\u4f1a\u8bae\u7ec4\u7ec7\u59d4\u5458\u4f1a<\/strong>\uff1a<\/p>\n\n\n\n\u6bb5\u6d77\u65b0 \u6e05\u534e\u5927\u5b66 <\/p>\n\n\n\n
\u6b66\u6210\u5c97 \u4e2d\u79d1\u9662\u8ba1\u7b97\u6240 <\/p>\n\n\n\n
\u82cf\u749e\u777f \u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240 <\/p>\n\n\n\n
\u5f20\u7389\u6e05 \u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66<\/p>\n\n\n\n
\u5f20\u6bb7\u4e7e \u5357\u65b9\u79d1\u6280\u5927\u5b66 <\/p>\n\n\n\n
\u6768 \u73c9 \u590d\u65e6\u5927\u5b66 <\/p>\n\n\n\n
\u5f90\u6587\u6e0a \u6d59\u6c5f\u5927\u5b66<\/p>\n\n\n\n
\u738b\u7f8e\u7434 \u5c71\u4e1c\u5927\u5b66<\/p>\n\n\n\n
\u90ed\u5c71\u6e05 \u5c71\u4e1c\u5927\u5b66<\/p>\n\n\n\n
\u5218\u4fdd\u541b \u6e05\u534e\u5927\u5b66<\/p>\n\n\n\n
\u8d3e\u76f8\u5803 \u4e2d\u79d1\u9662\u8f6f\u4ef6\u6240<\/p>\n\n\n\n
\u8d75\u4e91\u534e \u4e2d\u79d1\u9662\u8ba1\u7b97\u6240<\/p>\n\n\n\n
\u5f20 \u6e90 \u590d\u65e6\u5927\u5b66<\/p>\n\n\n\n
\uff08\u201c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u56fd\u9645\u5b66\u672f\u6210\u679c\u5206\u4eab\u53ca\u4ea7\u5b66\u5bf9\u8bdd\uff08\u4e2d\uff09\uff08\u4e0b\uff09\u201d\u6d3b\u52a8\u5c06\u7ee7\u7eed\u5206\u4eab\u56fd\u9645\u9876\u7ea7\u5b66\u672f\u4f1a\u8bae\u7684\u7814\u7a76\u5185\u5bb9\uff0c\u656c\u8bf7\u671f\u5f85\uff01\uff09<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u6f14\u8bb2\u4e3b\u9898\u53ca\u5609\u5bbe\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n\uff08\u6309\u6f14\u8bb2\u987a\u5e8f\u6392\u5217\uff09<\/strong><\/p>\n\n\n\n\u6b66\u6210\u5c97 \u4e2d\u56fd\u79d1\u5b66\u9662\u8ba1\u7b97\u6240\u7814\u7a76\u5458\u7ea7\u9ad8\u5de5<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521105651.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n\u6b66\u6210\u5c97\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u8ba1\u7b97\u6280\u672f\u7814\u7a76\u6240\u7814\u7a76\u5458\u7ea7\u9ad8\u5de5\uff0c\u535a\u58eb\u751f\u5bfc\u5e08\u30022001\u5e74\u4e8e\u4e2d\u56fd\u79d1\u5b66\u9662\u8ba1\u7b97\u6280\u672f\u7814\u7a76\u6240\u83b7\u535a\u58eb\u5b66\u4f4d\u3002\u957f\u671f\u4ece\u4e8b\u57fa\u4e8e\u7f16\u8bd1\u6280\u672f\u7684\u8f6f\u4ef6\u5b89\u5168\u6280\u672f\u7684\u7814\u7a76\uff0c\u65e8\u5728\u901a\u8fc7\u7a0b\u5e8f\u5206\u6790\u6280\u672f\uff0c\u589e\u5f3a\u8f6f\u4ef6\u7684\u5b89\u5168\u6027\u3001\u53ef\u9760\u6027\u548c\u9ad8\u6548\u6027\u3002\u5728\u7a0b\u5e8f\u7f3a\u9677\u5b9a\u4f4d\u3001\u4e8c\u8fdb\u5236\u4ee3\u7801\u7684\u5206\u6790\u53d8\u6362\u53ca\u4f18\u5316\u3001\u8fd0\u884c\u65f6\u7a0b\u5e8f\u884c\u4e3a\u76d1\u6d4b\u3001\u5b89\u5168\u9632\u5fa1\u7b49\u65b9\u9762\uff0c\u6709\u7740\u8f83\u6df1\u7684\u6280\u672f\u79ef\u7d2f\u3002\u53d1\u8868\u8bba\u658730\u4f59\u7bc7\uff0c\u90e8\u5206\u53d1\u8868\u5728TSE\u3001ICSE\u3001ASE\u3001TPDS\u3001TACO\u3001SIGMETRICS\u3001PACT\u3001CGO\u3001VEE\u3001DATE\u7b49\u5b66\u672f\u4f1a\u8bae\u548c\u671f\u520a\u4e0a\uff0c\u83b7\u5f97\u6388\u6743\u4e13\u522916\u9879\uff0c\u8f6f\u4ef6\u8457\u4f5c\u67435\u9879\uff0c\u5e76\u4e8e2012\u5e74\u8363\u83b7\u5317\u4eac\u5e02\u79d1\u5b66\u6280\u672f\u4e8c\u7b49\u5956\u3002\u62c5\u4efb\u56fd\u9645\u5b66\u672f\u4f1a\u8baeCGO 2013\u5927\u4f1a\u4e3b\u5e2d\u3001APPT 2013\u7a0b\u5e8f\u59d4\u5458\u4f1a\u4e3b\u5e2d\uff0c\u8fd8\u62c5\u4efbCGO2015-2018\u3001PPoPP2017-2018\u3001PLDI2012\u3001CCGrid 2015\u3001ICPADS 2014\u3001PPPJ2014\u7b49\u4f1a\u8bae\u7684\u7a0b\u5e8f\u59d4\u5458\u4f1a\u59d4\u5458<\/p>\n\n\n\n
\u6bb5\u6d77\u65b0 \u6e05\u534e\u5927\u5b66\u7f51\u7814\u9662\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/16215830401.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n\u6bb5\u6d77\u65b0\uff0c\u6559\u6388\uff0c\u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7814\u7a76\u9662\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b9e\u9a8c\u5ba4\u4e3b\u4efb\uff0c\u56fd\u52a1\u9662\u5b66\u4f4d\u59d4\u5458\u4f1a\u7b2c\u516b\u5c4a\u5b66\u79d1\u8bc4\u8bae\u7ec4\u6210\u5458\uff0c\u6e05\u534e\u5927\u5b66-\u5947\u5b89\u4fe1\u96c6\u56e2\u8054\u5408\u5b9e\u9a8c\u5ba4\u4e3b\u4efb\u3002\u4ece\u4e8b\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u9886\u57df\u7684\u6559\u5b66\u3001\u79d1\u7814\u548c\u7ba1\u7406\u4e8c\u5341\u591a\u5e74\uff0c\u7814\u7a76\u65b9\u5411\u5305\u62ec\u7f51\u7edc\u57fa\u7840\u8bbe\u65bd\u548c\u534f\u8bae\u5b89\u5168\u3001\u6f0f\u6d1e\u6316\u6398\u3001\u7f51\u7edc\u653b\u51fb\u548c\u5730\u4e0b\u4ea7\u4e1a\u68c0\u6d4b\u7b49\u3002\u66fe\u5e26\u9886\u56e2\u961f\u53d1\u73b0\u4e86\u4e92\u8054\u7f51\u57fa\u7840\u534f\u8bae\u7684\u91cd\u8981\u5b89\u5168\u6f0f\u6d1e\uff0c\u4fc3\u4f7f\u8c37\u6b4c\u3001\u5fae\u8f6f\u3001\u4e9a\u9a6c\u900a\u7b49\u516c\u53f8\u591a\u6b21\u5347\u7ea7\u5b89\u5168\u4ea7\u54c1\uff0c\u4fc3\u4f7fIETF\u7b49\u56fd\u9645\u6807\u51c6\u5316\u7ec4\u7ec7\u591a\u6b21\u4fee\u6539\u534f\u8bae\uff0c\u63d0\u9ad8\u4e86\u4e92\u8054\u7f51\u7684\u5b89\u5168\u6027\u3002\u591a\u9879\u7814\u7a76\u6210\u679c\u53d1\u8868\u5728\u7f51\u7edc\u5b89\u5168\u56fd\u9645\u9876\u7ea7\u7684\u5b89\u5168\u5b66\u672f\u4f1a\u8bae\u4e0a\uff0c\u591a\u6b21\u83b7\u5f97CCS\u3001NDSS\u7b49\u56fd\u9645\u7f51\u7edc\u5b89\u5168\u9876\u7ea7\u4f1a\u8bae\u6700\u4f73\u8bba\u6587\u5956\uff0c\u5728\u56fd\u5185\u5916\u5b66\u672f\u548c\u5de5\u4e1a\u754c\u5177\u6709\u8f83\u9ad8\u7684\u5f71\u54cd\u529b\uff0c2016\u5e74\u83b7\u4e2d\u592e\u7f51\u4fe1\u529e\u9996\u5c4a\u201c\u7f51\u7edc\u5b89\u5168\u4f18\u79c0\u4eba\u624d\u201d\u5956\u3002\u6bb5\u6d77\u65b0\u6559\u6388\u662f\u4e16\u754c\u77e5\u540d\u653b\u9632\u6218\u961f\u201c\u84dd\u83b2\u82b1\u201d\u7684\u8054\u5408\u521b\u59cb\u4eba\uff0c\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u56fd\u9645\u5b66\u672f\u8bba\u575b\uff08InForSec\uff09\u7684\u8054\u5408\u53d1\u8d77\u4eba\uff0c\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u534f\u4f1a\u7406\u4e8b\uff0c\u4e2d\u56fd\u5bc6\u7801\u5b66\u4f1a\u534f\u8bae\u4e13\u59d4\u4f1a\u59d4\u5458\uff0c\u4e92\u8054\u7f51\u534f\u4f1a\u5b89\u5168\u4e13\u59d4\u4f1a\u59d4\u5458\u3002<\/p>\n\n\n\n
\u5f20\u7389\u6e05 \u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521105707.png\")
<\/figure><\/div>\n\n\n\n \u5f20\u7389\u6e05\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u5927\u5b66\u6559\u6388\u3001\u535a\u5bfc\uff0c\u56fd\u5bb6\u8ba1\u7b97\u673a\u7f51\u7edc\u5165\u4fb5\u9632\u8303\u4e2d\u5fc3\u4e3b\u4efb\uff0c\u4e3b\u8981\u4ece\u4e8b\u7f51\u7edc\u4e0e\u7cfb\u7edf\u5b89\u5168\u65b9\u9762\u7684\u7814\u7a76\uff0c\u53d1\u8868SCI\/EI\u8bba\u6587100\u4f59\u7bc7\uff0c\u5176\u4e2d\u6709ACM CCS\u3001USENIX SECURITY\u3001IEEE Transactions on Parallel and Distributed Systems (TPDS)\u3001IEEE Transactions on Cloud Computing (TCC)\u3001INFOCOM\u7b49\uff0c\u5236\u5b9a\u56fd\u5bb6\u53ca\u884c\u4e1a\u6807\u51c67\u4e2a\uff0c\u5148\u540e\u627f\u62c5\u56fd\u5bb6\u91cd\u70b9\u7814\u53d1\u8ba1\u5212\u9879\u76ee\u3001\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u91cd\u70b9\u9879\u76ee\u3001\u56fd\u5bb6\u53d1\u6539\u59d4\u4fe1\u606f\u5b89\u5168\u4e13\u9879\u3001\u56fd\u5bb6\u9ad8\u79d1\u6280\u53d1\u5c55\u8ba1\u5212\uff08863\uff09\u9879\u76ee\u3001\u4e2d\u56fd\u79d1\u5b66\u9662\u77e5\u8bc6\u521b\u65b0\u5de5\u7a0b\u91cd\u8981\u65b9\u5411\u9879\u76ee\u3001\u56fd\u5bb6242\u4fe1\u606f\u5b89\u5168\u8ba1\u5212\u9879\u76ee\u7b49\u8bfe\u9898\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\uff1a\u7f51\u7edc\u653b\u51fb\u4e0e\u9632\u5fa1\u3001\u5b89\u5168\u6f0f\u6d1e\u6316\u6398\u4e0e\u5229\u7528\u3001\u4eba\u5de5\u667a\u80fd\u4e0e\u5b89\u5168\u3001\u7269\u8054\u7f51\u5b89\u5168\u7b49\u3002<\/p>\n\n\n\n
\u5c48\u5b87 \u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821\u535a\u58eb\u540e<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112805.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u9898\u76ee\uff1a<\/strong>PalmTree: Learning an Assembly Language Model for Instruction Embedding\uff08\u8bba\u6587\u53d1\u8868\u4e8eCCS 2021\uff09<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nDeep learning has demonstrated its strengths in numerous binary analysis tasks, including function boundary detection, binary code search, function prototype inference, value set analysis, etc. When applying deep learning to binary analysis tasks, we need to decide what input should be fed into the neural network model. More specifically, we need to answer how to represent an instruction in a fixed-length vector. The idea of automatically learning instruction representations is intriguing, but the existing schemes fail to capture the unique characteristics of disassembly. These schemes ignore the complex intra-instruction structures and mainly rely on control flow in which the contextual information is noisy and can be influenced by compiler optimizations.<\/p>\n\n\n\n
