The Experts below are selected from a list of 105 Experts worldwide ranked by ideXlab platform

Yuen S - One of the best experts on this subject based on the ideXlab platform.

  • Multiparty session programming with global protocol combinators
    Schloss Dagstuhl -- Leibniz-Zentrum fuer Informatik, 2020
    Co-Authors: Yoshida N, Imai K, Neykova R, Yuen S
    Abstract:

    Multiparty Session Types (MPST) is a typing discipline for communication protocols. It ensuresthe absence of communication errors and deadlocks for well-typed communicating processes. Thestate-of-the-art implementations of the MPST theory rely on (1)runtime linearity checksto ensurecorrect usage of communication channels and (2) external domain-specific languages for specifyingand verifying multiparty protocols.To overcome these limitations, we propose a library for programming withglobal combinators– a set of functions for writing and verifying multiparty protocols in OCaml. Local behavioursforallprocesses in a protocol are inferredat oncefrom a global combinator. We formalise globalcombinators and prove a sound realisability of global combinators – a well-typed global combinatorderives a set of local types, by which typed endpoint programs can ensure type and communicationsafety. Our approach enables fully-static verification and implementation of the whole protocol, fromthe protocol specification to the process implementations, to happen in the same language.We compare our implementation to untyped and continuation-passing style implementations,and demonstrate its expressiveness by implementing a plethora of protocols. We show our librarycan interoperate with existing libraries and services, implementing DNS (domain name service)protocol and the OAuth (Open Authentication) protocol

  • Multiparty Session Programming with Global Protocol Combinators
    'Center for Open Science', 2020
    Co-Authors: Imai K, Neykova R, Yoshida N, Yuen S
    Abstract:

    EPSRC Doctoral Prize FellowshipMultiparty Session Types (MPST) is a typing discipline for communication protocols. It ensures the absence of communication errors and deadlocks for well-typed communicating processes. The state-of-the-art implementations of the MPST theory rely on (1) runtime linearity checks to ensure correct usage of communication channels and (2) external domain-specific languages for specifying and verifying multiparty protocols. To overcome these limitations, we propose a library for programming with global combinators -- a set of functions for writing and verifying multiparty protocols in OCaml. Local behaviours for all processes in a protocol are inferred at once from a global combinator. We formalise global combinators and prove a sound realisability of global combinators -- a well-typed global combinator derives a set of local types, by which typed endpoint programs can ensure type and communication safety. Our approach enables fully-static verification and implementation of the whole protocol, from the protocol specification to the process implementations, to happen in the same language. We compare our implementation to untyped and continuation-passing style implementations, and demonstrate its expressiveness by implementing a plethora of protocols. We show our library can interoperate with existing libraries and services, implementing DNS (domain name service) protocol and the OAuth (Open Authentication) protocol

López Romera Carlos - One of the best experts on this subject based on the ideXlab platform.

  • DNS Over HTTPS Traffic Analysis and Detection
    Universitat Oberta de Catalunya (UOC), 2020
    Co-Authors: López Romera Carlos
    Abstract:

    The domain name service (DNS) is a prevalent protocol used in computer communications, used to translate domain names to addresses that can be routed to via de Internet Protocol (IP). One of the main characteristics of DNS is the use of plaintext requests and responses, leaking information even in traditional secure communications; a client might resolve a server's IP address using plaintext messages, and then cryptographically protect its exchange with the server itself. DNS over HTTPS (DoH) is a protocol specification introduced in the IETF RFC 8484 (2018), which provides a mapping of regular DNS requests and responses over TLS-encapsulated HTTP messages. TLS (Transport Layer Protocol) and HTTP (HyperText Transfer Protocol), known in conjunction as HTTPS, are the two most common methods of communication with web servers, each providing security and structure respectively. DoH, then, provides not only the cryptographic benefits of TLS, but also the masquerading of DoH communications as regular web traffic. Although recent work has aimed to identify the content of DoH communications by using different fingerprinting techniques, distinguishing regular TLS-encapsulated HTTP traffic from DoH remains an unsolved challenge. In this thesis, passive analysis of DoH traffic is presented, as well as a method and implementation for its detection

