Secure IP Address Allocation at Cloud Scale

• URL: http://arxiv.org/abs/2210.14999v2
• Date: Tue, 10 Sep 2024 14:53:46 GMT
• Title: Secure IP Address Allocation at Cloud Scale
• Abstract summary: Dynamic allocation of IP addresses can be abused by adversaries to source malicious traffic, bypass rate limiting systems, and even capture traffic intended for other cloud tenants. In this paper, we develop a practical defense for IP address allocation through such an analysis. We show that principled analysis and implementation of cloud IP address allocation can lead to substantial security gains for tenants and their users.
• Score: 8.838701631824616
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: Public clouds necessitate dynamic resource allocation and sharing. However, the dynamic allocation of IP addresses can be abused by adversaries to source malicious traffic, bypass rate limiting systems, and even capture traffic intended for other cloud tenants. As a result, both the cloud provider and their customers are put at risk, and defending against these threats requires a rigorous analysis of tenant behavior, adversarial strategies, and cloud provider policies. In this paper, we develop a practical defense for IP address allocation through such an analysis. We first develop a statistical model of cloud tenant deployment behavior based on literature and measurement of deployed systems. Through this, we analyze IP allocation policies under existing and novel threat models. In response to our stronger proposed threat model, we design IP scan segmentation, an IP allocation policy that protects the address pool against adversarial scanning even when an adversary is not limited by number of cloud tenants. Through empirical evaluation on both synthetic and real-world allocation traces, we show that IP scan segmentation reduces adversaries' ability to rapidly allocate addresses, protecting both address space reputation and cloud tenant data. In this way, we show that principled analysis and implementation of cloud IP address allocation can lead to substantial security gains for tenants and their users.

Related papers

• IP Protection in the Era of Visual Generative AI: A Survey [70.06761647752164]
  This survey presents a two-dimensional taxonomy for IP protection in visual generative models.<n>The primary axis is a Control Logic View, which classifies methods into Information Exposure Control, Generative Behavior Constraint, and Attribution & Accountability.<n>The secondary axis distinguishes Data IP from Model IP as cross-cutting asset dimensions.
  arXiv  Detail & Related papers  (2026-08-13T00:26:41Z)
• Authorize-on-Demand: Dynamic Authorization with Legality-Aware Intellectual Property Protection for VLMs [70.09137776277994]
  AoD-IP is a framework that supports authorize-on-demand and legality-aware assessment.<n>AoD-IP maintains strong authorized-domain performance and reliable unauthorized detection.
  arXiv  Detail & Related papers  (2026-03-05T07:36:07Z)
• Bit of a Close Talker: A Practical Guide to Serverless Cloud Co-Location Attacks [9.93372713645485]
  Serverless computing has revolutionized cloud computing by offering users an efficient, cost-effective way to develop and deploy applications without managing infrastructure details.<n>Serverless cloud users remain vulnerable to various types of attacks, including micro-architectural side-channel attacks.<n>This study addresses the gap in understanding and constructing co-location attacks in serverless clouds.
  arXiv  Detail & Related papers  (2025-12-11T07:22:07Z)
• ZORRO: Zero-Knowledge Robustness and Privacy for Split Learning (Full Version) [58.595691399741646]
  Split Learning (SL) is a distributed learning approach that enables resource-constrained clients to collaboratively train deep neural networks (DNNs)<n>This setup enables SL to leverage server capacities without sharing data, making it highly effective in resource-constrained environments dealing with sensitive data.<n>We present ZORRO, a private, verifiable, and robust SL defense scheme.
  arXiv  Detail & Related papers  (2025-09-11T18:44:09Z)
• Network-Level Prompt and Trait Leakage in Local Research Agents [19.89535252097747]
  We show that Web and Research Agents (WRAs) are vulnerable to inference attacks by passive network adversaries such as ISPs.<n>WRAs could be deployed locally by organizations and individuals for privacy, legal, or financial purposes.
  arXiv  Detail & Related papers  (2025-08-27T21:24:10Z)
• Searching for Privacy Risks in LLM Agents via Simulation [61.229785851581504]
  We present a search-based framework that alternates between improving attack and defense strategies through the simulation of privacy-critical agent interactions.<n>We find that attack strategies escalate from direct requests to sophisticated tactics, such as impersonation and consent forgery.<n>The discovered attacks and defenses transfer across diverse scenarios and backbone models, demonstrating strong practical utility for building privacy-aware agents.
