Interaction of Structure and Information on Tor

Zabihimayvan, Mahdieh; Kadariya, Dipesh

doi:10.1007/978-3-030-65347-7_25

Cited by 4 publications

(3 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In the experiment, we compiled Busybox, OpenSSL and Coreutils in different architectures (ARM/MIPS/ X86/X64) and optimization levels (O0-O3) like [19][20][21], taking the compiled binary files as our analysis target. In addition, realworld firmware files from Genius dataset [22] were also used, which contain third-party library.…”

Section: Discussionmentioning

confidence: 99%

“…We evaluated the effectiveness of DAPDiff when making diffing between files compiled in different optimization levels and architectures. DAPDiff is compared with BinDiff, TurboDiff and Asm2vec by using precision and recall metrics [19][20][21]. To define the metrics of precision and recall, we use G to represent the ground truth information, which is the set of actually matched function pairs in the two binary files.…”

Section: Effectiveness (Rq2)mentioning

confidence: 99%

See 1 more Smart Citation

A Heuristic Local-sensitive Program-Wide Diffing Method for IoT Binary Files

Shen

et al. 2021

Arab J Sci Eng

View full text Add to dashboard Cite

Code reuse brings vulnerabilities in third-party library to many Internet of Things (IoT) devices, opening them to attacks such as distributed denial of service. Program-wide binary diffing technology can help detect these vulnerabilities in IoT devices whose source codes are not public. Considering the architectures of IoT devices may vary, we propose a data-aware program-wide diffing method across architectures and optimization levels. We rely on the defined anchor functions and call relationship to expand the comparison scope within the target file, reducing the impact of different architectures on the diffing result. To make the diffing result more accurate, we extract the semantic features that can represent the code by data flow dependence analysis. Earth mover distance is used to calculate the similarity of functions in two files based on semantic features. We implemented a proof-of-concept DAPDiff and compared it with baseline BinDiff, TurboDiff and Asm2vec. Experiments showed the availability and effectiveness of our method across optimization levels and architectures. DAPDiff outperformed BinDiff in recall and precision by 41.4% and 9.2% on average when making diffing between standard third-party library and the real-world firmware files. This proves that DAPDiff can be applicable for the vulnerability detection in IoT devices.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Effectiveness (Rq2)mentioning

confidence: 99%

A Heuristic Local-sensitive Program-Wide Diffing Method for IoT Binary Files

Shen

et al. 2021

Arab J Sci Eng

View full text Add to dashboard Cite

show abstract

“…To extend this work, we plan to evaluate the performance of deep neural network in classification of dark hidden services regarding their textual information and their structural identity [33]. Also, creating and publishing another dataset that contains more balanced data of Tor and VPN traffic can be another direction for future work.…”

Section: Discussionmentioning

confidence: 99%

Deep Neural Classification of Darknet Traffic

Alimoradi

Zabihimayvan

Daliri

et al. 2022

Frontiers in Artificial Intelligence and Applications

View full text Add to dashboard Cite

Darknet is an encrypted portion of the internet for users who intend to hide their identity. Darknet’s anonymous nature makes it an effective tool for illegal online activities such as drug trafficking, terrorist activities, and dark marketplaces. Darknet traffic recognition is essential in monitoring and detection of malicious online activities. However, due to the anonymizing strategies used for the darknet to conceal users’ identity, traffic recognition is practically challenging. The state-of-the-art recognition systems are empowered by artificial intelligence techniques to segregate the Darknet traffic data. Since they rely on processed features and balancing techniques, these systems suffer from low performance, inability to discover hidden relations in data, and high computational complexity. In this paper, we propose a novel decision support system named Tor-VPN detector to classify raw darknet traffic into four classes of Tor, non-Tor, VPN, and non-VPN. The detector discovers complex non-linear relations from raw darknet traffic by our deep neural network architecture with 79 input artificial neurons and 6 hidden layers. To evaluate the performance of the proposed method, analyses are conducted on a benchmark dataset of DIDarknet. Our model outperforms the state-of-the-art neural network for darknet traffic classification with an accuracy of 96%. These results demonstrate the power of our model in handling darknet traffic without using any preprocessing techniques, like feature extraction or balancing techniques.

show abstract

A first look at references from the dark to the surface web world: a case study in Tor

Zabihimayvan

2022

Int. J. Inf. Secur.

View full text Add to dashboard Cite

Interaction of Structure and Information on Tor

Cited by 4 publications

References 15 publications

A Heuristic Local-sensitive Program-Wide Diffing Method for IoT Binary Files

A Heuristic Local-sensitive Program-Wide Diffing Method for IoT Binary Files

Deep Neural Classification of Darknet Traffic

A first look at references from the dark to the surface web world: a case study in Tor

Contact Info

Product

Resources

About