CBS
CBS
CBS
What is the PRIVACY AND ML: PROBLEM #1 ?
• ML needs (a lot of) data to learn!
• Machine learning is based on data to
• Find features
• Train the model
• Data is highly unique → allows many inferences
• Anonymizing may not work…
• Aggregation affects utility and requires careful evaluation
• Hide data
• Noise → differential privacy
• Encryption → homomorphic encryption, secure multiparty computation, …
What is the PRIVACY AND ML: PROBLEM #2 ?
• To obtain value, you must give data!
• To use the ML model, you need to provide a sample…
• If the model is remote (e.g., MLaaS), you are giving this sample out
• We can do privacy-preserving model evaluation:
• Predict on noisy data: affects utility
• Use advanced cryptography: affects performance
What is the PRIVACY AND ML: PROBLEM #3 ?
• The output reveals information!
• Membership inference
• Given the answer of the classifier, infer whether the queried example was used in training
• Attribute inference
• Given the answer of the classifier, infer whether a training sample had a particular attribute
Give a definition of the term adversarial example
• Coined by Szegedy et al. in 2014 [1] with respect to computer vision but
goes back further to work on spam and malware evasion by Srndic &
Laskov [2], Biggio et al. [3], and Dalvi et al. [4] in 2013
What is a Working definition for adversarial example
Inputs to a model that an attacker has designed to cause the model to make a mistake
• Set of techniques that aim to fool ML model
What are the 2 ADVERSARIAL ML ATTACKS ?
• Evasion attacks
• Most prevalent type of attacks
• Perturbation of test data, no influence over training data
• E.g., spammers trying to evade detection by obfuscating the content of spam e-mails
• Samples are modified to be classified as legitimate
• E.g., image-based spam: spam content embedded within an attached image to evade textual analysis by anti-spam filters
• Poisoning attacks
• Adversarial contamination of training data
• ML systems can be re-trained using data collected during operations
• E.g., intrusion detection systems (IDSs) often re-trained using such data
• An attacker may poison this data by injecting malicious samples during operation that subsequently disrupt re-training
Give some example
elf-driving cars:
Stop sign → speed-limit sign with scotch
What is the Objective of MACHINE LEARNING 101 ?
Objective: find model parameters that minimize empirical loss
In MACHINE LEARNING 101 How do we find those parameters/weights?
image
What is the Adversary’s objective ?
Adversary’s objective: find a perturbation that maximizes the loss
HOW TO SOLVE THE OPTIMIZATION PROBLEM?
One approach: Fast Gradient Sign Method (FGSM
HOW TO DEFINE SIMILARITY?
The similarity relation is often represented as adversarial cost constraint.
If the goal is to be imperceptible, the common cost is a norm of the perturbation
OTHER SIMILARITY RELATIONS?
• Constraint on perturbation norm assumes that similar images are close in, e.g., Euclidean distance…
• But this is not always true! [1]
• For example, similarity could be defined as small affine transformations [2] :
Why Defending in general is hard AGAINST ADVERSARIAL EXAMPLES ?
We can only defend against a particular threat model (e.g., perturbations up to epsilon norm), and normally no guarantees
What is the Standard approachfor DEFENDING AGAINST ADVERSARIAL EXAMPLES
Training on simulated adversarial examples, i.e., include adversarial examples in the training set
Is Adversarial samples restricted to computer vision ? Give 3 examples
Adversarial samples are not restricted to computer vision
• Twitter bot detection [1]
• Detection tools can easily be fooled by tweaking the number of replies or retweets
• Text classification [2]
• Audio [3]
• Misleading an automatic speech recognition neural network with some noise
• E.g., transcribing "without the dataset the article is useless" into
"okay google, browse to evil.com"
Give exabple of CYBERSECURITY INCIDENTS
• Data or infrastructure as targets
• Attacks against confidentiality, integrity or availability
• Examples of incident description:
• Man-in-the-Middle attack when data was being transferred through the
public Internet
• Phishing
• People running crypto mining on our infrastructure through our APIs
• Server was compromised
• Botnet communication
Give example of PRIVACY INCIDENTS
• Relation to AI vague (beyond data related)
• Attacks against confidentiality, targeting data, not ML model
• Examples of incident description:
• Patient data should not be shared
• Data privacy
• Incorrect use of temporary storage on AWS lambda led to a potential leak of
raw inference [...] potentially containing PII [...]
Give example of: POISONING INCIDENTS
• Attacks against integrity
• Incident descriptions:
• ML systems being retrained to provide false outputs
• Client/partner employees [...] feel threatened by automation, and either stall
or sabotage the labeling effort, harming the models
Give examples of EVASION INCIDENTS
Evasion → 4
• Attacks against integrity
• Incident descriptions:
• Intentional circumventions
• Users spam to optimize their strategy for job search
• A speed-sign as advertisement put onto a driving-school car was interpreted
by the camera as a valid street sign
• Autonomous vehicle image recognition errors leading to dangerous path
planning
WHAT IS COMPUTER SECURITY?
