@inproceedings{19, abstract = {{Version Control Systems (VCS) are a valuable tool for software development and document management. Both client/server and distributed (Peer-to-Peer) models exist, with the latter (e.g., Git and Mercurial) becoming increasingly popular. Their distributed nature introduces complications, especially concerning security: it is hard to control the dissemination of contents stored in distributed VCS as they rely on replication of complete repositories to any involved user. We overcome this issue by designing and implementing a concept for cryptography-enforced access control which is transparent to the user. Use of field-tested schemes (end-to-end encryption, digital signatures) allows for strong security, while adoption of convergent encryption and content-defined chunking retains storage efficiency. The concept is seamlessly integrated into Mercurial---respecting its distributed storage concept---to ensure practical usability and compatibility to existing deployments.}}, author = {{Lass, Michael and Leibenger, Dominik and Sorge, Christoph}}, booktitle = {{Proc. 41st Conference on Local Computer Networks (LCN)}}, isbn = {{978-1-5090-2054-6}}, keywords = {{access control, distributed version control systems, mercurial, peer-to-peer, convergent encryption, confidentiality, authenticity}}, publisher = {{IEEE}}, title = {{{Confidentiality and Authenticity for Distributed Version Control Systems - A Mercurial Extension}}}, doi = {{10.1109/lcn.2016.11}}, year = {{2016}}, } @article{190, abstract = {{Today, software components are provided by global markets in the form of services. In order to optimally satisfy service requesters and service providers, adequate techniques for automatic service matching are needed. However, a requester’s requirements may be vague and the information available about a provided service may be incomplete. As a consequence, fuzziness is induced into the matching procedure. The contribution of this paper is the development of a systematic matching procedure that leverages concepts and techniques from fuzzy logic and possibility theory based on our formal distinction between different sources and types of fuzziness in the context of service matching. In contrast to existing methods, our approach is able to deal with imprecision and incompleteness in service specifications and to inform users about the extent of induced fuzziness in order to improve the user’s decision-making. We demonstrate our approach on the example of specifications for service reputation based on ratings given by previous users. Our evaluation based on real service ratings shows the utility and applicability of our approach.}}, author = {{Platenius, Marie Christin and Shaker, Ammar and Becker, Matthias and Hüllermeier, Eyke and Schäfer, Wilhelm}}, journal = {{IEEE Transactions on Software Engineering (TSE), presented at ICSE 2017}}, number = {{8}}, pages = {{739--759}}, publisher = {{IEEE}}, title = {{{Imprecise Matching of Requirements Specifications for Software Services using Fuzzy Logic}}}, doi = {{10.1109/TSE.2016.2632115}}, year = {{2016}}, } @inproceedings{2367, abstract = {{One of the most popular fuzzy clustering techniques is the fuzzy K-means algorithm (also known as fuzzy-c-means or FCM algorithm). In contrast to the K-means and K-median problem, the underlying fuzzy K-means problem has not been studied from a theoretical point of view. In particular, there are no algorithms with approximation guarantees similar to the famous K-means++ algorithm known for the fuzzy K-means problem. This work initiates the study of the fuzzy K-means problem from an algorithmic and complexity theoretic perspective. We show that optimal solutions for the fuzzy K-means problem cannot, in general, be expressed by radicals over the input points. Surprisingly, this already holds for simple inputs in one-dimensional space. Hence, one cannot expect to compute optimal solutions exactly. We give the first (1+eps)-approximation algorithms for the fuzzy K-means problem. First, we present a deterministic approximation algorithm whose runtime is polynomial in N and linear in the dimension D of the input set, given that K is constant, i.e. a polynomial time approximation scheme (PTAS) for fixed K. We achieve this result by showing that for each soft clustering there exists a hard clustering with similar properties. Second, by using techniques known from coreset constructions for the K-means problem, we develop a deterministic approximation algorithm that runs in time almost linear in N but exponential in the dimension D. We complement these results with a randomized algorithm which imposes some natural restrictions on the sought solution and whose runtime is comparable to some of the most efficient approximation algorithms for K-means, i.e. linear in the number of points and the dimension, but exponential in the number of clusters.