Usenix2022夏季论⽂简单分类
securing最近发现Usenix 2022夏季的paper已经出了，所以扫扫看有没有有趣的⽂章，对⽂章进⾏了简单的分类。基于个⼈知识分类，可能分类不是那么准确。也可以等usenix 2022上了dblp看官⽅的分类。
⽂章⽬录
⼆进制
DeepDi: Learning a Relational Graph Convolutional Network Model on Instructions for Fast and Accurate Disassembly
分类：深度学习应⽤在反汇编
Debloating Address Sanitizer
ASan的性能优化
RE-Mind: a First Look Inside the Mind of a Reverse Engineer
调研⼆进制逆向⼯程师是如何分析汇编代码，做逆向任务的。
Augmenting Decompiler Output with Learned Variable Names and Types
反汇编，基于机器学习的⽅法
fuzz
Fuzzware: Using Precise MMIO Modeling for Effective Firmware Fuzzing
固件fuzz
Morphuzz: Bending (Input) Space to Fuzz Virtual Devices
对虚拟设备进⾏fuzz
Regulator: Dynamic Analysis to Detect ReDoS
⽤fuzz去发现正则表达式引起的拒绝服务漏洞
软件安全
Ferry: State-Aware Symbolic Execution for Exploring State-Dependent Program Paths
能够探索状态依赖的分⽀的符号执⾏
How Long Do Vulnerabilities Live in the Code? A Large-Scale Empirical Measurement Study on FOSS Vulnerability Lifetimes 研究开源软件中的漏洞存在的时长
Expected Exploitability: Predicting the Development of Functional Vulnerability Exploits
漏洞利⽤性评估
物联⽹
Lumos: Identifying and Localizing Diverse Hidden IoT Devices in an Unfamiliar Environment
分类：在陌⽣环境发现隐藏的IoT设备
Practical Data Access Minimization in Trigger-Action Platforms
物联⽹平台的数据风险问题
ProFactory: Improving IoT Security via Formalized Protocol Customization
IoT应⽤的协议漏洞
声⾳相关
Towards More Robust Keyword Spotting for Voice Assistants
语⾳助⼿的防御
“OK, Siri” or “Hey, Google”: Evaluating Voiceprint Distinctiveness via Content-based PROLE Score
关于声纹独特性的研究
Your Microphone Array Retains Your Identity: A Robust Voice Liveness Detection System for Smart Speakers 分类：物联⽹安全，关于⽿机
Lamphone: Passive Sound Recovery from a Desk Lamp’s Light Bulb Vibrations
通过灯泡进⾏窃听
SkillDetective: Automated Policy-Violation Detection of Voice Assistant Applications in the Wild
语⾳助⼿的隐私违反检测
侧信道
SecSMT: Securing SMT Processors against Contention-Based Covert Channels
简介：分析了⾼性能协同多线程处理器⾥的基于竞争的安全漏洞
Rapid Prototyping for Microarchitectural Attacks
如何快速构造微体系结构攻击
Hiding in Plain Sight? On the Efficacy of Power Side Channel-Based Control Flow Monitoring
针对侧信道防御的⼀种新攻击
AMD Prefetch Attacks through Power and Time
分类：AMD的CPU也存在侧信道问题
Repurposing Segmentation as a Practical LVI-NULL Mitigation in SGX
针对LVI攻击（熔断幽灵那类）的防御
Rendering Contention Channel Made Practical in Web Browsers
浏览器渲染的侧信道攻击
Automated Side Channel Analysis of Media Software with Manifold Learning
⽤AI的学习⽅法去侧信道分析，然后重现机密的媒体输⼊
Lend Me Your Ear: Passive Remote Physical Side Channels on PCs
PC机远程物理侧信道，⽐如PC机上的⽿机
HyperDegrade: From GHz to MHz Effective CPU Frequencies
⽤性能降级技术来抵御侧信道攻击
GhostTouch: Targeted Attacks on Touchscreens without Physical Touch
不⽤碰屏幕，就可以实现针对屏幕的攻击
Hand Me Your PIN! Inferring ATM PINs of Users Typing with a Covered Hand
⽤深度学习发现在ATM输⼊密码的⼿势特征，还原你的银⾏卡密码
可信计算
Elasticlave: An Efficient Memory Model for Enclaves
允许共享的TEE内存模型
SGXLock: Towards Efficiently Establishing Mutual Distrust Between Host Application and Enclave for SGX 限制不可信enclave的⾏为
内核
Midas: Systematic Kernel TOCTTOU Protection
分类：内核安全，double-fetch bug
LinKRID: Vetting Imbalance Reference Counting in Linux kernel with Symbolic Execution
⽤符号执⾏检测内核⾥的引⽤计数器的⾮法使⽤
SyzScope: Revealing High-Risk Security Impacts of Fuzzer-Exposed Bugs in Linux kernel
确定内核漏洞的风险性
云安全
Jenny: Securing Syscalls for PKU-based Memory Isolation Systems
分类：PKU内存隔离系统⾥的系统调⽤过滤问题（PKU是云系统的⼀种隔离机制）
Exploring the Unchartered Space of Container Registry Typosquatting
docker 容器安全
