Detection of Intrusions and Malware, and Vulnerability Assessment: 19th International Conference, DIMVA 2022, Cagliari, Italy, June 29 –July 1, 2022, ... (Lecture Notes in Computer Science, 13358)

Preface
Organization
Contents
Hybrid Pruning: Towards Precise Pointer and Taint Analysis
	1 Introduction
	2 Background
		2.1 Flow-Sensitive, Static Points-To Analysis
		2.2 Static Taint Tracking
	3 Motivation
		3.1 Running Example
		3.2 Imprecision in Vanilla Static Analysis
		3.3 Precision Gain Due to Hybrid Pruning
	4 Hybrid Pruning
		4.1 Generation of Dynamic Facts
		4.2 Domain Re-mapping
		4.3 Injection of Dynamic Facts
		4.4 Vulnerability Detection
		4.5 Implementation
	5 Evaluation
		5.1 Evaluation Setup
		5.2 Vulnerability Detection
		5.3 Effect of Dynamic Trace
	6 Limitations and Discussion
	7 Related Work
	8 Conclusion
	References
Establishing the Contaminating Effect of Metadata Feature Inclusion in Machine-Learned Network Intrusion Detection Models
	1 Introduction
	2 Related Work
		2.1 Shortcut Learning
		2.2 State of the Art Datasets
		2.3 Proposed ML-IDS Systems
	3 Evaluation Methodology
		3.1 Two Notes on Methodological Design Choices
	4 Results
		4.1 NSL-KDD
		4.2 ISCX-IDS2012
		4.3 CTU-13
		4.4 UNSW-NB15
		4.5 CIDDS Collection
		4.6 CIC Collection
		4.7 Other Metadata Features
	5 Discussion
	6 Conclusion
	7 Future Work
	References
Extended Abstract: Effective Call Graph Fingerprinting for the Analysis and Classification of Windows Malware
	1 Introduction
	2 Background and Related Work
	3 Methodology
		3.1 Pre-processing and Analysis
		3.2 Feature Extraction
		3.3 Classification
	4 Experimental Evaluation
	5 Conclusions and Future Work
	References
COBRA-GCN: Contrastive Learning to Optimize Binary Representation Analysis with Graph Convolutional Networks
	1 Introduction
	2 Related Work
	3 Approach
		3.1 Approach Overview
		3.2 Assembly Instruction Embeddings
		3.3 Function Embeddings
		3.4 Program Embeddings
	4 Datasets
	5 Evaluation and Results
		5.1 Assembly Embeddings
		5.2 Function Embeddings
		5.3 Program Similarity
	6 Limitations and Future Work
	7 Conclusion
	References
Prioritizing Antivirus Alerts on Internal Enterprise Machines
	1 Introduction
	2 Background
	3 Proposed Method
		3.1 Overview
		3.2 Notations
		3.3 Training an AE Model (Ranker)
		3.4 Applying the AE Models to Rank Sensitive Events
	4 Evaluation
		4.1 Experimental Setup
		4.2 Results
	5 Related Work
	6 Conclusions
	References
VANDALIR: Vulnerability Analyses Based on Datalog and LLVM-IR
	1 Introduction
	2 Background
	3 Design
		3.1 Overview
		3.2 Knowledge Base
		3.3 Core Analyses
		3.4 Vulnerability Detection
	4 Evaluation
		4.1 Juliet Test Suite Results
		4.2 Real World Results
		4.3 Performance
	5 Limitations
	6 Related Work
	7 Conclusion
	References
Branch Different - Spectre Attacks on Apple Silicon
	1 Introduction
	2 Background and Related Work
	3 Building Blocks
		3.1 High-resolution Timing
		3.2 Cache Maintenance
	4 Fast Covert Channel
	5 Spectre Exploit
	6 Evaluation
		6.1 High-Resolution Timing
		6.2 Cache Maintenance
		6.3 Spectre-PHT Proof of Concept
	7 Discussion
	8 Conclusion
	A  Code
	B  Library Functions
	References
MPKAlloc: Efficient Heap Meta-data Integrity Through Hardware Memory Protection Keys
	1 Introduction
	2 Background and Threat Model
		2.1 Memory Protection Keys
		2.2 Related Work
		2.3 Design Assumptions and Threat Model
	3 System Overview
		3.1 Indirect Meta-data Corruption
		3.2 Code Domain Partitioning
		3.3 Detecting Domain Violations
	4 Implementation
		4.1 Meta-data in tcmalloc and PartitionAlloc
		4.2 Code Domain Partitioning
		4.3 Detecting Corruptions
	5 Evaluation
		5.1 Experimental Set Up
		5.2 SPEC CPU2006 Benchmarks
		5.3 Hardening Chromium with MPKAlloc
		5.4 Detecting Heap Meta-data in Chromium
		5.5 Corrupting Meta-data in Chromium
		5.6 Impact on Page Load Times
	6 Conclusion
	References
A Human in Every APE: Delineating and Evaluating the Human Analysis Systems of Anti-Phishing Entities
	1 Introduction
	2 System Description
		2.1 System Overview
		2.2 CAPTCHAs for Honey Sites
		2.3 Experimental Setup
	3 Delineation of Human Analysis Systems
		3.1 Filtering Automated Crawler Visits
		3.2 Human Systems' Impact Analysis
	4 Evaluation of Human Analysis Systems
		4.1 Geolocation-Based Evasion Attacks
		4.2 User Agents
		4.3 Timing Blind Spots
		4.4 Sensor API-based Mobile Evasion Attacks
	5 Discussion
	6 Related Work
	7 Conclusion
	References
Amplification Chamber: Dissecting the Attack Infrastructure of Memcached DRDoS Attacks
	1 Introduction
	2 Threat Model
	3 Real-World Observations
		3.1 Observing Memcached DRDoS Attacks
		3.2 Amplification Request and Factor
	4 Attack Infrastructure Analysis
		4.1 Back-End of Attack Infrastructure
		4.2 Front-End of Attack Infrastructure
		4.3 Infrastructure Hotspots
		4.4 Memcached Servers in the Wild
	5 Discussion
		5.1 Ethical Consideration
		5.2 Limitations
		5.3 Dataset
	6 Related Work
	7 Conclusion
	References
Consistency is All I Ask: Attacks and Countermeasures on the Network Context of Distributed Honeypots
	1 Introduction
	2 Related Work
	3 Threat Model
	4 Network Context Cross-Checking Attacks
		4.1 Pre-exploitation Reconnaissance
		4.2 Post-exploitation Reconnaissance
		4.3 Artifacts Cross-Checking
		4.4 Attack Effectiveness
	5 HoneyPortal: The Countermeasure
		5.1 System Design
		5.2 Implementation of HoneyPortal
	6 Evaluation
		6.1 Defense Effectiveness
		6.2 Processing Latency
		6.3 System Overhead
	7 Discussion
	8 Conclusion
	References
Author Index