Biblio

Attack graph is an effective way to analyze the vulnerabilities for industrial control networks. We develop a vulnerability correlation method and a practical visualization technology for industrial control network. First of all, we give a complete attack graph analysis for industrial control network, which focuses on network model and vulnerability context. Particularly, a practical attack graph algorithm is proposed, including preparing environments and vulnerability classification and correlation. Finally, we implement a three-dimensional interactive attack graph visualization tool. The experimental results show validation and verification of the proposed method.

Modern verifiers for cryptographic protocols can analyze sophisticated designs automatically, but require the entire code of the protocol to operate. Compositional techniques, by contrast, allow us to verify each system component separately, against its own guarantees and assumptions about other components and the environment. Compositionality helps protocol design because it explains how the design can evolve and when it can run safely along other protocols and programs. For example, it might say that it is safe to add some functionality to a server without having to patch the client. Unfortunately, while compositional frameworks for protocol verification do exist, they require non-trivial human effort to identify specifications for the components of the system, thus hindering their adoption. To address these shortcomings, we investigate techniques for automated, compositional analysis of authentication protocols, using automata-learning techniques to synthesize assumptions for protocol components. We report preliminary results on the Needham-Schroeder-Lowe protocol, where our synthesized assumption was capable of lowering verification time while also allowing us to verify protocol variants compositionally.

In isolated network domains, global trustworthiness (e.g., consistent network view) is critical to the multiple-domain business partners who aim to perform the trusted corporations depending on each isolated network view. However, to achieve such global trustworthiness across distributed network domains is a challenge. This is because when multiple-domain partners are required to exchange their local domain views with each other, it is difficult to ensure the data trustworthiness among them. In addition, the isolated domain view in each partner is prone to be destroyed by malicious falsification attacks. To this end, we propose a blockchain-based approach that can ensure the trustworthiness among multiple-party domains. In this paper, we mainly present the design and implementation of the proposed trustworthiness-protection system. A cloud-based prototype and a local testbed are developed based on Ethereum. Finally, experimental results demonstrate the effectiveness of the proposed prototype and testbed.

With the increasing attention to ocean and the development of data-intensive sciences, a large amount of ocean data has been acquired by various observing platforms and sensors, which poses new challenges to data management and utilization. Typically, nowadays we target to move ocean data management toward the FAIR principles of being findable, accessible, interoperable, and reusable. However, the data produced and managed by different organizations with wide diversity, various structures and increasing volume make it hard to be FAIR, and one of the most critical reason is the lack of unified data representation and publication methods. In this paper, we propose novel techniques to try to solve the problem by introducing semantics with ontologies. Specifically, we first propose a unified semantic model named OEDO to represent ocean data by defining the concepts of ocean observing field, specifying the relations between the concepts, and describing the properties with ocean metadata. Then, we further optimize the state-of-the-art quick service query list (QSQL) data structure, by extending the domain concepts with WordNet to improve data discovery. Moreover, based on the OEDO model and the optimized QSQL, we propose an ocean data service publishing method called DOLP to improve data discovery and data access. Finally, we conduct extensive experiments to demonstrate the effectiveness and efficiency of our proposals.

This paper describes our design and implementation of a covert channel over LoRa physical layer (PHY). LoRa adopts a unique modulation scheme (chirp spread spectrum (CSS)) to enable long range communication at low-power consumption. CSS uses the initial frequencies of LoRa chirps to differentiate LoRa symbols, while simply ignoring other RF parameters (e.g., amplitude and phase). Our study reveals that the LoRa physical layer leaves sufficient room to build a covert channel by embedding covert information with a modulation scheme orthogonal to CSS. To demonstrate the feasibility of building a covert channel, we implement CloakLoRa. CloakLoRa embeds covert information into a regular LoRa packet by modulating the amplitudes of LoRa chirps while keeping the frequency intact. As amplitude modulation is orthogonal to CSS, a regular LoRa node receives the LoRa packet as if no secret information is embedded into the packet. Such an embedding method is transparent to all security mechanisms at upper layers in current LoRaWAN. As such, an attacker can create an amplitude modulated covert channel over LoRa without being detected by current LoRaWAN security mechanism. We conduct comprehensive evaluations with COTS LoRa nodes and receive-only software defined radios and experiment results show that CloakLoRa can send covert information over 250m.

