Matthew Wright, PhD Director of the Center for Cybersecurity - - PowerPoint PPT Presentation

▶
matthew wright phd director of the center for
SMART_READER_LITE
LIVE PREVIEW

Matthew Wright, PhD Director of the Center for Cybersecurity - - PowerPoint PPT Presentation

Feb 01, 2024 259 likes •838 views

http://www.rit.edu/cybersecurity Matthew Wright, PhD Director of the Center for Cybersecurity Professor of Computing Security Rochester Institute of Technology Center Mission Research Interdisciplinary Real-world Human-centered

slide-1
SLIDE 1

Matthew Wright, PhD Director of the Center for Cybersecurity Professor of Computing Security Rochester Institute of Technology

http://www.rit.edu/cybersecurity

slide-2
SLIDE 2

Research Education Outreach

Center Mission

  • Interdisciplinary
  • Real-world
  • Human-centered
  • Tied to

Research

  • Real projects
  • SAFE Lab
  • Industry-focused

research

slide-3
SLIDE 3

Security Analytics

  • Prediction of attacks
  • Modeling attacker behavior
  • Simulation to predict outcomes
  • Discovering Architectural Weaknesses
  • Finding & characterizing design flaws
  • Working w/ MITRE’s CWE
  • Mining for Software Vulnerabilities
  • Understanding how software vulnerabilities

happen

  • Metrics
  • S. Jay Yang

Mehdi Mirakhorli Andy Meneely

Katie McConky

slide-4
SLIDE 4

Crypto & Trusted Hardware

  • ML on Encrypted Data
  • Applying homomorphic encryption
  • Fully secure in the cloud
  • Trusted Computing
  • Cache-based attacks in SGX
  • Defenses
  • Crypto Hardware
  • FPGA implementations
  • Power analysis attacks

Peizhao Hu Marcin Lukowiak Ziming Zhao

slide-5
SLIDE 5

Network Security

  • Measuring Internet Security
  • DNSSEC Deployment
  • Certificate Authorities
  • Software-Defined Networks
  • SDN Firewalls
  • SDN Honeynets
  • Wireless Security
  • Full-frame Encryption
  • Securing PHY-layer attributes

Tijay Chung Hanif Rahbari Ziming Zhao

slide-6
SLIDE 6

http://www.rit.edu/cybersecurity

slide-7
SLIDE 7

How Attackers Can Read Your Encrypted Traffic … and What to Do About It

slide-8
SLIDE 8

Encrypted Traffic

https://turtlehealth.com/shell

Reading up on my athlete’s shell symptoms.

Encrypted Connection

Shelly

slide-9
SLIDE 9

Encrypted Traffic

Encrypted Connection

Oh, what’s this? Broken shells! I can’t read it! Sheldon Shelly

https://turtlehealth.com/shell

slide-10
SLIDE 10

http://www.nickandmore.com/wordpress/wp-content/uploads/2013/08/cover.jpg

slide-11
SLIDE 11

Website Fingerprinting

DB P1 P2 P1 P2 Shredder

https://turtlehealth.com/shell https://turtlehealth.com/tail

slide-12
SLIDE 12

Website Fingerprinting

Ah! A match for P1! P1 P2

90%+ Accuracy

Shelly

https://turtlehealth.com/shell

slide-13
SLIDE 13

Website Fingerprinting Threat Model

Po Possible At Attackers ISP AS Website

slide-14
SLIDE 14
slide-15
SLIDE 15

Client Webserver Guard Middle Exit

Tor

Attacker

slide-16
SLIDE 16

16

Tr Train the classifier

Website Fingerprinting in Tor

slide-17
SLIDE 17

17

Websi site Fi Fingerp rpri rinti ting in To Tor

Pre Predict ct

Pe Perform the attack

slide-18
SLIDE 18

18

90%+ Accuracy*

Heh! Nice try J

* For ~100 sites, not pages

slide-19
SLIDE 19

Adaptive Padding

P1 Tor (unpadded) P1 Tor w/ Adaptive Padding

WTF-PAD

  • AP for Tor
  • 90% accuracy à 17%
  • 54-64% bandwidth
  • verhead
  • Minimal added delay
slide-20
SLIDE 20

Transition to Practice

  • Working with Tor to deploy this

+

slide-21
SLIDE 21

WTF!?!

slide-22
SLIDE 22

Questions?