In this talk, we propose to pre-train an assembly language model called PalmTree for generating general-purpose instruction embeddings by conducting self-supervised training on large-scale unlabeled binary corpora. PalmTree utilizes three pre-training tasks to capture various characteristics of assembly language. These training tasks overcome the problems in existing schemes, thus can help to generate high-quality representations. We conduct both intrinsic and extrinsic evaluations, and compare PalmTree with other instruction embedding schemes. PalmTree has the best performance for intrinsic metrics, and outperforms the other instruction embedding schemes for all downstream tasks.<\/p>\n\n\n\n
\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n\u5c48\u5b87\uff0c\u535a\u58eb\uff0c\u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821\u5c39\u6052\u6559\u6388\u7ec4\u535a\u58eb\u540e\u3002\u7814\u7a76\u65b9\u5411\u4e3a\uff1a\u8f6f\u4ef6\u5b89\u5168\uff0c\u673a\u5668\u5b66\u4e60\u53ca\u6df1\u5ea6\u5b66\u4e60\u7406\u8bba\u5728\u8f6f\u4ef6\u5de5\u7a0b\u4e2d\u7684\u5e94\u7528\u3002\u5c48\u5b87\u535a\u58eb\u5728CCS\uff0cICSE\uff0cASE\uff0cTSE\uff0cRAID\uff0cJSS\uff0cIST\uff0cEMSE\u7b49\u56fd\u9645\u77e5\u540d\u7f51\u7edc\u5b89\u5168\u53ca\u8f6f\u4ef6\u5de5\u7a0b\u4f1a\u8bae\u53ca\u671f\u520a\u4e0a\u53d1\u8868\u8bba\u658720\u4f59\u7bc7\uff0c\u53c2\u4e0e\u591a\u9879\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u53ca\u7f8e\u56fd\u56fd\u5bb6\u79d1\u5b66\u57fa\u91d1\u9879\u76ee\uff0c\u4f5c\u4e3a\u4e3b\u8981\u5b8c\u6210\u4eba\uff0c\u66fe\u83b72017\u5e74\u56fd\u5bb6\u79d1\u6280\u8fdb\u6b65\u4e8c\u7b49\u5956\uff0c2016\u5e74\u6559\u80b2\u90e8\u79d1\u6280\u8fdb\u6b65\u4e00\u7b49\u5956\u3002<\/p>\n\n\n\n
\u5434\u79cb\u5b9e \u660e\u5c3c\u82cf\u8fbe\u5927\u5b66\u8ba1\u7b97\u673a\u4e0e\u5de5\u7a0b\u5b66\u9662\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/16215831581-1.png\")
<\/figure><\/div>\n\n\n\n \u62a5\u544a\u4e3b\u9898\uff1a<\/strong>\u901a\u8fc7\u7b26\u53f7\u6bd4\u5bf9\u7cbe\u786e\u7b5b\u9009\u51fa\u6709\u5b89\u5168\u5f71\u54cd\u7684\u6f0f\u6d1e\u8865\u4e01<\/p>\n\n\n\nPrecisely Characterizing Security Impact in a Flood of Patches via Symbolic Rule Comparison<\/p>\n\n\n\n
\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nA bug is a vulnerability if it has security impacts when triggered. Determining the security impacts of a bug is important to both defenders and attackers. Maintainers of large software systems are bombarded with numerous bug reports and proposed patches, with missing or unreliable information about their impact. Determining which few bugs are vulnerabilities is difficult, and bugs that a maintainer believes do not have security impact will be deprioritized or even ignored. On the other hand, a public report of a bug with a security impact is a powerful first step towards exploitation. Adversaries may exploit such bugs to launch devastating attacks if defenders do not fix them promptly. Common practice is for maintainers to assess the security impacts of bugs manually, but the scaling and reliability challenges of manual analysis lead to missed vulnerabilities.<\/p>\n\n\n\n
We propose an automated approach, SID, to determine the security impacts for a bug given its patch, so that maintainers can effectively prioritize applying the patch to the affected programs. The insight behind SID is that both the effect of a patch (either submitted or applied) and security-rule violations (e.g., out-of-bound access) can be modeled as constraints that can be automatically solved. SID incorporates rule comparison, using under-constrained symbolic execution of a patch to determine the security impacts of an un-applied patch. SID can further automatically classify vulnerabilities based on their security impacts. We have implemented SID and applied it to bug patches of the Linux kernel and matching CVE-assigned vulnerabilities to evaluate its precision and recall. We optimized SID to reduce false positives, and our evaluation shows that, from 54K recent valid commit patches, SID detected 227 security bugs with at least 243 security impacts at a 97% precision rate. Critically, 197 of them were not reported as vulnerabilities before, leading to delayed or ignored patching in derivative programs. Even worse, 21 of them are still unpatched in the latest Android kernel. Once exploited, they can cause critical security impacts on Android devices. The evaluation results confirm that SID\u2019s approach is effective and precise in automatically determining security impacts for a massive stream of bug patches.<\/p>\n\n\n\n
\u5609\u5bbe\u7b80\u4ecb:<\/strong><\/p>\n\n\n\n\u5434\u79cb\u5b9e\uff0c\u660e\u5c3c\u82cf\u8fbe\u5927\u5b66\u8ba1\u7b97\u673a\u4e0e\u5de5\u7a0b\u5b66\u9662\u535a\u58eb\u751f\uff0c\u672c\u79d1\u6bd5\u4e1a\u4e8e\u4e2d\u56fd\u79d1\u5b66\u6280\u672f\u5927\u5b66\u4fe1\u606f\u5b89\u5168\u4e13\u4e1a\u3002\u4ed6\u76ee\u524d\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u64cd\u4f5c\u7cfb\u7edf\u5b89\u5168\uff0c\u6f0f\u6d1e\u68c0\u6d4b\uff0c\u4e0e\u4ee3\u7801\u8865\u4e01\u5206\u6790\u3002<\/p>\n\n\n\n
\u5218\u6768 \u65b0\u52a0\u5761\u5357\u6d0b\u7406\u5de5\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/ly.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u9898\u76ee\uff1a<\/strong>\u6a21\u7cca\u6d4b\u8bd5\u7814\u7a76\u63a2\u7d22\u4e4b\u8def <\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u6a21\u7cca\u6d4b\u8bd5\u662f\u76ee\u524d\u7f51\u7edc\u5b89\u5168\u9886\u57df\u6700\u6d41\u884c\u7684\u52a8\u6001\u5206\u6790\u65b9\u6cd5\u4e4b\u4e00\uff0c\u5728\u5de5\u4e1a\u754c\u4e5f\u6709\u5e7f\u6cdb\u7684\u5e94\u7528\uff0c\u540c\u65f6\u7814\u7a76\u4eba\u5458\u7528\u8fd9\u79cd\u6280\u672f\u53d1\u73b0\u4e86\u5927\u91cf\u7684CVE\u3002\u8fd9\u4e2a\u8bb2\u5ea7\u4f1a\u5206\u4e09\u4e2a\u5185\u5bb9\u6db5\u76d6\u6700\u8fd1\u51e0\u5e74\u5728\u6a21\u7cca\u6d4b\u8bd5\u9886\u57df\u7684\u76f8\u5173\u7684\u79d1\u7814\u3002\u7b2c\u4e00\u90e8\u5206\u5185\u5bb9\u4ece\u79cd\u5b50\u751f\u6210\uff0c\u53d8\u5f02\u64cd\u4f5c\uff0c\u79cd\u5b50\u4f18\u5148\u7ea7\u4f18\u5316\uff0c\u5b58\u50a8\u4f18\u5316\uff0c\u56de\u9988\u673a\u5236\uff0c\u52a8\u9759\u7ed3\u5408\u7b49\u4e0d\u540c\u7684\u6b65\u9aa4\u6765\u63a2\u8ba8\u6a21\u7cca\u6d4b\u8bd5\u7684\u79d1\u7814\u8fdb\u5c55\u3002\u7b2c\u4e8c\u90e8\u5206\u5185\u5bb9\u4ecb\u7ecd\u4e86\u5982\u4f55\u6269\u5c55\u6a21\u7cca\u6d4b\u8bd5\u5728\u4e0d\u540c\u7c7b\u578b\u6216\u8005\u4e0d\u540c\u5e73\u53f0\u7684\u6f0f\u6d1e\uff1a\u5185\u5b58\u4f7f\u7528\u6f0f\u6d1e\uff0cUaF\u6f0f\u6d1e\uff0c\u5e76\u53d1\u6f0f\u6d1e\uff0c\u4e8c\u8fdb\u5236\u4ee3\u7801\u6a21\u7cca\u6d4b\u8bd5\u7b49\u3002\u7b2c\u4e09\u90e8\u5206\u5185\u5bb9\u4ecb\u7ecd\u5982\u4f55\u628a\u4eba\u5de5\u667a\u80fd\u7b97\u6cd5\u548c\u6a21\u7cca\u6d4b\u8bd5\u76f8\u7ed3\u5408\u7684\u4e00\u4e9b\u601d\u8def\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n\u5218\u6768\uff0c\u65b0\u52a0\u5761\u5357\u6d0b\u7406\u5de5\u5927\u5b66\uff08NTU\uff09\u8ba1\u7b97\u673a\u5b66\u9662\u6559\u6388\uff0cNTU\u7f51\u7edc\u5b89\u5168\u5b9e\u9a8c\u5ba4\u4e3b\u4efb\u3001HP-NTU\u516c\u53f8\u5b9e\u9a8c\u5ba4\u9879\u76ee\u4e3b\u4efb\u4ee5\u53ca\u65b0\u52a0\u5761\u56fd\u5bb6\u5353\u8d8a\u536b\u661f\u4e2d\u5fc3\u526f\u4e3b\u4efb\uff0c\u5e76\u4e8e2019\u5e74\u8363\u83b7\u5927\u5b66\u9886\u8896\u8bba\u575b\u8bb2\u5e2d\u6559\u6388\u3002\u5218\u6768\u535a\u58eb\u4e13\u653b\u8f6f\u4ef6\u9a8c\u8bc1\uff0c\u8f6f\u4ef6\u5b89\u5168\u548c\u8f6f\u4ef6\u5de5\u7a0b\uff0c\u5176\u7814\u7a76\u586b\u8865\u4e86\u5f62\u5f0f\u5316\u65b9\u6cd5\u548c\u7a0b\u5e8f\u5206\u6790\u4e2d\u7406\u8bba\u548c\u5b9e\u9645\u5e94\u7528\u4e4b\u95f4\u7684\u7a7a\u767d\uff0c\u8bc4\u4f30\u4e86\u8f6f\u4ef6\u7684\u8bbe\u8ba1\u4e0e\u5b9e\u73b0\u4ee5\u786e\u4fdd\u9ad8\u5b89\u5168\u6027\u3002\u5230\u76ee\u524d\u4e3a\u6b62\uff0c\u4ed6\u5df2\u7ecf\u5728\u9876\u7ea7\u4f1a\u8bae\u548c\u9876\u7ea7\u671f\u520a\u4e0a\u53d1\u8868\u4e86\u8d85\u8fc7300\u7bc7\u6587\u7ae0\u3002\u4ed6\u8fd8\u83b7\u5f97\u591a\u9879\u8457\u540d\u5956\u9879\uff0c\u5305\u62ecMSRA fellowship\uff0cTRF Fellowship, \u5357\u6d0b\u52a9\u7406\u6559\u6388\uff0cTan Chin Tuan Fellowship\uff0cNanyang Research Award 2019\uff0cNRF Investigatorship 2020\uff0c\u5e76\u4e14\u5728ASE\u3001FSE\u3001ICSE\u7b49\u9876\u7ea7\u4f1a\u8bae\u4e0a\u83b7\u5f9710\u9879\u6700\u4f73\u8bba\u6587\u5956\u4ee5\u53ca\u6700\u5177\u5f71\u54cd\u529b\u8f6f\u4ef6\u5956\u3002<\/p>\n\n\n\n