  • DNS over HTTPS traffic analysis and detection
    Universitat Oberta de Catalunya (UOC), 2020
    Co-Authors: López Romera Carlos
    Abstract:

    The domain name service (DNS) is a prevalent protocol used in computer communications, used to translate domain names to addresses that can be routed to via de Internet Protocol (IP). One of the main characteristics of DNS is the use of plaintext requests and responses, leaking information even in traditional secure communications; a client might resolve a server's IP address using plaintext messages, and then cryptographically protect its exchange with the server itself. DNS over HTTPS (DoH) is a protocol specification introduced in the IETF RFC 8484 (2018), which provides a mapping of regular DNS requests and responses over TLS-encapsulated HTTP messages. TLS (Transport Layer Protocol) and HTTP (HyperText Transfer Protocol), known in conjunction as HTTPS, are the two most common methods of communication with web servers, each providing security and structure respectively. DoH, then, provides not only the cryptographic benefits of TLS, but also the masquerading of DoH communications as regular web traffic. Although recent work has aimed to identify the content of DoH communications by using different fingerprinting techniques, distinguishing regular TLS-encapsulated HTTP traffic from DoH remains an unsolved challenge. In this thesis, passive analysis of DoH traffic is presented, as well as a method and implementation for its detection.El Servicio de nombres de dominio (DNS) es un protocolo muy utilizado en las comunicaciones informáticas, que se emplea para traducir los nombres de dominio a direcciones que puedan ser enrutadas a través del Protocolo de Internet (IP). Una de las principales características del DNS es el uso de solicitudes y respuestas en texto plano, que filtran información incluso en las comunicaciones seguras tradicionales; un cliente puede resolver la dirección IP de un servidor utilizando mensajes en texto plano y luego proteger criptográficamente su intercambio con el propio servidor. El DNS sobre HTTPS (DoH) es una especificación de protocolo introducida en la RFC 8484 (2018) de la IETF, que proporciona un mapeo de las solicitudes y respuestas regulares de DNS sobre mensajes HTTP encapsulados en TLS. El TLS (Protocolo de Capa de Transporte) y el HTTP (Protocolo de Transferencia de Hipertexto), conocidos conjuntamente como HTTPS, son los dos métodos más comunes de comunicación con los servidores web, y cada uno de ellos proporciona seguridad y estructura respectivamente. El DoH, por lo tanto, proporciona no sólo los beneficios criptográficos del TLS, sino también el disfraz de las comunicaciones del DoH como tráfico web regular. Aunque la labor reciente ha tenido por objeto identificar el contenido de las comunicaciones de la DdH mediante el uso de diferentes técnicas de huellas dactilares, la distinción entre el tráfico HTTP encapsulado en el TLS y el tráfico de la DdH sigue siendo un problema no resuelto. En esta tesis se presenta un análisis pasivo del tráfico DoH, así como un método y una implementación para su detección.El Servei de noms de domini (DNS) és un protocol molt utilitzat en les comunicacions informàtiques, que s'empra per a traduir els noms de domini a adreces que puguin ser enrutadas a través del Protocol d'Internet (IP). Una de les principals característiques del DNS és l'ús de sol·licituds i respostes en text pla, que filtren informació fins i tot en les comunicacions segures tradicionals; un client pot resoldre l'adreça IP d'un servidor utilitzant missatges en text pla i després protegir criptogràficament el seu intercanvi amb el propi servidor. El DNS sobre HTTPS (DoH) és una especificació de protocol introduïda en la RFC 8484 (2018) de la IETF, que proporciona un mapatge de les sol·licituds i respostes regulars de DNS sobre missatges HTTP encapsulats en TLS. El TLS (Protocol de Capa de Transport) i l'HTTP (Protocol de Transferència d'Hipertext), coneguts conjuntament com a HTTPS, són els dos mètodes més comuns de comunicació amb els servidors web, i cadascun d'ells proporciona seguretat i estructura respectivament. El DoH, per tant, proporciona no sols els beneficis criptogràfics del TLS, sinó també la disfressa de les comunicacions del DoH com a trànsit web regular. Encara que la labor recent ha tingut per objecte identificar el contingut de les comunicacions de la DdH mitjançant l'ús de diferents tècniques d'empremtes dactilars, la distinció entre el trànsit HTTP encapsulat en el TLS i el trànsit de la DdH continua sent un problema no resolt. En aquesta tesi es presenta una anàlisi passiva del trànsit DoH, així com un mètode i una implementació per a la seva detecció

