Biblio

According to the characteristics of security threats and massive users in power mobile applications, a mobile application security situational awareness method based on big data architecture is proposed. The method uses open-source big data technology frameworks such as Kafka, Flink, Elasticsearch, etc. to complete the collection, analysis, storage and visual display of massive power mobile application data, and improve the throughput of data processing. The security situation awareness method of power mobile application takes the mobile terminal threat index as the core, divides the risk level for the mobile terminal, and predicts the terminal threat index through support vector machine regression algorithm (SVR), so as to construct the security profile of the mobile application operation terminal. Finally, through visualization services, various data such as power mobile applications and terminal assets, security operation statistics, security strategies, and alarm analysis are displayed to guide security operation and maintenance personnel to carry out power mobile application security monitoring and early warning, banning disposal and traceability analysis and other decision-making work. The experimental analysis results show that the method can meet the requirements of security situation awareness for threat assessment accuracy and response speed, and the related results have been well applied in a power company.

Over the past decade, smart grids have been widely implemented. Real-time pricing can better address demand-side management in smart grids. Real-time pricing requires managers to interact more with consumers at the data level, which raises many privacy threats. Thus, we introduce differential privacy into the Real-time pricing for privacy protection. However, differential privacy leaves more space for an adversary to compromise the robustness of the system, which has not been well addressed in the literature. In this paper, we propose a novel active attack detection scheme against stealthy attacks, and then give the proof of correctness and effectiveness of the proposed scheme. Further, we conduct extensive experiments with real datasets from CER to verify the detection performance of the proposed scheme.

With the development of the information age, the process of global networking continues to deepen, and the cyberspace security has become an important support for today’s social functions and social activities. Web applications which have many security risks are the most direct interactive way in the process of the Internet activities. That is why the web applications face a large number of network attacks. Interpretive dynamic programming languages are easy to lean and convenient to use, they are widely used in the development of cross-platform web systems. As well as benefit from these advantages, the web system based on those languages is hard to detect errors and maintain the complex system logic, increasing the risk of system vulnerability and cyber threats. The attack defense of systems based on interpretive dynamic programming languages is widely concerned by researchers. Since the advance of endogenous security technologies, there are breakthroughs on the research of web system security. Compared with traditional security defense technologies, these technologies protect the system with their uncertainty, randomness and dynamism. Based on several common network attacks, the traditional system security defense technology and endogenous security technology of web application based on interpretive dynamic languages are surveyed and compared in this paper. Furthermore, the possible research directions of those technologies are discussed.

From the perspective of time domain, the propagation characteristics of sound waves in seawater can be seen more intuitively. In order to study the influence and characteristics of seamount on low frequency acoustic propagation, the research of this paper used the Finite Element Method (FEM) based on time domain to set up a full-waveguide low-frequency acoustic propagation simulation model, and discussed the influencing laws about acoustic propagation on seamount. The simulation results show that Seamounts can hinder the propagation of sound waves, weaken the energy of sound waves. The topographic changes of seamounts can cause the coupling and transformation of acoustic signals during the propagation which can stimulate the seabed interface wave.

Cloud data integrity verification was an important means to ensure data security. We used public key infrastructure (PKI) to manage user keys in Traditional way, but there were problems of certificate verification and high cost of key management. In this paper, RSA signature was used to construct a new identity-based cloud audit protocol, which solved the previous problems caused by PKI and supported forward security, and reduced the loss caused by key exposure. Through security analysis, the design scheme could effectively resist forgery attack and support forward security.

As the COVID-19 continues to spread globally, more and more companies are transforming into remote online offices, leading to the expansion of electronic signatures. However, the existing electronic signatures platform has the problem of data-centered management. The system is subject to data loss, tampering, and leakage when an attack from outside or inside occurs. In response to the above problems, this paper designs an electronic signature solution and implements a prototype system based on the consortium blockchain. The solution divides the contract signing process into four states: contract upload, initiation signing, verification signing, and confirm signing. The signing process is mapped with the blockchain-linked data. Users initiate the signature transaction by signing the uploaded contract's hash. The sign state transition is triggered when the transaction is uploaded to the blockchain under the consensus mechanism and the smart contract control, which effectively ensures the integrity of the electronic contract and the non-repudiation of the electronic signature. Finally, the blockchain performance test shows that the system can be applied to the business scenario of contract signing.

