Search

Website fingerprinting attacks, which use statistical analysis on network traffic to compromise user privacy, have been shown to be effective even if the traffic is sent over anonymity-preserving networks such as Tor. The classical attack model used to evaluate website fingerprinting attacks assumes an on-path adversary, who can observe all traffic traveling between the user's computer and the Tor network. In this work we investigate these attacks under a different attack model, in which the adversary is capable of running a small amount of unprivileged code on the target user's computer. Under this model, the attacker can mount cache side-channel attacks, which exploit the effects of contention on the CPU's cache, to identify the website being browsed. In an important special case of this attack model, a JavaScript attack is launched when the target user visits a website controlled by the attacker. The effectiveness of this attack scenario has never been systematically analyzed, especially in the open-world model which assumes that the user is visiting a mix of both sensitive and non-sensitive sites. In this work we show that cache website fingerprinting attacks in JavaScript are highly feasible, even when they are run from highly restrictive environments, such as the Tor Browser. Specifically, we use machine learning techniques to classify traces of cache activity. Unlike prior works, which try to identify cache conflicts, our work measures the overall occupancy of the last-level cache. We show that our approach achieves high classification accuracy in both the open-world and the closed-world models. We further show that our techniques are resilient both to network-based defenses and to side-channel countermeasures introduced to modern browsers as a response to the Spectre attack.

This study was undertaken to examine the efficacy of lidocaine aerosol pretreatment in attenuating hemodynamic (HD) responses secondary to laryngoscopy and tracheal intubation in patients undergoing surgery for intracranial space occupying lesions (ICSOL). A semiclosed breathing system was improvised to generate aerosol of consistent density. Five percent lidocaine was nebulized in two different dosages (0.2 and 0.1 ml/kg in groups A and B, respectively); group C (control) received aerosol of normal saline. The average aerosol-treatment time was 24, 12, and 16 min in groups A, B, and C, respectively. Changes in heart rate (HR), systolic arterial pressure (SAP), diastolic arterial pressure (DAP), and rate pressure product (RPP) were analyzed by analysis of variance (ANOVA). In group A, tracheal intubation did not cause significant HD changes. In group B, a significant increase was observed in each HD parameter which, when compared with control, was less severe. Lidocaine toxicity, regurgitation, nausea, vomiting, or aspiration did not occur in any patient. Patients accepted the procedure well. This study found efficacy of the technique to be related to duration of aerosol treatment.

The existence of evasion attacks during the test phase of machine learning algorithms represents a significant challenge to both their deployment and understanding. These attacks can be carried out by adding imperceptible perturbations to inputs to generate adversarial examples and finding effective defenses and detectors has proven to be difficult. In this paper, we step away from the attack-defense arms race and seek to understand the limits of what can be learned in the presence of an evasion adversary. In particular, we extend the Probably Approximately Correct (PAC)-learning framework to account for the presence of an adversary. We first define corrupted hypothesis classes which arise from standard binary hypothesis classes in the presence of an evasion adversary and derive the Vapnik-Chervonenkis (VC)-dimension for these, denoted as the adversarial VC-dimension. We then show that sample complexity upper bounds from the Fundamental Theorem of Statistical learning can be extended to the case of evasion adversaries, where the sample complexity is controlled by the adversarial VC-dimension. We then explicitly derive the adversarial VC-dimension for halfspace classifiers in the presence of a sample-wise norm-constrained adversary of the type commonly studied for evasion attacks and show that it is the same as the standard VC-dimension, closing an open question. Finally, we prove that the adversarial VC-dimension can be either larger or smaller than the standard VC-dimension depending on the hypothesis class and adversary, making it an interesting object of study in its own right., Comment: 14 pages, 2 figures (minor changes to biblatex output)