The Design and Analysis of Graphical Passwords
- Ian H. Jermyn, A. Mayer, F. Monrose, M. Reiter, A. Rubin
- Computer Science, MathematicsUSENIX Security Symposium
- 23 August 1999
This work proposes and evaluates new graphical password schemes that exploit features of graphical input displays to achieve better security than text-based passwords and describes the prototype implementation of one of the schemes on a personal digital assistants (PDAs) namely the Palm PilotTM.
Just-In-Time Code Reuse: On the Effectiveness of Fine-Grained Address Space Layout Randomization
- K. Snow, F. Monrose, Lucas Davi, A. Dmitrienko, Christopher Liebchen, A. Sadeghi
- Computer ScienceIEEE Symposium on Security and Privacy
- 1 May 2013
This paper introduces the design and implementation of a framework based on a novel attack strategy that undermines the benefits of fine-grained ASLR by exploiting the ability to repeatedly abuse a memory disclosure to map an application's memory layout on the fly.
On User Choice in Graphical Password Schemes
- Darren Davis, F. Monrose, M. Reiter
- Computer ScienceUSENIX Security Symposium
- 13 August 2004
It is shown that permitting user selection of passwords in two graphical password schemes can yield passwords with entropy far below the theoretical optimum and, in some cases, that are highly correlated with the race or gender of the user.
Keystroke dynamics as a biometric for authentication
- F. Monrose, A. Rubin
- Computer ScienceFuture generations computer systems
- 1 February 2000
All Your iFRAMEs Point to Us
- Niels Provos, P. Mavrommatis, M. Rajab, F. Monrose
- Computer ScienceUSENIX Security Symposium
- 28 July 2008
The relationship between the user browsing habits and exposure to malware, the techniques used to lure the user into the malware distribution networks, and the different properties of these networks are studied.
A multifaceted approach to understanding the botnet phenomenon
- M. Rajab, J. Zarfoss, F. Monrose, A. Terzis
- Computer ScienceACM/SIGCOMM Internet Measurement Conference
- 25 October 2006
This paper attempts to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure, which shows that botnets represent a major contributor to unwanted Internet traffic and provides deep insights that may facilitate further research to curtail this phenomenon.
Authentication via keystroke dynamics
- F. Monrose, A. Rubin
- Computer ScienceConference on Computer and Communications…
- 1 April 1997
A database of 42 profiles was constructed based on keystroke patterns gathered from various users performing structured and unstructured tasks, and a toolkit for analyzing system performance under varying criteria is presented.
Isomeron: Code Randomization Resilient to (Just-In-Time) Return-Oriented Programming
- Lucas Davi, Christopher Liebchen, A. Sadeghi, K. Snow, F. Monrose
- Computer ScienceNetwork and Distributed System Security Symposium
- 1 February 2015
This paper conducts a security analysis of a recently proposed fine-grained ASLR scheme and presents a new and hybrid defense approach, dubbed Isomeron, that combines code randomization with execution-path randomization to mitigate conventional ROP and JIT-ROP attacks.
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection
- Lucas Davi, A. Sadeghi, Daniel Lehmann, F. Monrose
- Computer ScienceUSENIX Security Symposium
- 20 August 2014
This paper provides the first comprehensive security analysis of various CFI solutions, and shows that with bare minimum assumptions, turing-complete and real-world ROP attacks can still be launched even when the strictest of enforcement policies is in use.
Traffic Morphing: An Efficient Defense Against Statistical Traffic Analysis
- C. V. Wright, Scott E. Coull, F. Monrose
- Computer ScienceNetwork and Distributed System Security Symposium
- 2009
This paper proposes a novel method for thwarting statistical traffic analysis algorithms by optimally morphing one class of traffic to look like another class, and shows how to optimally modify packets in real-time to reduce the accuracy of a variety of traffic classifiers while incurring much less overhead than padding.
...
...