Smart grids are envisioned as the next-generation electricity grids. The data measured from the smart grid is very sensitive. It is thus highly necessary to adopt data access control in smart grids to guarantee the security and privacy of the measured data. Due to its flexibility and scalability, attribute-based encryption (ABE) is widely utilized to realize data access control in smart grids. However, most existing ABE solutions impose a heavy decryption overhead on their users. To this end, we propose a lightweight attribute-based encryption scheme for data access control in smart grids by adopting the idea of computation outsourcing. Under our proposed scheme, users can outsource a large amount of computation to a server during the decryption phase while still guaranteeing the security and privacy of the data. Theoretical analysis and experimental evaluation demonstrate that our scheme outperforms the existing schemes by achieving a very low decryption cost.

As the cyberspace structure becomes more and more complex, the problems of dynamic network space topology, complex composition structure, large spanning space scale, and a high degree of self-organization are becoming more and more important. In this paper, we model the cyberspace elements and their dependencies by combining the knowledge of graph theory. Layer adopts a network space modeling method combining virtual and real, and level adopts a spatial iteration method. Combining the layer-level models into one, this paper proposes a fast modeling method for cyberspace security structure model with network connection relationship, hierarchical relationship, and vulnerability information as input. This method can not only clearly express the individual vulnerability constraints in the network space, but also clearly express the hierarchical relationship of the complex dependencies of network individuals. For independent network elements or independent network element groups, it has flexibility and can greatly reduce the computational complexity in later applications.

In the PKI-CA system with a traditional trust model based on trust chain and centralized private key management, there are some problems with issuing certificates illegally, denying issued certificates, tampering with issuance log, and leaking certificate private key due to the excessive power of a single CA. A novel distributed CA system based on blockchain was constructed to solve the problems. The system applied blockchain and smart contract to coordinate the certificate issuing process, and stored the issuing process logs and information used to verify certificates on the blockchain. It guaranteed the non-tamperability and non-repudiation of logs and information. Aiming at the disadvantage of easy leakage of private keys in centralized management mode, the system used the homomorphism of elliptic encryption algorithm, CPK and transformation matrix to generate and store user private keys safely and distributively. Experimental analysis showed that the system can not only overcome the drawbacks of the traditional PKI-CA system, but also issue certificates quickly and save as much storage as possible to store certificate private keys.

The advancements in technology can be seen in recent years, and people have been adopting the emerging technologies. Though people rely upon these advancements, many loopholes can be seen if you take a particular field, and attackers are thirsty to steal personal data. There has been an increasing number of cyber threats and breaches happening worldwide, primarily for fun or for ransoms. Web servers and sites of the users are being compromised, and they are unaware of the vulnerabilities. Vulnerabilities include OWASP's top vulnerabilities like SQL injection, Cross-site scripting, and so on. To overcome the vulnerabilities and protect the site from getting down, the proposed work includes the implementation of a Web Application Firewall focused on the Application layer of the OSI Model; the product protects the target web applications from the Common OWASP security vulnerabilities. The Application starts analyzing the incoming and outgoing requests generated from the traffic through the pre-built Application Programming Interface. It compares the request and parameter with the algorithm, which has a set of pre-built regex patterns. The outcome of the product is to detect and reject general OWASP security vulnerabilities, helping to secure the user's business and prevent unauthorized access to sensitive data, respectively.

This paper focuses on the system on wireless sensor networks. The system is linear and the time of the system is discrete as well as variable, which named discrete-time linear time-varying systems (DLTVS). DLTVS are vulnerable to network attacks when exchanging information between sensors in the network, as well as putting their security at risk. A DLTVS with privacy-preserving is designed for this purpose. A set-membership estimator is designed by adding privacy noise obeying the Laplace distribution to state at the initial moment. Simultaneously, the differential privacy of the system is analyzed. On this basis, the real state of the system and the existence form of the estimator for the desired distribution are analyzed. Finally, simulation examples are given, which prove that the model after adding differential privacy can obtain accurate estimates and ensure the security of the system state.