slide-23
SLIDE 23

De Deep Fi Fingerp rpri rinti ting

Un Undermining Website Fingerprinting De Defenses wi with De Deep Learning

Payap Sirinam Rochester Institute of Technology Mohsen Imani University of Texas at Arlington Marc Juarez imec-COSIC KU Leuven, Belgium Matthew Wright Rochester Institute of Technology Payap Mohsen Marc

slide-24
SLIDE 24

Deep Learning

24

https://codeburst.io/deep-learning-what-why-dd77d432f182

slide-25
SLIDE 25

ILSVRC: 1.2M images, 1.2K categories

slide-26
SLIDE 26

http://arcticicekennels.tripod.com/puppies.html

120 Breeds

slide-27
SLIDE 27

Trained!

slide-28
SLIDE 28

28

Websi site Fi Fingerp rpri rinti ting in To Tor

Mo Monitored- vs vs Unm nmoni

  • nitor
  • red

ed Websi ebsites es

slide-29
SLIDE 29

29

Cl Closed- vs vs Open pen Wor

  • rld

d Scenar cenarios

  • s

Mo Monitore red

facebook.com humanright.com …..

Cl Closed-Wor World d Scenar enario

  • Users only visit monitored websites
  • Identify which website ?
  • Accu

ccuracy cy of the attack

  • Unrealistic [JAA14 ]
  • Classifier performance evaluation

[JAA14] Juarez et al. A critical evaluation of website fingerprinting attacks., CCS 2014

Websi site Fi Fingerp rpri rinti ting in To Tor

slide-30
SLIDE 30

30

Websi site Fi Fingerp rpri rinti ting in To Tor

Cl Closed- vs vs Open pen Wor

  • rld

d Scenar cenarios

  • s

Op Open-Wor World d Scenar enario

  • Users can visit any website in the world (> billions)
  • Recognizing monitored or unmonitored
  • More realistic and more difficult
  • Preci

cisi sion and Reca call [JAA14 , PLZ16 ]

[JAA14] Juarez et al. A critical evaluation of website fingerprinting attacks., CCS 2014 [PLZ16] Panchenko et al. Website fingerprinting at internet scale., NDSS 2016

slide-31
SLIDE 31

31

Website Fingerprinting Attacks & Defenses

slide-32
SLIDE 32

32

We Website Fingerprinting At Attacks & & Defenses WF WF Attacks using Hand-cr craf afted ed Feat eatur ures es

  • Feature engineering
  • 3 state-of-the-art
  • k-NN [WCN14 ]
  • CUMUL [PLZ16 ]
  • k-FP [HD16 ]
  • 90+% Accuracy

[WCN14] Wang et al. Effective attacks and provable defenses for website fingerprinting., USENIX 2014 [PLZ16] Panchenko et al. Website fingerprinting at internet scale., NDSS 2016 [HD16] Hayes and Danezis. k-Fingerprinting: A robust scalable website fingerprinting technique., USENIX 2016.

slide-33
SLIDE 33

33

WF WF Defenses

  • Basic mechanisms

We Website Fingerprinting At Attacks & & Defenses

Ad Add dummy packets De Delay packets

slide-34
SLIDE 34

34

Li Light ghtwei eight ght WF Def efenses enses

  • WTF-PAD [JIP16 ]
  • Moderate bandwidth e.g. 54% + Low delay
  • Reduce accuracy < 20%
  • Main candidate to be deployed in Tor. [PER15 ]

[JIP16] Juarez et al. Toward an efficient website fingerprinting defense., ESORIC2016. [PER15] Mike Perry. Padding negotiation. Tor protocol specification., 2015.

We Website Fingerprinting At Attacks & & Defenses

slide-35
SLIDE 35

35

Li Light ghtwei eight ght WF Def efenses enses

  • Walkie-Talkie (W-T) [WG17 ]
  • 31% extra bandwidth overhead & 34% extra latency overhead
  • Reduce accuracy < 30%

[WG17] Wang and Goldberg. Walkie-talkie: An efficient defense against passive website fingerprinting attacks. USENIX 2017

We Website Fingerprinting At Attacks & & Defenses

slide-36
SLIDE 36

36

WF WF Attacks using Deep Learning

  • Rimmer et al. work [RPJ18 ]
  • Automated feature engineering
  • 3 DL vs 1 Hand-crafted
  • SDAE, CNN, LSTM vs CUMUL
  • CNN, SDAE and CUMUL consistently perform best
  • 95-97% Accuracy

[RPJ18] Rimmer et al. Automated website fingerprinting through deep learning., NDSS2018