The opioid abuse epidemic represents a major public health threat to global populations. The role social media may play in facilitating illicit drug trade is largely unknown due to limited research. However, it is known that social media use among adults in the US is widespread, there is vast capability for online promotion of illegal drugs with delayed or limited deterrence of such messaging, and further, general commercial sale applications provide safeguards for transactions; however, they do not discriminate between legal and illegal sale transactions. These characteristics of the social media environment present challenges to surveillance which is needed for advancing knowledge of online drug markets and the role they play in the drug abuse and overdose deaths. In this paper, we present a computational framework developed to automatically detect illicit drug ads and communities of vendors.The SVM- and CNNbased methods for detecting illicit drug ads, and a matrix factorization based method for discovering overlapping communities have been extensively validated on the large dataset collected from Google+, Flickr and Tumblr. Pilot test results demonstrate that our computational methods can effectively identify illicit drug ads and detect vendor-community with accuracy. These methods hold promise to advance scientific knowledge surrounding the role social media may play in perpetuating the drug abuse epidemic.

Strong physical unclonable function (PUF) is a promising lightweight hardware security primitive for device authentication. However, it is vulnerable to machine learning attacks. This paper demonstrates that even a recently proposed dual-mode PUF is still can be broken. In order to improve the security, this paper proposes a highly flexible machine learning resistant configurable tristate (CT) PUF which utilizes the response generated in the working state of Arbiter PUF to XOR the challenge input and response output of other two working states (ring oscillator (RO) PUF and bitable ring (BR) PUF). The proposed CT PUF is implemented on Xilinx Artix-7 FPGAs and the experiment results show that the modeling accuracy of logistic regression and artificial neural network is reduced to the mid-50%.

In modern grid systems which is a typical cyber-physical System (CPS), information space and physical space are closely related. Once the communication link is interrupted, it will make a great damage to the power system. If the service path is too concentrated, the risk will be greatly increased. In order to solve this problem, this paper constructs a route planning algorithm that combines node load pressure, link load balance and service delay risk. At present, the existing intelligent algorithms are easy to fall into the local optimal value, so we chooses the deep reinforcement learning algorithm (DRL). Firstly, we build a risk assessment model. The node risk assessment index is established by using the node load pressure, and then the link risk assessment index is established by using the average service communication delay and link balance degree. The route planning problem is then solved by a route planning algorithm based on DRL. Finally, experiments are carried out in a simulation scenario of a power grid system. The results show that our method can find a lower risk path than the original Dijkstra algorithm and the Constraint-Dijkstra algorithm.

Due to the popularity of Windows system, BitLocker is widely used as a built-in disk encryption tool. As a commercial application, the design of BitLocker has to consider a capability of disaster recovery, which helps a user to recover data stored on encrypted disk when a regular access is not available. In this case, it will inevitably lead to some security risks when using BitLocker. We have a deep exploration of BitLocker encryption mechanism in this paper. We present the decryption method of encrypted VMK in case of system partition encryption and non-system partition encryption, respectively. VMK is the core key in BitLocker, with which the encrypted partition or the entire disk can be further decrypted. As for security analysis on BitLocker, we firstly make a difficulty analysis of brute force cracking on BitLocker keys, and then we analyze a possible threat caused by key theft. Based on this, we propose a few countermeasures about BitLocker usage. Additionally, we give some suggestions about security enhancement of BitLocker encryption.

This letter presents a novel median filtering forensics approach, based on a convolutional neural network (CNN) with an adaptive filtering layer (AFL), which is built in the discrete cosine transform (DCT) domain. Using the proposed AFL, the CNN can determine the main frequency range closely related with the operational traces. Then, to automatically learn the multi-scale manipulation features, a multi-scale convolutional block is developed, exploring a new multi-scale feature fusion strategy based on the maxout function. The resultant features are further processed by a convolutional stream with pooling and batch normalization operations, and finally fed into the classification layer with the Softmax function. Experimental results show that our proposed approach is able to accurately detect the median filtering manipulation and outperforms the state-of-the-art schemes, especially in the scenarios of low image resolution and serious compression loss.

Smart grid is the key infrastructure of the country, and its network security is an important link to ensure the national important infrastructure security. SOC as a secure operation mechanism for adaptive and continuous improvement of information security, it is practically significant to address the challenge to the network security of the smart grid. Based on the analysis of the technical characteristics and security of smart grid, and taking a grid enterprise smart grid as an example, we propose the design scheme and implementation plan of smart grid SOC platform. Experimental results show that the platform we designed can meet the performance requirements, it also meets the requirements of real-time storage of behavioral data and provides support for interactive analysis and batch analysis.