\u5f20\u6bb7\u4e7e \u5357\u65b9\u79d1\u6280\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/zqk.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898:<\/strong>AMD SEV\u5b89\u5168\u7814\u7a76\uff1a\u4eceASID\u6ee5\u7528\u5230CrossLine\u653b\u51fb<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nAMD\u5904\u7406\u5668\u6700\u65b0\u652f\u6301\u7684\u5b89\u5168\u52a0\u5bc6\u865a\u62df\u5316\uff08SEV\uff09\u6280\u672f\u901a\u8fc7\u652f\u6301\u5168\u865a\u62df\u673a\u5185\u5b58\u52a0\u5bc6\u6210\u4e3a\u65b0\u4e00\u4ee3\u673a\u5bc6\u548c\u9690\u79c1\u8ba1\u7b97\u7684\u4e3b\u6d41\u5e73\u53f0\u3002\u7136\u800c\uff0c\u7531\u4e8e\u521d\u4ee3SEV\u6280\u672f\u4e0d\u652f\u6301\u5bf9\u52a0\u5bc6\u5185\u5b58\u7684\u5b8c\u6574\u6027\u6821\u9a8c\uff0c\u5bfc\u81f4\u5176\u5b58\u5728\u5f88\u591a\u5b89\u5168\u95ee\u9898\u3002\u6211\u4eec\u5b9e\u9a8c\u5ba4\u9488\u5bf9SEV\u7684\u5b89\u5168\u6027\u8fdb\u884c\u4e86\u4e00\u7cfb\u5217\u7814\u7a76\uff0c\u53d1\u73b0\u5176\u5728\u5185\u5b58\u5b8c\u6574\u6027\u4e4b\u5916\u4ecd\u7136\u5b58\u5728\u8bf8\u591a\u5b89\u5168\u9690\u60a3\u3002\u6211\u4eec\u5c06\u7b80\u8981\u4ecb\u7ecd\u8fd9\u4e00\u7cfb\u5217\u5de5\u4f5c\uff0c\u5e76\u91cd\u70b9\u4ecb\u7ecd\u5c06\u8981\u53d1\u8868\u5728ACM CCS 2021\u7684CrossLine\u653b\u51fb\u3002SEV\u4f7f\u7528\u5730\u5740\u7a7a\u95f4\u6807\u8bc6\uff08ASID\uff09\u5bf9\u865a\u62df\u673a\u8bbf\u95eeCPU\u7f13\u5b58\u3001TLB\u548c\u52a0\u5bc6\u5185\u5b58\u9875\u7684\u8fdb\u884c\u8bbf\u95ee\u63a7\u5236\u3002\u7136\u800c\uff0c\u865a\u62df\u673a\u7684ASID\u7531\u865a\u62df\u673a\u7ba1\u7406\u5668\u8bbe\u7f6e\u3002\u6076\u610f\u7684\u865a\u62df\u673a\u7ba1\u7406\u5668\u53ef\u4ee5\u901a\u8fc7\u7be1\u6539\u865a\u62df\u673a\u7684ASID\u6765\u4f7f\u5176\u80fd\u591f\u77ed\u6682\u5730\u8bbf\u95ee\u5176\u4ed6\u865a\u62df\u673a\u7684\u52a0\u5bc6\u5185\u5b58\u3002SEV\u7684\u8bbe\u8ba1\u4e2d\u91c7\u7528\u4e86\u201c\u6545\u969c\u5f0f\u5b89\u5168\u201d\uff08Security-by-Crash\uff09\u7684\u5b89\u5168\u539f\u5219\uff0c\u8ba4\u4e3a\u8fd9\u79cdASID\u7684\u6ee5\u7528\u4f1a\u8fc5\u901f\u5bfc\u81f4\u865a\u62df\u673a\u6545\u969c\uff0c\u4ece\u800c\u4fdd\u8bc1\u52a0\u5bc6\u865a\u62df\u673a\u7684\u5b89\u5168\u6027\u3002\u7136\u800c\uff0c\u6211\u4eec\u7684\u5de5\u4f5c\u5c55\u793a\u4e86\u80fd\u591f\u5229\u7528\u8be5\u6f0f\u6d1e\u6765\u7834\u574fSEV\u7684\u4fdd\u5bc6\u6027\u548c\u5b8c\u6574\u6027\u7684CrossLine\u653b\u51fb\u3002\u8fd9\u9879\u7814\u7a76\u8868\u660e\uff0cSEV\u4e0d\u80fd\u6709\u6548\u7684\u901a\u8fc7 \u201c\u6545\u969c\u5f0f\u5b89\u5168\u201d\u9632\u6b62ASID\u6ee5\u7528\uff0c\u6307\u51fa\u4e86\u8fd9\u4e00\u8bbe\u8ba1\u7406\u5ff5\u7684\u5b89\u5168\u95ee\u9898\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n\u5f20\u6bb7\u4e7e\u6559\u6388\u662f\u5357\u65b9\u79d1\u6280\u5927\u5b66\u6559\u6388\uff0c\u535a\u58eb\u751f\u5bfc\u5e08\u3002\u4ed6\u5f52\u56fd\u524d\u66fe\u4efb\u7f8e\u56fd\u4fc4\u4ea5\u4fc4\u5dde\u7acb\u5927\u5b66\u8ba1\u7b97\u673a\u79d1\u5b66\u4e0e\u5de5\u7a0b\u7cfb\u7684\u7ec8\u8eab\u526f\u6559\u6388\u3002\u4ed6\u4e3b\u6301\u7684\u5357\u79d1\u5927\u53ef\u4fe1\u7cfb\u7edf\u5b89\u5168\u5b9e\u9a8c\u5ba4\u4e3b\u8981\u7814\u7a76\u65b9\u5411\uff1a\u89e3\u51b3\u4e91\u8ba1\u7b97\u3001\u7269\u8054\u7f51\u3001\u533a\u5757\u94fe\u7b49\u5173\u952e\u9886\u57df\u7684\u53ef\u4fe1\u4e0e\u5b89\u5168\u95ee\u9898\uff0c\u4e3a\u6570\u636e\u9690\u79c1\u3001\u667a\u80fd\u7ec8\u7aef\u3001\u91d1\u878d\u79d1\u6280\u3001\u8f66\u8f7d\u7cfb\u7edf\u7b49\u5e94\u7528\u573a\u666f\u63d0\u4f9b\u6280\u672f\u652f\u6301\u3002\u5f20\u6559\u6388\u7684\u7814\u7a76\u6d89\u53ca\u4f53\u7cfb\u7ed3\u6784\u5b89\u5168\u3001\u8f6f\u4ef6\u548c\u7cfb\u7edf\u5b89\u5168\u3001\u5206\u5e03\u5f0f\u7cfb\u7edf\u548c\u5e94\u7528\u5b89\u5168\u3001\u5b89\u5168\u4e0e\u4eba\u5de5\u667a\u80fd\u3001\u5f62\u5f0f\u5316\u9a8c\u8bc1\u7b49\u8bf8\u591a\u9886\u57df\uff0c\u7814\u7a76\u6210\u679c\u591a\u6b21\u53d1\u8868\u5728\u56fd\u9645\u77e5\u540d\u7684\u8ba1\u7b97\u673a\u5b89\u5168\u4f1a\u8bae\u548c\u671f\u520a\u4e0a\uff0c\u5176\u4e2d\u4e09\u5341\u591a\u7bc7\u53d1\u8868\u5728\u56fd\u9645\u56db\u5927\u5b89\u5168\u9876\u4f1a\u3002\u4ed6\u66fe\u8363\u83b7\u7f8e\u56fd\u56fd\u5bb6\u79d1\u5b66\u57fa\u91d1\u9752\u5e74\u79d1\u5b66\u5bb6\u5956\uff0c\u4fc4\u4ea5\u4fc4\u5dde\u7acb\u5927\u5b66Lumley\u7814\u7a76\u6210\u5c31\u5956\u548c\u8ba1\u7b97\u673a\u7cfb\u6770\u51fa\u6559\u5b66\u5956\uff0c\u5317\u7f8e\u8ba1\u7b97\u673a\u534e\u4eba\u5b66\u8005\u534f\u4f1a\u9881\u53d1\u7684\u660e\u65e5\u4e4b\u661f\u5956\uff0c\u8fd8\u66fe\u57282018\u548c2020 \u8fde\u7eed\u4e24\u6b21\u83b7\u5f97AMiner \u6700\u5177\u5f71\u54cd\u529b\u7684\u5b89\u5168\u548c\u9690\u79c1\u5b66\u8005\u63d0\u540d\u3002<\/p>\n\n\n\n
\u82cf\u749e\u777f \u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u6240\u7814\u7a76\u5458<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/2022.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u82cf\u749e\u777f\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u8f6f\u4ef6\u7814\u7a76\u6240\u7814\u7a76\u5458\uff0c\u535a\u58eb\u751f\u5bfc\u5e08\uff0c\u53ef\u4fe1\u8ba1\u7b97\u4e0e\u4fe1\u606f\u4fdd\u969c\u5b9e\u9a8c\u5ba4\u5e38\u52a1\u526f\u4e3b\u4efb\uff0c\u8ba1\u7b97\u673a\u75c5\u6bd2\u9632\u5fa1\u6280\u672f\u56fd\u5bb6\u5de5\u7a0b\u5b9e\u9a8c\u5ba4\u4e2d\u79d1\u9662\u5206\u4e2d\u5fc3\u4e3b\u4efb\uff0c\u7b2c22\u5c4a\u7f51\u7edc\u653b\u9632\u56fd\u9645\u5b66\u672f\u4f1a\u8bae\uff08RAID 2019\uff09\u5927\u4f1a\u4e3b\u5e2d\u3002\u957f\u671f\u4ece\u4e8b\u7f51\u7edc\u7a7a\u95f4\u5bf9\u6297\u3001\u8f6f\u4ef6\u5b89\u5168\u7b49\u7814\u7a76\u5de5\u4f5c\uff0c\u66fe\u4e3b\u6301\u56fd\u5bb6\u91cd\u70b9\u7814\u53d1\u8ba1\u5212\u9879\u76ee\u3001\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u91cd\u70b9\u9879\u76ee\u7b49\u5341\u4f59\u9879\u56fd\u5bb6\u7ea7\u79d1\u7814\u4efb\u52a1\u653b\u5173\uff0c\u66fe\u5728USENIX Security\u3001ACM CCS\u3001NDSS\u7b49\u5b66\u672f\u4f1a\u8bae\u548c\u671f\u520a\u53d1\u8868\u8bba\u658740\u4f59\u7bc7\uff0c\u4e3b\u6301\u7814\u5236\u7684\u91d1\u521a\u7cfb\u7edf\u7b49\u6210\u679c\uff0c\u66fe\u83b7\u4e2d\u56fd\u901a\u4fe1\u5b66\u4f1a\u4e00\u7b49\u5956\u3001\u5317\u4eac\u5e02\u79d1\u6280\u8fdb\u6b65\u4e8c\u7b49\u5956\u7b49\u8363\u8a89\u3002<\/p>\n\n\n\n
\u5085\u5efa\u660e \u6b66\u6c49\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/3.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898: <\/strong>\u5e94\u7528\u5c42\u865a\u62df\u5316\u6076\u610f\u4ee3\u7801\u7684\u5206\u6790\u4e0e\u68c0\u6d4b<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u968f\u7740\u79fb\u52a8\u4e92\u8054\u7f51\u7684\u5feb\u901f\u53d1\u5c55\uff0c\u7ec8\u7aef\u548c\u4e91\u7aef\u865a\u62df\u5316\u6280\u672f\u3001\u57fa\u4e8e\u865a\u62df\u5316\u7684\u8de8\u7ec8\u7aef\u5e94\u7528\u548c\u573a\u666f\u9010\u6e10\u589e\u591a\u3002App-virtualization\uff08VA\uff09\u5219\u662f\u975e\u5e38\u5178\u578b\u865a\u62df\u5316\u6280\u672f\uff0c\u53ef\u4ee5\u5b9e\u73b0\u5728\u5355\u4e2a\u8bbe\u5907\u4e0a\u8fd0\u884c\u540c\u4e00\u5e94\u7528\u7a0b\u5e8f\u7684\u591a\u4e2a\u526f\u672c\uff0c\u5f62\u6210\u72ec\u7acb\u7684\u4f53\u9a8c\u7a7a\u95f4\u3002\u8be5\u6280\u672f\u5728\u7ed9\u7528\u6237\u5e26\u6765\u4fbf\u5229\u7684\u540c\u65f6\uff0c\u4e5f\u7ed9\u7f51\u7edc\u72af\u7f6a\u5206\u5b50\u63d0\u4f9b\u4e86\u53ef\u8d81\u4e4b\u673a\u3002<\/p>\n\n\n\n
\u8be5\u62a5\u544a\u4ecb\u7ecdVA\u7684\u673a\u7406\uff0c\u9a8c\u8bc1VA\u5bf9app\u9694\u79bb\u6027\u548cVA\u5bf9app\u5f15\u53d1\u7684\u5b89\u5168\u5a01\u80c1\u3002\u540c\u65f6\u89e3\u6790\u4e86\u653b\u51fb\u8005\u5229\u7528VA\u4f20\u64ad\u6076\u610f\u4ee3\u7801\u7684\u65b9\u5f0f\uff0c\u8be5\u65b9\u5f0f\u5229\u7528VA\u76f4\u63a5\u52a0\u8f7d\u5404\u79cd\u6076\u610f\u7684\u79fb\u52a8APP\uff0c\u65e0\u9700\u7528\u6237\u5b89\u88c5\u548c\u8bb8\u53ef\uff0c\u53ef\u4ee5\u7ed5\u8fc7\u53cd\u75c5\u6bd2\u626b\u63cf\u8f6f\u4ef6\u7684\u68c0\u6d4b\u548c\u7cfb\u7edf\u5b89\u5168\u9632\u62a4\u673a\u5236\u3002\u6700\u540e\uff0c\u63d0\u51fa\u4e86\u4e00\u79cd\u53cc\u5c42\u68c0\u6d4b\u65b9\u6cd5-VAHunt\uff0cVAHunt\u53ef\u4ee5\u81ea\u52a8\u5316\u68c0\u6d4b\u51fa\u5e26VA\u6846\u67b6\u7684\u6076\u610fApp\uff0c\u540c\u65f6\u7f13\u89e3\u5b89\u5168\u5206\u6790\u5e08\u7e41\u91cd\u7684\u9006\u5411\u5206\u6790\u8d1f\u62c5\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u5085\u5efa\u660e\uff0c\u535a\u58eb\uff0c\u6b66\u6c49\u5927\u5b66\u56fd\u5bb6\u7f51\u7edc\u5b89\u5168\u5b66\u9662\u6559\u6388\u3001\u535a\u58eb\u751f\u5bfc\u5e08\u3002\u7814\u7a76\u65b9\u5411\u4e3a\u6076\u610f\u4ee3\u7801\u68c0\u6d4b\u3001\u6f0f\u6d1e\u9632\u5fa1\u3001\u8f6f\u4ef6\u89e3\u6790\u53ca\u5176\u5b89\u5168\u786e\u4fdd\u3002\u5728USENIX Security\u3001CCS\u3001ICSE\u3001Mobisys\u3001\u300a\u8ba1\u7b97\u673a\u5b66\u62a5\u300b\u3001\u300a\u8f6f\u4ef6\u5b66\u62a5\u300b\u3001\u300a\u8ba1\u7b97\u673a\u7814\u7a76\u4e0e\u53d1\u5c55\u300b\u7b49\u4f1a\u8bae\u548c\u671f\u520a\u53d1\u8868\u8bba\u6587\u591a\u7bc7\uff0c\u83b7\u5f97\u9ad8\u7b49\u6559\u80b2\u56fd\u5bb6\u7ea7\u6559\u5b66\u6210\u679c\u5956\u4e00\u7b49\u59561\u9879\u3001\u6e56\u5317\u7701\u79d1\u6280\u8fdb\u6b65\u5956\u4e8c\u7b49\u59561\u9879\u3002<\/p>\n\n\n\n