“Measures and controls that ensure confidentiality, integrity, and availability of information system assets including hardware, software, firmware, and information being processed, stored, and communicated.”
What are the 3 KEY SECURITY OBJECTIVES and explain them ?
Confidentiality
Integrity
Availability
What is Data confidentiality: ?
Data confidentiality: private or confidential information not made available or
disclosed to unauthorized individuals
What is Privacy?
Privacy: individuals control or influence what information related to them may be
collected and stored and by whom and to whom that information may be disclosed
What is Data integrity ?
Data integrity: information and programs are changed only in a specified and
authorized manner
What is system integrity ?
• System integrity: a system performs its intended function in an unimpaired manner,
free from deliberate or inadvertent unauthorized manipulation of the system
What is availability ?
Systems work promptly and service is not denied to authorized users
In terms of requirements and loss security (NIST standard) what i s Confidentiality ?
. Preserving authorized restrictions on information access and disclosure, incl. means for protecting privacy and proprietary information
In terms of requirements and loss security (NIST standard) what is Integrity?
Preventing improper information modification or destruction, incl. ensuring information non-repudiation and authenticity
In terms of requirements and loss security (NIST standard) what is Availability?
Availability
• Ensuring timely and reliable access to and use of information
What is Loss of confidentiality ?
unauthorized disclosure of information
What is Loss of integrity ?
unauthorized modification or destruction of information
What is Loss of availability?
disruption of access to or use of information (denial of service)
What are the 3 OTHER SECURITY OBJECTIVES and explain them
• Authenticity
• Verifying that users are who they say they are
• Accountability (non-repudiation)
• Entity cannot deny having done an action
• Anonymity
• Not being recognizable among a group of people
Give the 8 CHALLENGES IN SECURITY
1. Computer security is not as simple as it might first appear to the novice
2. In developing a particular security mechanism or algorithm, one must always consider potential attacks on those security features
3. Security mechanisms typically involve more than one particular protocol and also require that participants be in possession of some secret information which raises questions about the creation, distribution, and protection of that secret information
4. Attackers only need to find a single weakness, while the designer must find and eliminate all weaknesses to achieve perfect security
5. Security is still too often an afterthought to be incorporated into a system after the design is complete, rather than being an integral part of the design process
6. Security requires regular and constant monitoring
7. There is a natural tendency on the part of users and system managers to perceive little benefit from security investment until a security failure occurs
8. Many users and even security administrators view strong security as an impediment to efficient and user-friendly operation of an information system
What is an Asset ?
• Asset
• Hardware, software, data, communication networks, …
• E.g., a major application, high impact program, physical plant, mission critical system, …
What is an Adversary (or attacker, threat agent)
Individual, group, organization, or government that conducts detrimental activities
What is an Attack
Any kind of malicious activity that attempts to collect, disrupt, deny, degrade, or destroy information system resources or the information itself
What is a Threat ?
Any event with the potential to adversely impact organizational operations, organizational assets, individuals, other organizations, or the Nation through an information system via unauthorized access, destruction, disclosure, modification of information, and/or denial of service
What is aThreat model (or adversary model) ?
Technical term that defines the adversary’s capabilities (more about it next)
-
- 1 / 491
-
Lernkarten
How does Alice verify Bob's certificate?
Alice receives Bob's certificate.
She uses the CA's public key, stored in her browser or operating system, to verify the CA's signature.
If the signature is valid, Alice trusts that the public key in the certificate belongs to Bob.
What is RSA public-key encryption?
RSA public-key encryption is an asymmetric encryption scheme.
A sender encrypts a message with the receiver's public key.
Only the receiver can decrypt it using their private key.
It provides confidentiality.
What is RSA Algorithms?
see image
What is the Security behind RSA ?
factoring n into two prime numbers p and q should be hard
On what Vast majority of products and standards that use public-key crypto
for encryption and digital signatures rely on
RSA
How many bits RSA to be secure ?
• But key size between 1024 and 2048 bits to be secure
→ high computational burden
How to reduce high computationnal need with RSA ?
ELLIPTIC-CURVE CRYPTOGRAPHY (ECC)
what are ASYMMETRIC CRYPTOGRAPHY LIMITATIONS? Give solutions for practical implemenatation
• Computationally costly compared to most symmetric key algorithms of equivalent security
• Signing and encrypting is slow
• No good « cipher modes »
• Not suitable to encrypt large amounts of data
• Solutions for practical implementation:
• Signing hash of messages instead of long messages
• Use hybrid encryption instead of asymmetric encryption
What is a hash function?