To solve the problem of poor security and performance caused by traditional encryption algorithm in the cloud data storage of power bidding system, we proposes a hybrid encryption method based on symmetric encryption and asymmetric encryption. In this method, firstly, the plaintext upload file is divided into several blocks according to the proportion, then the large file block is encrypted by symmetrical encryption algorithm AES to ensure the encryption performance, and then the small file block and AES key are encrypted by asymmetric encryption algorithm ECC to ensure the file encryption strength and the security of key transmission. Finally, the ciphertext file is generated and stored in the cloud storage environment to prevent sensitive files Pieces from being stolen and destroyed. The experimental results show that the hybrid encryption method can improve the anti-attack ability of cloud storage files, ensure the security of file storage, and have high efficiency of file upload and download.

Home automation is an intelligent, functional as a unit system that facilitates home processes without unnecessarily complicating the user's life. Devices can be connected, which in turn connect and talk through a centralized control unit, which are accessible via mobile phones. These devices include lights, appliances, security systems, alarms and many other sensors and devices. This paper presents the design and implementation of a Bluetooth based smart home automation system which uses a Peripheral interface controller (PIC) microcontroller (16F1937) as the main processer and the appliances are connected to the peripheral ports of the microcontroller via relays. The circuit in the project was designed in Diptrace software. The PCB layout design was completed. The fully functional smart home prototype was built and demonstrated to functional.

The current network security situation of the electric power dispatching and control system is becoming more and more severe. On the basis of the original network security management platform, to increase the collection of network security data information and improve the network security analysis ability, this article proposes the electric power dispatching and control system network security situation awareness analysis module. The perception layer accesses multi-source heterogeneous data sources. Upwards through the top layer, data standardization will be introduced, who realizes data support for security situation analysis, and forms an association mapping with situation awareness elements such as health situation, attack situation, behavior situation, and operation situation. The overall effect is achieving the construction goals of "full control of equipment status, source of security attacks can be traced, operational risks are identifiable, and abnormal behaviors can be found.".

The strength of the substitution box (S-box) determines the security of the cryptographic algorithm because it's the only nonlinear component in the block cipher. Because of the disadvantages of non-uniformity sequence and limited range in the one-dimension (1D) chaotic map, this paper constructs the logistic map and the sine map into a combined chaotic map, and a new S-box construction method based on this combined chaotic map is presented. Performance tests were performed on the S-box, including nonlinearity, linear probability, differential probability, strict avalanche criterion, bits independence criterion. Compared with others S-box, this result indicates that the S-box has more excellent cryptographic performance and can be used as a nonlinear component in the lightweight block cipher algorithm.

This paper studies the security issue of a gossip-based distributed projected gradient (DPG) algorithm, when it is applied for solving a decentralized multi-agent optimization. It is known that the gossip-based DPG algorithm is vulnerable to insider attacks because each agent locally estimates its (sub)gradient without any supervision. This work leverages the convolutional neural network (CNN) to perform the detection and localization of the insider attackers. Compared to the previous work, CNN can learn appropriate decision functions from the original state information without preprocessing through artificially designed rules, thereby alleviating the dependence on complex pre-designed models. Simulation results demonstrate that the proposed CNN-based approach can effectively improve the performance of detecting and localizing malicious agents, as compared with the conventional pre-designed score-based model.

Mobile antivirus technologies incorporate static analysis which involves the analysis of programs without its execution. This process relies on pattern matching against a signature repository to identify malware, which can be easily tricked by transformation techniques such as obfuscation. Obfuscation as an evasion technique renders character strings disguised and incomprehensive, to prevent tampering and reengineering, which poses to be a valuable technique malware developers adopt to evade detection. This paper attempts to study the detection efficiency of static analyzers against obfuscated Android malware. This study is the first step in a larger project attempting to improve the efficiency of malware detectors.

In this paper, our aim is to detect illegal spectrum access behaviors. Firstly, we detect whether the channel is busy, and then if it is busy, recognizing whether there are illegal users. To get closer to the actual situation, we consider a more general scenario where multiple users are authorized to work on the same channel under certain interference control strategies, and build it as a ternary hypothesis test model using the generalized multi-hypothesis Neyman-Pearson criterion. Considering the various potential combination of multiple authorized users, the spectrum detection process utilizes a two-step detector. We adopt the Generalized Likelihood Ratio Test (GLRT) and the Rao test to detect illegal spectrum access behaviors. What is more, the Wald test is proposed which has a compromise between computational complexity and performance. The relevant formulas of the three detection schemes are derived. Finally, comprehensive and in-depth simulations are provided to verify the effectiveness of the proposed detection scheme that it has the best detection performance under different authorized sample numbers and different performance constraints. Besides, we illustrate the probability of detection of illegal behaviors under different parameters of illegal behaviors and different sets of AUs' states under the Wald test.

