Colloquium Archive

Almost daily, we hear about outrageous cases of product counterfeiting; we all experience increased demands for identification of persons and computer data. Traditional concepts of trust, based on scarcity and secrets, are eroded by perfect digital copies, both in software and hardware. Physical Unclonable Functions (PUFs) offer a solution: they reference objects to measurable qualities outside the creator’s (or would-be counterfeiters) control, with the help of naturally occurring randomness. In our team, we focus on silicon chips built in a standard manufacturing process, and in particular, on their differential timing performance, rooted in random manufacturing process variations - still within normal circuit specifications. To create reliable and repeatable PUF, the design must emphasize uniqueness while suppressing systematic patterns, digitizing noise, and environmental influences. As a practical example, we will explain the operation of a basic, challengeable, multiplexer-array PUF, explore its response characteristics, choose an operational threshold, and determine its nominal error rates.

Malicious JavaScript detection is challenging in several ways. First, it is usually invisible to users, so it cannot be avoided by users’ vigilance. Second, it is often heavily obfuscated to bypass signature-based detection mechanisms and term-based classifiers such as the Bayesian classifier often used for spam detection. We have combined a web crawler for targeted collection of malicious JavaScript, a de-obfuscator that derives URLs from malicious JavaScript, and multiple classifiers for a comprehensive detection framework. Among tested, Support-Vector Machine showed the best performance. Given our test set from well-known malicious JavaScript repositories and high-traffic websites, our framework detects around 90% of malicious JavaScript and 99.9% of good scripts correctly. These results are published in Malware 2009, ACM DSMM '09, and ACM CCS '09 in poster session. This detection rate is already useful in real-time detection, especially when blacklists are not up to date and static and dynamic analysis imposes too much delay for web surfing. To improve the detection even further, we are currently building more detailed-blacklists using our crawlers.