In order to better cultivate engineering and application-oriented cryptographic talents, it is urgent to establish a joint school enterprise cryptographic laboratory. However, there is a core problem in the existing school enterprise joint laboratory construction scheme: the enterprise is not specialized and has insufficient cooperation ability, which can not effectively realize the effective integration of resources and mutual benefit and win-win results. To solve this problem, we propose a comprehensive evaluation model of cooperative enterprises based on entropy weight method and grey correlation analysis. Firstly, the multi-level evaluation index system of the enterprise is established, and the entropy weight method is used to objectively weight the index. After that, the grey weighted correlation degree between each enterprise and the virtual optimal enterprise is calculated by grey correlation analysis to compare the advantages and disadvantages of enterprises. Through the example analysis, it is proved that our method is effective and reliable, eliminating subjective factors, and providing a certain reference value for the construction of school enterprise joint cryptographic laboratory.

The development of IoT has penetrated various sectors. The development of IoT devices continues to increase and is predicted to reach 75 billion by 2025. However, the development of IoT devices is not followed by security developments. Therefore, IoT devices can become gateways for cyber attacks, including brute force and sniffing attacks. Authentication mechanisms can be used to ward off attacks. However, the implementation of authentication mechanisms on IoT devices is challenging. IoT devices are dominated by constraint devices that have limited computing. Thus, conventional authentication mechanisms are not suitable for use. Two-factor authentication using RFID and fingerprint can be a solution in providing an authentication mechanism. Previous studies have proposed a two-factor authentication mechanism using RFID and fingerprint. However, previous research did not pay attention to message exchange security issues and did not provide mutual authentication. This research proposes a secure mutual authentication protocol using two-factor RFID and fingerprint using MQTT protocol. Two processes support the authentication process: the registration process and authentication. The proposed protocol is tested based on biometric security by measuring the false acceptance rate (FAR) and false rejection rate (FRR) on the fingerprint, measuring brute force attacks, and measuring sniffing attacks. The test results obtained the most optimal FAR and FRR at the 80% threshold. Then the equal error rate (ERR) on FAR and FRR is around 59.5%. Then, testing brute force and sniffing attacks found that the proposed protocol is resistant to both attacks.

Code-graph based software defect prediction methods have become a research focus in SDP field. Among them, Code Property Graph is used as a form of data representation for code defects due to its ability to characterize the structural features and dependencies of defect codes. However, since the coarse granularity of Code Property Graph, redundant information which is not related to defects often attached to the characterization of software defects. Thus, it is a problem to be solved in how to locate software defects at a finer granularity in Code Property Graph. Static analysis is a technique for identifying software defects using set defect rules, and there are many proven static analysis tools in the industry. In this paper, we propose a method for locating specific types of defects in the Code Property Graph based on the result of static analysis tool. Experiments show that the location method based on static analysis results can effectively predict the location of specific defect types in real software program.

To reduce the false negative rate in power data anomaly detection, enhance the overall detection accuracy and reliability, and create a more stable data detection environment, this paper designs a power big data anomaly detection method based on improved support vector machine technology. The abnormal features are extracted in advance, combined with the changes of power data, the multi-target anomaly detection nodes are laid, and on this basis, the improved support vector machine anomaly detection model is constructed. The anomaly detection is realized by combining the normalization processing of the equivalent vector. The final test results show that compared with the traditional clustering algorithm big data anomaly detection test group and the traditional multi-domain feature extraction big data anomaly detection test group, the final false negative rate of the improved support vector machine big data exception detection test group designed in this paper is only 2.04, which shows that the effect of the anomaly detection method is better. It is more accurate and reliable for testing in a complex power environment and has practical application value.

