Dynamic enforcement of knowledge-based security policies using probabilistic abstract interpretation

Journal of Computer Security

Volumn 21, Issue 4, 2013, Pages 463-532

  Mardziel, Piotr ^a,b   Hicks, Michael ^a   Srivatsa, Mudhakar ^c  

^a UNIVERSITY OF MARYLAND   (United States)

^b IDA Center for Computing Sciences   (United States)

^c IBM T J WATSON RESEARCH CENTER   (United States)

Author keywords

Abstract interpretation; Probabilistic semantics; Quantitative information flow; Security policies

Indexed keywords

ABSTRACT DOMAINS; ABSTRACT INTERPRETATIONS; IMPROVE PERFORMANCE; INFORMATION FLOWS; PROBABILISTIC ABSTRACT INTERPRETATION; PROBABILISTIC SEMANTICS; QUANTITATIVE INFORMATION FLOWS; SECURITY POLICY;

ABSTRACTING; BENCHMARKING; GEOMETRY; KNOWLEDGE BASED SYSTEMS; QUERY PROCESSING; SECURITY SYSTEMS; SEMANTICS;

PROBABILITY DISTRIBUTIONS;

EID: 84883726322     PISSN: 0926227X     EISSN: None     Source Type: Journal    
DOI: 10.3233/JCS-130469     Document Type: Article

References (57)

