Export Citations
Publications
Save this search
Please login to be able to save your searches and receive alerts for new content matching your search criteria.
- research-article
You Might Have Known It Earlier: Analyzing the Role of Underground Forums in Threat Intelligence
RAID '24: Proceedings of the 27th International Symposium on Research in Attacks, Intrusions and Defenses•September 2024, pp 368-383• https://doi.org/10.1145/3678890.3678930This paper analyzes 88 million hacker forum posts of a publicly available dataset and 75,000 online articles over a 20-year timespan, studying the potential of hacker forums as a proactive Cyber Threat Intelligence (CTI) source. Using a custom Natural ...
- Article
Tarallo: Evading Behavioral Malware Detectors in the Problem Space
- Gabriele Digregorio,
- Salvatore Maccarrone,
- Mario D’Onghia,
- Luigi Gallo,
- Michele Carminati,
- Mario Polino,
- Stefano Zanero
Detection of Intrusions and Malware, and Vulnerability Assessment•July 2024, pp 128-149• https://doi.org/10.1007/978-3-031-64171-8_7AbstractMachine learning algorithms can effectively classify malware through dynamic behavior but are susceptible to adversarial attacks. Existing attacks, however, often fail to find an effective solution in both the feature and problem spaces. This ...
- research-article
Lookin' Out My Backdoor! Investigating Backdooring Attacks Against DL-driven Malware Detectors
AISec '23: Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security•November 2023, pp 209-220• https://doi.org/10.1145/3605764.3623919Given their generalization capabilities,deep learning algorithms may represent a powerful weapon in the arsenal of antivirus developers. Nevertheless, recent works in different domains (e.g., computer vision) have shown that such algorithms are ...
- research-article
Fraud Detection under Siege: Practical Poisoning Attacks and Defense Strategies
ACM Transactions on Privacy and Security, Volume 26, Issue 4•November 2023, Article No.: 45, pp 1-35 • https://doi.org/10.1145/3613244Machine learning (ML) models are vulnerable to adversarial machine learning (AML) attacks. Unlike other contexts, the fraud detection domain is characterized by inherent challenges that make conventional approaches hardly applicable. In this article, we ...
- Article
Advancing Fraud Detection Systems Through Online Learning
- Tommaso Paladini,
- Martino Bernasconi de Luca,
- Michele Carminati,
- Mario Polino,
- Francesco Trovò,
- Stefano Zanero
Machine Learning and Knowledge Discovery in Databases: Applied Data Science and Demo Track•September 2023, pp 275-292• https://doi.org/10.1007/978-3-031-43427-3_17AbstractThe rapid increase in digital transactions has led to a consequential surge in financial fraud, requiring an automatic way of defending effectively from such a threat. The past few years experienced a rise in the design and use by financial ...
- research-article
BINO: Automatic recognition of inline binary functions from template classes
Computers and Security, Volume 132, Issue C•Sep 2023 • https://doi.org/10.1016/j.cose.2023.103312Highlights- Reverse engineering is a complex process essential to vulnerability detection.
- Compiler optimizations such as inlining make the task of reverse engineering significantly harder.
- Functions from library template classes, such as the ...
AbstractIn this paper, we propose BINO, a static analysis approach that relieves reverse engineers from the challenging task of recognizing library functions that have been inlined. BINO recognizes inline calls of methods of C++ template classes (even ...
- research-article
DJM-CYBER: A Joint Master in Advanced Cybersecurity
ARES '23: Proceedings of the 18th International Conference on Availability, Reliability and Security•August 2023, Article No.: 65, pp 1-10• https://doi.org/10.1145/3600160.3605002Various publicly available studies show that millions of cybersecurity experts are missing worldwide. One possible way to tackle the workforce gap is with tailored higher education programmes. The goal of this paper is to present the relevant projects ...
- Article
The Good, the Bad, and the Binary: An LSTM-Based Method for Section Boundary Detection in Firmware Analysis
Advances in Information and Computer Security•August 2023, pp 16-35• https://doi.org/10.1007/978-3-031-41326-1_2AbstractStatic analysis tools need information about the ISA and the boundaries of the code and data sections of the binary they analyze. This information is often not readily available in embedded systems firmware, often provided only in a non-standard ...
- column
Coming of Age
Communications of the ACM, Volume 66, Issue 9•September 2023, pp 21-23 • https://doi.org/10.1145/3608965Stressing the importance of threat models.
- Article
Untangle: Aiding Global Function Pointer Hijacking for Post-CET Binary Exploitation
Detection of Intrusions and Malware, and Vulnerability Assessment•July 2023, pp 256-275• https://doi.org/10.1007/978-3-031-35504-2_13AbstractIn this paper, we combine static code analysis and symbolic execution to bypass Intel’s Control-Flow Enforcement Technology (CET) by exploiting function pointer hijacking. We present Untangle, an open-source tool that implements and automates the ...