From the past few years cloud services are so popular and are being used by many people from various domains for various purposes such as data storage, e-mails, backing up data and much more. While there were many options to perform such things why did people choose cloud? The answer is clouds are more flexible, convenient, reliable and efficient. Coming to security of data over cloud, it is secure to store data over cloud rather than storing data locally as there is chance of some computer breakdown or any natural disaster may also occur. There are also many threats for data security over cloud namely data breaching, lack of access-key management and much more. As the data has been processed and being stored online for various purposes, there is a clear requirement for data security. Many organizations face various challenges while storing their data over cloud such as data leakages, account hijacking, insufficient credentials and so on. So to overcome these challenges and safeguard the data, various encryption techniques were implemented. However, even though encryption is used, the data still needs to be decrypted in order to do any type of operation. As a result, we must choose a manner in which the data can be analyzed, searched for, or used in any other way without needing to be decoded. So, the objective is to introduce a technique that goes right for the above conditions mentioned and for data security over cloud.

Vulnerability assessment is an important process for network security. However, most commonly used vulnerability assessment methods still rely on expert experience or rule-based automated scripts, which are difficult to meet the security requirements of increasingly complex network environment. In recent years, although scientists and engineers have made great progress on artificial intelligence in both theory and practice, it is a challenging to manufacture a mature high-quality intelligent products in the field of network security, especially in penetration testing based vulnerability assessment for enterprises. Therefore, in order to realize the intelligent penetration testing, Vul.AI with its rich experience in cyber attack and defense for many years has designed and developed a set of intelligent penetration and attack simulation system Ai.Scan, which is based on attack chain, knowledge graph and related evaluation algorithms. In this paper, the realization principle, main functions and application scenarios of Ai.Scan are introduced in detail.

In the process of compiling the power-cut window period of the power grid equipment maintenance plan, problems such as omission of constraints are prone to occur due to excessive reliance on manual experience. In response to these problems, this paper proposes a method for mining key features of the power-cut window based on grey relational analysis. Through mining and analysis of the historical operation data of the power grid, the operation data of new energy, and the historical power-cut information of equipment, the indicators that play a key role in the arrangement of the outage window period of the equipment maintenance plan are found. Then use the key indicator information to formulate the window period. By mining the relationship between power grid operation data and equipment power outages, this paper can give full play to the big data advantages of the power grid, improve the accuracy and efficiency of the power-cut window period.

With the dramatic increase in malicious software, the sophistication and innovation of malware have increased over the years. In particular, the dynamic analysis based on the deep neural network has shown high accuracy in malware detection. However, most of the existing methods only employ the raw API sequence feature, which cannot accurately reflect the actual behavior of malicious programs in detail. The relationship between API calls is critical for detecting suspicious behavior. Therefore, this paper proposes a malware detection method based on the graph neural network. We first connect the API sequences executed by different processes to build a directed process graph. Then, we apply Bert to encode the API sequences of each process into node embedding, which facilitates the semantic execution information inside the processes. Finally, we employ GCN to mine the deep semantic information based on the directed process graph and node embedding. In addition to presenting the design, we have implemented and evaluated our method on 10,000 malware and 10,000 benign software datasets. The results show that the precision and recall of our detection model reach 97.84% and 97.83%, verifying the effectiveness of our proposed method.

Mortality from lung cancer has ranked high among cancers for many years. Early detection of lung cancer is critical for disease prevention, cure, and mortality rate reduction. Many existing detection methods on lung nodules can achieve high sensitivity but meanwhile introduce an excessive number of false-positive proposals, which is clinically unpractical. In this paper, we propose the multi-head detection and spatial attention network, shortly MHSnet, to address this crucial false-positive issue. Specifically, we first introduce multi-head detectors and skip connections to capture multi-scale features so as to customize for the variety of nodules in sizes, shapes, and types. Then, inspired by how experienced clinicians screen CT images, we implemented a spatial attention module to enable the network to focus on different regions, which can successfully distinguish nodules from noisy tissues. Finally, we designed a lightweight but effective false-positive reduction module to cut down the number of false-positive proposals, without any constraints on the front network. Compared with the state-of-the-art models, our extensive experimental results show the superiority of this MHSnet not only in the average FROC but also in the false discovery rate (2.64% improvement for the average FROC, 6.39% decrease for the false discovery rate). The false-positive reduction module takes a further step to decrease the false discovery rate by 14.29%, indicating its very promising utility of reducing distracted proposals for the downstream tasks relied on detection results.

