Readings
Paper Response Guidelines
Write a ~400 word critical response and comments to each required paper. Focus on the following:
- State the problem that they try to solve and the main contributions (be brief).
- High-level discussion points: What are things that you like and dislike about the paper? Why is this a good or bad paper (yes it is completely okay to say it is bad as long as you provide evidence to support your claim. We strongly encourage you to be critical!)? What assumptions (explicit and implicit) are made and are they valid? How do you think the authors come up with the idea (is there a single key observation that led to the whole paper)? How you might do it differently? Any other suggestions to improve the paper? What principles can you extract from the paper? From the insights described in the paper, how you might apply it to solve other problems?
- * For attack/vulnerability analysis papers: Why does an identified
vulnerability exist (any implicit assumptions)? Can you imagine or come up
with other attack scenarios exploiting the same underlying vulnerability?
How do you think the authors discover the vulnerability (what prompted them)?
Why were the networks/protocols designed this way (any alternatives)?
* For defense papers: Why is a defense successful (what are some metrics to quantify the success)? Any serious limitations? Do you think the defense will be deployed in practice? What are the hurdles that may prevent it from being deployed? What assumptions or necessary conditions (in the attack being addressed by the paper) are broken by the defense?
* For measurement papers: What are the key observations? How are the data collected (are they representative / biased)? Can you replicate the measurement? Are the conclusions convincing? Any alternative explanations of the results?
The more you write about B and C, the better. Your most important task is to demonstrate that you've read the paper and thought carefully about the topic. Feel free to give other original/creative thoughts that are not listed above (and do some research if possible to check their feasibility). No copy and paste of the original paper text --- if detected, lowest possible score will be given automatically!
Paper responses are due before each class (submit on ilearn). A response for each paper will be graded and returned back with a check-, check, or check+.
Be prepared to discuss in the lecture with your notes about what you find interesting and want to know more about (they can be questions, critics, etc.).
Use of AI (e.g., ChatGPT) is highly discouraged. It is okay to use it to help you paraphrase you wording, but the opinions and observations should come from you!
Discussion Lead and Extra Points
Please take a look at the papers in each session. If you are interested in leading the discussion of any session, you should sign up on the web sheet published through ilearn and get extra points for doing so. As a discussion lead, two tasks are expected: 1) You will summarize the papers in class (with or without slides) for 10-min each. 2) You should prepare yourself by reading the technical details carefully and coming up with a list of discussion points. The discussion points should be designed to engage students in critical and creative thinking. Think about the points ahead of time and be prepared to answer questions other students may throw at you. Email ahead of time your discussion points to instructor for feedback. Please allow 2 days to receive the feedback. This will be a good opportunity for you to learn to discuss ideas around a research topic and it generally helps your presentation and communication skills.Reading List
Most papers should be publicly accessible. If any links are broken, please search for them. If any of them require paid subscription, you can access them for free when connecting on campus. For off-campus access, try UCR VPN.
Week 1
Monday, Jan 6
Wednesday, Jan 8 --- Where we started (one combined response)
- A Look Back at “Security Problems in the TCP/IP Protocol Suite”, Bellovin 2004
- Packets found on the Internet, Bellovin. Computer Communications Review 1993
Week 2 - meet instructor to pick projects - Initial idea due on Friday (by email)
Monday, Jan 13 --- Denial-of-Service (separate responses)
- Inferring Internet Denial-of-Service Activity, Moore, Voelker and Savage, USENIX Security 2001
- SIFF: A Stateless Internet Flow Filter to Mitigate DDoS Flooding Attacks, Yaar, Perrig, and Song,IEEE S&P 2004
- Identifying the Scan and Attack Infrastructure Behind Amplification DDoS Attacks, Krupp, Backes, and Rossow. CCS 2016
Wednesday, Jan 15 –
TCP/IP (one combined response)
- IP-spoofing Demystified, daemon9, route, and infinity. Phrack Magazine 1996
- Blind TCP/IP hijacking is still alive, lkm. 2007
- Black Ops 2008: It's the End of the Cache as We Know It (slides), Kaminsky. Blackhat 2008
- Fragmentation Considered Poisonous, Herzberg and Shulman. IEEE CNS 2013
- Defending against Sequence Number Attacks, Gont and Bellovin. RFC 6528, 2012
Week 3
Monday, Jan 20 – Holiday
- No readings!
