"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}