This paper investigates the effect of price limits on strategically informed trading and market performances. We show that a price limit will increase the costs of liquidity traders and volatility spillover by its ex ante effects on strategically informed trading. Our study differs from prior research by focusing on informed traders¡¦ strategies and information competitiveness. With long-lived information or less information competitiveness, the price limit rule encourages stealthily informed trading, distorts the price dynamics and increases the trading costs of small liquidity traders. Volatility subsequent to a limit-hit is also increased. By using the listed firms in the Taiwan Stock Exchange, we provide empirical evidences that informed traders switch to trade with small orders when they encounter a price limit and volatility spillover exists. Furthermore, this negative effect is more sever for those stocks with less information competitiveness. Our findings suggest that the ex ante effects of price limits on market performances may be contrary to what the stabilizing mechanism is intended to achieve, especially for those firms with less information competitiveness.

An increasing variety of malware, including spyware, worms, and bots, threatens data confidentiality and system integrity on computing devices ranging from backend servers to mobile devices. To address these threats, exacerbated by dynamic network traffic patterns and growing volumes, network security has been undergoing major changes to improve accuracy and scalability in the security analysis techniques. This dissertation addresses the problem of detecting the network anomalies on a single device by inferring the traffic dependence to ensure the root-triggers. In particular, we propose a dependence model for illustrating the network traffic causality. This model depicts the triggering relation of network requests, and thus can be used to reason about the occurrences of network events and pinpoint stealthy malware activities. The triggering relationships can be inferred by means of both rule-based and learning-based approaches. The rule-based approach originates from several heuristic algorithms based on the domain knowledge. The learning-based approach discovers the triggering relationship using a pairwise comparison operation that converts the requests into event pairs with comparable attributes. Machine learning classifiers predict the triggering relationship and further reason about the legitimacy of requests by enforcing their root-triggers. We apply our dependence model on the network traffic from a single host and a mobile device. Evaluated with real-world malware samples and synthetic attacks, our findings confirm that the traffic dependence model provides a significant source of semantic and contextual information that detects zero-day malicious applications. This dissertation also studies the usability of visualizing the traffic causality for domain experts. We design and develop a tool with a visual locality property. It supports different levels of visual based querying and reasoning required for the sensemaking process on complex network data. The significance of this dissertation research is in that it provides deep insights on the dependency of network requests, and leverages structural and semantic information, allowing us to reason about network behaviors and detect stealthy anomalies. / Ph. D.

Many real word networks exhibit cascading phenomena, e.g., disease outbreaks in social contact networks, malware propagation in computer networks, failures in cyber-physical systems such as power grids. As they grow in size and complexity, their security becomes increasingly important. In this thesis, we address the problems of controlling cascading failures in various network settings. We address the cascading phenomena which are either natural (e.g., disease outbreaks) or malicious (e.g., cyber attacks). We consider the nodes of a network as being individually or collectively controlled by self-interested autonomous agents and study their strategic decisions in the presence of these failure cascades. There are many models of cascading failures which specify how a node would fail when some neighbors have failed, such as: (i) epidemic spread models in which the cascading can be viewed as a natural and stochastic process and (ii) cyber attack models where the cascade is driven by malicious intents. We present our analyses and algorithms for these models in two parts. Part I focuses on problems of controlling epidemic spread. Epidemic outbreaks are generally modeled as stochastic diffusion processes. In particular, we consider the SIS model on networks. There exist heuristic centralized approaches in the literature for containing epidemic spread in SIS/SIR models; however no rigorous performance bounds are known for these approaches. We develop algorithms with provable approximation guarantees that involve either protective intervention (e.g., vaccination) or