  arXiv  Detail & Related papers  (2025-08-14T17:49:09Z)
• HSM and TPM Failures in Cloud: A Real-World Taxonomy and Emerging Defenses [0.0]
  This paper presents a comprehensive analysis of publicly disclosed attacks and breaches involving HSMs and TPMs in cloud environments.<n>We propose a taxonomy of attack vectors based on real-world case studies and threat intelligence reports, highlighting the gaps between hardware trust anchors and dynamic cloud ecosystems.<n>Our findings emphasize that securing cloud-based cryptographic trust requires a layered, context-aware approach.
  arXiv  Detail & Related papers  (2025-07-23T16:18:16Z)
• Web Intellectual Property at Risk: Preventing Unauthorized Real-Time Retrieval by Large Language Models [49.270849415269936]
  We propose a novel framework that empowers web content creators to safeguard their web-based IP from unauthorized extraction and redistribution.<n>Our method follows principled motivations and effectively addresses an intractable black-box optimization problem.
  arXiv  Detail & Related papers  (2025-05-19T03:14:08Z)
• Cluster-Aware Attacks on Graph Watermarks [50.19105800063768]
  We introduce a cluster-aware threat model in which adversaries apply community-guided modifications to evade detection. Our results show that cluster-aware attacks can reduce attribution accuracy by up to 80% more than random baselines. We propose a lightweight embedding enhancement that distributes watermark nodes across graph communities.
  arXiv  Detail & Related papers  (2025-04-24T22:49:28Z)
• Vision-Language Model IP Protection via Prompt-based Learning [52.783709712318405]
  We introduce IP-CLIP, a lightweight IP protection strategy tailored to vision-language models (VLMs) By leveraging the frozen visual backbone of CLIP, we extract both image style and content information, incorporating them into the learning of IP prompt. This strategy acts as a robust barrier, effectively preventing the unauthorized transfer of features from authorized domains to unauthorized ones.
  arXiv  Detail & Related papers  (2025-03-04T08:31:12Z)
• Risk-Aware Sensitive Property-Driven Resource Management in Cloud Datacenters [1.103311584463036]
  We propose an efficient risk-aware sensitive property-driven virtual resource assignment mechanism for cloud datacenters. We have used two information-theoretic measures, i.e., KL-divergence and mutual information, to represent sensitive properties in the dataset. Based on the vulnerabilities of cloud architecture and the sensitive property profile, we have formulated the problem as a cost-drive optimization problem.
  arXiv  Detail & Related papers  (2025-02-04T21:10:34Z)
• SafeSplit: A Novel Defense Against Client-Side Backdoor Attacks in Split Learning (Full Version) [53.16528046390881]
  Split Learning (SL) is a distributed deep learning approach enabling multiple clients and a server to collaboratively train and infer on a shared deep neural network (DNN) This paper presents SafeSplit, the first defense against client-side backdoor attacks in Split Learning (SL) It uses a two-fold analysis to identify client-induced changes and detect poisoned models.
  arXiv  Detail & Related papers  (2025-01-11T22:20:20Z)
• Autonomous Identity-Based Threat Segmentation in Zero Trust Architectures [4.169915659794567]
  Zero Trust Architectures (ZTA) fundamentally redefine network security by adopting a "trust nothing, verify everything" approach. This research applies the proposed AI-driven, autonomous, identity-based threat segmentation in ZTA.
  arXiv  Detail & Related papers  (2025-01-10T15:35:02Z)
• Edge-Only Universal Adversarial Attacks in Distributed Learning [49.546479320670464]
  In this work, we explore the feasibility of generating universal adversarial attacks when an attacker has access to the edge part of the model only. Our approach shows that adversaries can induce effective mispredictions in the unknown cloud part by leveraging key features on the edge side. Our results on ImageNet demonstrate strong attack transferability to the unknown cloud part.
  arXiv  Detail & Related papers  (2024-11-15T11:06:24Z)
• Model Inversion Attacks: A Survey of Approaches and Countermeasures [59.986922963781]
  Recently, a new type of privacy attack, the model inversion attacks (MIAs), aims to extract sensitive features of private data for training. Despite the significance, there is a lack of systematic studies that provide a comprehensive overview and deeper insights into MIAs. This survey aims to summarize up-to-date MIA methods in both attacks and defenses.