Since the cyber and physical layers in the distribution system are deeply integrated, the traditional distribution system has gradually developed into the cyber-physical distribution system (CPDS), and the failures of the cyber layer will affect the reliable and safe operation of the whole distribution system. Therefore, this paper proposes an CPDS planning method considering the reliability of the cyber-physical system. First, the reliability evaluation model of CPDS is proposed. Specifically, the functional reliability model of the cyber layer is introduced, based on which the physical equipment reliability model is further investigated. Second, an optimal planning model of CPDS considering cyber-physical random failures is developed, which is solved using the Monte Carlo Simulation technique. The proposed model is tested on the modified IEEE 33-node distribution system, and the results demonstrate the effectiveness of the proposed method.

New malware increasingly adopts novel fileless techniques to evade detection from antivirus programs. Process injection is one of the most popular fileless attack techniques. This technique makes malware more stealthy by writing malicious code into memory space and reusing the name and port of the host process. It is difficult for traditional security software to detect and intercept process injections due to the stealthiness of its behavior. We propose a novel framework called ProcGuard for detecting process injection behaviors. This framework collects sensitive function call information of typical process injection. Then we perform a fine-grained analysis of process injection behavior based on the function call chain characteristics of the program, and we also use the improved RCNN network to enhance API analysis on the tampered memory segments. We combine API analysis with deep learning to determine whether a process injection attack has been executed. We collect a large number of malicious samples with process injection behavior and construct a dataset for evaluating the effectiveness of ProcGuard. The experimental results demonstrate that it achieves an accuracy of 81.58% with a lower false-positive rate compared to other systems. In addition, we also evaluate the detection time and runtime performance loss metrics of ProcGuard, both of which are improved compared to previous detection tools.

In recent years, as an important part of the Internet, web applications have gradually penetrated into life. Now enterprises, units and institutions are using web applications regardless of size. Intrusion detection to effectively identify malicious traffic has become an inevitable requirement for the development of network security technology. In addition, the proportion of deserialization vulnerabilities is increasing. Traditional intrusion detection mostly focuses on the identification of SQL injection, XSS, and command execution, and there are few studies on the identification of deserialization attack traffic. This paper use a method to extracts relevant features from the deserialized traffic or even the obfuscated deserialized traffic by reorganizing the traffic and running the relevant content through simulation, and combines deep learning technology to make judgments to efficiently identify deserialization attacks. Finally, a prototype system was designed to capture related attacks in real-world. The technology can be used in the field of malicious traffic detection and help combat Internet crimes in the future.

CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) is a widely used technology to distinguish real users and automated users such as bots. However, the advance of AI technologies weakens many CAPTCHA tests and can induce security concerns. In this paper, we propose a user-friendly text-based CAPTCHA generation method named Robust Text CAPTCHA (RTC). At the first stage, the foregrounds and backgrounds are constructed with font and background images respectively sampled from font and image libraries, and they are then synthesized into identifiable pseudo adversarial CAPTCHAs. At the second stage, we utilize a highly transferable adversarial attack designed for text CAPTCHAs to better obstruct CAPTCHA solvers. Our experiments cover comprehensive models including shallow models such as KNN, SVM and random forest, as well as various deep neural networks and OCR models. Experiments show that our CAPTCHAs have a failure rate lower than one millionth in general and high usability. They are also robust against various defensive techniques that attackers may employ, including adversarially trained CAPTCHA solvers and solvers trained with collected RTCs using manual annotation. Codes available at https://github.com/RulinShao/RTC.

The Internet of Things devices is rapidly becoming widespread, as are IoT services. Their achievement has not gone unnoticed, as threats as well as attacks towards IoT devices as well as services continue to grow. Cyber attacks are not unique to IoT, however as IoT becomes more ingrained in our lives as well as communities, it is imperative to step up as well as take cyber defense seriously. As a result, there is a genuine need to protect IoT, which necessitates a thorough understanding of the dangers and attacks against IoT infrastructure. The purpose of this study is to define threat types, as well as to assess and characterize intrusions and assaults against IoT devices as well as services