}}, author = {{Blömer, Johannes and Brauer, Sascha and Bujna, Kathrin}}, booktitle = {{2016 IEEE 16th International Conference on Data Mining (ICDM)}}, isbn = {{9781509054732}}, keywords = {{unsolvability by radicals, clustering, fuzzy k-means, probabilistic method, approximation algorithms, randomized algorithms}}, location = {{Barcelona, Spain}}, pages = {{805--810}}, publisher = {{IEEE}}, title = {{{A Theoretical Analysis of the Fuzzy K-Means Problem}}}, doi = {{10.1109/icdm.2016.0094}}, year = {{2016}}, } @inproceedings{20556, author = {{Bodden, Eric and I Pun, Ka and Steffen, Martin and Stolz, Volker and Wickert, Anna-Katharina}}, booktitle = {{Leveraging Applications of Formal Methods, Verification and Validation: Foundational Techniques - 7th International Symposium, ISoLA 2016, Imperial, Corfu, Greece, October 10-14, 2016, Proceedings, Part {I}}}, pages = {{431--445}}, title = {{{Information Flow Analysis for Go}}}, doi = {{10.1007/978-3-319-47166-2_30}}, year = {{2016}}, } @inproceedings{207, abstract = {{We consider a scheduling problem where machines need to be rented from the cloud in order to process jobs. There are two types of machines available which can be rented for machine-type dependent prices and for arbitrary durations. However, a machine-type dependent setup time is required before a machine is available for processing. Jobs arrive online over time, have machine-type dependent sizes and have individual deadlines. The objective is to rent machines and schedule jobs so as to meet all deadlines while minimizing the rental cost. Since we observe the slack of jobs to have a fundamental influence on the competitiveness, we study the model when instances are parameterized by their (minimum) slack. An instance is called to have a slack of $\beta$ if, for all jobs, the difference between the job's release time and the latest point in time at which it needs to be started is at least $\beta$. While for $\beta series = {LNCS}}}, author = {{Mäcker, Alexander and Malatyali, Manuel and Meyer auf der Heide, Friedhelm and Riechers, Sören}}, booktitle = {{Proceedings of the 10th Annual International Conference on Combinatorial Optimization and Applications (COCOA)}}, pages = {{578----592}}, title = {{{Cost-efficient Scheduling on Machines from the Cloud}}}, doi = {{10.1007/978-3-319-48749-6_42}}, year = {{2016}}, } @inproceedings{20716, author = {{Bodden, Eric and Eichberg, Michael and I Pun, Ka and Steffen, Martin and Stolz, Volker and Wickert, Anna-Katharina}}, booktitle = {{Nordic Workshop on Programming Theory (NWPT'16)}}, title = {{{Don't let data Go astray---A Context-Sensitive Taint Analysis for Concurrent Programs in Go}}}, year = {{2016}}, } @techreport{20717, author = {{Nguyen Quang Do, Lisa and Ali, Karim and Livshits, Benjamin and Bodden, Eric and Smith, Justin and Murphy-Hill, Emerson}}, keywords = {{ATTRACT, ITSECWEBSITE}}, title = {{{Just-in-Time Static Analysis}}}, doi = {{http://dx.doi.org/10.7939/DVN/10859}}, year = {{2016}}, } @article{20718, author = {{Rasthofer, Siegfried and Arzt, Steven and Bodden, Eric and Miltenberger, Marc}}, journal = {{Datenschutz und Datensicherheit}}, keywords = {{ATTRACT, ITSECWEBSITE}}, pages = {{718--722}}, title = {{{Harvester - Vollautomatische Extraktion von Laufzeitwerten aus obfuskierten Android-Applikationen}}}, doi = {{https://www.springerprofessional.de/en/datenschutz-und-datensicherheit-dud-11-2016/10866536}}, year = {{2016}}, } @inproceedings{20719, author = {{Holzinger, Philipp and Triller, Stefan and Bartel, Alexandre and Bodden, Eric}}, booktitle = {{Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security}}, isbn = {{978-1-4503-4139-4}}, keywords = {{ATTRACT, access control, exploits, java security, security analysis, ITSECWEBSITE}}, pages = {{779--790}}, title = {{{An In-Depth Study of More Than Ten Years of Java Exploitation}}}, doi = {{http://doi.acm.org/10.1145/2976749.2978361}}, year = {{2016}}, } @inproceedings{20720, author = {{Follner, Andreas and Bartel, Alexandre and Peng, Hui and