Readings
Paper Response Guidelines
Write a ~400 word critical response and comments to each required paper. Focus on the following:
- State the problem that they try to solve and the main contributions (be brief).
- High-level discussion points: What are things that you like and dislike about the paper? Why is this a good or bad paper (yes it is completely okay to say it is bad as long as you provide evidence to support your claim. We strongly encourage you to be critical!)? What assumptions (explicit and implicit) are made and are they valid? How do you think the authors come up with the idea (is there a single key observation that led to the whole paper)? How you might do it differently? Any other suggestions to improve the paper? What principles can you extract from the paper? From the insights described in the paper, how you might apply it to solve other problems?
- * For attack/vulnerability analysis papers: Why does an identified
vulnerability exist (any implicit assumptions)? Can you imagine or come up
with other attack scenarios exploiting the same underlying vulnerability?
How do you think the authors discover the vulnerability (what prompted them)?
Why were the networks/protocols designed this way (any alternatives)?
* For defense papers: Why is a defense successful (what are some metrics to quantify the success)? Any serious limitations? Do you think the defense will be deployed in practice? What are the hurdles that may prevent it from being deployed? What assumptions or necessary conditions (in the attack being addressed by the paper) are broken by the defense?
* For measurement papers: What are the key observations? How are the data collected (are they representative / biased)? Can you replicate the measurement? Are the conclusions convincing? Any alternative explanations of the results?
The more you write about B and C, the better. Your most important task is to demonstrate that you've read the paper and thought carefully about the topic. Feel free to give other original/creative thoughts that are not listed above (and do some research if possible to check their feasibility). No copy and paste of the original paper text --- if detected, lowest possible score will be given automatically!
Paper responses are due before each class (submit on ilearn). A response for each paper will be graded and returned back with a check-, check, or check+.
Be prepared to discuss in the lecture with your notes about what you find interesting and want to know more about (they can be questions, critics, etc.).
Discussion Lead and Extra Points
Please take a look at the papers in each session. If you are interested in leading the discussion of any session, you should sign up on the web sheet published through ilearn and get extra points for doing so. As a discussion lead, two tasks are expected: 1) You will summarize the papers in class (with or without slides) for 10-min each. 2) You should prepare yourself by reading the technical details carefully and coming up with a list of discussion points. The discussion points should be designed to engage students in critical and creative thinking. Think about the points ahead of time and be prepared to answer questions other students may throw at you. Email ahead of time your discussion points to instructor for feedback. Please allow 2 days to receive the feedback. This will be a good opportunity for you to learn to discuss ideas around a research topic and it generally helps your presentation and communication skills.Reading List
Most papers should be publicly accessible. If any links are broken, please search for them. If any of them require paid subscription, you can access them for free when connecting on campus. For off-campus access, try UCR VPN.
Week 1
Tuesday, Mar 29
Thursday, Mar 31 --- Where we started (one combined response)
- A Look Back at “Security Problems in the TCP/IP Protocol Suite”, Bellovin 2004
- Packets found on the Internet, Bellovin. Computer Communications Review 1993
Week 2 - meet instructor to pick projects - Initial idea due on Friday (by email)
Tuesday, Apr 5 --- Denial-of-Service (separate responses)
- Inferring Internet Denial-of-Service Activity, Moore, Voelker and Savage, USENIX Security 2001
- SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks, Yaar, Perrig, and Song,IEEE S&P 2004
- Identifying the Scan and Attack Infrastructure Behind Amplification DDoS Attacks, Krupp, Backes, and Rossow. CCS 2016
Thursday,
Apr 7 –
TCP/IP (one combined response)
- IP-spoofing Demystified, daemon9, route, and infinity. Phrack Magazine 1996
- Blind TCP/IP hijacking is still alive, lkm. 2007
- Black Ops 2008: It's the End of the Cache as We Know It (slides), Kaminsky. Blackhat 2008
- Fragmentation Considered Poisonous, Herzberg and Shulman. IEEE CNS 2013
- Defending against Sequence Number Attacks, Gont and Bellovin. RFC 6528, 2012
Week 3
Tuesday, Apr 12 – Guest lecture (TBD).
- No readings!
