No abstract

In September 2017, McAffee Labs quarterly report [2] estimated that brute force attacks represent 20% of total network attacks, making them the most prevalent type of attack ex-aequo with browser based vulnerabilities. These attacks have sometimes catastrophic consequences, and understanding their fundamental limits may play an important role in the risk assessment of password-secured systems, and in the design of better security protocols. While some solutions exist to prevent online brute-force attacks that arise from one single IP address, attacks performed by botnets are more challenging. In this paper, we analyze these distributed attacks by using a simplified model. Our aim is to understand the impact of distribution and asynchronization on the overall computational effort necessary to breach a system. Our result is based on Guesswork, a measure of the number of queries (guesses) required of an adversary before a correct sequence, such as a password, is found in an optimal attack. Guesswork is a direct surrogate for time and computational effort of guessing a sequence from a set of sequences with associated likelihoods. We model the lack of synchronization by a worst-case optimization in which the queries made by multiple adversarial agents are received in the worst possible order for the adversary, resulting in a min-max formulation. We show that, even without synchronization, and for sequences of growing length, the asymptotic optimal performance is achievable by using randomized guesses drawn from an appropriate distribution. Therefore, randomization is key for distributed asynchronous attacks. In other words, asynchronous guessers can asymptotically perform brute-force attacks as efficiently as synchronized guessers. I. INTRODUCTIONFrom online banking [3] and bitcoin wallets [4], to secure shell (SSH), file transfer protocol (ftp), and telnet servers [5], and passing by governmental institutions [6], brute-force attacks have shown to be one of the major threats to network security. Despite the computational burden on the attacker, brute-force attacks are prevalent. This can be explained through multiple points of view. First, passwords are often weaker than what they ought to be, meaning that attackers can hope to find the correct password well before they query a significant portion of the possible password strings. Next, attacks through huge networks of compromised computers (botnets) are now more common, giving access to significant computational resources for the attacker. More critically, these botnets help to disguise the attack by distributing it. Indeed, a main solution to the threat of online brute-force attacks is to setup a system that detects and prevents too many queries from any one user, as determined by IP addresses. As such, an attacker which uses only a single IP address would be limited to a fixed number of guesses. In recent years, however, this defense was circumvented by using massive botnets, each bot querying potential passwords. In this situation, it is hard to detect legitimat...

We consider the problem of signal estimation (denoising) from a statistical-mechanical perspective, in continuation to a recent work on the analysis of mean-square error (MSE) estimation using a direct relationship between optimum estimation and certain partition functions. The paper consists of essentially two parts. In the first part, using the aforementioned relationship, we derive single-letter expressions of the mismatched MSE of a codeword (from a randomly selected code), corrupted by a Gaussian vector channel. In the second part, we provide several examples to demonstrate phase transitions in the behavior of the MSE. These examples enable us to understand more deeply and to gather intuition regarding the roles of the real and the mismatched probability measures in creating these phase transitions. Index TermsMinimum mean-square error (MMSE), mismatched MSE, partition function, statistical-mechanics, conditional mean estimation, phase transitions, threshold effect.

Compressed sensing is a signal processing technique in which data is acquired directly in a compressed form. There are two modeling approaches that can be considered: the worst-case (Hamming) approach and a statistical mechanism, in which the signals are modeled as random processes rather than as individual sequences. In this paper, the second approach is studied. In particular, we consider a model of the form Y = HX + W , where each comportment of X is given by X i = S i U i , where {U i } are i.i.d. Gaussian random variables, and {S i } are binary random variables independent of {U i }, and not necessarily independent and identically distributed (i.i.d.), H ∈ R k×n is a random matrix with i.i.d. entries, and W is white Gaussian noise. Using a direct relationship between optimum estimation and certain partition functions, and by invoking methods from statistical mechanics and from random matrix theory (RMT), we derive an asymptotic formula for the minimum mean-square error (MMSE) of estimating the input vector X given Y and H, as k, n → ∞, keeping the measurement rate, R = k/n, fixed. In contrast to previous derivations, which are based on the replica method, the analysis carried out in this paper is rigorous. Index TermsCompressed Sensing (CS), minimum mean-square error (MMSE), partition function, statisticalmechanics, replica method, conditional mean estimation, phase transitions, threshold effect, random matrix.

The rate of mRNA translation depends on the initiation, elongation, and termination rates of ribosomes along the mRNA. These rates depend on many “local” factors like the abundance of free ribosomes and tRNA molecules in the vicinity of the mRNA molecule. All these factors are stochastic and their experimental measurements are also noisy. An important question is how protein production in the cell is affected by this considerable variability. We develop a new theoretical framework for addressing this question by modeling the rates as identically and independently distributed random variables and using tools from random matrix theory to analyze the steady-state production rate. The analysis reveals a principle of universality: the average protein production rate depends only on the of the set of possible values that the random variable may attain. This explains how total protein production can be stabilized despite the overwhelming stochasticticity underlying cellular processes.