Chang, Yu-Chen and Ispoglou, Kyriakos and Payer, Mathias and Bodden, Eric}}, booktitle = {{International Workshop on Security and Trust Management (STM)}}, pages = {{212--228}}, title = {{{PSHAPE: Automatically Combining Gadgets for Arbitrary Method Execution}}}, year = {{2016}}, } @inproceedings{20721, author = {{Nguyen Quang Do, Lisa and Eichberg, Michael and Bodden, Eric}}, booktitle = {{Proceedings of the 5th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis}}, keywords = {{ATTRACT}}, pages = {{13--17}}, title = {{{Toward an Automated Benchmark Management System}}}, year = {{2016}}, } @inproceedings{20722, author = {{Arzt, Steven and Kussmaul, Tobias and Bodden, Eric}}, booktitle = {{Proceedings of the 5th ACM SIGPLAN International Workshop on State Of the Art in Program Analysis}}, pages = {{1--6}}, title = {{{Towards Cross-Platform Cross-Language Analysis with Soot}}}, year = {{2016}}, } @article{20724, author = {{Follner, Andreas and Bodden, Eric}}, issn = {{2214-2126}}, journal = {{Journal of Information Security and Applications }}, pages = {{16--26}}, title = {{{ROPocop — Dynamic mitigation of code-reuse attacks}}}, doi = {{http://dx.doi.org/10.1016/j.jisa.2016.01.002}}, volume = {{29}}, year = {{2016}}, } @inproceedings{20725, author = {{Follner, Andreas and Bartel, Alexandre and Bodden, Eric}}, booktitle = {{International Symposium on Engineering Secure Software and Systems (ESSoS)}}, title = {{{Analyzing the Gadgets - Towards a Metric to Measure Gadget Quality}}}, year = {{2016}}, } @inproceedings{20726, author = {{Falzon, Kevin and Bodden, Eric}}, booktitle = {{Principles of Security and Trust: 5th International Conference, POST 2016, Held as Part of the European Joint Conferences on Theory and Practice of Software, ETAPS 2016, Eindhoven, The Netherlands, April 2--8, 2016, Proceedings}}, editor = {{Piessens, Frank and Vigan'o, Luca}}, isbn = {{978-3-662-49635-0}}, pages = {{116--138}}, publisher = {{Springer Berlin Heidelberg}}, title = {{{Towards a Comprehensive Model of Isolation for Mitigating Illicit Channels}}}, doi = {{10.1007/978-3-662-49635-0_7}}, year = {{2016}}, } @inproceedings{20727, author = {{Rasthofer, Siegfried and Arzt, Steven and Miltenberger, Marc and Bodden, Eric}}, booktitle = {{Network and Distributed System Security Symposium (NDSS)}}, keywords = {{ATTRACT, ITSECWEBSITE}}, title = {{{Harvesting Runtime Values in Android Applications That Feature Anti-Analysis Techniques}}}, year = {{2016}}, } @inproceedings{20728, author = {{Nadi, Sarah and Krüger, Stefan and Mezini, Mira and Bodden, Eric}}, booktitle = {{International Conference for Software Engineering (ICSE)}}, keywords = {{CROSSING, ITSECWEBSITE}}, pages = {{935--946}}, title = {{{Jumping Through Hoops: Why do Java Developers Struggle With Cryptography APIs?}}}, year = {{2016}}, } @inproceedings{20729, author = {{Arzt, Steven and Bodden, Eric}}, booktitle = {{International Conference for Software Engineering (ICSE)}}, keywords = {{ITSECWEBSITE}}, title = {{{StubDroid: Automatic Inference of Precise Data-flow Summaries for the Android Framework}}}, year = {{2016}}, } @inproceedings{20730, author = {{Eling, N. and Rasthofer, S. and Kolhagen, M. and Bodden, Eric and Buxmann, P.}}, booktitle = {{2016 49th Hawaii International Conference on System Sciences (HICSS)}}, issn = {{1530-1605}}, pages = {{3666--3675}}, title = {{{Investigating Users' Reaction to Fine-Grained Data Requests: A Market Experiment}}}, doi = {{10.1109/HICSS.2016.458}}, year = {{2016}}, } @inproceedings{208, abstract = {{This paper presents a new framework for constructing fully CCA-secure predicate encryption schemes from pair encoding schemes. Our construction is the first in the context of predicate encryption which uses the technique of well-formedness proofs known from public key encryption. The resulting constructions are simpler and more efficient compared to the schemes achieved using known generic transformations from CPA-secure to CCA-secure schemes. The reduction costs of our framework are comparable to the reduction costs of the underlying CPA-secure framework. We achieve this last result by applying the dual system encryption methodology in a novel way.}}, author = {{Blömer, Johannes and Liske, Gennadij}}, booktitle = {{Proceedings of the CT-RSA 2016}}, pages = {{431--447}}, title = {{{Construction of Fully CCA-Secure Predicate Encryptions from Pair Encoding Schemes}}}, doi = {{10.1007/978-3-319-29485-8_25}}, year = {{2016}}, }