\u5f20\u6653\u5bd2 \u590d\u65e6\u5927\u5b66\u535a\u58eb\u540e<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/4.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>Understanding and Mitigating Model Aging of ML-based Android Malware Detectors\uff08CCS2020\uff09<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nMachine learning (ML) has been widely used to detect Android malware, but the performance of ML-based detectors drops drastically over time, known as model aging. In this talk, we first explore the aging problem by an empirical study on a large-scale (perhaps the largest in this line of work), evolutionary dataset of Android apps. By observing some intrinsic properties of evolved malware, we propose a general, plug-and-play mitigating method based on API semantics which can help capture the semantic-similarity of malware variants. Extensive experiments on several state-of-the-art Android malware detectors show that the proposed method can significantly slow-down aging and reduce maintaining efforts.<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u5f20\u6653\u5bd2\uff0c\u590d\u65e6\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u535a\u58eb\u540e\u7814\u7a76\u5458\u3002\u4e3b\u8981\u7814\u7a76\u65b9\u5411\u4e3a\u7cfb\u7edf\u5b89\u5168\uff0c\u79fb\u52a8\u6076\u610f\u8f6f\u4ef6\u68c0\u6d4b\u548cAI\u5b89\u5168\u3002\u5728USENIX Security\uff0cACM CCS\uff0cICSE\u7b49\u9876\u4f1a\u53d1\u8868\u8bba\u65875\u7bc7\uff0c\u4e00\u9879\u7814\u7a76\u83b7ACM CCS 2020\u6700\u4f73\u8bba\u6587\u63d0\u540d\u3002<\/p>\n\n\n\n
\u7518\u6c34\u6ed4 \u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7814\u7a76\u9662\u535a\u58eb\u540e<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/5.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>GREYONE: Data Flow Sensitive Fuzzing<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u4ee3\u7801\u8986\u76d6\u7387\u662f\u8861\u91cf\u6f0f\u6d1e\u81ea\u52a8\u6316\u6398\u7cfb\u7edf\u6d4b\u8bd5\u6027\u80fd\u7684\u5173\u952e\u6307\u6807\uff0c\u5de5\u5177\u7684\u6f0f\u6d1e\u6316\u6398\u80fd\u529b\u4e0e\u5176\u4ee3\u7801\u8986\u76d6\u80fd\u529b\u6709\u7740\u8f83\u5f3a\u7684\u6b63\u76f8\u5173\u5173\u7cfb\u3002\u6a21\u7cca\u6d4b\u8bd5\u4e00\u76f4\u4f5c\u4e3a\u5e94\u7528\u6700\u5e7f\u6cdb\u7684\u6f0f\u6d1e\u6316\u6398\u6280\u672f\uff0c\u7531\u4e8e\u5176\u8fc7\u5f3a\u7684\u968f\u673a\u6027\uff0c\u5f80\u5f80\u96be\u4ee5\u8fbe\u5230\u7406\u60f3\u7684\u4ee3\u7801\u8986\u76d6\u80fd\u529b\uff0c\u5373\u4fbf\u501f\u52a9\u52a8\u6001\u6c61\u70b9\u5206\u6790\u7b49\u6570\u636e\u6d41\u5206\u6790\u6280\u672f\uff0c\u4e5f\u65e0\u6cd5\u9ad8\u6548\u89e3\u51b3\u8f6f\u4ef6\u4e2d\u590d\u6742\u5206\u652f\u6761\u4ef6\u5feb\u901f\u8986\u76d6\u95ee\u9898\uff0c\u8fd9\u4e3b\u8981\u6e90\u4e8e\u4f20\u7edf\u52a8\u6001\u6c61\u70b9\u5206\u6790\u6280\u672f\u5b58\u5728\u6c61\u70b9\u7cbe\u5ea6\u5dee\u3001\u5206\u6790\u901f\u5ea6\u6162\u3001\u9ad8\u5ea6\u4f9d\u8d56\u624b\u5199\u89c4\u5219\u7b49\u95ee\u9898\u3002<\/p>\n\n\n\n
\u5728\u6b64\u6b21\u62a5\u544a\u4e2d\uff0c\u4f5c\u8005\u5c06\u4ecb\u7ecd\u6570\u636e\u6d41\u654f\u611f\u7684\u6a21\u7cca\u6d4b\u8bd5\u65b9\u6848GREYONE\uff0c\u8be5\u5de5\u4f5c\u53d1\u8868\u4e8eUSENIX security 2020\uff0c\u901a\u8fc7\u6784\u5efa\u4e00\u4e2a\u6a21\u7cca\u6d4b\u8bd5\u9a71\u52a8\u7684\u6c61\u70b9\u5206\u6790\u5f15\u64ce\uff0c\u7a81\u7834\u4e86\u4f20\u7edf\u52a8\u6001\u6c61\u70b9\u5206\u6790\u901f\u5ea6\u6162\u548c\u7cbe\u786e\u5ea6\u4f4e\u7b49\u9650\u5236\uff0c\u5728\u6b64\u57fa\u7840\u4e0a\u63d0\u51fa\u6c61\u70b9\u5236\u5bfc\u7684\u53d8\u5f02\u65b9\u6cd5\u3001\u4e00\u81f4\u6027\u5236\u5bfc\u7684\u8fdb\u5316\u6a21\u578b\u4ee5\u53ca\u53ef\u9009\u62e9\u6267\u884c\u6027\u80fd\u4f18\u5316\u7b56\u7565\uff0c\u80fd\u9ad8\u6548\u5904\u7406\u957fMAGIC\u5b57\u8282\u6bd4\u8f83\u548cChecksum\u6821\u9a8c\u5206\u652f\u7b49\u590d\u6742\u7a0b\u5e8f\u7279\u5f81\uff0c\u4f7f\u5f97\u6574\u4e2a\u6d41\u654f\u611f\u6a21\u7cca\u6d4b\u8bd5\u7cfb\u7edf\u7684\u4ee3\u7801\u8986\u76d6\u80fd\u529b\u548c\u6f0f\u6d1e\u6316\u6398\u80fd\u529b\u8fdc\u8d85\u51fa\u540c\u7c7b\u6807\u6746\u6027\u6f0f\u6d1e\u6316\u6398\u5de5\u5177\u3002\u53e6\u5916\uff0c\u8be5\u6a21\u7cca\u6d4b\u8bd5\u7cfb\u7edf\u5177\u5907\u5f88\u5f3a\u7684\u63a8\u5e7f\u80fd\u529b\uff0c\u4e0d\u4ec5\u80fd\u9002\u5e94\u4e0d\u540c\u5f62\u6001\u7684\u590d\u6742\u8f6f\u4ef6\u5bf9\u8c61\uff0c\u5e76\u5177\u5907\u66f4\u591a\u8106\u5f31\u6027\u5206\u6790\u573a\u666f\u5e94\u7528\u80fd\u529b\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u7b80\u4ecb\uff1a<\/strong><\/p>\n\n\n\n\u7518\u6c34\u6ed4\uff0c\u6e05\u534e\u5927\u5b66\u535a\u58eb\u540e\uff0cMEAC\u56fd\u5bb6\u91cd\u70b9\u5b9e\u9a8c\u5ba4\u526f\u7814\u7a76\u5458\u3002\u957f\u671f\u4ece\u4e8b\u7f51\u7edc\u5b89\u5168\u5173\u952e\u6280\u672f\u7814\u7a76\uff0c\u6784\u5efa\u4e86CollAFL\u3001CollAFL-bin\u3001GreyOne\u7b49\u591a\u4e2a\u63a7\u5236\u6d41\u548c\u6570\u636e\u6d41\u654f\u611f\u7684\u8106\u5f31\u6027\u81ea\u52a8\u6316\u6398\u65b9\u6848\uff0c\u53d6\u5f97\u663e\u8457\u6548\u679c\u3002\u8d1f\u8d23\u6216\u53c2\u4e0e\u91cd\u8981\u9879\u76ee\u5341\u591a\u9879\uff0c\u591a\u6b21\u83b7\u5f97\u90e8\u59d4\u7ea7\u79d1\u6280\u6210\u679c\u5956\uff0c\u53d1\u8868\u5b66\u672f\u8bba\u6587\u4e8c\u5341\u4f59\u7bc7\uff0c\u5305\u62ec\u4ee5\u7b2c\u4e00\u4f5c\u8005\u8eab\u4efd\u53d1\u8868\u8bba\u6587\u4e8eUSENIX Security\u3001IEEE S&P\u3001IEEE TDSC\u7b49\u7f51\u7edc\u4e0e\u4fe1\u606f\u5b89\u5168\u9886\u57df\u9876\u7ea7\u4f1a\u8bae\u4e0e\u671f\u520a\u3002<\/p>\n\n\n\n
\u96f7\u7075\u5149 \u4e2d\u79d1\u9662\u4fe1\u5de5\u6240\u526f\u7814\u7a76\u5458<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/7.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>\u57fa\u4e8eCache\u7684\u4e2d\u95f4\u4eba\u653b\u51fb-\u64cd\u7eb5\u9694\u79bb\u6267\u884c\u73af\u5883\u4e2d\u654f\u611f\u6570\u636e\uff08CCS 2020\uff09<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nARM TrustZone\u6280\u672f\u88ab\u5e7f\u6cdb\u7528\u4e8e\u4e3a\u79fb\u52a8\u7ec8\u7aef\u53ca\u5d4c\u5165\u5f0f\u5e73\u53f0\u63d0\u4f9b\u57fa\u4e8e\u786c\u4ef6\u7684\u5b89\u5168\u9632\u62a4\u3002\u7136\u800c\uff0c\u76f4\u63a5\u5c06\u654f\u611f\u5e94\u7528\u653e\u5728\u5b89\u5168\u4e16\u754c\uff0c\u4f1a\u5bfc\u81f4TCB\u589e\u5927\uff1b\u4e5f\u589e\u52a0\u4e86\u5e94\u7528\u90e8\u7f72\u7684\u96be\u5ea6\u3002\u7531\u6b64\uff0c\u7814\u7a76\u4eba\u5458\u63d0\u51fa\u4e86\u5728\u666e\u901a\u4e16\u754c\u6784\u9020\u9694\u79bb\u6267\u884c\u73af\u5883\u6765\u6267\u884c\u654f\u611f\u5e94\u7528\u7684\u65b9\u6848\uff0c\u5373IEE\u65b9\u6848\u3002\u7136\u800c\uff0c\u6211\u4eec\u53d1\u73b0\u73b0\u6709\u7684IEE\u65b9\u6848\u5e76\u672a\u5145\u5206\u8003\u8651\u5bf9Cache\u7684\u4fdd\u62a4\u3002\u901a\u8fc7\u5bf9IEE\u65b9\u6848\u4e2d\u7684\u6570\u636e\u4fdd\u62a4\u6a21\u578b\u53caARM Cache\u7279\u6027\u7684\u7cfb\u7edf\u5316\u7814\u7a76\uff0c\u63d0\u51fa\u4e86\u57fa\u4e8eCache\u7684\u4e2d\u95f4\u4eba\u653b\u51fb\uff08CITM\uff09\uff0c\u5229\u7528Cache\u4e0eMemory\u5728\u6570\u636e\u3001\u5b89\u5168\u5c5e\u6027\u7b49\u65b9\u9762\u7684\u4e0d\u4e00\u81f4\uff0c\u80fd\u6709\u6548\u653b\u7834IEE\u4e2d\u7684\u6570\u636e\u4fdd\u62a4\u673a\u5236\u3002\u540c\u65f6\uff0c\u6211\u4eec\u4ee5\u4e09\u4e2a\u8457\u540d\u7684IEE\u65b9\u6848\u4e3a\u4f8b\uff0c\u5373SANCTUARY\uff08NDSS 2019\uff09\u3001Ginseng(NDSS 2019)\u548cTrustICE(DSN 2015)\uff0c\u8bc1\u660e\u4e86CITM\u653b\u51fb\u7684\u5e7f\u6cdb\u6027\u548c\u5b9e\u9645\u53ef\u884c\u6027\u3002\u6700\u540e\uff0c\u5728\u6df1\u5165\u5206\u6790CITM\u5b58\u5728\u7684\u539f\u56e0\u4e4b\u540e\uff0c\u63d0\u51fa\u4e86\u76f8\u5e94\u7684\u9632\u62a4\u63aa\u65bd\uff0c\u5e76\u901a\u8fc7\u539f\u578b\u8bc4\u4f30\u4e86\u5176\u6027\u80fd\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u96f7\u7075\u5149\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\uff0c\u526f\u7814\u7a76\u5458\uff0c\u4e3b\u8981\u4ece\u4e8b\u7cfb\u7edf\u53ca\u7ec8\u7aef\u5b89\u5168\u65b9\u9762\u7684\u7814\u7a76\uff0c\u5305\u62ec\u79fb\u52a8\u7ec8\u7aef\u5b89\u5168\u3001\u53ef\u4fe1\u8ba1\u7b97\u6280\u672f\u3001\u5bb9\u5668\u5b89\u5168\u7b49\u3002\u5728CCS\u3001TDSC\u3001ESORICS\u3001ACSAC\u7b49\u7cfb\u7edf\u5b89\u5168\u9876\u7ea7\/\u91cd\u8981\u7684\u671f\u520a\/\u4f1a\u8bae\u4e0a\u53d1\u8868\u8bba\u6587\u4e8c\u5341\u4f59\u7bc7\u3002\u76f8\u5173\u7814\u7a76\u6210\u679c\u83b7\u5f97\u56fd\u5bb6\u5bc6\u7801\u79d1\u6280\u8fdb\u6b65\u4e00\u7b49\u5956\uff0c\u53c2\u4e0e\u7f16\u5236\u4fe1\u606f\u5b89\u5168\u76f8\u5173\u56fd\u5bb6\u6807\u51c6\u591a\u9879\u3002\u4e3b\u6301\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u57fa\u91d1\u8bfe\u9898\u3001\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u91cd\u70b9\u7814\u53d1\u8ba1\u5212\u5b50\u4efb\u52a1\u3001\u5bc6\u7801\u57fa\u91d1\u8bfe\u9898\u7b49\u591a\u9879\u3002<\/p>\n\n\n\n
\u5468\u4e9a\u91d1 \u00a0\u00a0\u00a0\u6d59\u6c5f\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/9.png\")
