| Date | Lectures Topics | Speakers & Notes | Reading |
|---|---|---|---|
| Mon 5.6 | Program analysis | Hao | EXE: Automatically Generating Inputs of Death http://www.stanford.edu/~engler/exe-ccs-06.pdf Dynamic Taint Analysis: Automatic Detection, Analysis, and Signature Generation of Exploit Attacks on Commodity Software. http://www.cs.berkeley.edu/%7Edawnsong/papers/taintcheck.pdf |
| Mon 5.7 | Program analysis in action | Hao | Intrusion Detection via Static Analysishttp://www.cs.berkeley.edu/~daw/papers/ids-oakland01.ps A secure environment for untrusted helper applications:confining the wily hacker.http://www.cs.berkeley.edu/~daw/papers/janus-usenix96.ps |
| Mon 5.13 | Android Security | Hao | TaintDroid: An Information-Flow Tracking System for Realtime Privacy Monitoring on Smartphoneshttp://appanalysis.org/tdroid10.pdf AppsPlayground: Automatic Security Analysis of Smartphone Applications http://www.enck.org/pubs/codaspy13.pdf Android Security and Permissions http://developer.android.com/guide/topics/security/security.html Android Permissions Demystified http://www.cs.berkeley.edu/~daw/papers/androidperm-ccs11.pdf |
| Sun 5.19 | Android Security | Hao | Permission Re-Delegation: Attacks and Defenses http://www.cs.berkeley.edu/~afelt/felt_usenixsec2011.pdf AdDroid: Privilege Separation for Applications and Advertisers in Android http://www.cs.berkeley.edu/~afelt/addroid.pdf AdRob: Examining the Landscape and Impact of Android Application Plagiarism http://www.cs.ucdavis.edu/~hchen/paper/mobisys12uecon.pdf |
| Mon 6.3 | Openflow Background | [OpenFlow] Yan |
OpenFlow:enabling innovation in campus networks, McKeown,
Nick, et al., ACM SIGCOMM Computer Communication Review
38.2 (2008). [Ref]NOX:towards an operating system for networks, Gude, Natasha, et al., ACM SIGCOMM Computer Communication Review 38.3 (2008). |
| SDN Background | [Slides by Shenker] Yan |
The Future of Networking, and the
Past of Protocols, Scott Shenker (video of talk at Ericsson) [Ref]Fabric: A Retrospective on Evolving SDN, Mart锟絥 Casado, Teemu Koponen, Scott Shenker, Amin Tootoonchian, HotSDN 2012 |
|
| Mon 6.10 | OpenFlow Security Services | [OF Sec
Services] Yan |
FRESCO:
Modular Composable Security Services for
Software-Defined Networks, Shin, Seugwon, et al., in
the Network and Distributed System Security Symposium,
(NDSS), 2013. [Ref] A security enforcement kernel for OpenFlow networks, Porras, Philip, et al., in the Proc. of the first Workshop on Hot Topics in Software Defined Networks (SDN), ACM, 2012. |
| OpenFlow App Testing | [OF App
Testing] Yan |
A NICE Way to Test OpenFlow Applications, by Canini, Marco, et al., in the Proc. of NSDI, 2012. | |
| Mon 6.17 | WWW security background | [browser_security] Yan |
Browser Security Handbook, part 1 (Basic concepts) |
| Web origins and the same origin policy | [flowfox][gazelle] Yan |
FlowFox: a Web Browser with Flexible and Precise Information
Flow Control, Willem De Groef, Dominique Devriese,
Nick Nikiforakis and Frank Piessens, CCS 2012. [Ref] The Multi-Principal OS Construction of the Gazelle Web Browser, Helen Wang, Chris Grier, Alexander Moshchuk, Samuel T. King, Piali Choudhury, and Herman Venter, USENIX Security 2009. |
|
| Mon 6.24 | Browser Extension Vulnerabilities | [VEX.pptx] Yan |
Bandhakavi, Sruthi, et al. "VEX:
Vetting browser extensions for security
vulnerabilities." Usenix Security. 2010. [video
of the authors' talk] |
| Project Presentation | Yan |
Notes: You may find the brochure useful: Efficient reading of papers in Science and Technology by Michael J. Hanson, 1990, revised 2000 Dylan McNamee.