We Website Fingerprinting At Attacks & & Defenses

slide-37
SLIDE 37

37

Neural Networks (in 1 slide)

https://stats.stackexchange.com/questions/188277/activation-function-for-first-layer-nodes-in-an-ann https://www.digitaltrends.com/cool-tech/what-is-an-artificial-neural-network/

Right? Wrong?

slide-38
SLIDE 38

38

CNNs (in 1 slide)

https://stats.stackexchange.com/questions/188277/activation-function-for-first-layer-nodes-in-an-ann https://www.digitaltrends.com/cool-tech/what-is-an-artificial-neural-network/

slide-39
SLIDE 39

39

We Website Fingerprinting At Attacks & & Defenses Go Goals

  • Prior work
  • CNN model à early-proposed architecture
  • Improvement of CNN in the literature

Al AlexNet (2 (2012) ~55% Accuracy VG VGG19 (2014) ~71% Accuracy In Inceptio tion V4 (2016) ~80% Accuracy

Canziani et al. An Analysis of Deep Neural Network Models for Practical Applications., arXiv:1605.07678

slide-40
SLIDE 40

40

We Website Fingerprinting At Attacks & & Defenses Ke Key Challenges

  • No evaluation against WF defenses

CNN CNN Model Effective

e.g. ~80 Accuracy

Effective?

Original Distorted

CNN CNN Model

slide-41
SLIDE 41

41

Deep Fingerprinting

slide-42
SLIDE 42

42

De Deep Fingerprinting DF DF Model: Improved De Design of CNN CNN

#Filters growing Low-level High-level

Ze Zeiler and and Fe Fergus. . “Visualizing and understa tanding convoluti tional net networ

  • rks”. ECCV,

, 2014.

Deeper layers

Image Network Traffic

slide-43
SLIDE 43

43

De Deep Fingerprinting

DF DF Model (O (Our) r) AW AWF M Model (Ri Rimmer et et al. al.)

slide-44
SLIDE 44

44

De Deep Fingerprinting

DF DF Model (O (Our) r) AW AWF M Model (Ri Rimmer et et al. al.)

slide-45
SLIDE 45

45

De Deep Fingerprinting

DF DF Model (O (Our) r) AW AWF M Model (Ri Rimmer et et al. al.)

slide-46
SLIDE 46

46

Batch Normalization

Gradient Descent

https://saugatbhattarai.com.np/what-is-gradient-descent-in-machine-learning/ https://towardsdatascience.com/gradient-descent-in-a-nutshell-eaf8c18212f0 https://medium.com/@julian.harris/stochastic-gradient-descent-in-plain-english-9e6c10cdba97

BN: 1 ft. max

slide-47
SLIDE 47

47

Dropout

https://stats.stackexchange.com/questions/201569/difference-between-dropout-and-dropconnect

Train Test

slide-48
SLIDE 48

48

De Deep Fingerprinting

~3X deeper

DF DF Model (O (Our) r) AW AWF M Model (Ri Rimmer et et al. al.)

slide-49
SLIDE 49

49

De Deep Fingerprinting Ex Experimental Ev Evaluation

  • No

Non-def defended ended Dat atas aset et

slide-50
SLIDE 50

50

Ex Experimental Ev Evaluation

  • Wal

Walkie-Ta Talkie

  • 31% Bandwidth, 34% Latency

De Deep Fingerprinting

Theoretical Maximum Accuracy

slide-51
SLIDE 51

51

Ex Experimental Ev Evaluation

  • WT

WTF-PAD PAD

  • 64% Bandwidth, 0% Latency

De Deep Fingerprinting

slide-52
SLIDE 52

52

De Deep Fingerprinting Wa Walkie-Ta Talkie: Discussion

  • At

At most st 50% accu ccura racy cy in cl close sed worl rld

  • To

Top-N N prediction

Re Real Site Deco coy y Site

DF DF: Top-2 2 pr predi ediction

  • n à 98.

98.44 44 Accur urac acy

slide-53
SLIDE 53

53

Conclusion

slide-54
SLIDE 54

54

Co Conclusion

Effective?

Distorted

CNN CNN Model

Network Traffic with Defenses

DF DF Model >90% Accuracy (WTF-PAD)

slide-55
SLIDE 55

This material is based upon work supported by the National Science Foundation under Grant No. CNS-1423163, CNS-1722473, and CNS-1816851. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation.

slide-56
SLIDE 56

I’m back, baby!

slide-57
SLIDE 57

57

Deep Fingerprinting

Undermining Website Fingerprinting Defenses with Deep Learning

https://github.com/deep-fingerprinting/df