link removal (e.g., unfriending). Our approach relies on the characterization of the SIS model in terms of the spectral radius of the network. The centralized approaches, however, are sometimes not feasible in practice. For example, targeted vaccination is often not feasible because of limited compliance to directives. This issue has been addressed in the literature by formulating game theoretic models for the containment of epidemic spread. However they generally assume simplistic propagation models or homogeneous network structures. We develop novel game formulations which rely on the spectral characterization of the SIS model. In these formulations, the failures start from a random set of nodes and propagate through the network links. Each node acts as a self-interested agent and makes strategic intervention decisions (e.g., taking vaccination). Each agent decides its strategy to optimize its payoff (modeled by some payoff function). We analyze the complexity of finding Nash equilibria (NE) and study the structure of NE for different networks in these game settings. Part II focuses on malware spread in networks. In cybersecurity literature malware spreads are often studied in the framework of ``attack graph" models. In these models, a node represents either a physical computing unit or a network configuration and an edge represents a physical or logical vulnerability dependency. A node gets compromised if a certain set of its neighbors are compromised. Attack graphs describe explicit scenarios in which a single vulnerability exploitation cascades further into the network exploiting inherent dependencies among the network components. Attack graphs are used for studying cascading effects in many cybersecurity applications, e.g., component failure in enterprise networks, botnet spreads, advanced persistent attacks. One distinct feature of cyber attack cascades is the stealthy nature of the attack moves. Also, cyber attacks are generally repeated. How to control stealthy and repeated attack cascades is an interesting problem. Dijk et. al.~cite{van2013flipit} first proposed a game framework called ``FlipIt" for reasoning about the stealthy interaction between a defender and an attacker over the control of a system resource. However, in cybersecurity applications, systems generally consists of multiple resources connected by a network. Therefore it is imperative to study the stealthy attack and defense in networked systems. We develop a generalized framework called ``FlipNet" which extends the work of Dijk et. al.~cite{van2013flipit} for network. We present analyses and algorithms for different problems in this framework. On the other hand, if the security of a system is limited to the vulnerabilities and exploitations that are known to the security community, often the objective of the system owner is to take cost-effective steps to minimize potential damage in the network. This problem has been formulated in the cybersecurity literature as hardening attack graphs. Several heuristic approaches have been shown in the litrature so far but no algorithmic analysis have been shown. We analyze the inherent vulnerability of the network and present approximation hardening algorithms. / Ph. D.

With the growth of successes in pattern recognition and signal processing, mobile robot applications today are increasingly equipping their hardware with microphones to improve the set of available sensory information. However, if the robot, and therefore the microphone, ends up in a poor location acoustically, then the data will remain noisy and potentially useless for accomplishing the required task. This is compounded by the fact that there are many bad acoustic locations through which a robot is likely to pass, and so the results from auditory sensors often remain poor for much of the task. The movement of the robot, though, can also be an important tool for overcoming these problems, a tool that has not been exploited in the traditional signal processing community. Robots are not limited to a single location as are traditionally placed microphones, nor are they powerless over to where they will be moved as with wearable computers. If there is a better location available for performing its task, a robot can navigate to that location under its own power. Furthermore, when deciding where to move, robots can develop complex models of the environment. Using an array of sensors, a mobile robot can build models of sound flow through an area, picking from those models the paths most likely to improve performance of an acoustic application. In this dissertation, we address the question of how to exploit robotic movement. Using common sensors, we present a collection of tools for gathering information about the auditory scene and incorporating that information into a general framework for acoustical awareness. Thus equipped, robots can make intelligent decisions regarding control strategies to enhance their performance on the underlying acoustic application.