Bedrock: Programmable Network Support for Secure RDMA Systems
云数据中⼼的防御，侧重于做Remote direct memory access （RDMA）
嵌⼊式设备
PISTIS: Trusted Computing Architecture for Low-end Embedded Systems
可信体系结构，低档嵌⼊式系统
RapidPatch: Firmware Hotpatching for Real-Time Embedded Devices
对嵌⼊式设备⾃动打上热补丁
Holistic Control-Flow Protection on Real-Time Embedded Systems with Kage
保护基于微控制器的嵌⼊式系统的控制流
AI模型安全
ML-Doctor: Holistic Risk Assessment of Inference Attacks Against Machine Learning Models
分类：机器学习模型的Inference Attack
On the Security Risks of AutoML
对神经搜索⽅法潜在的安全性做了研究
Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel
神经⽹络的侧信道攻击
Inference Attacks Against Graph Neural Networks
图神经⽹络的推断攻击(Inference Attack)
SIMC: ML Inference Secure Against Malicious Clients at Semi-Honest Cost
机器学习模型推断攻击的防御
Label Inference Attacks Against Vertical Federated Learning
垂直联邦学习的标签推断攻击（Label Inference Attacks）
驾驶系统
DoubleStar: Long-Range Attack Towards Depth Estimation based Obstacle Avoidance in Autonomous Systems 分类：⾃动驾驶系统的安全问题
Rolling Colors: Adversarial Laser Exploits against Traffic Light Recognition
在交通灯图⽚上注⼊彩⾊条纹，使得⾃动驾驶系统识别红绿灯出错
Towards Automatically Reverse Engineering Vehicle Diagnostic Protocols
对驾驶系统的协议进⾏⾃动化逆向
SAID: State-aware Defense Against Injection Attacks on In-vehicle Network
驾驶系统的注⼊攻击防御
移动安全
A Large-scale Temporal Measurement of Android Malicious Apps: Persistence, Migration, and Lessons Learned 分类：恶意APP的综述
FReD: Identifying File Re-Delegation in Android System Services
安卓系统服务的安全、静态分析
A Large-scale Investigation into Geodifferences in Mobile Apps
移动APP地理差异的研究（地理差异可以⽤来墙的）
FOAP: Fine-Grained Open-World Android App Fingerprinting
细粒度的开源安卓APP指纹技术
LTE（通信安全？）
LTrack: Stealthy Tracking of Mobile Phones in LTE
对LTE攻击，能够获取到设备的位置
Watching the Watchers: Practical Video Identification Attack in LTE Networks
视频识别攻击，可以知道受害者在看什么视频。
DoLTEst: In-depth Downlink Negative Testing Framework for LTE Devices
LTE设备的negative testing框架
密码学
OpenSSLNTRU: Faster post-quantum TLS key exchange
后量⼦密码学相关
Polynomial Commitment with a One-to-Many Prover and Applications
密码学相关
Post-Quantum Cryptography with Contemporary Co-Processors: Beyond Kronecker, Schönhage-Strassen & Nussbaumer 后量⼦密码、IoT设备
Orca: Blocklisting in Sender-Anonymous Messaging
设计了匿名发送系统的协议
How to Abuse and Fix Authenticated Encryption Without Key Commitment
密码学、认证相关
Omnes pro uno: Practical Multi-Writer Encrypted Database
密码学相关
⽹络安全
Spoki: Unveiling a New Wave of Scanners through a Reactive Network Telescope
⽹络扫描
Total Eclipse of the Heart – Disrupting the InterPlanetary File System
P2P⽅案InterPlanetary File System的⼀个攻击
Under the Hood of DANE Mismanagement in SMTP
DNS、⽹络安全相关
MAGE: Mutual Attestation for a Group of Enclaves without Trusted Third Parties
远程认证机制
Adversarial Detection Avoidance Attacks: Evaluating the robustness of perceptual hashing-based client-side scanning
端到端的加密系统（⽐如邮箱平台⽤的）的安全性问题
99% False Positives: A Qualitative Study of SOC Analysts’ Perspectives on Security Alarms
从安全运营分析者⾓度对安全警告的定性研究（99%都是误报）
Web安全
Online Website Fingerprinting: Evaluating Website Fingerprinting Attacks on Tor in the Real World
web 指纹攻击
Mistrust Plugins You Must: A Large-Scale Study Of Malicious Plugins In WordPress Marketplaces
wordpress 的恶意插件研究
Web Cache Deception Escalates!
web 安全
Mining Node.js Vulnerabilities via Object Dependence Graph and Query
挖掘node.js的漏洞

版权声明：本站内容均来自互联网，仅供演示用，请勿用于商业和其他非法用途。如果侵犯了您的权益请与我们联系QQ:729038198，我们将在24小时内删除。