CADE: Detecting and Explaining Concept Drift Samples for Security Applications
USENIX Security ‘21 [PDF, INFO]
Concept drift poses a critical challenge to deploy machine learning models to solve practical security problems. Due to the dynamic behavior changes of attackers (and/or the benign counterparts), the testing data distribution is often shifting from the original training data over time, causing major failures to the deployed model.
To combat concept drift, we present a novel system CADE aiming to 1) detect drifting samples that deviate from existing classes, and 2) provide explanations to reason the detected drift. Unlike traditional approaches (that require a large number of new labels to determine concept drift statistically), we aim to identify individual drifting samples as they arrive. Recognizing the challenges introduced by the high-dimensional outlier space, we propose to map the data samples into a low-dimensional space and automatically learn a distance function to measure the dissimilarity between samples. Using contrastive learning, we can take full advantage of existing labels in the training dataset to learn how to compare and contrast pairs of samples. To reason the meaning of the detected drift, we develop a distance-based explanation method. We show that explaining “distance” is much more effective than traditional methods that focus on explaining a “decision boundary” in this problem context. We evaluate CADE with two case studies: Android malware classification and network intrusion detection. We further work with a security company to test CADE on its malware database. Our results show that CADE can effectively detect drifting samples and provide semantically meaningful explanations.
Home Router Security Report 2020
Fraunhofer-Institut für Kommunikation, Informationsverarbeitung und Ergonomie, FKIE
[PDF]
This report analyses 127 current routers for private use developed by seven different large vendors selling their products in Europe. An automated approach was used to check the router’s most recent firmware versions for five security related aspects. We were able to extract completely 117 of the 127 firmware images. Four firmware images could be extracted partly and six firmware images could not be extracted at all. 116 of 127 (91%) devices are powered by Linux. One was powered by ThreadX and another one by eCos. The security aspects addressed in this report are:
- When were the devices updated last time?
- Which operating system versions are used and how many known critical vulnerabilities affect these operating system versions?
- Which exploit mitigation techniques do the vendors use? How often do they activate these techniques?
- Do the firmware images contain private cryptographic key material?
- Are there any hard-coded login credentials?
Our results are alarming. There is no router without flaws. 46 routers did not get any security up-date within the last year. Many routers are affected by hundreds of known vulnerabilities. Even if the routers got recent updates, many of these known vulnerabilities were not fixed. What makes matters even worse is that exploit mitigation techniques are used rarely. Some routers have easy crackable or even well known passwords that cannot be changed by the user. Most firmware images provide private cryptographic key material. This means, whatever they try to secure with a public-private crypto mechanism is not secure at all. Nonetheless, vendors seem to prioritize security differently. Especially AVM does a better job than the other vendors regarding most of the security aspects. However, AVM routers are not flawless as well. ASUS and Netgear do a better job on some aspects than D-Link, Linksys, TP-Linkand Zyxel.To sum it up, much more effort is needed to make home routers as secure as current desktop or server systems. Additionally, our evaluation showed that large scale automated security analysis of embedded devices is possible today. We used the the Firmware Analysis and Comparison Tool (FACT) and it worked very well for almost all firmware images analyzed during this study. FACT is an opensource software available on GitHub
Last Updated on 9 Apr 2021 (CC BY-SA 4.0)