Routing hijacks have plagued the Internet for decades. These attacks corrupt the routing table entries that networks use to forward traffic, causing affected network devices to route private and possibly sensitive Internet traffic towards the hijacker. Despite many failed attempts to thwart hijackers, recent Internet-wide routing monitoring infrastructures give us hope that future systems can quickly and ultimately mitigate hijacks. Such monitoring infrastructures consist of multiple globally distributed monitoring entities, called Route Collectors. To enable the whole community to monitor the validity and stability of the exchanged routing information, network volunteers disclose their routes to public route collectors. However, hijackers can also exploit this information to avoid being reported to route collectors. This thesis evaluates the effectiveness of monitoring infrastructures against two kinds of hijack scenarios: (i) an omniscient attacker with complete knowledge of both the Internet topology and the routing preferences of networks, and (ii) a realistic attacker which lacks such knowledge but gathers routing information from what networks themselves disclose to the public route collectors. Prior simulations showed that hijacks that affect more than 2% of the Internet are always visible to the public route collector infrastructure. However, our simulations show that omniscient and realistic hijackers that react to the deployment of public collectors could stealthily hijack up to 11.7× more (i.e., 23.5%) and 8.1× (i.e., 16.2%) more of the Internet (respectively) without being observed by the existing public route collector infrastructure. Having evaluated the effectiveness of the existing public route collector infrastructure with current Internet datasets, we evaluated the effectiveness in realistic future scenarios of (i) more interconnected (flatter) Internet topologies as well as (ii) topologies where more network volunteers disclose their routes to the public collectors. Unfortunately, both types of hijackers are more effective in flatter Internet topologies. Omniscient hijackers could stealthily hijack up to 24.5× (i.e., 49.0%) more of the Internet while realistic hijackers up to 22.7× (i.e., 45.5%) more without being observed by route collectors. In topologies with up to 4× more volunteers disclosing their routes to the public route collectors, hijackers could react to these new monitors by modifying their attacks to stealthily hijack up to 4× (i.e., 8.2%) and 2.9× (i.e., 5.9%) more of the Internet (respectively). Finally, we conclude with an analysis of two suggestions for improving the existing public route collector infrastructure: (i) selecting new network volunteers in more strategic locations and (ii) having volunteers disclose more routes to the route collectors. We hope that our findings in simulations will help towards the design of more reliable public route monitoring infrastructures. / Ruttkapningar har plågat internet i årtionden. Dessa attacker korrumperar poster i routingtabeller som används av nätverket för att vidarebefordra trafik, på ett sådant sätt att påverkade enheter dirigerar privat och tänkbart känslig trafik till kaparen. Trots många misslyckade försök att hindra kapare, ger på senare tid internetbred ruttövervakningsinfrastruktur oss förhoppningen att framtida system snabbt och slutgiltigt kan förhindra kapningar. Sådan övervakningsinfrastruktur består av flera globalt distribuerade övervakningsenheter kallade ruttinsamlare. Nätverksvolontärer uppger sina rutter till sådana publika ruttinsamlare så att hela nätverket kan övervaka validiteten och stabiliteten av den utbytta ruttinformationen. Dessvärre kan kapare utnyttja denna information för att undvika att bli rapporterade till ruttinsamlare. I denna avhandling utvärderar vi effektiviteten av sådan övervakningsinfrastruktur mot två typer av kapnings scenarier: Det första innefattar en allvetande attackerare med fullständig vetskap om både internettopologin och ruttpreferenser i nätverken. Det andra innefattar en realistisk attackerare som saknar sådan kunskap men som samlar upp den ruttinformation som nätverken själva lämnar ut till publika ruttinsamlare. Tidigare simuleringar har visat att kapningar som påverkar mer än 2% av internet alltid är