  arXiv  Detail & Related papers  (2024-11-15T08:09:28Z)
• Federated Instruction Tuning of LLMs with Domain Coverage Augmentation [87.49293964617128]
  Federated Domain-specific Instruction Tuning (FedDIT) utilizes limited cross-client private data together with various strategies of instruction augmentation. We propose FedDCA, which optimize domain coverage through greedy client center selection and retrieval-based augmentation. For client-side computational efficiency and system scalability, FedDCA$*$, the variant of FedDCA, utilizes heterogeneous encoders with server-side feature alignment.
  arXiv  Detail & Related papers  (2024-09-30T09:34:31Z)
• Robust Utility-Preserving Text Anonymization Based on Large Language Models [80.5266278002083]
  Text anonymization is crucial for sharing sensitive data while maintaining privacy. Existing techniques face the emerging challenges of re-identification attack ability of Large Language Models. This paper proposes a framework composed of three LLM-based components -- a privacy evaluator, a utility evaluator, and an optimization component.
  arXiv  Detail & Related papers  (2024-07-16T14:28:56Z)
• SLIP: Securing LLMs IP Using Weights Decomposition [0.0]
  Large language models (LLMs) have recently seen widespread adoption, in both academia and industry. As these models grow, they become valuable intellectual property (IP), reflecting enormous investments by their owners. Current methods to protect models' IP on the edge have limitations in terms of practicality, loss in accuracy, or suitability to requirements. We introduce a novel hybrid inference algorithm, named SLIP, designed to protect edge-deployed models from theft.
  arXiv  Detail & Related papers  (2024-07-15T16:37:55Z)
• Dullahan: Stealthy Backdoor Attack against Without-Label-Sharing Split Learning [29.842087372804905]
  We propose a stealthy backdoor attack strategy tailored to the without-label-sharing split learning architecture. Our SBAT achieves a higher level of attack stealthiness by refraining from modifying any intermediate parameters during training.
  arXiv  Detail & Related papers  (2024-05-21T13:03:06Z)
• Generative AI for Secure and Privacy-Preserving Mobile Crowdsensing [74.58071278710896]
  generative AI has attracted much attention from both academic and industrial fields. Secure and privacy-preserving mobile crowdsensing (SPPMCS) has been widely applied in data collection/ acquirement.
  arXiv  Detail & Related papers  (2024-05-17T04:00:58Z)
• Fed-urlBERT: Client-side Lightweight Federated Transformers for URL Threat Analysis [6.552094912099549]
  Federated URL pre-trained model designed to address both privacy concerns and the need for cross-domain collaboration in cybersecurity. Our appraoch achieves performance comparable to centralized model under both independently and identically distributed (IID) and two non-IID data scenarios.
  arXiv  Detail & Related papers  (2023-12-06T17:31:16Z)
• Emergent (In)Security of Multi-Cloud Environments [3.3819025097691537]
  A majority of IT organizations have workloads spread across different cloud service providers, growing their multi-cloud environments. The increase in the number of attack vectors creates a challenge of how to prioritize mitigations and countermeasures. We conducted an analysis of multi-cloud threat vectors enabling calculation and prioritization for the identified mitigations and countermeasures.
  arXiv  Detail & Related papers  (2023-11-02T14:02:33Z)
• A Novel Supervised Deep Learning Solution to Detect Distributed Denial of Service (DDoS) attacks on Edge Systems using Convolutional Neural Networks (CNN) [0.41436032949434404]
  This project presents a novel deep learning-based approach for detecting DDoS attacks in network traffic. The algorithm employed in this study exploits the properties of Convolutional Neural Networks (CNN) and common deep learning algorithms. The results of this study demonstrate the effectiveness of the proposed algorithm in detecting DDOS attacks, achieving an accuracy of.9883 on 2000 unseen flows in network traffic.
  arXiv  Detail & Related papers  (2023-09-11T17:37:35Z)
• Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection [52.08301776698373]
  We propose a novel approach called Compact Un-Transferable Isolation Domain (CUTI-domain) CUTI-domain acts as a barrier to block illegal transfers from authorized to unauthorized domains. We show that CUTI-domain can be easily implemented as a plug-and-play module with different backbones.
  arXiv  Detail & Related papers  (2023-03-20T13:07:11Z)
• Fixed Points in Cyber Space: Rethinking Optimal Evasion Attacks in the Age of AI-NIDS [70.60975663021952]
  We study blackbox adversarial attacks on network classifiers. We argue that attacker-defender fixed points are themselves general-sum games with complex phase transitions. We show that a continual learning approach is required to study attacker-defender dynamics.
  arXiv  Detail & Related papers  (2021-11-23T23:42:16Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.