1. Daniela Oliveira 1, Dhiraj Murthy 1, Henric Johnson 2, S. Felix Wu 3, Roozbeh Nia 3 and Jeff Rowe 3 1 Bowdoin College 2 Blekinge Institute of Technology 3 University of California at Davis IEEE Workshop on Semantics, Security and Privacy September 21, 2011

2.  Introduction  Limitations of Traditional Defense Solutions  The Challenge of Computing with Social Trust  The Socially-Aware OS  Applications, Benefits and Threats  Concluding Remarks

3.  OSNs: rise in popularity;  Malware landscape complex;  Internet: social platform ◦ What can be trusted? Internet

4.  Based on social trust;  OS, architecture and applications should become socially-aware;  OSN users assign/have inferred trust values for friends and objects;  Continuum trusted-untrusted.

5.  Signature, Behavior, Information-flow models: ◦ Automated, rigid and threat-specific.  Shift to Web-based computer paradigm: ◦ Users accomplish most of their computing need with browser.

6.  What if we leverage social trust to distinguish a continuum of trusted/untrusted? ◦ Flexibility ◦ Diversity ◦ Stronger security policies

7.  Signature-based ◦ Defeated by code obfuscation, polymorphism, metamorphism ◦ Cannot prevent zero-day attacks  Behavior-based ◦ Susceptible to false positives ◦ Depends of relevant training data  Information flow-based ◦ Usually assumes all data from the Internet as untrusted: too restrictive

8.  Unpredictability  Diversity  Continuum of trust/untrusted values  Human role

9.  In Sociology: ◦ Essential commodity ◦ Functional pre-requisite for society  Tool for making trustworthy decisions ◦ Risk and uncertainty ◦ An added bonus?  Computing with Social Trust ◦ New research area

10.  Operating systems manages: ◦ Processes; ◦ Memory; ◦ File systems; ◦ I/O devices;

11.  Operating systems manages: ◦ Processes; ◦ Memory; ◦ File systems; ◦ I/O devices; ◦ Social trust

13.  People user is connected to: email addresses  Objects: URLs, files, IP addresses, files;  Privacy preserved: only sharable objects 20 Years of Linux: http://www.cnn.com/2011/TECH/gaming.gadgets/08/25/linux.20/index.html?hpt=hp_bn7 Bowdoin College IP: 139.140.214.196/16 danielaseabra@gmail.com http://www.cc.gatech.edu/~brendan/Virtuoso_Oakland.pdf http://sourceforge.net/projects/jedit/files/jedit/4.4.1/jedit4.4.1install.exe/download

14. OSN Server TR User 1 TR User 2 TR User 3 TR User N TR Alice Network Trust-aware syscall interface social_synch() TR: Trust Repository OS Alice TR Alice

15. OSN Server TR User 1 TR User 2 TR User 3 TR User N TR Alice Network Trust-aware syscall interface social_synch() TR: Trust Repository OS Alice TR Alice

16. OSN Server TR User 1 TR User 2 TR User 3 TR User N TR Alice Network Trust-aware syscall interface social_synch() TR: Trust Repository OS Alice TR Alice

17.  Adaptation of Web of Trust (Richardson et al.’ 03) t ij = amount of trust user i has for her friend user j t jk = amount of trust user j has for her friend user k t ik = amount of trust user i should have for user k, not directly connected, function of t ij and t jk

18. NxN matrix, where N is the number of user t i = row vector of user i trust in other users t ik = how much user i trusts her friend user k t kj = how much user k trusts her friend user j (t ik. t kj ) = amount user i trusts user j via k ∑ k (t ik. t kj ) = how much user i trusts user j via any other node.

19.  Represents trust between any two users ◦ Aggregation function concatenates trusts along paths (1)M (0) = T (2)M (n) = T. M (n-1) Repeat (2) until M (n) = M (n-1) M (i) is the value of M in iteration i. Matrix multiplication definition: C ij = ∑ k (A ik. B kj )

20.  Personal beliefs: ◦ Asserted by a user to an object in her trust repository b i = user i’s personal belief (trust) on a certain object. b = collection of personal beliefs in a particular object How much a user believes in any sharable object in the network?

21.  Computes for any user, her belief in any sharable object (1)b (0) = b (2)b (n) = T. b (n-1) or (b i ) n = ∑ k (t ik. (b k ) n-1 ) Repeat (2) until b (n) = b (n-1) where: b (i) is the value of b in iteration i.

22.  Streamline security policies and decision- making process: ◦ Restriction of system resources based on trust; ◦ Software installation, URL visit.  Information-flow tracking with refined trust levels;  Anti-SPAM techniques.

23.  OSN or OS compromised: ◦ Attacker increases trust values for malicious objects:  System behave as if trustworthy framework was never installed;  High trust values do not mean higher privileges:  The higher the trust, the closer to default levels without social trust ◦ Attacker decreases trust values for benign objects:  DoS attack.

24.  Challenges ◦ Management and reliability of social data/trust: reliability, ethics issues, no standard API; ◦ The socially-aware kernel: managing multiple repositories, performance, usability, Sybil attacks, identity management. ◦ Confidentiality and Security: new vulnerabilities, privacy leaks, exporting trust information.