synliga för den publika ruttinsamlarinfrastrukturen. Vår simulering visar däremot att allvetande och realistiska kapare som reagerar på utplaceringen av publika ruttinsamlare i smyg kan kapa upp till 11.7 gånger (d.v.s. 23.5%) respektive 8.1 gånger (d.v.s. 16.2%) mer av internet, utan att upptäckas av den existerande publika ruttinsamlarinfrastrukturen. Efter att ha utvärderat effektiviteten i den existerande publika infrastrukturen med nuvarande internet datamängder, utvärderade vi effektiviteten i realistiska framtida scenarier av för det första fler sammanlänkad (plattare) internet topologier samt för det andra topologier där fler nätverksvolontärer uppger sina rutter till publika ruttinsamlare. Dessvärre är båda typer av kapare mer effektiva i plattare internet topologier. Allvetande kapare kunde i smyg kapa upp till 24.5 gånger (d.v.s. 49.0%) mer av internet, medan realistiska kapare kunde kapa upp till 22.7 gånger (d.v.s. 45.5%) mer av internet, utan att upptäckas av ruttinsamlare. I topologier med upp till 4 gånger fler nätverksvolontärer som uppger sina rutter till publika ruttinsamlare, kunde allvetande och realistiska kapare reagerar på nya övervakare genom att modifiera sina attacker till att i smyg kapa upp till 4 gånger (d.v.s. 8.2%) respektive 2.9 gånger (d.v.s. 5.9%) mer av internet. Slutligen sammanfattar vi med en analys av två förslag till förbättring av den existerande ruttinsamlarinfrastrukturen: I det första väljes nya nätverksvolontärer på mer strategiska platser och i det andra låter vi nätverksvolontärer uppge fler rutter till ruttinsamlare. Vi hoppas att våra simuleringsresultat kan bidra till en design av en mer pålitlig publik rutt övervakningsinfrastruktur. / <p>QC 20220524</p>

BGP hijacking is a threat to network organizations because traditional BGP protocols were not designed with security in mind. Currently, research to combat hijacking is being done by detecting hijacking in real time from Public Route Collectors. However, by using AS-Path Prepending, a well-known traffic engineering technique, hijackers could adjust the influence scope of hijacks to potentially avoid Public Route Collectors. This thesis investigates fist, whether AS-Path Prepending is sufficient to hide from Public Route Collector, and second whether the hijacker can predict its hijack’s stealthiness by simply comparing the AS path length with the victim. Last, we investigate the non-hijacker-controlled parameters, which are the geographical locations and victim prepending times if the victim also enable AS-Path Prepending for traffic engineering in our study. Our results show that on one hand, AS-Path Prepending benefits stealthy hijacks to route collectors. While on the other hand, it is not sufficient to completely hide from route collectors only using it. By simply comparing the AS paths length, the hijacker’s prediction is constructive but not practical. And non-hijacker-controlled parameters indeed can significantly affect the stealthiness of hijacking. / BGP-kapning är ett hot mot nätverksorganisationer eftersom traditionella BGP-protokoll inte har utformats med säkerheten i åtanke. För närvarande bedrivs forskning för att bekämpa kapning genom att upptäcka kapning i realtid från offentliga ruttinsamlare. Genom att använda AS-Path Prepending, en välkänd trafikteknik, kan kapare dock justera kapningarnas inflytande för att eventuellt undvika offentliga ruttinsamlare. I den här avhandlingen undersöks för det första om AS-Path Prepending är tillräckligt för att dölja sig för Public Route Collector och för det andra om kaparen kan förutsäga hur smygande kapningen är genom att helt enkelt jämföra AS Path-längden med offrets. Slutligen undersöker vi de parametrar som inte kontrolleras av kaparen, dvs. geografiska platser och offrets prependingtider om offret också aktiverar AS-Path Prepending för trafikteknik i vår studie. Våra resultat visar att AS-Path Prepending å ena sidan gynnar smygande kapningar av ruttinsamlare. Å andra sidan räcker det inte för att helt och hållet dölja sig för ruttinsamlare om man bara använder det. Genom att helt enkelt jämföra AS-vägarnas längd är kaparens förutsägelser konstruktiva men inte praktiska. Parametrar som inte kontrolleras av kaparen kan faktiskt påverka kapningens smygande på ett betydande sätt.

