The parameterized pattern matching (PPM) problem is seeking occurrences of one string in another, where both strings are given from two parameter and constant alphabet sets. In this matching paradigm, a consistent renaming of symbols from the parameter alphabet is allowed. The parameterized pattern matching is useful in problems in software engineering, computational biology, and other applications. In this paper, for the first time, we consider the problem of secure parameterized multi-pattern matching (SPMPM) that an owner of a set of patterns allows matching of his/her patterns against the text while pattern owner only learns matching results and the text owner learns nothing. In our setting, a pattern owner can find the matching locations in multiple texts in a privacy-preserving manner. The server only performs operations over encrypted values and cannot obtain any information about the text or the patterns. The proposed scheme is efficient for the pattern owner and every text owner. We prove the security of our scheme via the simulation-based paradigm.
Reverse engineering using Side Channel Attacks (SCA) have been known as a serious menace against embedded devices. The attacker could employ side channel data to retrieve some sensitive information from the device, security analysis, existence of a library in the device or execution of a special stream of codes. Side channel data could be gathered from the power consumption or electromagnetic radiations by the device. In this paper, we propose a disassembler to extract the instructions of the device under attack. A deep convolutional neural network is employed to make templates of the target to use it for real-time scenarios. Short Time Fourier Transform (STFT), and Mel-Frequency Cepstrum Coefficients (MFCC) are utilized as feature extractors. The proposed method consists of two different parts: 1) Hierarchical scenario and 2) Sole model. Atmel 8-bit AVR micro-controller is employed as the target device under attack. Our results indicate that, even with an experimental and low cost setup a vast number of instructions are detectable. The proposed method reaches 98.21% accuracy on the real code, outperforms state-of-the-art methods on the proposed dataset.
In recent years pairing-based cryptographic protocols have attracted so much attention. Meanwhile identity-based cryptography based on bilinear pairings has received particular attention. The IEEE, IETF, and ISO organizations have been working on standardization of pairing-based cryptographic schemes. The Boneh-Franklin identity-based encryption is the most well-known identity-based scheme that has been standardized. So far, various schemes have been proposed to reduce the computational cost of pairing operations. All these schemes are trying to outsource pairing operations in a secure manner. But in addition to pairing operations, there are other basic and costly operations in pairing-based cryptography and identity-based schemes, including scalar multiplication on elliptic curves. In this research, we outsource the Boneh-Franklin encryption in a more secure and efficient (in terms of computational and communication complexity) way than existing schemes. The proposed scheme is secure in the OMTUP model. Also, unlike previous schemes, we considered communication channels insecure. Moreover, compared with the trivial solution which outsources every single operation (such as pairing, scalar multiplication and modular exponentiation) as a separate subroutine, our scheme offers less complexity by seamlessly outsourcing the whole encryption scheme for the first time.
Web application firewalls (WAF) are the last line of defense in protecting web applications from application layer security threats like SQL injection and cross-site scripting. Currently, most evasion techniques from WAFs are still developed manually. In this work, we propose a solution, which automatically scans the WAFs to find payloads through which the WAFs can be bypassed. Our solution finds out rules defects, which can be further used in rule tuning for rule-based WAFs. Also, it can enrich the machine learning-based dataset for retraining. To this purpose, we provide a framework based on reinforcement learning with an environment compatible with OpenAI gym toolset standards, employed for training agents to implement WAF evasion tasks. The framework acts as an adversary and exploits a set of mutation operators to mutate the malicious payload syntactically without affecting the original semantics. We use Q-learning and proximal policy optimization algorithms with the deep neural network. Our solution is successful in evading signature-based and machine learning-based WAFs.
Fragile watermarking is the task of embedding a watermark in an image such that even small changes, called tamper, in the image can be detected or even recovered to preserve unauthorized alteration. A well-known type of spatial fragile watermarking embeds the watermark in the least significant bits of the image to measure correctness of the most significant bits. In addition, Hamming code is a coding algorithm in communication that transmits the data-bits by augmenting some check-bits to exactly detect and recover single-bit modifications. This property is used, in this paper, to detect and perfectly recover the images modified by a tamper with diameter less than a half of the diameter of the image. Based on our knowledge, this is the first time that perfect reconstruction is guaranteed in a high probable condition. To achieve this goal, the Hamming code is applied on a distributed pixel of which bits are extracted from far sufficient pixels in the image. According to the experimental results, the proposed method achieves better performance, in terms of recovering the tampered areas, in comparison to state-of-the-art.