Wednesday, Jan 22 – Reconnaissance (one combined response)
- Idle Port Scanning and Non-interference Analysis of Network Protocol Stacks Using Model Checking, Ensafi, Park, Kapur, and Crandall. USENIX Security 2010
- TCP Stealth, Kirsch, Grothoff, Appelbaum, H. Kenn. IETF draft, 2015
-
Counting Packets Sent Between Arbitrary Internet Hosts, Knockel
and Crandall. FOCI 2014
- nmap, flexible network scanner
Week 4 - Proposal report due Friday
Monday, Jan 27 – Crypto Intro
- Lecture
Wednesday, Jan 29 – Proposal presentation
- No readings!
Week 5
Monday, Feb 3 – Guest lecture (TBD)
- Lecture
Wednesday, Feb 5 – Attack and Tool Presentation
- No readings!
Week 6
Monday, Feb 10 – Public key cryptography (SSL/TLS)
- No readings!
Wednesday, Feb 12 – Attack and Tool Presentation + SSL/TLS failures (Reading assigned but no response needed)
Week 7
Monday, Feb 17 – Holiday
- No readings!
Wednesday, Feb 19 – Anonimity and Email Security (separate responses)
- Tor: The Second-Generation Onion Router, Dingledine, Mathewson, and Syverson. USENIX Security 2004
- Neither Snow Nor Rain Nor MITM...An Empirical Analysis of Email Delivery Security, Durumeric et al. ACM IMC 2015
Week 8
Monday, Feb 24 – Censorship (separate responses)
- Telex: Anticensorship in the Network Infrastructure, Wustrow, Wolchok, Goldberg, and Halderman. Usenix Security 2011
- Your State is Not Mine: A Closer Look at Evading Stateful Internet Censorship, Wang, Yue, Qian, Song, Krishnamurthy. ACM IMC 2017
- ConceptDoppler: A Weather Tracker for Internet Censorship. Crandall, Zinn, Byrd, Barr, and East. CCS 2007
Wednesday, Feb 26 – Internet Worm (one combined response)
- How to 0wn the Internet in Your Spare Time, Staniford, Paxson, Weaver. USENIX Security 2002
- EternalBlue – Everything There Is To Know Grossman. Checkpoint Research Blog Post, 2017
- Code-Red: a case study on the spread and victims of an Intemet worm, Moore, Shannon, k claffy. IMW 2002
Week 9
Monday, Mar 3 – Botnet (separate responses)
- Your Botnet is My Botnet: Analysis of a Botnet Takeover. Stone-Gross, et al. CCS 2009.
- Characterizing Large-Scale Click Fraud in ZeroAccess, Pearce et al. CCS 2014
- Detecting Stepping Stones, Zhang and Paxson. USENIX Security 2000
- Spamming Botnets: Signatures and Characteristics, Xie et al. SIGCOMM 2008
Wednesday, Mar 5 – Internet-wide measurement
- ZMap: Fast Internet-Wide Scanning and its Security Applications, Durumeric, Wustrow, and Halderman. USENIX Security 2013
- Investigation of the 2016 Linux TCP Stack Vulnerability at Scale, Quach, Wang, and Qian. Sigmetrics 2017
- The Matter of Heartbleed, Durumeric and Frank Li et al. IMC 2014
- When private keys are public: Results from the 2008 Debian OpenSSL vulnerability, Yilek, Rescorla, Shacham, Enright, and Savage. IMC 2008
Week 10
Monday, Mar 10 – Underground economy
- Under the Shadow of Sunshine: Understanding and Detecting Bulletproof Hosting on Legitimate Service Provider Networks, Alrwais et al. IEEE S&P 2017
- Tracking Ransomware End-to-end, Huang et al. IEEE S&P 2018
- Click Trajectories: End-to-End Analysis of the Spam Value Chain, Levchenko et al. IEEE S&P 2011
Wednesday, Mar 12 – Network Intrusion Detection (separate responses)
- Bro: A System for Detecting Network Intruders in Real-Time, Paxson. USENIX Security 1998
- Insertion, Evasion, and Denial Of Service: Eluding Network Intrusion Detection, Ptacek and Newsham. 1998
- Outside the Closed World: On Using Machine Learning for Network Intrusion Detection, Sommer and Paxson. IEEE S&P 2010
- SymTCP: Eluding Stateful Deep Packet Inspection with Automated Discrepancy Discovery Wang et al. NDSS 2020.