<div>Despite the broad diversity of attacks and the many different ways an adversary can exploit a system, each attack can be divided into different phases. These phases include the discovery of a vulnerability in the system, its exploitation and the achieving persistence on the compromised system for (potential) further compromise and future access. Determining the exploitability of a system –and hence the success of an attack– remains a challenging, manual task. Not only because the problem cannot be formally defined but also because advanced protections and mitigations further complicate the analysis and hence, raise the bar for any successful attack. Nevertheless, it is still possible for an attacker to circumvent all of the existing defenses –under certain circumstances.</div><div><br></div><div>In this dissertation, we define and infer the Residual Attack Surface on a system. That is, we expose the limitations of the state-of-the-art mitigations, by showing practical ways to circumvent them. This work is divided into four parts. It assumes an attack with three phases and proposes new techniques to infer the Residual Attack Surface on each stage.</div><div><br></div><div>For the first part, we focus on the vulnerability discovery. We propose FuzzGen, a tool for automatically generating fuzzer stubs for libraries. The synthesized fuzzers are target specific, thus resulting in high code coverage. This enables developers to expose and fix vulnerabilities (that reside deep in the code and require initializing a complex state to trigger them), before they can be exploited. We then move to the vulnerability exploitation part and we present a novel technique called Block Oriented Programming (BOP), that automates data-only attacks. Data-only attacks defeat advanced control-flow hijacking defenses such as Control Flow Integrity. Our framework, called BOPC, maps arbitrary exploit payloads into execution traces and encodes them as a set of memory writes. Therefore an attacker’s intended execution “sticks” to the execution flow of the underlying binary and never departs from it. In the third part of the dissertation, we present an extension of BOPC that presents some measurements that give strong indications of what types of exploit payloads are not possible to execute. Therefore, BOPC enables developers to test what data an attacker would compromise and enables evaluation of the Residual Attack Surface to assess an application’s risk. Finally, for the last part, which is to achieve persistence on the compromised system, we present a new technique to construct arbitrary malware that evades current dynamic and behavioral analysis. The desired malware is split into hundreds (or thousands) of little pieces and each piece is injected into a different process. A special emulator coordinates and synchronizes the execution of all individual pieces, thus achieving a “distributed execution” under multiple address spaces. malWASH highlights weaknesses of current dynamic and behavioral analysis schemes and argues for full-system provenance.</div><div><br></div><div>Our envision is to expose all the weaknesses of the deployed mitigations, protections and defenses through the Residual Attack Surface. That way, we can help the research community to reinforce the existing defenses, or come up with new, more effective ones.</div>

Ce sujet s'inscrit dans le domaine de la vectorisation de médicaments et de la nanomédecine, un domaine en pleine expansion. Les nanovecteurs destinés à la santé doivent être stables, non-toxiques et furtifs vis-à-vis du système immunitaire pour pouvoir circuler librement dans le sang. C'est pourquoi il est nécessaire d'élaborer des polymères pouvant former des nanoparticules possédant un caractère furtif. Le poly(acide lactique) (PLA) est un polyester hydrophobe et biodégradable couramment utilisé pour former des nanoparticules (NPs) capables d'encapsuler des composés apolaires. Le poly(2-méthyl-2-oxazoline) (PMeOx) est un polymère hydrophile, biocompatible et non toxique. Il peut être synthétisé par polymérisation cationique par ouverture de cycle (CROP), ce qui permet la préparation de polymères avec un bon contrôle de la masse molaire et une faible polymolécularité. Différentes architectures de copolymères PMeOx-co-PLA (di-,triblocs ou greffés) ont été développées en couplant la CROP et la chimie « clic ». Des NPs sont obtenues par nanoprécipitation de ces copolymères et caractérisées par un large éventail de techniques expérimentales dont, notamment, la diffusion dynamique de la lumière, la cryo-microscopie électronique à transmission, et la diffusion de neutrons aux petits angles. Ces techniques complémentaires ont permis de mettre en évidence l'obtention de NPs possédant des structures internes variées, telles que des polymersomes, des nanoparticules cœur-couronne ou multicouches. L'évaluation de la furtivité