<\/figure><\/div>\n\n\n\n\u90d1\u65fb\uff08\u84b8\u7c73\uff09\u8682\u8681\u91d1\u670d\u9ad8\u7ea7\u5b89\u5168\u4e13\u5bb6<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/8.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>POP and PUSH: Demystifying and Defending against (Mach) Port-oriented Pro<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981<\/strong><\/p>\n\n\n\nApple devices (e.g., iPhone, MacBook, iPad and Apple Watch) are high value targets for attackers. Although these devices use different operating systems (e.g. iOS, macOS, iPadOS, watchOS, and tvOS), they are all based on a hybrid kernel called XNU. Existing attacks demonstrated that vulnerabilities in XNU could be exploited to escalate privileges and jailbreak devices. To mitigate these threats, multiple security mechanisms have been deployed in latest systems.<\/p>\n\n\n\n
In this paper, we first perform a systematic assessment of recently proposed mitigations by Apple and demonstrate that most of them can be bypassed through corrupting a special type of kernel objects, i.e., Mach port objects. We summarize this type of attack as (Mach) Port Object-Oriented Programming} (POP). Accordingly, we define multiple attack primitives to launch the attack and demonstrate realistic scenarios to achieve full memory manipulation on latest systems (i.e., iOS 13 and macOS 10.15). To defend against POP, we propose the Port Ultra-SHield (PUSH) system to reduce the number of unprotected Mach port objects. Specifically, PUSH automatically locates potential POP primitives and instruments related system calls to enforce the integrity of Mach port kernel objects. It does not require system modifications and only introduces 2% runtime overhead. The PUSH framework has been deployed on more than 40,000 macOS devices in a leading company. The evaluation of 18 public exploits and one zero-day exploit detected by our system demonstrated the effectiveness of PUSH. We believe that the proposed framework will facilitate the design and implementation of a more secure XNU kernel.<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd<\/strong><\/p>\n\n\n\n\uff081\uff09\u90d1\u65fb\uff08\u84b8\u7c73\uff09\uff0c\u8682\u8681\u96c6\u56e2\u9ad8\u7ea7\u5b89\u5168\u4e13\u5bb6\uff0c\u9999\u6e2f\u4e2d\u6587\u5927\u5b66\u535a\u58eb\uff0c\u963f\u91cc\u661f\u3002\u52a0\u5165\u8682\u8681\u4e4b\u524d\uff0c\u4ed6\u66fe\u7ecf\u5728\u963f\u91cc\u3001\u817e\u8baf\u3001\u767e\u5ea6\u4ee5\u53ca\u7845\u8c37FireEye\u5de5\u4f5c\u5b9e\u4e60\u3002\u4ed6\u5728\u4e1a\u4f59\u65f6\u95f4\u591a\u6b21\u53c2\u52a0\u4fe1\u606f\u5b89\u5168\u7ade\u8d5b (DEFCON\uff0cAliCTF\uff0cGeekPwn\u7b49)\uff0c\u5e76\u53d6\u5f97\u4f18\u5f02\u6210\u7ee9\u3002\u84b8\u7c73\u53d1\u73b0\u5e76\u547d\u540d\u4e86\u5f71\u54cd\u4e0a\u4ebf\u8bbe\u5907\u7684iOS\u75c5\u6bd2XcodeGhost\u548c\u5f71\u54cd\u4e0a\u4ebf\u8bbe\u5907\u7684Android app\u6f0f\u6d1eWormHole \uff0c\u5bf9\u5b89\u5168\u754c\u4ea7\u751f\u5de8\u5927\u5f71\u54cd\uff0c\u5e76\u88abFIT 2016\u8bc4\u9009\u4e3a\u201d\u5e74\u5ea6\u6700\u4f73\u5b89\u5168\u7814\u7a76\u5458\u201d \u3002\u4ed6\u8fd8\u5e2e\u52a9Apple\u516c\u53f8\u4fee\u590d\u591a\u5904iOS\u548cmacOS\u7cfb\u7edf\u5b89\u5168\u95ee\u9898\uff0c\u5e76\u4e14Apple\u516c\u53f8\u5728\u5b98\u7f51\u81f4\u8c22\u3002\u4ed6\u5728\u5b66\u672f\u754c\u9876\u4f1a\uff08NDSS\uff0cCCS\u7b49\uff09\u548c\u5de5\u4e1a\u754c\u9876\u4f1a\uff08Blackhat USA\u3001DEFCON\u7b49\uff09\u90fd\u53d1\u8868\u8fc7\u8bba\u6587\u548c\u6f14\u8bb2\u3002\u76ee\u524d\u4e3b\u8981\u5728\u8682\u8681\u96c6\u56e2\u8d1f\u8d23\u5b89\u5168\u5207\u9762\u76f8\u5173\u7684\u4e1a\u52a1\u3002<\/p>\n\n\n\n
(2)\u5468\u4e9a\u91d1\uff0c\u535a\u58eb\uff0c\u6d59\u6c5f\u5927\u5b66\u8ba1\u7b97\u673a\u79d1\u5b66\u4e0e\u6280\u672f\u5b66\u9662\/\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\u767e\u4eba\u8ba1\u5212\u7814\u7a76\u5458\uff0c\u535a\u5bfc\u30022015\u5e74\u6bd5\u4e1a\u4e8e\u7f8e\u56fd\u5317\u5361\u5dde\u7acb\u5927\u5b66\uff0c\u968f\u540e\u52a0\u5165\u5947\u864e360\u62c5\u4efb\u9ad8\u7ea7\u5b89\u5168\u7814\u7a76\u5458\u3002\u4ed6\u957f\u671f\u4ece\u4e8b\u7cfb\u7edf\u5b89\u5168\u7814\u7a76\u5de5\u4f5c\uff0c\u6709\u4e30\u5bcc\u7684\u5b66\u672f\u7814\u7a76\u548c\u5b89\u5168\u4ea7\u54c1\u7814\u53d1\u7ecf\u9a8c\uff0c\u7814\u7a76\u6210\u679c\u53d7\u5230\u5b66\u672f\u754c\u548c\u5de5\u4e1a\u754c\u7684\u5e7f\u6cdb\u5173\u6ce8\u3002\u5148\u540e\u670910\u7bc7\u8bba\u6587\u53d1\u8868\u4e8e\u5b89\u5168\u5b66\u672f\u56db\u5927\u9876\u7ea7\u4f1a\u8bae\uff0c\u8bba\u6587\u5f15\u7528\u8d85\u8fc77500\u6b21\uff0c\u5176\u4e2d\u4e24\u7bc7\u8bba\u6587\u5165\u9009\u81ea1980\u5e74\u4ee5\u6765\u5f15\u7528\u6700\u591a\u7684100\u7bc7\u5b89\u5168\u8bba\u6587\u5217\u8868\uff0c\u83b7\u5f97AMiner\u5168\u7403\u6700\u5177\u5f71\u54cd\u529b\u7684\u5b89\u5168\u548c\u9690\u79c1\u65b9\u5411\u5b66\u8005. \u4ed6\u4f5c\u4e3a\u5171\u540c\u4f5c\u8005\u591a\u6b21\u83b7\u5f97\u6700\u4f73\u8bba\u6587\u5956\uff0c\u4e5f\u591a\u6b21\u62c5\u4efb\u9876\u7ea7\u5b89\u5168\u5b66\u672f\u4f1a\u8bae\uff08\u5305\u62ecACM CCS 2019, 2021, IEEE S&P 2021, 2022\uff0cUSENIX Security 2022\uff09\u7684\u7a0b\u5e8f\u59d4\u5458\u4f1a\u59d4\u5458\u3002\u4ed6\u66fe\u4f5c\u4e3a\u5171\u540c\u6307\u5bfc\u8001\u5e08\u83b7\u5f97 iDash \u5b89\u5168\u57fa\u56e0\u8ba1\u7b97Track III \u9690\u79c1\u673a\u5668\u5b66\u4e60\u6bd4\u8d5b\u5168\u7403\u7b2c\u4e00\u540d\uff0c\u5e76\u6307\u5bfc\u5b66\u751f\u83b7\u5f972019\u5e74\u5168\u56fd\u5927\u5b66\u751f\u4fe1\u5b89\u7ade\u8d5b\u4f5c\u54c1\u8d5b\u4e00\u7b49\u5956\uff0c2020\u5e74\u5168\u56fd\u5927\u5b66\u751f\u4fe1\u606f\u5b89\u5168\u7ade\u8d5b\u521b\u65b0\u5b9e\u8df5\u8d5b\u4e00\u7b49\u5956\u3002\u4ed6\u7684\u7814\u7a76\u76ee\u524d\u805a\u7126\u5728\u8f6f\u4ef6\u5b89\u5168\uff0c\u786c\u4ef6\u8f85\u52a9\u5b89\u5168\u3001\u9690\u79c1\u8ba1\u7b97\u548c\u65b0\u5174\u5b89\u5168\u5a01\u80c1\uff0c\u5305\u62ec\u533a\u5757\u94fe\u5b89\u5168\u3001\u53bb\u4e2d\u5fc3\u5316\u91d1\u878d\u5b89\u5168\u548c\u65b0\u578b\u7f51\u7edc\u72af\u7f6a\u6cbb\u7406\u3002<\/p>\n\n\n\n
\u8881\u658c \u534e\u4e2d\u79d1\u6280\u5927\u5b66\u526f\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/11.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898<\/strong>\uff1aShattered Chain of Trust: Understanding Security Risks in Cross-Cloud IoT Access Delegation<\/p>\n\n\n\n \u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u4f5c\u4e3a\u4e3b\u8981\u7684IoT\u670d\u52a1\u5e73\u53f0\uff0cIoT\u4e91\u4f7f\u5f97IoT\u7528\u6237\u80fd\u591f\u8fdc\u7a0b\u63a7\u5236\u8bbe\u5907\uff08\u8fd9\u79cd\u8fdc\u7a0b\u63a7\u5236\u751a\u81f3\u53ef\u4ee5\u8de8\u8d8a\u4e0d\u540c\u7684IoT\u4e91\u5e73\u53f0\uff09\u3002\u652f\u6491\u8fd9\u79cd\u8de8\u4e91\u5e73\u53f0\u7684\u8bbe\u5907\u8bbf\u95ee\u53ca\u5176\u6743\u9650\u63a7\u5236\u7684\u662f\u5404\u4e2aIoT\u4e91\u5e73\u53f0\u7684\u6388\u6743\u673a\u5236\u3002\u7136\u800c\uff0c\u7531\u4e8e\u7f3a\u5c11\u8de8IoT\u4e91\u5e73\u53f0\u6388\u6743\u7684\u884c\u4e1a\u6807\u51c6\uff0c\u73b0\u6709\u7684\u6388\u6743\u673a\u5236\u5f80\u5f80\u7531\u5404\u5382\u5546\u81ea\u5df1\u5f00\u53d1\u8bbe\u8ba1\u3002\u800c\u7edf\u4e00\u63a5\u53e3\u3001\u5b89\u5168\u534f\u5546\u673a\u5236\u7b49\u7684\u7f3a\u5931\uff0c\u4f7f\u5f97\u73b0\u6709\u7684IoT\u6388\u6743\u673a\u5236\u5b58\u5728\u4e25\u91cd\u5b89\u5168\u9690\u60a3\u3002\u672c\u7814\u7a76\u5de5\u4f5c\u9488\u5bf9\u4e0a\u8ff0\u95ee\u9898\uff0c\u5bf9\u4e3b\u6d41IoT\u4e91\u5e73\u53f0\u7684\u6388\u6743\u673a\u5236\u7684\u5b89\u5168\u95ee\u9898\u8fdb\u884c\u4e86\u7cfb\u7edf\u6027\u7684\u7814\u7a76\uff0c\u63d0\u51fa\u4e86\u57fa\u4e8e\u5f62\u5f0f\u5316\u5b89\u5168\u9a8c\u8bc1\u7684\u6388\u6743\u673a\u5236\u6f0f\u6d1e\u68c0\u6d4b\u65b9\u6cd5\uff0c\u5f00\u53d1\u4e86\u534a\u81ea\u52a8\u68c0\u6d4b\u4e0e\u9a8c\u8bc1\u5de5\u5177\uff08VerioT\uff09\uff0c\u9996\u6b21\u5bf9\u5305\u62ecGoogle Home\u3001Philips Hue\u3001MiHome\u3001Samsung SmartThings\u7b49\u5728\u5185\u768410\u4e2a\u4e3b\u6d41IoT\u5e73\u53f0\u7684\u8de8\u4e91\u6388\u6743\u673a\u5236\u8fdb\u884c\u4e86\u8be6\u7ec6\u7684\u5b89\u5168\u8bc4\u4f30\uff0c\u53d1\u73b0\u4e86\u8bbe\u5907\u654f\u611f\u4fe1\u606f\u6cc4\u9732\u3001\u6388\u6743\u6570\u636e\u6cc4\u9732\u3001OAuth\u4ee4\u724c\u6cc4\u9732\u3001\u6388\u6743API\u6ee5\u7528\u7b49\u591a\u4e2a\u6f0f\u6d1e\u3002\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u53ef\u4ee5\u5b9e\u73b0\u5bf9\u667a\u80fd\u95e8\u9501\u3001\u667a\u80fd\u5f00\u5173\u3001\u667a\u80fd\u706f\u6ce1\u7b49\u5404\u79cd\u667a\u80fd\u5bb6\u5c45\u8bbe\u5907\u7684\u6076\u610f\u63a7\u5236\uff0c\u4f7f\u5f97\u9ad8\u8fbe\u6570\u767e\u4e07\u7528\u6237\u7684\u667a\u80fd\u5bb6\u5c45\u7cfb\u7edf\u548c\u670d\u52a1\u53d7\u5230\u4e25\u91cd\u7684\u5b89\u5168\u5a01\u80c1\u3002\u901a\u8fc7PoC\u653b\u51fb\u9a8c\u8bc1\u548c\u5bf9\u653b\u51fb\u8fc7\u7a0b\u7684\u7cfb\u7edf\u6027\u5206\u6790\u7814\u7a76\uff0c\u8fdb\u4e00\u6b65\u63d0\u51fa\u4e86\u8bbe\u8ba1\u5b89\u5168\u7684\u8de8\u4e91IoT\u6388\u6743\u673a\u5236\u6240\u8981\u9075\u5faa\u7684\u539f\u5219\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u8881\u658c\uff0c\u534e\u4e2d\u79d1\u6280\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\u526f\u6559\u6388\u30022018\u5e74\u4e8e\u534e\u4e2d\u79d1\u6280\u5927\u5b66\u8ba1\u7b97\u673a\u79d1\u5b66\u4e0e\u6280\u672f\u5b66\u9662\u83b7\u5f97\u535a\u58eb\u5b66\u4f4d\uff0c\u66fe\u5148\u540e\u524d\u5f80\u632a\u5a01\u65af\u5854\u4e07\u683c\u5927\u5b66\u3001\u5965\u65af\u9646Simula\u7814\u7a76\u4e2d\u5fc3\u3001\u7f8e\u56fd\u5370\u7b2c\u5b89\u7eb3\u5927\u5b66\u5e03\u9c81\u660e\u987f\u5206\u6821\u8fdb\u884c\u8bbf\u5b66\u3002\u7814\u7a76\u65b9\u5411\u4e3b\u8981\u5305\u62ec\u8f6f\u4ef6\u5b9a\u4e49\u7f51\u7edc\u3001\u7f51\u7edc\u5b89\u5168\u3001\u7269\u8054\u7f51\u5b89\u5168\u3001\u4e91\u8ba1\u7b97\u5b89\u5168\u7b49\uff0c\u5728USENIX