Josiah Hagen - One of the best experts on this subject based on the ideXlab platform.

  • finding domain generation algorithms by looking at length distribution
    International Symposium on Software Reliability Engineering, 2014
    Co-Authors: Miranda Mowbray, Josiah Hagen
    Abstract:

    In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from domain name service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.

Joss Wright - One of the best experts on this subject based on the ideXlab platform.

  • regional variation in chinese internet filtering
    Information Communication & Society, 2014
    Co-Authors: Joss Wright
    Abstract:

    Internet filtering in China is a pervasive and well-reported phenomenon and, as arguably the most extensive filtering regime in the world today, has been studied by a number of authors. Existing studies, however, have considered both the filtering infrastructure and the nation itself as largely homogeneous in this respect. This article investigates variation in filtering across China through direct access to internet services across the country. This is achieved through use of the domain name service (DNS), which provides a mapping between human-readable names and machine-routable internet addresses, and is thus a critical component of internet-based communications. Manipulation of DNS is a common mechanism used by states and institutions to hamper access to internet services that have been deemed undesirable. Our experiments support the hypothesis that, despite typically being considered a monolithic entity, the Chinese filtering approach is better understood as a decentralized and semi-privatized operat...

  • regional variation in chinese internet filtering
    2012
    Co-Authors: Joss Wright
    Abstract:

    Internet filtering in China is a pervasive and well-reported phenomenon and, as arguably the most extensive filtering regime in the world today, has been studied by a number of authors. Existing studies, however, have considered both the filtering infrastructure and the nation itself as largely homogeneous in this respect. This article investigates variation in filtering across China through direct access to internet services across the country. This is achieved through use of the domain name service, which provides a mapping between human-readable names and machine-routable internet addresses, and is thus a critical component of internet-based communications. Manipulation of DNS is a common mechanism used by states and institutions to hamper access to internet services that have been deemed undesirable. Our experiments support the hypothesis that, despite typically being considered a monolithic entity, the Chinese filtering approach is better understood as a decentralised and semi-privatised operation in which low-level filtering decisions are left to local authorities and organisations. This article provides a first step in understanding how filtering affects populations at a fine-grained level, and moves toward a more subtle understanding of internet filtering than those based on the broad criterion of nationality. The techniques employed in this work, while here applied to geographic criteria, provide an approach by which filtering can be analysed according to a range of social, economic and political factors in order to more fully understand the role that internet filtering plays in China, and around the world.

Miranda Mowbray - One of the best experts on this subject based on the ideXlab platform.

  • finding domain generation algorithms by looking at length distribution
    International Symposium on Software Reliability Engineering, 2014
    Co-Authors: Miranda Mowbray, Josiah Hagen
    Abstract:

    In order to detect malware that uses domain fluxing to circumvent blacklisting, it is useful to be able to discover new domain-generation algorithms (DGAs) that are being used to generate algorithmically-generated domains (AGDs). This paper presents a procedure for discovering DGAs from domain name service (DNS) query data. It works by identifying client IP addresses with an unusual distribution of second-level string lengths in the domain names that they query. Running this fairly simple procedure on 5 days' data from a large enterprise network uncovered 19 different DGAs, nine of which have not been identified as previously-known. Samples and statistical information about the DGA domains are given.