Before we knew it
Published 15 October 2012
Leyla Bilge, Tudor Dumitraş
Citations608
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
This paper describes a method for automatically identifying zero-day attacks from field-gathered data that records when benign and malicious binaries are downloaded on 11 million real hosts around the world and identifies 18 vulnerabilities exploited before disclosure.
Abstract
Little is known about the duration and prevalence of zero-day attacks, which exploit vulnerabilities that have not been disclosed publicly. Knowledge of new vulnerabilities gives cyber criminals a free pass to attack any target of their choosing, while remaining undetected. Unfortunately, these serious threats are difficult to analyze, because, in general, data is not available until after an attack is discovered. Moreover, zero-day attacks are rare events that are unlikely to be observed in honeypots or in lab experiments.
Keywords
Computer Science
ScienceThe Economics of Information Security
808 Citations2006Ross Anderson, Tyler Moore
The economics of information security has recently become a thriving and fast-moving discipline and provides valuable insights into more general areas such as the design of peer-to-peer systems, the optimal balance of effort by programmers and testers, why privacy gets eroded, and the politics of digital rights management.
Proceedings - IEEE Symposium on Security and Privacy/Proceedings of the ... IEEE Symposium on Security and PrivacyAutomatic Patch-Based Exploit Generation is Possible: Techniques and Implications
283 Citations2008David Brumley, Pongsin Poosankam +2 more
IEEE Security & PrivacyIs finding security holes a good idea?
268 Citations2005Eric Rescorla
The analysis in this article represents the best-case scenario, consistent with the data and my ability to analyze it, for the vulnerability finding's usefulness.
ComputerWindows of vulnerability: a case study analysis
263 Citations2000John McHugh, William Fithen +1 more
A life cycle model for system vulnerabilities is proposed, then applied to three case studies to reveal how systems often remain vulnerable long after security fixes are available.
Milk or wine: does software security improve with age?
164 Citations2006Andy Ozment, Stuart Schechter
Strong statistical evidence of a decrease in the rate at which foundational vulnerabilities are being reported is found, however, this decrease is anything but brisk: foundational vulnerabilities have a median lifetime of at least 2.6 years.
Timing the Application of Security Patches for Optimal Uptime
156 Citations2002Steve Beattie, Seth Arnold +4 more
A model is presented that will help provide a formal foundation for when the practitioner should apply security updates, providing both mathematical models of the factors affecting when to patch and collecting empirical data to give the model practical value.
Polonium: Tera-Scale Graph Mining and Inference for Malware Detection
156 Citations2011Duen Horng Chau, Carey Nachenberg +3 more
Polonium, a novel Symantec technology that detects malware through large-scale graph inference based on the scalable Belief Propagation algorithm, infers every file’s reputation, flagging files with low reputation as malware.
A large scale exploratory analysis of software vulnerability life cycles
123 Citations2012Muhammad Shahzad, Muhammad Shafiq +1 more
An exploratory measurement study of a large software vulnerability data set containing 46310 vulnerabilities disclosed since 1988 till 2011 uncovers several statistically significant findings that have important implications for software development and deployment.
Toward a standard benchmark for computer security research
90 Citations2011Tudor Dumitraş, Darren Shou
The unique characteristics of the WINE data are reviewed, why rigorous benchmarking will provide fresh insights on the security arms race is discussed, and a research agenda for this area is proposed.
Digital Eprints Services at ISB (DESI) (Indian School of Business)Impact of Vulnerability Disclosure and Patch Availability - An Empirical Analysis
85 Citations2004Ashish Arora, Ramayya Krishnan +4 more
This paper is an attempt to empirically test the impact of vulnerability information disclosure and availability of patches on attackers’ tendency to exploit vulnerabilities on one hand and on the vendors' tendency to release patches on the other.
Empirical Estimates and Observations of 0Day Vulnerabilities
65 Citations2009M.A. McQueen, T.A. McQueen +2 more
This work analyzed the 0Day lifespans of 491 vulnerabilities and conservatively estimated that in the worst year there were on average 2500 0Day vulnerabilities in existence on any given day and made a more aggressive estimate of 4500.
Polonium: Tera-Scale Graph Mining for Malware Detection
49 Citations2013Duen Horng Chau, Carey Nachenberg +3 more
The Polonium algorithm computes file reputation based on the fast and scalable Belief Propagation algorithm (O(|E|)), which iteratively improves inference quality, and achieves 85% true positive rate (in detecting malware).
Repository for Publications and Research Data (ETH Zurich)Security econometrics: The dynamics of (in)security
40 Citations2009Stefan Frei
This analysis provides a metric for the success of the "responsible disclosure" process and measures the prevalence of the commercial markets for vulnerability information and the role of security information providers (SIP), which function as the "free press" of the ecosystem.
Emerging Issues in Responsible Vulnerability Disclosure.
40 Citations2005Hasan Cavusoglu, Huseyin Cavusoglu +1 more
This paper examines the impact of an early discovery, which can be encouraged with proper incentive mechanisms, on the release time of the patch, the grace period, and the social welfare, and explores the several policy implications of the results and their relationship with current disclosure practices.
Elsevier eBooksAnatomy of an attack
31 Citations2002George L Stefanek
This chapter describes the clever methods that may be employed by a hacker to gain access to a systems and network to discover information.
Communications of the ACMThe nonsecurity of secrecy
18 Citations2004Bruce Schneier
Proponents of secrecy ignore the security value of openness: public scrutiny is the only reliable way to improve security.
IEEE Security & PrivacyLocks and full disclosure
11 Citations2003Bruce Schneier
It turns out that the ways the authors've learned to conceptualize security and attacks in the computer world are directly applicable to other areas of security like door locks.