Decentralised Runtime Monitoring for Access Control Systems in Cloud Federations

2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)

Hoffmann

et al. 2021

University o f Chicago {cw an, s h ic h e n g 2 0 0 0 , h a n k h o ffm a n n , m m a ire , s h a n lu } @ u c h ic a g o .e d u Abstract-Machine learning (ML) cloudAPIs enable developers to easily incorporate learning solutions into software systems. Unfortunately, ML APIs are challenging to use correctly and efficiently, given their unique semantics, data requirements, and accuracy-performance tradeoffs. Much prior work has studied how to develop ML APIs or ML cloud services, but not how open-source applications are using ML APIs. In this paper, we manually studied 360 representative open-source applications that use Google or AWS cloud-based m L APIs, and found 70% of these applications contain API misuses in their latest versions that degrade functional, performance, or economical quality of the software. We have generalized 8 anti-patterns based on our manual study and developed automated checkers that identify hundreds of more applications that contain ML API misuses. I. In t r o d u c t io n A. MotivationMachine learning (ML) provides efficient solutions for a number of problems that were difficult to solve with traditional computing techniques; e.g., object detection and language translation. ML cloud APIs allow programmers to incorporate these learning solutions into software systems without designing and training the learning model themselves [1], and hence put these powerful techniques into the hands of non-experts. Indeed, there are more than 35,000 open-source projects on GitHub that use Google or Amazon ML Cloud APIs to solve a wide variety of problems, among which more than 14,000 were created within the last 1 2 months.While these APIs make it easy for non-experts to incorporate learning into software systems, there are still a number of challenges that must be addressed to ensure that the resulting applications are both correct and efficient. While certain challenges come with the use of any third-party API, this paper focuses on unique challenges for ML APIs that arise due to the nature of learning itself. Complicated data requirements. Machine learning tech-niques are used to process digitalized real-world visual, audio and text content. Although such content can be generated by a huge variety of devices and encoding software, the suitable input content and format (encoding, resolution, size, etc.) for ML APIs are rather limited and often uniquely defined by the DNN-training process. For example, cameras can produce images in many formats, but the image sets on which ML models are trained have a relatively small variety [2 ]- [8 ]. Thus, it is up to the API user to select the input or convert the input into what the API can accept and effectively process.

Section: Re L a T E D Wo R Kmentioning

confidence: 99%

Are Machine Learning Cloud APIs Used Correctly?

Wan

2021 IEEE/ACM 43rd International Conference on Software Engineering (ICSE)

Hoffmann

et al. 2021

“…Ref. [ 19 ] proposed a decentralized runtime monitoring architecture based on blockchain technology to improve the accountability and reliability of distributed access control systems.…”

Section: Background and Related Workmentioning

confidence: 99%

Tracking the Insider Attacker: A Blockchain Traceability System for Insider Threats

Xin

et al. 2020

Sensors

The insider threats have always been one of the most severe challenges to cybersecurity. It can lead to the destruction of the organisation’s internal network system and information leakage, which seriously threaten the confidentiality, integrity and availability of data. To make matters worse, since the attacker has authorized access to the internal network, they can launch the attack from the inside and erase their attack trace, which makes it challenging to track and forensics. A blockchain traceability system for insider threats is proposed in this paper to mitigate the issue. First, this paper constructs an insider threat model of the internal network from a different perspective: insider attack forensics and prevent insider attacker from escaping. Then, we analyze why it is difficult to track attackers and obtain evidence when an insider threat has occurred. After that, the blockchain traceability system is designed in terms of data structure, transaction structure, block structure, consensus algorithm, data storage algorithm, and query algorithm, while using differential privacy to protect user privacy. We deployed this blockchain traceability system and conducted experiments, and the results show that it can achieve the goal of mitigating insider threats.

“…Blockchain technology has emerged as the promising solution for creating a more secure IoT in the future [31]. Blockchain properties like transparency, irreversible, distribution and auditability can help the IoT resist many network attacks such as resource consumption and liability disputes [32,33,34,35].…”

Section: Related Workmentioning

confidence: 99%

eHAPAC: A Privacy-Supported Access Control Model for IP-Enabled Wireless Sensor Networks

Tang

Wang

2019

Sensors

The implementation of IP technology in wireless sensor networks has promoted the development of many smart scenarios. To enhance secure access in IP-enabled wireless sensor networks, access control to sensor nodes is a necessary process. However, access control currently faces two challenges, feasibility and preservation of user access privacy. In this paper, we propose eHAPAC, a novel privacy-preserving access control model for IP-enabled wireless sensor networks. The contributions of our paper include three parts. First, this paper integrates the Hidra access control protocol and APAC privacy-preserving model, addressing the issue of privacy-preserving access control in resource-constrained devices. Second, this paper proposes an enhanced Hidra protocol to implement the unlinkability of protocol message exchanges. Third, to solve the problem of third party credibility, this paper improves the group signature-based APAC model and utilizes blockchain technology to manage the storage and publication of public group signature keys. Security analysis and performance evaluation prove that our protocol is secure and effective.