Security\u3001IEEE TSC\u3001IEEE TNSM\u3001 IEEE TNSE\u3001ACM TOIT\u3001FGCS\u7b49\u56fd\u9645\u9876\u7ea7\u4f1a\u8bae\u548c\u671f\u520a\u4e0a\u53d1\u8868\u8bba\u6587\u591a\u7bc7\uff0c\u83b7\u5f97\u56fd\u5bb6\u53d1\u660e\u4e13\u5229\u6388\u67431\u9879\u3002\u4e3b\u6301\u4e86\u56fd\u5bb6\u81ea\u7136\u79d1\u5b66\u9752\u5e74\u57fa\u91d1\uff08No. 61902138\uff09\u3001\u535a\u58eb\u540e\u79d1\u5b66\u57fa\u91d1\uff08No. 2018M640701\uff09\u7b49\u9879\u76ee\uff1b\u53c2\u4e0e\u4e86\u56fd\u5bb6\u91cd\u70b9\u7814\u53d1\u8ba1\u5212\u9879\u76ee\uff08No. 2017YFB0801804\uff09\u3001973\u9879\u76ee\uff08No. 2014CB340600\uff09\u7b49\u91cd\u5927\u79d1\u7814\u9879\u76ee\u3002<\/p>\n\n\n\n
\u94b1\u5fd7\u4e91 \u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821\u526f\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/10.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>\u5982\u4f55\u5728\u8ba1\u7b97\u673a\u5e94\u7528\u9886\u57df\u5bfb\u627e\u7814\u7a76\u60f3\u6cd5<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u5728\u505a\u79d1\u7814\u7684\u8fc7\u7a0b\u5f53\u4e2d\uff0c\u6700\u56f0\u96be\u7684\u73af\u8282\u5927\u6982\u5c31\u662f\u627e\u65b0\u7684\u6709\u4ef7\u503c\u7684\u7814\u7a76\u8bfe\u9898\u3002\u8fd9\u5728\u8ba1\u7b97\u673a\u5e94\u7528\uff08\u5305\u62ec\u5b89\u5168\uff09\u5c24\u5176\u5982\u6b64\u3002\u672c\u6b21\u62a5\u544a\u7684\u5185\u5bb9\u4e3b\u8981\u5206\u4eab\u4e86\u4e2a\u4eba\u603b\u7ed3\u7684\u4e00\u4e9b\u7ecf\u9a8c\uff0c\u5305\u62ec\u4e86\u5b9e\u7528\u7684\u601d\u7ef4\u6a21\u5f0f\u548c\u826f\u597d\u79d1\u7814\u4e60\u60ef\uff0c\u6765\u5e2e\u52a9\u5927\u5bb6\u66f4\u6709\u6548\u7684\u627e\u5230\u81ea\u5df1\u5fc3\u6021\u7684\u8bfe\u9898\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u94b1\u5fd7\u4e91\u662f\u52a0\u5dde\u5927\u5b66\u6cb3\u6ee8\u5206\u6821 (University of California, Riverside) \u7684\u526f\u6559\u6388\u3002\u4ed6\u7684\u7814\u7a76\u5174\u8da3\u5728\u4e8e\u7f51\u7edc\uff0c\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4ee5\u53ca\u8f6f\u4ef6\u5b89\u5168\u3002\u5176\u4e2d\u6d89\u53ca\u5230TCP\/IP\u534f\u8bae\u7684\u8bbe\u8ba1\u4e0e\u5b9e\u73b0\uff0c\u5b89\u5353\u64cd\u4f5c\u7cfb\u7edf\u7684\u6f0f\u6d1e\u6316\u6398\u548c\u5206\u6790\uff0c\u4ee5\u53ca\u6d4b\u6027\u9053\u5728\u7f51\u7edc\u7cfb\u7edf\u9886\u57df\u4e2d\u7684\u5b89\u5168\u6027\u7814\u7a76\u3002\u7814\u7a76\u66fe\u83b7\u5f97 ACM CCS 2020 Distinguished Paper Award, IRTF Applied Networking Research Prize, Facebook Internet Defense Prize Finalist, \u4ee5\u53ca GeekPwn \u6700\u5927\u8111\u6d1e\u5956\u3002 <\/p>\n\n\n\n
\u6881\u632f\u51ef \u65b0\u52a0\u5761\u56fd\u7acb\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/12-1.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong><\/p>\n\n\n\nUnderstanding Audit Logs: Techniques, Experience, and Requirements<\/p>\n\n\n\n
\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\nEndpoint monitoring solutions are the basis for understanding the security status of a computing system. They are widely deployed in today’s enterprise environments to support advanced attack detection and investigation. These monitors continuously record system-level activities as audit logs and provide deep visibility into security incidents. Unfortunately, to recognize behaviors of interest and detect potential threats, cyber analysts face a semantic gap between low-level audit events and high-level system behaviors. Existing work bridges this gap by matching streams of audit logs against a knowledge base of rules that describe behaviors. However, specifying such rules heavily relies on expert knowledge.<\/p>\n\n\n\n
In this talk, we discuss techniques for understanding behaviors in audit events. We introduce our recent work that uncovers the semantics of events through their usage context in audit logs. It then combines event semantics as the representation of behaviors, clusters semantically similar behaviors, and identifies the representatives for analyst investigation.<\/p>\n\n\n\n
Besides the introduction of the technical approach, we will have an open discussion to share our experience of this projects’ execution, especially the experience from a students’ point of view. We will also discuss the future demands and requirements for audit log analysis.<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\nDr. LIANG Zhenkai is an Associate Professor in the Department of Computer Science at National University of Singapore. He is also a co-Lead Principal Investigator of National Security R&D Lab of Singapore. His research interests are in system and software security, such as binary program analysis, security in Web, mobile, and Internet-of-things (IoT) platforms. He has been publishing high-impact papers in top security and software engineering conferences, and has won seven best paper awards, including Annual Computer Security Applications Conference (ACSAC), USENIX Security Symposium, and ACM SIGSOFT Symposium on the Foundations of Software Engineering (FSE). He has been actively served as technical committee members and editorial board members of top security conferences and journals, including ACM Conference on Computer and Communications Security (CCS), USENIX Security Symposium, Network and Distributed System Security Symposium (NDSS), and IEEE Transactions on Dependable and Secure Computing (TDSC). He is also a member of the Steering Group of NDSS. He has won the Annual Teaching Excellence Award of NUS in 2014 and 2015. He received his Ph.D. degree in Computer Science from Stony Brook University in 2006, and B.S. degrees in Computer Science and Economics from Peking University in 1999.<\/p>\n\n\n\n
\u5f20\u4e00\u94ed \u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7814\u7a76\u9662\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112854.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898<\/strong>\uff1a\u7f51\u7edc\u5b89\u5168\u548c\u7f51\u7edc\u6d4b\u91cf\u7814\u7a76\u4e2d\u7684Ethics\u95ee\u9898\uff1a\u4e00\u4e2a\u535a\u58eb\u751f\u7684\u63a2\u7d22\u4e0e\u56f0\u60d1<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a <\/strong><\/p>\n\n\n\n\u8fd1\u5e74\u6765\uff0c\u5b89\u5168\u7814\u7a76\u7684\u9053\u5fb7\u4f26\u7406\u95ee\u9898\u6b63\u53d7\u5230\u793e\u533a\u6108\u53d1\u5e7f\u6cdb\u7684\u5173\u6ce8\uff0c\u5404\u5927\u5b66\u672f\u4f1a\u8bae\u4e5f\u9488\u5bf9ethics\u5408\u89c4\u6027\u63d0\u51fa\u4e86\u8bf8\u591a\u8981\u6c42\u3002\u672c\u6b21\u62a5\u544a\u5c06\u4ece\u4e00\u4f4d\u7f51\u7edc\u5b89\u5168\u7814\u7a76\u535a\u58eb\u751f\u7684\u89c6\u89d2\u51fa\u53d1\uff0c\u7ed3\u5408\u77e5\u540d\u5b66\u672f\u4f1a\u8bae\u5ba1\u7a3f\u8981\u6c42\u53ca\u4e1a\u754c\u666e\u904d\u8ba4\u53ef\u7684\u89c4\u8303\u6587\u6863\uff0c\u5bf9\u7f51\u7edc\u5b89\u5168\u3001\u7f51\u7edc\u6d4b\u91cf\u7684ethics\u6807\u51c6\u8fdb\u884c\u7efc\u8ff0\u6c47\u62a5\uff0c\u5206\u4eab\u62a5\u544a\u4eba\u5728\u7814\u7a76\u4e2d\u9047\u5230\u7684ethics\u95ee\u9898\u53ca\u5bfb\u6c42\u5bf9\u7b56\u7684\u63a2\u7d22\u7ecf\u5386\uff0c\u5e76\u7ed3\u5408\u76ee\u524d\u56fd\u5185\u76f8\u5173\u5236\u5ea6\u5efa\u8bbe\u60c5\u51b5\u4ea4\u6d41\u73b0\u5b58\u56f0\u60d1\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u5f20\u4e00\u94ed\uff0c\u6e05\u534e\u5927\u5b66\u8ba1\u7b97\u673a\u7cfb\u5728\u8bfb\u535a\u58eb\u751f\u3002\u7814\u7a76\u65b9\u5411\u4e3a\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\uff0c\u7814\u7a76\u8bfe\u9898\u96c6\u4e2d\u4e8e\u6570\u636e\u9a71\u52a8\u7684\u5b89\u5168\u7814\u7a76\u53ca\u7f51\u7edc\u534f\u8bae\u5b89\u5168\u7814\u7a76\uff0c\u76ee\u524d\u5df2\u5728CCS\u3001NDSS\u3001IJCAI\u7b49\u4f1a\u8bae\u53ca\u671f\u520a\u53d1\u8868\u5b66\u672f\u8bba\u6587\u3002<\/p>\n\n\n\n