1. M. Backes, B. Koddddpf and A. Rybalchenko, Automatic discovery and quantification of information leaks, in: Proceedings of the IEEE Symposium on Security and Privacy (S&P), 2009.
2. R. Baden, A. Bender, N. Spring, B. Bhattacharjee and D. Starin, Persona: An online social network with user-defined privacy, in: Proceedings of the ACM SIGCOMM Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM), 2009.
3. R. Bagnara, P.M. Hill and E. Zaffanella, Widening operators for powerset domains, International Journal on Software Tools for Technology Transfer 8(4) (2006), 449-466.
4. K. Boda, Aaaaa.M. Foddddldes, G.G. Gulyaaaaas and S. Imre, User tracking on the web via cross-browser fingerprinting, in: Proceedings of the Nordic Conference in Secure IT Systems (NordSec), 2011.
5. J. Borgstroddddm, A.D. Gordon, M. Greenberg, J. Margetson and J. Van Gael, Measure transformer semantics for Bayesian machine learning, in: Proceedings of the European Symposium on Programming (ESOP), 2011.
6. G. Claret, S.K. Rajamani, A.V. Nori, A.D. Gordon and J. Borgstroem, Bayesian inference for probabilistic programs via symbolic execution, Technical Report MSR-TR-2012-86, Microsoft Research, 2012.
7. D. Clark, S. Hunt and P. Malacaria, Quantitative information flow, relations and polymorphic types, Journal of Logic and Computation 15 (2005), 181-199.
8. M.R. Clarkson, A.C. Myers and F.B. Schneider, Quantifying information flow with beliefs, Journal of Computer Security 17(5) (2009), 655-701.
9. A. Cortesi, Widening operators for abstract interpretation, in: Proceedings of the IEEE International Conference on Software Engineering and Formal Methods (SEFM), 2008.
10. P. Cousot and R. Cousot, Static determination of dynamic properties of programs, in: Proceedings of the Second International Symposium on Programming, 1976.
11. P. Cousot and R. Cousot, Abstract interpretation: A unified lattice model for static analysis of programs by construction or approximation of fixpoints, in: Proceedings of the ACM SIGPLAN Conference on Principles of Programming Languages (POPL), 1977.
12. P. Cousot and R. Cousot, Systematic design of program analysis frameworks, in: Proceedings of the Sixth International Symposium on Programming, 1979.
13. P. Cousot and N. Halbwachs, Automatic discovery of linear restraints among variables of a program, in: Proceedings of the ACM SIGPLAN Conference on Principles of Programming Languages (POPL), 1978.
14. P. Cousot and M. Monerau, Probabilistic abstract interpretation, in: Proceedings of the European Symposium on Programming (ESOP), 2012.
15. J.A. De Loera, D. Haws, R. Hemmecke, P. Huggins, J. Tauzer and R. Yoshida, Latte, 2008, available at: Http://www.math.ucdavis.edu/latte.
16. A. Di Pierro, C. Hankin and H. Wiklicky, Probabilistic lambda-calculus and quantitative program analysis, Journal of Logic and Computation 15(2) (2005), 159-179.
17. Do not track, 2012, available at: Https://www.eff.org/issues/do-not- track.
18. C. Dwork, A firm foundation for private data analysis, Communications of the ACM 54(1) (2011), 86-95.
19. Facebook ads: A guide to targeting and reporting, 2011, available at: Http://www.openforum.com/articles/facebook-Ads-A-guide-to-targeting-And- reporting-Adele-cooper.
20. Facebook ads: Case studies, 2011, available at: Http://www.facebook.com/ advertising/?campaign-id=402047449186.
21. Facebook demographics and statistics report, 2010, available at: Http://www.istrategylabs.com/2010/01/facebook-demographics-And-statistics- report-2010-145-growth-in-1-year.
22. Facebook developers, 2011, available at: Http://developers.facebook.com (see the policy and docs/guides/canvas directories for privacy information).
23. P. Golle, Revisiting the uniqueness of simple demographics in the us population, in: Proceedings of the Workshop on Privacy in the Electronic Society (WPES), 2006.
24. N.D. Goodman, V.K. Mansinghka, D.M. Roy, K. Bonawitz and J.B. Tenenbaum, Church: A language for generative models, in: Proceedings of the Conference on Uncertainty in Artificial Intelligence (UAI), 2008.
25. S. Guha, B. Cheng and P. Francis, Challenges in measuring online advertising systems, in: Proceedings of the Internet Measurement Conference (IMC), 2010.
26. S. Guha, B. Cheng and P. Francis, Privad: Practical privacy in online advertising, in: Proceedings of the Symposium on Networked Systems Design and Implementation (NSDI), March 2011.
27. K. Kenthapadi, N. Mishra and K. Nissim, Simulatable auditing, in: Proceedings of the ACM SIGMOD Symposium on Principles of Database Systems (PODS), 2005.
28. O. Kiselyov and C-C. Shan, Embedded probabilistic programming, in: Proceedings of the Working Conference on Domain Specific Languages (DSL), 2009.
29. B. Koddddpf and D. Basin, An Information-Theoretic Model for Adaptive Side-Channel Attacks, in: Proceedings of the ACM Conference on Computer and Communications Security (CCS), 2007.