- Article
Evaluating the Robustness of Automotive Intrusion Detection Systems Against Evasion Attacks
Cyber Security, Cryptology, and Machine Learning•June 2023, pp 337-352• https://doi.org/10.1007/978-3-031-34671-2_24AbstractThis paper discusses the robustness of machine learning-based intrusion detection systems (IDSs) used in the Controller Area Networks context against adversarial samples, inputs crafted to deceive the system. We design a novel methodology to ...
- Article
HAMLET: A Transformer Based Approach for Money Laundering Detection
Cyber Security, Cryptology, and Machine Learning•June 2023, pp 234-250• https://doi.org/10.1007/978-3-031-34671-2_17AbstractMoney laundering has damaging economic, security, and social consequences, fueling criminal activities like terrorism, human and drug trafficking. Recent technological advancements have increased the complexity of laundering operations, prompting ...
- Article
CANdito: Improving Payload-Based Detection of Attacks on Controller Area Networks
Cyber Security, Cryptology, and Machine Learning•June 2023, pp 135-150• https://doi.org/10.1007/978-3-031-34671-2_10AbstractOver the years, the increasingly complex and interconnected vehicles raised the need for effective and efficient Intrusion Detection Systems against on-board networks. In light of the stringent domain requirements and the heterogeneity of ...
- research-article
CANova: A hybrid intrusion detection framework based on automatic signal classification for CAN
Computers and Security, Volume 128, Issue C•May 2023 • https://doi.org/10.1016/j.cose.2023.103166AbstractOver the years, vehicles have become increasingly complex and an attractive target for malicious adversaries. This raised the need for effective and efficient Intrusion Detection Systemss (IDSs) for onboard networks able to work with the ...
- research-article
CANflict: Exploiting Peripheral Conflicts for Data-Link Layer Attacks on Automotive Networks
CCS '22: Proceedings of the 2022 ACM SIGSAC Conference on Computer and Communications Security•November 2022, pp 711-723• https://doi.org/10.1145/3548606.3560618Current research in the automotive domain has proven the limitations of the Controller Area Network (CAN) protocol from a security standpoint. Application-layer attacks, which involve the creation of malicious packets, are deemed feasible from remote ...
- research-article
Apícula: Static detection of API calls in generic streams of bytes
- Mario D’Onghia,
- Matteo Salvadore,
- Benedetto Maria Nespoli,
- Michele Carminati,
- Mario Polino,
- Stefano Zanero
Computers and Security, Volume 119, Issue C•Aug 2022 • https://doi.org/10.1016/j.cose.2022.102775AbstractAPI functions often require the crafting of specific inputs and may return some output that is usually processed by the code that immediately follows their invocation. In this work, we claim that - for some APIs - those two stages are ...
- research-article
A Systematical and longitudinal study of evasive behaviors in windows malware
Computers and Security, Volume 113, Issue C•Feb 2022 • https://doi.org/10.1016/j.cose.2021.102550AbstractMalware is one of the prevalent security threats. Sandboxes and, more generally, instrumented environments play a crucial role in dynamically analyzing malware samples, providing key threat intelligence results and critical information ...
- research-article
SyML: Guiding Symbolic Execution Toward Vulnerable States Through Pattern Learning
- Nicola Ruaro,
- Kyle Zeng,
- Lukas Dresel,
- Mario Polino,
- Tiffany Bao,
- Andrea Continella,
- Stefano Zanero,
- Christopher Kruegel,
- Giovanni Vigna
RAID '21: Proceedings of the 24th International Symposium on Research in Attacks, Intrusions and Defenses•October 2021, pp 456-468• https://doi.org/10.1145/3471621.3471865Exploring many execution paths in a binary program is essential to discover new vulnerabilities. Dynamic Symbolic Execution (DSE) is useful to trigger complex input conditions and enables an accurate exploration of a program while providing extensive ...
- research-article
Smart Factory Security: A Case Study on a Modular Smart Manufacturing System
- Federico Maggi,
- Marco Balduzzi,
- Rainer Vosseler,
- Martin Rösler,
- Walter Quadrini,
- Giacomo Tavola,
- Marcello Pogliani,
- Davide Quarta,
- Stefano Zanero
Procedia Computer Science, Volume 180, Issue C•2021, pp 666-675 • https://doi.org/10.1016/j.procs.2021.01.289AbstractSmart manufacturing systems are an attractive target for cyber attacks, because they embed valuable data and critical equipment. Despite the market is driving towards integrated and interconnected factories, current smart manufacturing systems are ...
- research-article
Constrained Concealment Attacks against Reconstruction-based Anomaly Detectors in Industrial Control Systems
- Alessandro Erba,
- Riccardo Taormina,
- Stefano Galelli,
- Marcello Pogliani,
- Michele Carminati,
- Stefano Zanero,
- Nils Ole Tippenhauer
ACSAC '20: Proceedings of the 36th Annual Computer Security Applications Conference•December 2020, pp 480-495• https://doi.org/10.1145/3427228.3427660Recently, reconstruction-based anomaly detection was proposed as an effective technique to detect attacks in dynamic industrial control networks. Unlike classical network anomaly detectors that observe the network traffic, reconstruction-based ...