\u5362\u5eb7\u6770 \u660e\u5c3c\u82cf\u8fbe\u5927\u5b66\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/14.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\nDr. Kangjie Lu is an assistant professor in the Computer Science & Engineering Department of the University of Minnesota-Twin Cities. His research interests include security and privacy, program analysis, and operating systems. He is particularly interested in automatically finding classes of vulnerabilities, introduced by both developers and compilers, in widely used systems, and hardening systems while preserving their reliability and efficiency. He won the competitive best paper award at ACM CCS 2019. His research results are regularly published at top-tier venues and have led to many important updates in the Linux kernel, the Android OS, the FreeBSD kernel, and Apple\u2019s iOS. He received his Ph.D. in Computer Science from the Georgia Institute of Technology. More details can be found at https:\/\/www-users.cs.umn.edu\/~kjlu<\/p>\n\n\n\n
\u52b3\u4e1c\u71d5 \u6e05\u534e\u5927\u5b66\u6cd5\u5b66\u9662\u6559\u6388<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/13.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>\u6cd5\u5f8b\u89c6\u89d2\u4e0b\u7684\u6280\u672f\u4f26\u7406 <\/p>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u52b3\u4e1c\u71d5\uff0c\u6d59\u6c5f\u7ecd\u5174\u4eba\uff0c\u5317\u4eac\u5927\u5b66\u6cd5\u5b66\u535a\u58eb\uff0c\u6e05\u534e\u5927\u5b66\u6cd5\u5b66\u9662\u957f\u8058\u6559\u6388\uff0c\u535a\u58eb\u751f\u5bfc\u5e08\u3002\u517c\u4efb\u6700\u9ad8\u4eba\u6c11\u68c0\u5bdf\u9662\u6cd5\u5f8b\u653f\u7b56\u7814\u7a76\u5ba4\u526f\u4e3b\u4efb\uff08\u6302\u804c\uff09\uff0c\u66fe\u4efb\u5317\u4eac\u5e02\u6d77\u6dc0\u533a\u4eba\u6c11\u6cd5\u9662\u526f\u9662\u957f\uff08\u6302\u804c\uff09\u3002\u4e3b\u8981\u7814\u7a76\u9886\u57df\u4e3a\u5211\u6cd5\u5b66\u3002\u51fa\u7248\u300a\u529f\u80fd\u4e3b\u4e49\u7684\u5211\u6cd5\u89e3\u91ca\u300b\u3001\u300a\u98ce\u9669\u793e\u4f1a\u4e2d\u7684\u5211\u6cd5\u300b\u3001\u300a\u7f6a\u5211\u6cd5\u5b9a\u672c\u571f\u5316\u7684\u6cd5\u6cbb\u53d9\u4e8b\u300b\u7b49\u4e13\u8457\uff0c\u5728\u300a\u4e2d\u56fd\u793e\u4f1a\u79d1\u5b66\u300b\u3001\u300a\u6cd5\u5b66\u7814\u7a76\u300b\u3001\u300a\u4e2d\u56fd\u6cd5\u5b66\u300b\u3001\u300a\u4e2d\u5916\u6cd5\u5b66\u300b\u7b49\u6743\u5a01\u4e0e\u4e13\u4e1a\u520a\u7269\u4e0a\u53d1\u8868\u8bba\u6587\u516b\u5341\u4f59\u7bc7\u3002<\/p>\n\n\n\n
\u5f20\u950b\u5dcd \u5357\u65b9\u79d1\u6280\u5927\u5b66\u526f\u6559\u6388\uff08PANEL\u4e3b\u6301\u4eba\uff09<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112903.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u5f20\u950b\u5dcd\u8001\u5e08\u662f\u5357\u65b9\u79d1\u6280\u5927\u5b66\u8ba1\u7b97\u673a\u79d1\u5b66\u4e0e\u5de5\u7a0b\u7cfb\u526f\u6559\u6388\uff0c\u7814\u7a76\u5458\u3002\u5728\u52a0\u5165\u5357\u79d1\u5927\u4e4b\u524d\uff0c\u4ed6\u662f\u7f8e\u56fd\u97e6\u6069\u5dde\u7acb\u5927\u5b66\u8ba1\u7b97\u673a\u7cfb\u52a9\u7406\u6559\u6388\uff082015-2019\uff09\u3002\u4ed6\u4e8e2015\u5e74\u83b7\u5f97\u7f8e\u56fd\u4e54\u6cbb\u6885\u68ee\u5927\u5b66\u8ba1\u7b97\u673a\u4e13\u4e1a\u7684\u535a\u58eb\u5b66\u4f4d\u3002\u4e3b\u8981\u7814\u7a76\u9886\u57df\u662f\u7cfb\u7edf\u5b89\u5168\uff0c\u5305\u62ec\u53ef\u4fe1\u6267\u884c\u3001\u786c\u4ef6\u8f85\u52a9\u5b89\u5168\u3001\u6076\u610f\u8f6f\u4ef6\u900f\u660e\u5206\u6790\u3001\u4ea4\u901a\u706f\u7cfb\u7edf\u5b89\u5168\uff0c\u4ee5\u53ca\u53ef\u5426\u8ba4\u52a0\u5bc6\u3002\u5f20\u8001\u5e08\u5df2\u7ecf\u53d1\u8868\u4e8650\u4f59\u7bc7\u56fd\u9645\u4f1a\u8bae\u548c\u671f\u520a\u8bba\u6587\uff0c\u5e76\u62c5\u4efbIEEE S&P\uff0cUSENIX Security\uff0cACM CCS\u7b49\u591a\u4e2a\u56fd\u9645\u9876\u7ea7\u4f1a\u8bae\u7a0b\u5e8f\u59d4\u5458\u4f1a\u7684\u6210\u5458\uff0c\u83b7ACSAC 2017\u6770\u51fa\u8bba\u6587\u5956\u548cIEEE\/IFIP DSN 2020\u6700\u4f73\u8bba\u6587\u63d0\u540d\u3002\u4ed6\u7684\u7814\u7a76\u5de5\u4f5c\u66fe\u83b7\u5f97\u4e86\u591a\u9879\u7f8e\u56fd\u81ea\u7136\u57fa\u91d1\u9879\u76ee\u7684\u652f\u6301\u3002<\/p>\n\n\n\n
\u674e\u5377\u5b7a \u4e0a\u6d77\u4ea4\u901a\u5927\u5b66G.O.S.S.I.P \u7814\u7a76\u7ec4\u957f<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112909.png\")
<\/figure><\/div>\n\n\n\n\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u674e\u5377\u5b7a\u535a\u58eb\uff0c\u4e0a\u6d77\u4ea4\u901a\u5927\u5b66\u7f51\u7edc\u5b89\u5168\u5b66\u9662\u52a9\u7406\u7814\u7a76\u5458\u3001\u201c\u6668\u661f\u201d\u535a\u58eb\u540e\u3001\u77e5\u540d\u5b89\u5168\u56e2\u961fG.O.S.S.I.P\u521b\u59cb\u4eba\u3002\u4ed6\u7684\u7814\u7a76\u5174\u8da3\u8986\u76d6\u8f6f\u4ef6\u5b89\u5168\u591a\u4e2a\u9886\u57df\uff0c\u9488\u5bf9\u4ee3\u7801\u5b89\u5168\u5206\u6790\u3001\u79fb\u52a8\u5b89\u5168\u3001IoT\u5b89\u5168\u548c\u73b0\u5b9e\u4e16\u754c\u5bc6\u7801\u8f6f\u4ef6\u5b89\u5168\u7684\u7814\u7a76\u5de5\u4f5c\u53d1\u8868\u5728CCS\u3001NDSS\u3001ICSE\u3001RAID\u3001ACSAC\u3001ESORICS\u3001AsiaCCS\u548cWiSec\u7b49\u5b66\u672f\u4f1a\u8bae\u4e0a\uff0c\u76f8\u5173\u5b89\u5168\u7814\u7a76\u6210\u679c\u4e3a\u8682\u8681\u91d1\u670d\u3001\u534e\u4e3a\u3001\u817e\u8baf\u3001\u5c0f\u7c73\u3001\u7231\u5947\u827a\u7b49\u63d0\u4f9b\u4e86\u6280\u672f\u652f\u6301\u3002<\/p>\n\n\n\n
\u55bb\u7075\u5a67 \u4e2d\u79d1\u9662\u4fe1\u5de5\u6240\u7279\u522b\u7814\u7a76\u52a9\u7406<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112911.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>You Are What You Broadcast: Identification of Mobile and IoT Devices from (Public) WiFi\u3010Usenix Security2020\u3011<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u968f\u7740\u65e0\u7ebf\u901a\u4fe1\u6280\u672f\u7684\u53d1\u5c55\u53ca\u5176\u5e26\u6765\u7684\u4fbf\u5229\uff0c\u8d8a\u6765\u8d8a\u591a\u7684\u4f20\u7edf\uff08\u6709\u7ebf\uff09\u8bbe\u5907\u548c\u7269\u8054\u7f51\u8bbe\u5907\u901a\u8fc7\u65e0\u7ebf\u65b9\u5f0f\u63a5\u5165WiFi\u7f51\u7edc\u3002WiFi\u7f51\u7edc\u4e2d\u7531\u65e0\u7ebf\u8bbe\u5907\u548c\u7269\u8054\u7f51\u8bbe\u5907\u5e26\u6765\u7684\u5b89\u5168\u98ce\u9669\u4e5f\u968f\u4e4b\u4ea7\u751f\u3002\u653b\u51fb\u8005\u5728\u53d1\u8d77\u653b\u51fb\u524d\u901a\u5e38\u4f1a\u5148\u8fdb\u884c\u7f51\u7edc\u4fa6\u5bdf\u4ee5\u53d1\u73b0\u66b4\u9732\u7684\u8bbe\u5907\uff0c\u8bc6\u522b\u5176\u5236\u9020\u5546\u3001\u7c7b\u578b\u548c\u578b\u53f7\u3002\u7136\u540e\u653b\u51fb\u8005\u53ef\u4ee5\u5c06\u8bbe\u5907\u7684\u5236\u9020\u5546\u3001\u7c7b\u578b\u548c\u578b\u53f7\u4e0e\u5df2\u77e5\u6f0f\u6d1e\u96c6\u8fdb\u884c\u5339\u914d\uff0c\u83b7\u53d6\u8bbe\u5907\u7684\u6f0f\u6d1e\u4ee5\u8fdb\u884c\u9488\u5bf9\u6027\u653b\u51fb\u3002\u6b64\u5916\uff0c\u6076\u610f\u8bbe\u5907\u53ef\u80fd\u8bd5\u56fe\u4f2a\u9020\u81ea\u8eab\u8eab\u4efd\uff0c\u4e5f\u53ef\u80fd\u9690\u85cf\u81ea\u5df1\u4ee5\u907f\u514d\u88ab\u8bc6\u522b\u6216\u8ddf\u8e2a\u3002\u56e0\u6b64\uff0cWiFi\u7f51\u7edc\u7ba1\u7406\u5458\u5e94\u8be5\u8bc6\u522b\u7f51\u7edc\u4e2d\u6f5c\u5728\u7684\u6f0f\u6d1e\u4e0e\u98ce\u9669\uff0c\u901a\u8fc7\u8bc6\u522b\u8fde\u63a5\u5230\u7f51\u7edc\u7684\u8bbe\u5907\u7684\u5236\u9020\u5546\u3001\u7c7b\u578b\u548c\u578b\u53f7\uff0c\u4ee5\u4fbf\u8bbe\u7f6e\u7f51\u7edc\u7684\u8bbf\u95ee\u89c4\u5219\u3001\u9632\u706b\u5899\u89c4\u5219\u3001\u68c0\u67e5\u5df2\u77e5\u6f0f\u6d1e\u662f\u5426\u5b58\u5728\u6216\u914d\u7f6e\u76f8\u5e94\u7684\u5165\u4fb5\u68c0\u6d4b\u7cfb\u7edf\u3002\u540c\u65f6\uff0c WiFi \u7f51\u7edc\u4e2d\u7684\u666e\u901a\u7528\u6237\u4e5f\u9700\u8981\u53d1\u73b0\u7f51\u7edc\u4e2d\u7684\u6f5c\u5728\u6076\u610f\u8bbe\u5907\uff08\u5982\u5047\u5192\u7f51\u5173\u6216\u8005\u9690\u85cf\u7684\u6076\u610f\u6444\u50cf\u5934\uff09\uff0c\u4ee5\u4fdd\u62a4\u81ea\u8eab\u7684\u9690\u79c1\u4e0e\u5b89\u5168\u3002\u7136\u800c\uff0c\u79fb\u52a8\u8bbe\u5907\u548c\u7269\u8054\u7f51\u8bbe\u5907\u5728\u52a0\u5165 WiFi \u7f51\u7edc\u65f6\u6ca1\u6709\u88ab\u5f3a\u5236\u62a5\u544a\u81ea\u5df1\u7684\u8be6\u7ec6\u7c7b\u522b\u4fe1\u606f\uff0c\u653b\u51fb\u8005\u8fd8\u53ef\u4ee5\u8f7b\u677e\u5730\u901a\u8fc7\u4f2a\u9020\u8bbe\u5907\u5c5e\u6027\u6765\u5047\u5192\u5176\u4ed6\u7c7b\u522b\u7684\u8bbe\u5907\u6216\u8005\u9690\u85cf\u8bbe\u5907\u7c7b\u522b\u3002<\/p>\n\n\n\n
