Pierangela Samarati Indrajit RayIndrakshi Ray (Eds.)

From Database to Cyber Security

Fest

schr

iftLN

CS 1

1170

Essays Dedicated to Sushil Jajodia on the Occasion of His 70th Birthday

123

Pierangela Samarati • Indrajit RayIndrakshi Ray (Eds.)

From Databaseto Cyber SecurityEssays Dedicated to Sushil Jajodiaon the Occasion of His 70th Birthday

123

EditorsPierangela SamaratiUniversità degli Studi di MilanoMilano, Italy

Indrajit RayColorado State UniversityFort Collins, CO, USA

Indrakshi RayColorado State UniversityFort Collins, CO, USA

ISSN 0302-9743 ISSN 1611-3349 (electronic)Lecture Notes in Computer ScienceISBN 978-3-030-04833-4 ISBN 978-3-030-04834-1 (eBook)https://doi.org/10.1007/978-3-030-04834-1

Library of Congress Control Number: 2018962749

LNCS Sublibrary: SL4 – Security and Cryptology

© Springer Nature Switzerland AG 2018This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of thematerial is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation,broadcasting, reproduction on microfilms or in any other physical way, and transmission or informationstorage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology nowknown or hereafter developed.The use of general descriptive names, registered names, trademarks, service marks, etc. in this publicationdoes not imply, even in the absence of a specific statement, that such names are exempt from the relevantprotective laws and regulations and therefore free for general use.The publisher, the authors, and the editors are safe to assume that the advice and information in this book arebelieved to be true and accurate at the date of publication. Neither the publisher nor the authors or the editorsgive a warranty, express or implied, with respect to the material contained herein or for any errors oromissions that may have been made. The publisher remains neutral with regard to jurisdictional claims inpublished maps and institutional affiliations.

Cover illustration: Word Cloud. Created by WordArt.com. Used with permission.

This Springer imprint is published by the registered company Springer Nature Switzerland AGThe registered company address is: Gewerbestrasse 11, 6330 Cham, Switzerland

Sushil Jajodia

From Left to Right: Lingyu Wang, V. S. Subrahmanian, R. Chandramouli, Neil Johnson, X. SeanWang, Csilla Farkas, Luigi Mancini, Zhan Wang, Sara Foresti, Peng Ning, Sabrina De Capitani diVimercati, Claudio Bettini, Sankardas Roy, Sencun Zhu, Kun Sun, Meixing Le, Indrajit Ray, RajniGoel, LouAnna Notargiacomo, Vijay Atluri, Indrakshi Ray, John McDermott, Sushil Jajodia,Massimiliano Albanese, Michael Martin, Lei Zhang, Shiping Chen, Chao Yao, Yingjiu Li, Peng Liu(at Airlie Center, Warrenton, Virginia, August 9, 2017).

Preface

This book contains papers written in honor of Sushil Jajodia, of his vision and hisachievements.

Sushil has sustained a highly active research agenda spanning several importantareas in computer security and privacy, and established himself as a leader in thesecurity research community through unique scholarship and service. He has extraor-dinarily impacted the scientific and academic community, opening and pioneering newdirections of research, and significantly influencing the research and development ofsecurity solutions worldwide. Also, his excellent record of research funding shows hiscommitment to sponsored research and the practical impact of his work.

In his academic career, Sushil has been driven by four main objectives: (a) focus onmulti disciplinary research to solve a wide range of real-world security problems,(b) produce top-level PhD students, (c) collaborate with leading research institutions,industry, and government partners, and (d) transfer solutions from academic research tocommercial sector. To this end, in 1990, he established the Center for Secure Infor-mation Systems (CSIS). Under his outstanding leadership, CSIS became a hub ofresearch and teaching activity in cyber security at George Mason University, VA, USA.Not only has CSIS the distinction of being the first academic center dedicated tosecurity at a US university; today, by any measure, it is a leading security researchcenter in the world.

With respect to research, Sushil has developed mathematical models, scalablemethods, and automated tools that attempt to efficiently answer the following ques-tions: What measures can be taken to protect security and privacy of information? Isthere any ongoing cyber attack? If so, where is the attacker? Are available attackmodels sufficient to understand what is observed? Can they predict an attacker’s goal?If so, how can they prevent that goal from being reached? These are some of the mostdifficult and “hottest” research questions of interest to the academic community as wellas government and industry sponsors. Sushil has always sought deep understandingof the problem and to offer novel and well-articulated solutions. His efforts haveresulted in several seminal papers, 19 patents, and a commercial-grade system. Sushil’sresearch record is excellent because of not only the significance of his accomplishmentsthat strongly impacted the academic and industrial community, but also for his visionand the breadth of his research, which has spanned different and diverse problems inthe security field, in all of which he has opened new directions.

