arXiv subjects

Seungsoo Lee

Publications and source records attributed to Seungsoo Lee.

4 recordsLinked to original sources

arXiv2026

ALPS: Automated Least-Privilege Enforcement for Securing Serverless Functions

Serverless computing is increasingly adopted for AI-driven workloads due to its automatic scaling and pay-as-you-go model. However, its function-based architecture creates significant security risks, including excessive privilege allocation and poor permission management. In this paper, we present ALPS, an automated framework for enforcing least privilege in serverless environments. Our system employs serverless-tailored static analysis to extract precise permission requirements from function code and a fine-tuned Large Language Model (LLM) to generate language- and vendor-specific security policies. It also performs real-time monitoring to block unauthorized access and adapt to policy or code changes, supporting heterogeneous cloud providers and programming languages. In an evaluation of 8,322 real-world functions across AWS, Google Cloud, and Azure, ALPS achieved 94.8\% coverage for least-privilege extraction, improved security logic generation quality by 220\% (BLEU), 124\% (ChrF++) and 100\% (ROUGE-2), and added minimum performance overhead. These results demonstrate that ALPS provides an effective, practical, and vendor-agnostic solution for securing serverless workloads.

cs.CR↗

arXiv2025

Heimdallr: Fingerprinting SD-WAN Control-Plane Architecture via Encrypted Control Traffic

Software-defined wide area network (SD-WAN) has emerged as a new paradigm for steering a large-scale network flexibly by adopting distributed software-defined network (SDN) controllers. The key to building a logically centralized but physically distributed control-plane is running diverse cluster management protocols to achieve consistency through an exchange of control traffic. Meanwhile, we observe that the control traffic exposes unique time-series patterns and directional relationships due to the operational structure even though the traffic is encrypted, and this pattern can disclose confidential information such as control-plane topology and protocol dependencies, which can be exploited for severe attacks. With this insight, we propose a new SD-WAN fingerprinting system, called Heimdallr. It analyzes periodical and operational patterns of SD-WAN cluster management protocols and the context of flow directions from the collected control traffic utilizing a deep learning-based approach, so that it can classify the cluster management protocols automatically from miscellaneous control traffic datasets. Our evaluation, which is performed in a realistic SD-WAN environment consisting of geographically distant three campus networks and one enterprise network shows that Heimdallr can classify SD-WAN control traffic with $\geq$ 93%, identify individual protocols with $\geq$ 80% macro F-1 scores, and finally can infer control-plane topology with $\geq$ 70% similarity.

cs.CR↗

arXiv2025

Ambusher: Exploring the Security of Distributed SDN Controllers Through Protocol State Fuzzing

Distributed SDN (Software-Defined Networking) controllers have rapidly become an integral element of Wide Area Networks (WAN), particularly within SD-WAN, providing scalability and fault-tolerance for expansive network infrastructures. However, the architecture of these controllers introduces new potential attack surfaces that have thus far received inadequate attention. In response to these concerns, we introduce Ambusher, a testing tool designed to discover vulnerabilities within protocols used in distributed SDN controllers. Ambusher achieves this by leveraging protocol state fuzzing, which systematically finds attack scenarios based on an inferred state machine. Since learning states from a cluster is complicated, Ambusher proposes a novel methodology that extracts a single and relatively simple state machine, achieving efficient state-based fuzzing. Our evaluation of Ambusher, conducted on a real SD-WAN deployment spanning two campus networks and one enterprise network, illustrates its ability to uncover 6 potential vulnerabilities in the widely used distributed controller platform.

cs.CR↗

arXiv2024

Finite Time Explosion of Stochastic Differential Equations: A survey into Khasminskii's Lyapunov Method and its Consistency with the Osgood Criterion

Solutions of Stochastic Differential Equations can have three types of explosive behaviors: almost-sure non-explosive, explosion with positive probability, and almost sure explosion. In this paper, we will provide a survey of Khasminskii's Lyapunov method for classifying explosive behaviors of solutions of stochastic differential equations. We will embark our expedition by examining the renowned Feller's test for explosion and observing its shortfalls. Afterwards, we will present Khasminskii's Lyapunov method for almost-sure non-explosion, explosion with positive probability, and almost-sure explosion. Ample examples will be provided to illuminate the power of Khasminskii's Lyapunov methods. Furthermore, quick layovers will be made to extend Khasminskii's Lyapunov method for almost-sure non-explosion and explosion with positive probability for jump processes with constant Poisson intensities.

math.PR↗