Thursday, Apr 14 – Off-Path TCP/UDP Attacks (separate responses)
- Off-Path TCP Exploits: Global Rate Limit Considered Dangerous, Cao, Qian, Wang, Dao, Krishnamurthy, Marvel. USENIX Security 2016
- DNS Cache Poisoning Attack Reloaded: Revolutions with Side Channels, Man, Qian, Wang, Zheng, Huang and Duan. CCS 2020
- Off-Path TCP Exploit: How Wireless Routers Can Jeopardize Your Secret, Chen, Qian. USENIX Security 2018
- Off-Path TCP Injection Attacks, Gilad and Herzberg. ACM Transactions on Information and System Security 2014
Week 4 - Proposal report due Friday
Tuesday, Apr 19 – Reconnaissance (one combined response)
- Idle Port Scanning and Non-interference Analysis of Network Protocol Stacks Using Model Checking, Ensafi, Park, Kapur, and Crandall. USENIX Security 2010
- TCP Stealth, Kirsch, Grothoff, Appelbaum, H. Kenn. IETF draft, 2015
-
Counting Packets Sent Between Arbitrary Internet Hosts, Knockel
and Crandall. FOCI 2014
- nmap, flexible network scanner
Thursday, Apr 21 – Pre-proposal presentation
- No readings!
Week 5
Tuesday, Apr 26 – Crypto intro
- Lecture.
Thursday, Apr 28 – Public key cryptography (SSL/TLS)
- Lecture.
Week 6
Tuesday, May 3 – Attack and Tool Presentation
- No readings!
Thursday, May 5 – Attack and Tool Presentation
No readings!
Week 7
Tuesday, May 10 – Email Security
- Neither Snow Nor Rain Nor MITM...An Empirical Analysis of Email Delivery Security, Durumeric et al. ACM IMC 2015
Thursday, May 12 – Anonimity
- Tor: The Second-Generation Onion Router, Dingledine, Mathewson, and Syverson. USENIX Security 2004
- How the Great Firewall of China is Blocking Tor. Winter and Lindskog. USENIX FOCI 2012
Week 8
Tuesday, May 17 – Censorship (separate responses)
- Telex: Anticensorship in the Network Infrastructure, Wustrow, Wolchok, Goldberg, and Halderman. Usenix Security 2011
- Your State is Not Mine: A Closer Look at Evading Stateful Internet Censorship, Wang, Yue, Qian, Song, Krishnamurthy. ACM IMC 2017
- ConceptDoppler: A Weather Tracker for Internet Censorship. Crandall, Zinn, Byrd, Barr, and East. CCS 2007
Thursday, May 19 – Internet Worm (one combined response)
- How to 0wn the Internet in Your Spare Time, Staniford, Paxson, Weaver. USENIX Security 2002
- EternalBlue – Everything There Is To Know Grossman. Checkpoint Research Blog Post, 2017
- Code-Red: a case study on the spread and victims of an Intemet worm, Moore, Shannon, k claffy. IMW 2002
Week 9
Tuesday, May 24 – Botnet (separate responses)
- Your Botnet is My Botnet: Analysis of a Botnet Takeover. Stone-Gross, et al. CCS 2009.
- Characterizing Large-Scale Click Fraud in ZeroAccess, Pearce et al. CCS 2014
- Detecting Stepping Stones, Zhang and Paxson. USENIX Security 2000
- Spamming Botnets: Signatures and Characteristics, Xie et al. SIGCOMM 2008
Thursday, May 26 – Internet-wide measurement
- ZMap: Fast Internet-Wide Scanning and its Security Applications, Durumeric, Wustrow, and Halderman. USENIX Security 2013
- Investigation of the 2016 Linux TCP Stack Vulnerability at Scale, Quach, Wang, and Qian. Sigmetrics 2017
- The Matter of Heartbleed, Durumeric and Frank Li et al. IMC 2014
- When private keys are public: Results from the 2008 Debian OpenSSL vulnerability, Yilek, Rescorla, Shacham, Enright, and Savage. IMC 2008
Week 10
Tuesday, May 31 – Underground economy
- Under the Shadow of Sunshine: Understanding and Detecting Bulletproof Hosting on Legitimate Service Provider Networks, Alrwais et al. IEEE S&P 2017
- Tracking Ransomware End-to-end, Huang et al. IEEE S&P 2018
- Click Trajectories: End-to-End Analysis of the Spam Value Chain, Levchenko et al. IEEE S&P 2011
Thursday, Jun 2 – Network Intrusion Detection (separate responses)
- Bro: A System for Detecting Network Intruders in Real-Time, Paxson. USENIX Security 1998
- Insertion, Evasion, and Denial Of Service: Eluding Network Intrusion Detection, Ptacek and Newsham. 1998
- Outside the Closed World: On Using Machine Learning for Network Intrusion Detection, Sommer and Paxson. IEEE S&P 2010
- SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery Wang et al. NDSS 2020.