30. B. Koddddpf and A. Rybalchenko, Approximation and randomization for quantitative information-flow analysis, in: Proceedings of the IEEE Computer Security Foundations Symposium (CSF), 2010.
31. A. Machanavajjhala, A. Korolova and A. Das Sarma, Personalized social recommendations: Accurate or private, in: Proceedings of the International Conference on Very Large Data Bases (VLDB), 2011.
32. P. Mardziel, M. Hicks, J. Katz and M. Srivatsa, Knowledge-oriented secure multiparty computation, in: Proceedings of the ACM SIGPLAN Workshop on Programming Languages and Analysis for Security (PLAS), 2012.
33. P. Mardziel, S. Magill, M. Hicks and M. Srivatsa, Dynamic enforcement of knowledge-based security policies, in: Proceedings of the IEEE Computer Security Foundations Symposium (CSF), 2011.
34. P. Mardziel, S. Magill, M. Hicks and M. Srivatsa, Dynamic enforcement of knowledge-based security policies. Technical Report CS-TR-4978, Department of Computer Science, University of Maryland, 2011.
35. S. McCamant and M.D. Ernst, Quantitative information flow as network flow capacity, in: Proceedings of the ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI), 2008.
36. B. Milch, B. Marthi, S. Russell, D. Sontag, D.L. Ong and A. Kolobov, Blog: Probabilistic models with unknown objects, in: Proceedings of the International Joint Conference on Artificial Intelligence (IJCAI), 2005.
37. A. Miné, The octagon abstract domain, in: Proceedings of the Working Conference on Reverse Engineering (WCRE), 2001.
38. D. Monniaux, Abstract interpretation of probabilistic semantics, in: Proceedings of the Static Analysis Symposium (SAS), 2000.
39. D. Monniaux, Analyse de programmes probabilistes par interpré tation abstraite, Thèse de doctorat, Université Paris IX Dauphine, 2001.
40. C. Mu and D. Clark, An interval-based abstraction for quantifying information flow, Electronic Notes in Theoretical Computer Science 253(3) (2009), 119-141.
41. G.C. Necula, Proof-carrying code, in: Proceedings of the ACM SIGPLAN Conference on Principles of Programming Languages (POPL), 1997, pp. 106-119.
42. S. Park, F. Pfenning and S. Thrun, A probabilistic language based on sampling functions, ACM Transactions on Programming Languages and Systems (TOPLAS) 31(1) (2008), 4:1-4:46.
43. A. Pfeffer, The design and implementation of IBAL: A general-purpose probabilistic language, in: Statistical Relational Learning, L. Getoor and B. Taskar, eds, MIT Press, 2007.
44. C. Popeea and W-n. Chin, Inferring disjunctive postconditions, in: Proceedings of the Asian Computing Science Conference (ASIAN), 2006.
45. PPL: The Parma polyhedral library, 2011, available at: Http://www.cs.unipr.it/ppl/.
46. A. Radul, Report on the probabilistic language Scheme, in: Proceedings of the Dynamic Languages Symposium (DLS), 2007.
47. V. Rastogi, M. Hay, G. Miklau and D. Suciu, Relationship privacy: Output perturbation for queries with joins, in: Proceedings of the ACM SIGMOD Symposium on Principles of Database Systems (PODS), 2009.
48. A. Rial and G. Danezis, Privacy-preserving smart metering, in: Proceedings of the Workshop on Privacy in the Electronic Society (WPES), 2011.
49. S-W. Seong, J. Seo, M. Nasielski, D. Sengupta, S. Hangal, S.K. Teh, R. Chu, B. Dodson and M.S. Lam, PrPl: A decentralized social networking infrastructure, in: Proceedings of the Workshop on Mobile Cloud Computing & Services: Social Networks and Beyond, 2010 (Invited Paper).
50. R. Shokri, G. Theodorakopoulos, J-Y. Le Boudec and J-P. Hubaux, Quantifying location privacy, in: Proceedings of the IEEE Symposium on Security and Privacy (S&P), 2011, pp. 247-262.
51. K. Singh, S. Bhola andW. Lee, xBook: Redesigning privacy control in social networking platforms, in: Proceedings of the USENIX Security Symposium, 2009.
52. G. Smith, On the foundations of quantitative information flow, in: Proceedings of the Conference on Foundations of Software Science and Computation Structures (FoSSaCS), 2009.
53. M.J.A. Smith, Probabilistic abstract interpretation of imperative programs using truncated normal distributions, Electronic Notes in Theoretical Computer Science 220(3) (2008), 43-59.
54. Statement of rights and responsibilities, October 2010, available at: Http://www.facebook.com/terms.php.
55. L. Sweeney, Simple demographics often identify people uniquely, Technical Report LIDAP-WP4, Carnegie Mellon University, School of Computer Science, Data Privacy Laboratory, 2000.
56. D. Worthington, Mypace user data for sale, PC World on-line, March 2010, available at: Http://www.pcworld.com/article/191716/myspace-user-data-for-sale. html.
57. A.C-C. Yao, How to generate and exchange secrets, in: Proceedings of the IEEE Symposium on Foundations of Computer Science (FOCS), 1986.