A hash function takes an input of any length and produces a fixed-length output called a hash or digest.
It is mainly used to verify integrity: if the input changes, the hash changes.
Hashing is not encryption because it is not reversible.
Where we use a hash function ?
Digital signatures, HMAC, password storage, file integrity, secure commitments, blockchains, etc
What are the three security properties that a Hash functions must respect?
• Pre-image resistance: given H(m), difficult to get m
• Second pre-image resistance: Given m, difficult to get m’ != m such that H(m) = H(m’)
• Collision resistance: difficult to find any m, m’ such that H(m) = H (m’)
What are the Existing hash function algorithms ?
• MD5 (128 bits): insecure (published in 1991)
• SHA-1 (160 bits): insecure
• SHA-2 (256, 384, 512 bits): Good security but slow
• New NIST standard: SHA-3, published in 2015
Why do we use DIGITAL SIGNATURES ON HASH FUNCTIONS ?
In practice, digital signatures sign the hash of the message, not the whole message.
The sender computes H(m) and signs it with their private key.
The recipient hashes the received message again and verifies the signature using the signer's public key.
This provides integrity and authentication, as long as the hash function is collision-resistant and second pre-image resistant.
What is the process with DIGITAL SIGNATURES ON HASH FUNCTIONS from sender and reciver perspective ?
Recipient first hashes the message m to get H(m), then verifies that
the signature is valid with the public key kp of the signer and H(m)
What security properties do we need for this hash function?
• Second pre-image resistance: prevents recipient from modifying m
• Collision resistance: prevents sender from modifying m
Why do we use HYBRID ENCRYPTION ? and how dows it work ?
Asymmetric encryption is slow, but symmetric encryption is fast
• Solution: use both and get the best of both worlds!
• First, establish a shared symmetric (secret) key k using asymmetric encryption
• Second, use the shared secret key k to encrypt the rest of the communication with symmetric encryption
Exanple: Diffie-Hellman key exchange
Give the formula of Diffie-hellman key exchange
image
Why is basic Diffie-Hellman vulnerable to a man-in-the-middle attack?
Basic Diffie-Hellman allows Alice and Bob to create a shared secret key, but it does not authenticate who they are talking to.
An attacker can intercept the exchanged public values and replace them with their own.
Result:
Alice shares a key with the attacker.
Bob shares another key with the attacker.
Solution:
Use authentication, such as digital signatures or certificates.
WHAT IS AUTHENTICATION?
Authentication is the process of verifying a claimed identity
WHAT IS AUTHENTICATION? (Nist definition?
Definition by the NIST:
“The process of establishing confidence in user identities that are presented
electronically to an information system.”
With what auhentificarion must Not be confused with?
message authentication
• Ensuring that the message comes from the designated sender, and has not been modified
hat are the 2 Basic security requirements for SECURITY REQUIREMENTS FOR IDENTIFICATION AND AUTHENTICATION ?
• Basic security requirements:
1. Identify information system users, processes acting on behalf of users, or devices.
2. Authenticate (or verify) the identities of those users, processes, or devices, as a prerequisite to allowing access to the information systems
hat are the 2 Derived security requirements for SECURITY REQUIREMENTS FOR IDENTIFICATION AND AUTHENTICATION ?
3. Use multifactor authentication
• for local and network access to privileged accounts;
• for network access to non-privileged accounts.
4. Use replay-resistant authentication mechanisms for network access to privileged and non-privileged accounts.
5. Enforce a minimum password complexity and change of characters when new passwords are created.
6. Prohibit password reuse for a specified number of generations.
7. Store and transmit only cryptographically-protected passwords.
8. Obscure feedback of authentication information.
What are the 3 Traditional means of authentication: ? an give more recent
Traditional means of authentication:
• What you know
• Password, PIN, set of questions, …
• What you are
• Biometrics such as fingerprint, retina, face, …
• What you have
• Tokens such as smart cards, physical keys, …
More recent means:
• Where you are: • Location, IP address
• How you act: Behavioral authentication: How you type, how you move your mouse, …
• Who you know: E.g., social ties
• Multifactor authentication:Combining multiple means of authentication
Traditional means of authentication:
• What you know
• Password, PIN, set of questions, …
• What you are
• Biometrics such as fingerprint, retina, face, …
• What you have
• Tokens such as smart cards, physical keys, …
More recent means:
• Where you are: • Location, IP address
• How you act: Behavioral authentication: How you type, how you move your mouse, …
• Who you know: E.g., social ties
• Multifactor authentication:Combining multiple means of authentication
What are the Four security aspects to consider with PASSWORD-BASED AUTHENTICATION?