\u672c\u7814\u7a76\u63d0\u51fa\u4e86\u4e00\u79cd\u65b0\u7684\u8bbe\u5907\u8bc6\u522b\u6280\u672fOWL\u3002OWL\u4f7f\u7528\u4e86\u88ab\u52a8\u91c7\u96c6\u5230\u7684\u8bbe\u5907\u5e7f\u64ad\u548c\u591a\u64ad\u6570\u636e\u5305\uff0c\u901a\u8fc7\u5d4c\u5165\u5f0f\u8868\u5f81\u5b66\u4e60\u5c06\u8bbe\u5907\u5e7f\u64ad\u548c\u591a\u64ad\u6570\u636e\u5305\u4e2d\u7684\u7279\u5f81\u6784\u5efa\u52306\u4e2a\u72ec\u7acb\u4e92\u8865\u7684\u7279\u5f81\u89c6\u56fe\u4e2d\u3002\u7136\u540e\uff0cOWL\u5229\u7528\u672c\u7814\u7a76\u63d0\u51fa\u7684\u591a\u89c6\u56fe\u5e7f\u6df1\u5b66\u4e60\u7b97\u6cd5MvWDL\uff0c\u901a\u8fc7\u8be5\u7b97\u6cd5\u63cf\u7ed8\u7684\u7279\u5f81\u753b\u50cf\u4ee5\u53ca\u7279\u5f81\u89c6\u56fe\u95f4\u7684\u4e0d\u4e00\u81f4\u6027\uff0c\u8bc6\u522b\u8bbe\u5907\u7c7b\u522b\u548c\u53d1\u73b0\u53ef\u80fd\u7684\u6076\u610f\u8bbe\u5907\u3002\u672c\u7814\u7a76\u901a\u8fc7\u5927\u89c4\u6a21\u5b9e\u9a8c\u3001\u6848\u4f8b\u5206\u6790\u548c\u5b9a\u6027\u5206\u6790\u591a\u4e2a\u89d2\u5ea6\uff0c\u5c55\u793a\u4e86OWL\u5728\u8bbe\u5907\u7c7b\u522b\u8bc6\u522b\u4e0e\u6076\u610f\u8bbe\u5907\u8bc6\u522b\u4e0a\u7684\u80fd\u529b\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u55bb\u7075\u5a67\uff0c\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u7279\u522b\u7814\u7a76\u52a9\u7406\u30022020\u5e74\u4e8e\u4e2d\u56fd\u79d1\u5b66\u9662\u4fe1\u606f\u5de5\u7a0b\u7814\u7a76\u6240\u83b7\u5f97\u535a\u58eb\u5b66\u4f4d\u3002\u76ee\u524d\u7814\u7a76\u65b9\u5411\u5305\u62ec\u7269\u8054\u7f51\u5b89\u5168\u3001\u7f51\u7edc\u5b89\u5168\u3001\u7f51\u7edc\u5185\u5bb9\u5b89\u5168\u7b49\uff0c\u5728USENIX Security\u3001SACMAT\u3001MASS\u3001ICICS\u7b49\u4f1a\u8bae\u4e0a\u53d1\u8868\u591a\u7bc7\u8bba\u6587\uff0c\u83b7\u5f97\u56fd\u5bb6\u53d1\u660e\u4e13\u5229\u6388\u67431\u9879\uff0c\u5df2\u53d7\u7406\u56fd\u5bb6\u53d1\u660e\u4e13\u52296\u9879\u3002\u4e3b\u6301\u548c\u53c2\u4e0e\u4e86\u67d0\u5b89\u5168\u4e2d\u5fc3\u79d1\u7814\u9879\u76ee\u591a\u9879\uff1b\u4f5c\u4e3a\u6838\u5fc3\u4eba\u5458\u53c2\u4e0e\u4e86\u56fd\u5bb6\u91cd\u70b9\u7814\u53d1\u8ba1\u5212\u9879\u76ee\uff08NO. 2016YFB0801300\uff09\u3001\u4e2d\u79d1\u9662\u5148\u5bfc\u9879\u76ee\uff08XDC02030000\uff09\u3001\u7f51\u7edc\u5b89\u5168\u5ba1\u8ba1\u3001\u7279\u5b9a\u7f51\u7ad9\u7814\u7a76\u3001\u6d41\u91cf\u4e32\u8054\u5e73\u53f0\u7b49\u91cd\u5927\u79d1\u7814\u9879\u76ee\u4e0e\u5de5\u7a0b\u9879\u76ee\u7684\u7814\u7a76\u548c\u5f00\u53d1\u3002<\/p>\n\n\n\n
\u51af\u7693\u6960 \u5317\u4eac\u90ae\u7535\u5927\u5b66\u7814\u7a76\u751f<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521112915.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898\uff1a<\/strong>FIDO UAF\u534f\u8bae\u7684\u5f62\u5f0f\u5316\u5206\u6790<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u5b89\u5168\u534f\u8bae\u7684\u5f62\u5f0f\u5316\u5206\u6790\u6280\u672f\u501f\u52a9\u6570\u5b66\u548c\u8ba1\u7b97\u673a\uff0c\u53ef\u4ee5\u81ea\u52a8\u3001\u5feb\u901f\u548c\u5168\u9762\u5730\u5bf9\u5b89\u5168\u534f\u8bae\u8fdb\u884c\u5206\u6790\uff0c\u5bfb\u627e\u5b89\u5168\u534f\u8bae\u7684\u6f0f\u6d1e\uff0c\u751a\u81f3\u53ef\u4ee5\u8bc1\u660e\u534f\u8bae\u7684\u5b89\u5168\u6027\uff0c\u5f25\u8865\u4e86\u4eba\u5de5\u5206\u6790\u7684\u4e0d\u8db3\u3002FIDO\uff08Fast Identity Online\uff09 UAF\uff08Universal Authentication Framework Protocol\uff09\u534f\u8bae\u662f\u4e00\u4e2a\u57fa\u4e8e\u6311\u6218-\u54cd\u5e94\u7684\u901a\u7528\u8ba4\u8bc1\u6846\u67b6\uff0c\u501f\u52a9\u751f\u7269\u56e0\u5b50\uff0c\u4e3a\u7528\u6237\u63d0\u4f9b\u5b89\u5168\u3001\u65e0\u5bc6\u7801\u7684\u4f53\u9a8c\u3002\u8be5\u534f\u8bae\u81ea\u63d0\u51fa\u4ee5\u6765\uff0c\u4e00\u76f4\u7f3a\u5c11\u5b8c\u6574\u7684\u5f62\u5f0f\u5316\u9a8c\u8bc1\u3002\u672c\u7814\u7a76\u5de5\u4f5c\u4ee5UAF\u534f\u8bae\u4f5c\u4e3a\u5206\u6790\u76ee\u6807\uff0c\u5bf9\u534f\u8bae\u7684\u5b89\u5168\u5047\u8bbe\u548c\u5b89\u5168\u76ee\u6807\u8fdb\u884c\u5f62\u5f0f\u5316\u63cf\u8ff0\uff0c\u63d0\u51faUAF\u534f\u8bae\u7684\u5f62\u5f0f\u5316\u6a21\u578b\uff0c\u4ee5ProVerif\u4e3a\u540e\u7aef\uff0c\u5f00\u53d1\u81ea\u52a8\u5316\u5de5\u5177UAFVerif\uff0c\u8be5\u5de5\u5177\u53ef\u4ee5\u81ea\u52a8\u751f\u6210\u5e76\u9a8c\u8bc140\u591a\u4e07\u79cdUAF\u534f\u8bae\u53ef\u80fd\u8fd0\u884c\u7684\u5e94\u7528\u573a\u666f\uff0c\u5e76\u81ea\u52a8\u5bfb\u627e\u6ee1\u8db3\u534f\u8bae\u5b89\u5168\u76ee\u6807\u7684\u6700\u5c0f\u5316\u5b89\u5168\u5047\u8bbe\u3002\u501f\u52a9\u5206\u6790\u7ed3\u679c\uff0c\u603b\u7ed3\u4e86\u5bf9UAF\u534f\u8bae\u7684\u8bbe\u8ba1\u6f0f\u6d1e\uff0c\u63d0\u51fa\u8ba4\u8bc1\u5668\u91cd\u7ed1\u5b9a\u653b\u51fb\u3001\u5e73\u884c\u4f1a\u8bdd\u653b\u51fb\u3001\u9690\u79c1\u63ed\u9732\u653b\u51fb\u548c\u62d2\u7edd\u670d\u52a1\u653b\u51fb4\u79cd\u7c7b\u578b\u7684\u653b\u51fb\uff0c\u5728\u4eac\u4e1c\u91d1\u878d\u548c\u548c\u5305\u652f\u4ed8\u5b89\u5353APP\u4e0a\u9a8c\u8bc1\u4e86\u8ba4\u8bc1\u5668\u91cd\u7ed1\u5b9a\u653b\u51fb\uff0c\u5e76\u83b7\u5f97\u4e00\u4e2a\u4e2d\u5371CNNVD\u6f0f\u6d1e\uff08CNNVD-202005-1219\uff09\u3002\u5728\u5206\u6790\u8fc7\u7a0b\u4e2d\uff0c\u8fd8\u53d1\u73b0\u4e86ProVerif\u5de5\u5177\u7684\u6f0f\u6d1e\uff0c\u901a\u8fc7\u4e0a\u62a5\u5f00\u53d1\u8005\uff0c\u4fc3\u8fdb\u4e86ProVerif 2.01\u7684\u66f4\u65b0\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u51af\u7693\u6960\uff0c\u672c\u79d1\u4e0e\u7814\u7a76\u751f\u5c31\u8bfb\u4e8e\u5317\u4eac\u90ae\u7535\u5927\u5b66\u7f51\u7edc\u7a7a\u95f4\u5b89\u5168\u5b66\u9662\uff0c\u76ee\u524d\u662f\u7814\u7a76\u751f\u4e09\u5e74\u7ea7\u5b66\u751f\u3002\u4ece2016\u5e74\u5f00\u59cb\u8fdb\u884c\u5b89\u5168\u534f\u8bae\u5f62\u5f0f\u5316\u5206\u6790\u65b9\u5411\u7684\u7814\u7a76\uff0c\u5bf9ProVerif\u5f62\u5f0f\u5316\u5206\u6790\u5de5\u5177\u6709\u6bd4\u8f83\u6df1\u5165\u7684\u4e86\u89e3\u30022021\u5e74\u5728\u56fd\u9645\u9876\u7ea7\u4f1a\u8baeNDSS\u4e0a\u4ee5\u7b2c\u4e00\u4f5c\u8005\u53d1\u8868\u8bba\u6587\u201cA Formal Analysis of the FIDO UAF protocol\u201d\u3002\u83b7\u5f97\u56fd\u5bb6\u53d1\u660e\u4e13\u52291\u9879\uff08201910918214.X\uff09\u3002\u5728\u6821\u671f\u95f4\u591a\u6b21\u83b7\u5f97\u4e00\u7b49\u5956\u5b66\u91d1\uff0c\u5e76\u83b7\u5f97\u56fd\u5bb6\u5956\u5b66\u91d1\uff082019\uff09\uff0c\u53c2\u4e0e\u7b2c\u56db\u5c4a\u5168\u56fd\u5bc6\u7801\u6280\u672f\u7ade\u8d5b\u5e76\u83b7\u5f97\u7279\u7b49\u5956\u3002<\/p>\n\n\n\n
\u9646\u8d85\u9038 \u6e05\u534e\u5927\u5b66\u7f51\u7edc\u7814\u7a76\u9662<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/16-1.png\")
<\/figure><\/div>\n\n\n\n\u62a5\u544a\u4e3b\u9898<\/strong>\uff1a\u300aFrom WHOIS to WHOWAS: A Large-Scale Measurement Study of Domain Registration Privacy under the GDPR\u300b<\/p>\n\n\n\n\u5185\u5bb9\u6458\u8981\uff1a<\/strong><\/p>\n\n\n\n\u57df\u540dWHOIS\u6570\u636e\u8bb0\u5f55\u7740\u6ce8\u518c\u4eba\u7684\u201c\u5b9e\u540d\u201d\u4fe1\u606f\uff0c\u5728\u6076\u610f\u57df\u540d\u68c0\u6d4b\u3001\u7f51\u7edc\u653b\u51fb\u884c\u4e3a\u8ffd\u8e2a\u7b49\u5b89\u5168\u7814\u7a76\u4e2d\u6709\u7740\u5e7f\u6cdb\u5e94\u7528\u3002\u7136\u800c\uff0c\u516c\u5f00\u7684WHOIS\u6570\u636e\u6216\u591a\u6216\u5c11\u5730\u5b58\u5728\u9690\u79c1\u95ee\u9898\uff0c\u4e00\u4e9b\u56fd\u5bb6\u8fd1\u5e74\u6765\u4e5f\u4ece\u6cd5\u5f8b\u5c42\u9762\u52a0\u5f3a\u5bf9\u6570\u636e\u9690\u79c1\u7684\u4fdd\u62a4\u3002\u81ea2018\u5e74\u8d77\uff0c\u6b27\u76df\u901a\u7528\u6570\u636e\u4fdd\u62a4\u6761\u4f8b\uff08GDPR\uff09\u4f7f\u5927\u91cf\u4e92\u8054\u7f51\u6570\u636e\u53d7\u5230\u7ba1\u8f96\uff0cWHOIS\u7684\u516c\u5f00\u56e0\u6b64\u6210\u4e3a\u5386\u53f2\u3002\u6b64\u4e3e\u4fdd\u62a4\u4e86\u7528\u6237\u7684\u9690\u79c1\uff0c\u4f46\u540c\u65f6\u4f7f\u4e00\u4e9b\u5b89\u5168\u7814\u7a76\u53d8\u5f97\u66f4\u52a0\u56f0\u96be\u3002<\/p>\n\n\n\n
\u6211\u4eec\u7814\u7a76\u4e86GDPR\u65bd\u884c\u4e24\u5e74\u95f4\u5bf9WHOIS\u7cfb\u7edf\u7684\u5b9e\u9645\u5f71\u54cd\u3002\u4ece\u4e92\u8054\u7f51\u7528\u6237\u89d2\u5ea6\uff0c\u5bf9\u57df\u540d\u6ce8\u518c\u673a\u6784\u7684\u5408\u89c4\u6027\u8fdb\u884c\u5206\u6790\uff0c\u53d1\u73b0\u9690\u79c1\u6cd5\u89c4\u6267\u884c\u4e2d\u5b58\u5728\u7684\u95ee\u9898\uff1b\u4ece\u5b89\u5168\u7814\u7a76\u8005\u89d2\u5ea6\uff0c\u5206\u6790WHOIS\u6570\u636e\u7f3a\u5931\u5c06\u5f71\u54cd\u54ea\u4e9b\u7f51\u7edc\u5b89\u5168\u7814\u7a76\uff0c\u5e76\u63d0\u51fa\u5e94\u5bf9\u63aa\u65bd\u3002\u540c\u65f6\uff0c\u6211\u4eec\u8fd8\u5f00\u53d1\u4e86\u5728\u7ebf\u5de5\u5177\u4f9b\u57df\u540d\u6ce8\u518c\u673a\u6784\u548c\u4e92\u8054\u7f51\u76d1\u7763\u90e8\u95e8\u8fdb\u884c\u5408\u89c4\u6027\u68c0\u67e5\u3002<\/p>\n\n\n\n
\u672c\u9879\u7814\u7a76\u53d1\u8868\u4e8eNDSS 2021\u4f1a\u8bae\u3002\u7814\u7a76\u6210\u679c\u540c\u65f6\u88ab\u6b27\u6d32\u8bae\u4f1a\u7f51\u7edc\u72af\u7f6a\u529e\u516c\u5ba4\u3001\u745e\u5178\u56fd\u5bb6\u4e92\u8054\u7f51\u5e94\u6025\u54cd\u5e94\u4e2d\u5fc3\uff08CERT-SE\uff09\u7b49\u673a\u6784\u7684\u7f51\u7edc\u5b89\u5168\u5468\u62a5\u6536\u5f55\u3002<\/p>\n\n\n\n
\u5609\u5bbe\u4ecb\u7ecd\uff1a<\/strong><\/p>\n\n\n\n\u9646\u8d85\u9038\uff0c\u6e05\u534e\u5927\u5b662017\u7ea7\u535a\u58eb\u7814\u7a76\u751f\uff0c\u7814\u7a76\u65b9\u5411\u4e3a\u7f51\u7edc\u57fa\u7840\u8bbe\u65bd\u5b89\u5168\u548c\u4e92\u8054\u7f51\u6d4b\u91cf\u3002\u591a\u9879\u7814\u7a76\u6210\u679c\u53d1\u8868\u4e8eUSENIX Security\u3001NDSS\u3001CCS\u3001IMC\u7b49\u7f51\u7edc\u5b89\u5168\u5b66\u672f\u4f1a\u8bae\u3002\u66fe\u83b7\u5f972020\u5e74\u56fd\u9645\u4e92\u8054\u7f51\u7814\u7a76\u4efb\u52a1\u7ec4-\u5e94\u7528\u7f51\u7edc\u7814\u7a76\u5956\uff08IRTF ANRP\uff09\u30012019\u5e74IMC\u4f1a\u8bae\u6700\u4f73\u8bba\u6587\u5956\u63d0\u540d\u548c\u793e\u533a\u8d21\u732e\u5956\u63d0\u540d\u3002<\/p>\n\n\n\n
\u674e\u661f \u6d59\u6c5f\u5927\u5b66\u535a\u58eb\u751f<\/strong><\/p>\n\n\n\n![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/18.png\")
<\/figure><\/div>\n\n\n\n
![\"\"](\"https:\/\/www.inforsec.org\/wp\/wp-content\/uploads\/2021\/05\/\u5fae\u4fe1\u56fe\u7247_20210521105159.jpg\")
<\/figure><\/div>\n\n\n\n