This project addresses a classic employment law question in Canada and elsewhere using machine learning approach: how do we know whether a worker is an employee or an independent contractor? This is a central issue for self-represented litigants insofar as these two legal categories entail very different rights and employment protections. In this interdisciplinary research study, we collaborated with the Conflict Analytics Lab to develop machine learning models aimed at determining whether a worker is an employee or an independent contractor. We present a number of supervised learning models including a neural network model that we implemented using data labeled by law researchers and compared the accuracy of the models. Our neural network model achieved an accuracy rate of 91.5%. A critical discussion follows to identify the key features in the data that influence the accuracy of our models and provide insights about the case outcomes.

In this paper, we propose a novel method to obtain the damage model (connectivity) of a power distribution system (PDS) based on distributed consensus algorithm. The measurement and sensing units in the distribution network are modeled as an agent with limited communication capability that exchanges the information (switch status) to reach an agreement in a consensus algorithm. Besides, a communication graph is designed for agents to run the consensus algorithm which is efficient and robust during the disaster event. Agents can dynamically communicate with the other agent based on available links that are established and solve the distributed consensus algorithm quickly to come up with the correct topology of PDS. Numerical simulations are performed to demonstrate the effectiveness of the proposed approach with the help of an IEEE 123-node test case with 3 different sub-graphs.

Software Defined Network (SDN) is a new type of network architecture solution, and its innovation lies in decoupling traditional network system into a control plane, a data plane, and an application plane. It logically implements centralized control and management of the network, and SDN is considered to represent the development trend of the network in the future. However, SDN still faces many security challenges. Currently, the number of insecure devices is huge. Distributed Denial of Service (DDoS) attacks are one of the major network security threats.This paper focuses on the detection and mitigation of DDoS attacks in SDN. Firstly, we explore a solution to detect DDoS using Renyi entropy, and we use exponentially weighted moving average algorithm to set a dynamic threshold to adapt to changes of the network. Second, to mitigate this threat, we analyze the historical behavior of each source IP address and score it to determine the malicious source IP address, and use OpenFlow protocol to block attack source.The experimental results show that the scheme studied in this paper can effectively detect and mitigate DDoS attacks.

This paper analyzes the vulnerability in the process of key negotiation between the main mode and aggressive mode of IKEv1 protocol in IPSec VPN, and proposes a DOS attack method based on OSPF protocol adjacent route spoofing. The experiment verifies the insecurity of IPSec VPN using IKEv1 protocol. This attack method has the advantages of lower cost and easier operation compared with using botnet.

In-Band Full-Duplex (IBFD) Underwater Acoustic (UWA) communication technology plays a major role in enhancing the performance of Underwater acoustic sensor networks (UWSN). Self-Interference (SI) is one of the main inherent challenges affecting the performance of IBFD UWA communication. To reconstruct the SI signal and counteract the SI effect, this is important to estimate the short range channel through which the SI signal passes. Inaccurate estimation will result in the performance degradation of IBFD UWA communication. From the perspective of engineering implementation, we consider that the UWA communication modem shell has a significant influence on the short-range SI channel, which will limit the efficiency of self-interference cancellation in the analog domain to some degree. Therefore we utilize a simplified model to simulate the influence of the structure of the IBFD UWA communication modem on the receiving end. This paper studies the effect of acoustic-shell coupling on near-end self-interference signal of IBFD UWA communication modem. Some suggestions on the design of shell structure of IBFD UWA communication modem are given.

Nanosize multiferroic La-doped YFeO3 powders are harvested via a low-temperature solid-state reaction method. X-ray diffraction (XRD), scanning electron microscopy (SEM) and Raman spectra analysis reveal that with La addition, YFeO3 powders are successfully fabricated at a lower temperature with the size below 60 nm, and a refined structure is obtained. Magnetic hysteresis loop illustrates ferromagnetic behavior of YFeO3 nano particles can be enhanced with La addition. The maximum and remnant magnetization of the powders are about 4.03 and 1.22 emu/g, respectively. It is shown that the optical band gap is around 2.25 eV, proving that La doped YFeO3 nano particles can strongly absorb visible light. Both magnetic and optical properties are greatly enhanced with La addition, proving its potential application in magnetic and optical field.

In recent years, IPv6 and its application are more and more widely deployed. Most network devices support and open IPv6 protocol stack. The security of IPv6 network is also concerned. In the IPv6 network security technology, address scanning is a key and difficult point. This paper presents a TGAs-based IPv6 address scanning method. It takes the known alive IPv6 addresses as input, and then utilizes the information entropy and clustering technology to mine the distribution law of seed addresses. Then, the final optimized target address set can be obtained by expanding from the seed address set according to the distribution law. Experimental results show that it can effectively improve the efficiency of IPv6 address scanning.