When it comes to measuring impact, there are several metrics one can use. Sushilscores impressively highly in all of them: number of publications (44 books and 450papers, showing that he is prolific); number of citations (more than 40,000 citationswith an h-index of 102, showing that his publications serve as sources of inspiration forother researchers); external funding (more than US$ 50 million, showing that hisresearch has practical relevance and advances the frontiers of cyber security); honorsand awards (including IEEE Fellow, IEEE Computer Society Technical Achievement,

ACM SIGSAC Outstanding Contribution, and ESORICS Outstanding ResearchAward, showing recognition of his scholarly contributions from fellow researchers);community service (with several journal editorships, conferences chairing, and pro-fessional activities); PhD student mentoring (27 graduates); and international collab-orations (visiting and mentoring colleagues and scholars from various countries). Andhe is not done yet! He continues to be productive as a leader in the field and an examplefor the whole community and the new generations. Sushil has been a role model for allthose he has mentored and with whom he has collaborated, showing his passion forscience and respect for hard work and dedicated work ethic, and always striving forexcellence.

But there is more than scientific excellence and achievements that makes Sushil whohe is: a great person and a true gentleman with unique abilities to face difficulties withstrength and successfully build on them, to advise and encourage young people. He isalso generous toward others by donating personal funds to charities including estab-lishing two scholarship endowments. He takes his responsibilities seriously whileenjoying and bringing enjoyment to everyone around him with enthusiasm and acontagious laugh.

This Festschrift is in appreciation of Sushil on the occasion of his 70th birthday, forwhich many of his students, collaborators, and friends reunited to celebrate and honorhim, with admiration, gratitude, and respect.

To Sushil:a bright mind … an open heart … a great man, mentor, colleague, and friend!

Happy Birthday !!!

X Preface

Contents

From Cyber Situational Awareness to Adaptive Cyber Defense:Leveling the Cyber Playing Field . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

Massimiliano Albanese

Policy Engineering in RBAC and ABAC . . . . . . . . . . . . . . . . . . . . . . . . . . 24Saptarshi Das, Barsha Mitra, Vijayalakshmi Atluri, Jaideep Vaidya,and Shamik Sural

Comprehensive Security Assurance Measures for VirtualizedServer Environments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55

Ramaswamy Chandramouli

Stratification Based Model for Security Policy with Exceptionsand Contraries to Duty. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78

Frédéric Cuppens and Nora Cuppens-Boulahia

Asymptotic Behavior of Attack Graph Games. . . . . . . . . . . . . . . . . . . . . . . 104George Cybenko and Gabriel F. Stocco

Some Ideas on Privacy-Aware Data Analyticsin the Internet-of-Everything. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113

Stelvio Cimato and Ernesto Damiani

Protecting Resources and Regulating Accessin Cloud-Based Object Storage . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125

Enrico Bacis, Sabrina De Capitani di Vimercati, Sara Foresti,Stefano Paraboschi, Marco Rosa, and Pierangela Samarati

Function-Based Access Control (FBAC): Towards Preventing InsiderThreats in Organizations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 143

Yvo Desmedt and Arash Shaghaghi

Virtualization Technologies and Cloud Security: Advantages,Issues, and Perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 166

Roberto Di Pietro and Flavio Lombardi

Access Privacy in the Cloud. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 186Sabrina De Capitani di Vimercati, Sara Foresti, Stefano Paraboschi,Gerardo Pelosi, and Pierangela Samarati

A Strategy for Effective Alert Analysis at a Cyber SecurityOperations Center . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 206

Rajesh Ganesan and Ankit Shah

Retrieval of Relevant Historical Data Triage Operations in SecurityOperation Centers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 227

Tao Lin, Chen Zhong, John Yen, and Peng Liu

Supporting Users in Cloud Plan Selection . . . . . . . . . . . . . . . . . . . . . . . . . 244Sabrina De Capitani di Vimercati, Sara Foresti, Giovanni Livraga,Vincenzo Piuri, and Pierangela Samarati

Distributed Services Attestation in IoT. . . . . . . . . . . . . . . . . . . . . . . . . . . . 261Mauro Conti, Edlira Dushku, and Luigi V. Mancini

Exploiting Data Sensitivity on Partitioned Data. . . . . . . . . . . . . . . . . . . . . . 274Sharad Mehrotra, Kerim Yasin Oktay, and Shantanu Sharma

A Review of Graph Approaches to Network Security Analytics . . . . . . . . . . 300Steven Noel

Advanced Biometric Technologies: Emerging Scenariosand Research Trends . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 324

Angelo Genovese, Enrique Muñoz, Vincenzo Piuri, and Fabio Scotti

Attribute-Based Encryption: Applications and Future Directions . . . . . . . . . . 353Bruhadeshwar Bezawada and Indrakshi Ray

Static Analysis for Security Vetting of Android Apps . . . . . . . . . . . . . . . . . 375Sankardas Roy, Dewan Chaulagain, and Shiva Bhusal

Breaking Bad: Forecasting Adversarial Android Bad Behavior . . . . . . . . . . . 405Shang Li, Srijan Kumar, Tudor Dumitras, and V. S. Subrahmanian

Bot or Human? A Behavior-Based Online Bot Detection System . . . . . . . . . 432Zi Chu, Steven Gianvecchio, and Haining Wang

Network Security Metrics: From Known Vulnerabilitiesto Zero Day Attacks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 450

Lingyu Wang, Mengyuan Zhang, and Anoop Singhal

Theoretical Foundations for Mobile Target Defense:Proactive Secret Sharing and Secure Multiparty Computation . . . . . . . . . . . . 470

Karim Eldefrawy, Rafail Ostrovsky, and Moti Yung

Author Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 487

XII Contents