Four security aspects to consider:
• Secure transfer: password may be eavesdropped when communicated
• Secure storage: if stolen, the full system is compromised
• Secure password selection: avoid short or easy-to-guess passwords
• Secure check: naive checks may leak information about the password
What is problem with PASSWORD TRANSFER?
Adversary can eavesdrop the communication and read the password and then replay the ID and password
What is problem with encrypted channel PASSWORD TRANSFER?
Adversary cannot read but he can copy the full message and then replay the encrypted message
(One of the most difficult aspects in authentication)
How TRANSFER PASSWORD despite REPLAY ATTACKS? Give the schema
image
how to protect against steal file Leak file Shared resource ? Are you safe ?
store password encrypted
No, if attacker has the key, he can compute
e’ = Enc(k, eaflkqerjwe)
e’ = e?
(Alice, e=Enc(k, eaflkqerjwe))
(Bob, e=Enc(k, adfwqeirj))
(Carl, e=Enc(k, wrkewék))
…
Encryption key = k
store a hash of the password is enough ?
No, it protects not against pre-image resistance,
h’ = H(eaflkqerjwe)
h’ = h
(Alice, h=H(eaflkqerjwe))
(Bob, h=H(adfwqeirj))
(Carl, h=H(wrkewék))
Give the problem of store a hash of the password
offline dictionary attack
• A hash does not require a key → anyone can compute a hash
• Passwords are not truly random
• 52 upper- and lower-case letters, 10 digits and 32 punctuation symbols
• 948 eight-character passwords (around 252) possibilities
• Users use a limited set of passwords, e.g., words from the dictionary
→ reduced search space
• Adversary can compute H(word) for every word in the dictionary and see if the results is in the password file
• Parallel cracking with GPU accelerates search
• Other approaches: rainbow tables, pre-computation, …
How to secure stored password ?
store a hash of the password & salt
what is the advantage of storing a hash of the password & salt?
Advantages of using a salt:
• Prevents duplicate passwords from being visible in the password file
• Greatly increases the difficulty of offline dictionary attacks
• Nearly impossible to find out whether a person has used the same password on multiple systems
What is the Complementary defenses of storing a hash of the password & salt?
• Use hash functions designed to be slow (bcrypt, scrypt, argon2)
• Repeat them several times (e.g., 1000)
• Require specific elements in passwords
• Increase entropy
• Strict access control on the password database!
• E.g., make the password file only accessible by the root user
What is the problem with passwords and what could be a solution ?passwords are very often too short or easy to guess
• Solution: pick x random printable characters
• Problem: impossible to remember for most users
• Objective:
• Eliminating guessable passwords
• Allowing users to select passwords that can be memorized
What are the 4 SECURE PASSWORD SELECTION STRATEGIES ?
• User education
• Users can be told the importance of using hard to guess passwords and can be provided with guidelines for selecting strong passwords
• Computer-generated passwords
• Users have trouble remembering them
• Poor acceptance by the users, tempted to write them down
• Reactive password checking
• System periodically runs its own password cracker to find guessable passwords
• Resource intensive if we want to mimic a determined opponent
• Complex password policy (or proactive password checking)
• User is allowed to select their own password; however, the system checks to see if the password is allowable, and if not, rejects it
• Goal is to eliminate guessable passwords while allowing the user to select a password that is memorable
• Important to strike a balance between user acceptability and password strength
What are the 3 PROACTIVE PASSWORD CHECKING ?
• Rule enforcement
• NIST SP 800-63-2 suggests the following alternative rules:
• Password must have at least 16 characters.
• Password must have at least 8 characters including an uppercase and lowercase letter, a symbol, and a digit
+ it may not contain a dictionary word.
• Update in 2024 (NIST): reducing the complexity of passwords
• At least 8 characters and ideally 15 characters
• Password checker
• Compile a large dictionary of passwords not to use
• Two problems with this approach:
• Space: The dictionary must be very large to be effective
• Time: The time required to search a large dictionary may itself be large. In addition, to check for likely permutations of dictionary words, either those words must be included in the dictionary, making it truly huge, or each search must also involve considerable processing.
• Bloom filter
• Allowing for effective and efficient password checker that is based on rejecting words on a list
• Reducing the search space at the cost of some false positives
• Implemented on a number of systems, including Linux
Is check letter by letter secure ?
No, Timing channel leaks information about the password
always check everything, Hashing will take care of equal operations;
Requires the same operations for accept and reject
What are the problems with Strong passwords ?
hard to remember
• Written passwords
• Reuse across systems
How password can be stolen or inferred ?
• Keylogger
• Shoulder surfing
• Phishing
• Social engineering
• Side channels
