As SDN becomes the backbone of today's cloud and enterprise infrastructure, its security evaluation remains scattered and inconsistent. A persistent gap exists in current frameworks regarding transparently and specifically assessing the impact of SDN attacks and the effectiveness of corresponding defenses. General-purpose tools like CVSS overlook critical SDN characteristics-scalability, vendor independence, resource constraints, and operational visibility-essential for measuring impact. Platform-specific systems (e.g., ONOS, OpenDaylight) suffer from inconsistent criteria, limited cross-vendor applicability, and opaque scoring processes. Moreover, many impactful SDN attacks remain untracked in CVE databases due to disclosure barriers and the opaque nature of the SDN ecosystem. To address these gaps, we present Odin, an open-source, lightweight framework for evaluating SDN security in cloud and enterprise environments. Odin scores attack impact and defense effectiveness across three dimensions: technical severity, resource feasibility, and operational visibility. Applied to 20 real-world attack-defense scenarios-including underreported cases-Odin offers more contextualized prioritization and actionable insights than CVSS. Our results show that Odin scores align with or exceed CVSS ratings for all evaluated attacks, while also capturing defenses' effectiveness and operational trade-offs. By providing transparency, tunability, and SDN-specific relevance, Odin helps researchers and practitioners assess risk and improve resilience across varied deployment environments.
With the growing adoption of cloud computing services, outsourced machine learning has become increasingly prevalent, raising significant concerns about the privacy of sensitive data. Users are often reluctant to reveal their personal information to access these services, while model providers strive to protect the security of their proprietary models. Naive Bayes classification is a widely used method for probabilistic decision-making in applications such as spam filtering, text categorization, and medical diagnosis. When either model parameters or user inputs are outsourced to the cloud, ensuring data security becomes essential. In this work, we present FssNBC, a secure and online efficient outsourced Naive Bayes classification protocol based on function secret sharing. FssNBC adopts an offline-online computation model that shifts most cryptographic operations to the offline phase, achieving both lightweight online cost and strong security guarantees. We implement and evaluate FssNBC, demonstrating its advantages over existing solutions in terms of both computational and communication efficiency. Compared to existing two-server protocols offering equivalent security guarantees, FssNBC improves online computation time by 10(8)x and reduces online communication cost by 10(3)x, making it highly practical for real-world deployment.
At Eurocrypt 2013, Bellare, Keelveedhi, and Ristenpart initiated a rigorous study of the important, practically-motivated problem of "Secure Deduplication". Deduplication deals with storing data efficiently by storing duplicate data only once; when data is spread across multiple parties, ensuring privacy becomes an added concern. Even though deduplication and privacy might appear to be mutually incompatible, Bellare et al. offer a meaningful definition as well as theoretical and practical constructions for the same. Our work considers the setting of Secure Fuzzy Deduplication where deduplication of nearby-and not equal-files is desired. We provide a rigorous definition of fuzzy message locked encryption as well as fuzzy deduplication. We build constructions that satisfy our definitions in the random oracle model and provide proof-of-concept implementations of the same by instantiating our random oracle using AES. Finally, we propose a general paradigm of data-adaptive clustering, where the clusters, which are intrinsic to fuzzy deduplication, are created based on the data. We believe this paradigm yields better deduplication efficiency for typical use cases involving time-series data, such as medical images (e.g., X-ray scans taken over time), CCTV footage from secure locations, DNA sequencing datasets, and longitudinal studies that collect large volumes of data (e.g., voice samples, videos capturing subject movement).
WebAssembly has become increasingly popular in web development, offering a versatile and efficient platform for executing code in languages beyond JavaScript, such as C and C++. However, WebAssembly's flat memory model exposes memory-safety vulnerabilities. While C and C++ code are primarily susceptible to memory safety issues, Rust, though improved, still presents vulnerabilities[44]. Inspired by the ARM Memory Tagging Extension, this paper proposes a memory tagging solution for WebAssembly. Our evaluation indicates that the proposed memory tagging mechanism introduces average time overheads of 48.91% for Wasm64 and 72.38% for Wasm32 in pure software implementations. On ARM Memory Tagging Extension-supported CPUs, the time overheads decrease to 5.71% for Wasm64 and 18.05% for Wasm32. Additionally, we compare our WebAssembly memory tagging to the host Address Sanitizer to demonstrate the efficacy of our approach. Finally, we conduct a case study on real-world CVEs to demonstrate the impact of our work.
The increasing complexity of cloud-native applications has necessitated advanced methodologies for threat modeling and security analysis. This paper presents THREATCOMPUTE, a novel framework that combines LLMs with attack graphs to automate the generation of threat hypotheses and the quantification of risk in Kubernetes environments. While traditional approaches to attack graph generation require significant manual effort from security experts, THREATCOMPUTE leverages LLMs to extract security insights from system information, reducing reliance on manual intervention while maintaining high accuracy and generating context-specific, system-aware threat insights. The framework utilizes the MITRE ATT&CK Matrix and the Microsoft Threat Matrix for Kubernetes as structured domains of possible attack techniques. Based on LLM-generated threat hypotheses and a quantitative risk metric, THREATCOMPUTE constructs detailed attack graphs that illustrate potential attack paths and assess their associated risks. This enables both qualitative and quantitative evaluations of application security across varying levels of granularity. Through real-world examples of Kubernetes applications, we demonstrate the effectiveness of our approach in identifying and quantifying security risks.
