Quantifying information leaks in outbound web traffic

Proceedings - IEEE Symposium on Security and Privacy

Volumn , Issue , 2009, Pages 129-140

  Borders, Kevin ^b   Prakash, Atul ^a  

^a UNIVERSITY OF MICHIGAN   (United States)

^b Web Tap Security Inc   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

CONFIDENTIAL INFORMATION; DATA LOSS; HIGH-CAPACITY; HYPERTEXT TRANSFER PROTOCOLS; IN-NETWORK; MANUAL INSPECTION; MEASUREMENT ALGORITHMS; NETWORK BANDWIDTH; NETWORK TRAFFIC; PREVENTION SYSTEMS; PROTOCOL SPECIFICATIONS; SENSITIVE DATAS; TUNNELING DATA; WEB BROWSING; WEB TRAFFIC;

HTTP; HYPERTEXT SYSTEMS; INTERNET; LOSS PREVENTION; NETWORK SECURITY;

INTERNET PROTOCOLS;

EID: 70449623147     PISSN: 10816011     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1109/SP.2009.9     Document Type: Conference Paper

References (27)

1. Adobe Systems Incorporated. Adobe Flash Player. http://www.macromedia. com/software/flash/about, 2008.
2. R. Anderson and F. Petitcolas. On the Limits of Steganography. IEEE Journal of Selected Areas in Communications, 16(4):474-481, 1998.
3. K. Borders and A. Prakash. Web Tap: Detecting Covert Web Traffic. In Proc. of the 11th ACM Conference on Computer and Communications Security (CCS), 2004.
4. rd USENIX Workshop on Hot Topics in Security, 2008.
5. S. Brand. DoD 5200.28-STD Department of Defense Trusted Computer System Evaluation Criteria (Orange Book). National Computer Security Center, 1985.
6. S. Cabuk, C. Brodley, and C. Shields. IP Covert Timing Channels: Design and Detection. In Proc. of the 11th ACM Conference on Computer and Communications Security (CCS), 2004.
7. S. Castro. How to Cook a Covert Channel. hakin9, http://www.gray-world. net/projects/cooking-channels/hakin9-cooking-channels-en.pdf, 2006.
8. J. Gailly and M. Adler. The gzip Home Page. http://www.gzip.org/, 2008.
9. J. Giles and B. Hajek. An Information-Theoretic and Game-Theoretic Study of Timing Channels. IEEE Transactions on Information Theory, 48:2455-2477, 2003.
10. th USENIX Security Symposium, 2001.
11. M. Kang, I. Moskowitz, and D. Lee. A Network Version of the Pump. In Proc. of the 1995 IEEE Symposium in Security and Privacy, 1995.
12. G. Malan, D.Watson, F. Jahanian, and P. Howell. Transport and Application Protocol Scrubbing. In Proc. of the IEEE INFOCOM 2000 Conference, 2000.
13. S. McCamant and M. Ernst. Quantitative Information Flow as Network Flow Capacity. In Proc. of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2008.
14. Mozilla. The Firefox Web Browser. http://www.mozilla.com/firefox/, 2008.
15. Mozilla. SpiderMonkey (Javscript-C) Engine. http://www.mozilla.org/js/ spidermonkey/, 2008.
16. A. Myers, N. Nystrom, L. Zheng, and S. Zdancewic. Jif: Java information flow. http://www.cs.cornell.edu/jif, 2001.
17. R. Richardson. CSI Computer Crime and Security Survey. http://i.cmpnet.com/v2.gocsi.com/pdf/CSISurvey2007.pdf, 2007.
18. RSA Security, Inc. RSA Data Loss Prevention Suite. RSA Solution Brief, http://www.rsa.com/products/EDS/sb/DLPST-SB-1207-lowres.pdf, 2007.
19. th Workshop on Hot Topics in Networks (HotNets), 2006.
20. J. Seward. bzip2 and libbzip2, version 1.0.5 - A Program and Library for Data Compression. http://www.bzip.org/1.0.5/bzip2-manual-1.0.5.html, 2007.
21. C. Shannon. Prediction and Entropy of Printed English. Bell System Technical Journal, 30:50-64, 1951.
22. S. Servetto and M. Vetterli. Communication Using Phantoms: Covert Channels in the Internet. In Proc. of the IEEE International Symposium on Information Theory, 2001.
23. Sun Microsystems. Java. http://www.java.com, 2008.
24. VONTU. Data Loss Prevention, Confidential Data Protection - Protect Your Data Anywhere. http://www.vontu.com, 2008.
25. R. Wagner and M. Fischer. The String-to-String Correction Problem. Journal of the ACM, 21(1):168-173, 1974.
26. Websense, Inc. Web Security, Internet Filtering, and Internet Security Software. http://www.websense.com/global/en/, 2008.
27. th USENIX Symposium on Networked Systems Design and Implementation(NSDI), 2007.