a été menée par l'étude de l'adsorption d'une protéine modèle, l'albumine de sérum bovin (BSA), sur la surface des nanoparticules. Enfin l'encapsulation de l'α-tocophérol et de quantum dots a démontré les nombreuses possibilités d'application de ces nouvelles NPs / This subject falls within the fields of drug delivery and nanomedecine, a topic of growing interest over the last years. Nanosystems dedicated to health must be stable, non-toxic and stealthy in the immune system in order to move freely in the blood. For this purpose, the design of elaborate polymers that can form stealthy nanoparticles is required. Poly(lactic acid) (PLA) is a hydrophobic and biodegradable polyester usually used to form nanoparticles able to encapsulate apolar compounds. Poly(2-methyl-2-oxazoline) (PMeOx) is a hydrophilic, biocompatible and non toxic polymer. PMeOx can be synthesized via cationic ring opening polymerization (CROP), which allows the design of polymers with a good control of the molecular weights and a low dispersity. Thus, in this context, we have developed several strategies to design different architectures of amphiphilic PMeOx-co-PLA copolymers such as di-, triblock or graft copolymers. Such strategies relied on the combined use of CROP and « click »chemistry ». Nanoparticles were obtained by nanoprecipitation, and characterized by a wide range of experimental techniques including dynamic light scattering, cryogenic transmission electron microscopy and small angle neutron scattering. These complementary approaches evidenced that nanoparticles could be obtained with a large variety of internal structure, such as polymersomes, core-shell or multilayer nanoparticles. The evaluation of the stealthiness was performed by considering the adsorption behavior of a model protein, bovin serum albumine (BSA), on the surface of the nanoparticles. The encapsulation of α-tocopherol and quantum dots demonstrated the numerous applicative possibilities offered by these new NPs

Submitted by Renata Lopes (renatasil82@gmail.com) on 2017-05-31T11:40:17Z No. of bitstreams: 1 matheusribeirofurtadodemendonca.pdf: 1083096 bytes, checksum: bb42372f22411bc93823b92e7361a490 (MD5) / Approved for entry into archive by Adriana Oliveira (adriana.oliveira@ufjf.edu.br) on 2017-05-31T12:42:30Z (GMT) No. of bitstreams: 1 matheusribeirofurtadodemendonca.pdf: 1083096 bytes, checksum: bb42372f22411bc93823b92e7361a490 (MD5) / Made available in DSpace on 2017-05-31T12:42:30Z (GMT). No. of bitstreams: 1 matheusribeirofurtadodemendonca.pdf: 1083096 bytes, checksum: bb42372f22411bc93823b92e7361a490 (MD5) Previous issue date: 2016 / CAPES - Coordenação de Aperfeiçoamento de Pessoal de Nível Superior / Muitos jogos modernos apresentam elementos que permitem que o jogador complete certos objetivos sem ser visto pelos inimigos. Isso culminou no surgimento de um novo gênero chamado de jogos furtivos, onde a furtividade é essencial. Embora elementos de furtividade sejam muito comuns em jogos modernos, este tema não tem sido estudado extensivamente. Este trabalho aborda três problemas distintos: (i) como utilizar uma abordagem por aprendizado de máquinas de forma a permitir que o agente furtivo aprenda como se comportar adequadamente em qualquer ambiente, (ii) criar um método eficiente para planejamento de caminhos furtivos que possa ser acoplado à nossa formulação por aprendizado de máquinas e (iii) como usar computação evolutiva de forma a definir certos parâmetros para nossa abordagem por aprendizado de máquinas. É utilizado aprendizado por reforço para aprender bons comportamentos que sejam capazes de atingir uma alta taxa de sucesso em testes aleatórios de um jogo furtivo. Também é proposto uma abor dagem evolucionária capaz de definir automaticamente uma boa função de reforço para a abordagem por aprendizado por reforço. / Many modern games present stealth elements that allow the player to accomplish a certain objective without being spotted by enemy patrols. This gave rise to a new genre called stealth games, where covertness plays a major role. Although quite popular in modern games, stealthy behaviors has not been extensively studied. In this work, we tackle three different problems: (i) how to use a machine learning approach in order to allow the stealthy agent to learn good behaviors for any environment, (ii) create an efficient stealthy path planning method that can be coupled with our machine learning formulation, and (iii) how to use evolutionary computing in order to define specific parameters for our machine learning approach without any prior knowledge of the problem. We use Reinforcement Learning in order to learn good covert behavior capable of achieving a high success rate in random trials of a stealth game. We also propose an evolutionary approach that is capable of automatically defining a good reward function for our reinforcement learning approach.