Biblio

With the rapid development of networks, cyberspace security is facing increasingly severe challenges. Traditional alert aggregation process and alert correlation analysis process are susceptible to a large amount of redundancy and false alerts. To tackle the challenge, this paper proposes a network security situational awareness model KG-NSSA (Knowledge-Graph-based NSSA) based on knowledge graphs. This model provides an asset-based network security knowledge graph construction scheme. Based on the network security knowledge graph, a solution is provided for the classic problem in the field of network security situational awareness - network attack scenario discovery. The asset-based network security knowledge graph combines the asset information of the monitored network and fully considers the monitoring of network traffic. The attack scenario discovery according to the KG-NSSA model is to complete attack discovery and attack association through attribute graph mining and similarity calculation, which can effectively reflect specific network attack behaviors and mining attack scenarios. The effectiveness of the proposed method is verified on the MIT DARPA2000 data set. Our work provides a new approach for network security situational awareness.

As the application of Internet of Things technology becomes more common, the security problems derived from it became more and more serious. Different from the traditional Internet, the security of the Internet of Things presented new features. This paper introduced the current situation of Internet of Things security, generalized the definitions of situation awareness and network security situation awareness, and finally discussed the methods of establishing security situational awareness of Internet of Things which provided some tentative solutions to the new DDoS attack caused by Internet of Things terminals.

In recent years, we have faced a series of online threats. The continuous malicious attacks on the network have directly caused a huge threat to the user's spirit and property. In order to deal with the complex security situation in today's network environment, an intelligent network situational awareness model based on deep neural networks is proposed. Use the nonlinear characteristics of the deep neural network to solve the nonlinear fitting problem, establish a network security situation assessment system, take the situation indicators output by the situation assessment system as a guide, and collect on the main data features according to the characteristics of the network attack method, the main data features are collected and the data is preprocessed. This model designs and trains a 4-layer neural network model, and then use the trained deep neural network model to understand and analyze the network situation data, so as to build the network situation perception model based on deep neural network. The deep neural network situational awareness model designed in this paper is used as a network situational awareness simulation attack prediction experiment. At the same time, it is compared with the perception model using gray theory and Support Vector Machine(SVM). The experiments show that this model can make perception according to the changes of state characteristics of network situation data, establish understanding through learning, and finally achieve accurate prediction of network attacks. Through comparison experiments, datatypized neural network deep neural network situation perception model is proved to be effective, accurate and superior.

Analyzing the DNS traffic of Internet hosts has been a successful technique to counter cyberattacks and identify connections to malicious domains. However, recent stealthy attacks hide malicious activities within seemingly legitimate connections to popular web services made by benign programs. Traditional DNS monitoring and signature-based detection techniques are ineffective against such attacks. To tackle this challenge, we present a new program-level approach that can effectively detect such stealthy attacks. Our method builds a fine-grained Program-DNS profile for each benign program that characterizes what should be the “expected” DNS behavior. We find that malware-injected processes have DNS activities which significantly deviate from the Program-DNS profile of the benign program. We then develop six novel features based on the Program-DNS profile, and evaluate the features on a dataset of over 130 million DNS requests collected from a real-world enterprise and 8 million requests from malware-samples executed in a sandbox environment. We compare our detection results with that of previously-proposed features and demonstrate that our new features successfully detect 190 malware-injected processes which fail to be detected by previously-proposed features. Overall, our study demonstrates that fine-grained Program-DNS profiles can provide meaningful and effective features in building detectors for attack campaigns that bypass existing detection systems.

In order to solve the problem of accurate positioning of mixed reality virtual scene in physical space, this paper, firstly, analyzes the positioning principle of mixed reality virtual scene. Secondly, based on the comparison among the three developer kits: ARToolKit, ARTag, and Vuforia and two image optimization algorithms: AHE and ACE, it makes sure to use Vuforia development tool to complete the signature-based tracking and registration task, and use ACE algorithm to optimize the signature-based image. It improves the efficiency, stability and accuracy of image recognition registration. Then the multi-target recognition and registration technology is used to realize the multi-location of virtual scene. Finally, Hololens glasses are used as the hardware carrier to verify the above method. The experimental results show that the above method not only realizes the precise location of MR virtual scene based on image recognition, but also ensures the absolute position of the virtual model in the real space, bringing users a more real virtual experience. Keywords-mixed reality, multi-person collaboration, virtual positioning, gesture interaction.

Surface acoustic wave devices based on LiNbO3/interlayer/substrate layered structure have attracted great attention due to the high electromechanical coupling coefficient (K2) of LiNbO3 and the energy confinement effect of the layered structure. In this study, 30° YX-LiNbO3 (LN)/SiO2/Si multilayered structure, which can excited shear-horizontal surface acoustic wave (SH-SAW) with high K2, was proposed. The optimized orientation of LiNbO3 was verified by the effective permittivity method based on the stiffness matrix. The phase velocity, K2 value, and temperature coefficient of frequency (TCF) of the SH-SAW were calculated as a function of the LiNbO3 thickness at different thicknesses of the SiO2 in 30° YX-LiNbO3/SiO2/Si multilayer structure by finite element method (FEM). The results show that the optimized LiNbO3 thickness is 0.1 and the optimized SiO2 thickness is 0.2λ. The optimized Al electrode thickness and metallization ratio are 0.07 and 0.4, respectively. The K2 of the SH-SAW is 29.89%, the corresponding phase velocity is 3624.00 m/s and TCF is about 10 ppm/°C with the optimized IDT/30° YX-LiNbO3/SiO2/Si layered structure.

The reform of electricity marketization has bred multiple market agents. In order to maximize the total social benefits on the premise of ensuring the security of the system and taking into account the interests of multiple market agents, a bi-level optimal allocation model of distribution network with multiple agents participating is proposed. The upper level model considers the economic benefits of energy and service providers, which are mainly distributed power investors, energy storage operators and distribution companies. The lower level model considers end-user side economy and actively responds to demand management to ensure the highest user satisfaction. The K-means multi scenario analysis method is used to describe the time series characteristics of wind power, photovoltaic power and load. The particle swarm optimization (PSO) algorithm is used to solve the bi-level model, and IEEE33 node system is used to verify that the model can effectively consider the interests of multiple agents while ensuring the security of the system.

Although quite a few results on resilient consensus of multi-agent systems with malicious agents and fixed topology have been reported in the literature, we lack any known results on such a problem for multi-agent systems with time-varying topologies. Herein, we study the resilient consensus problem of time-varying networked systems in the presence of misbehaving nodes. A novel concept of joint ( r, s) -robustness is firstly proposed to characterize the robustness of the time-varying topologies. It is further revealed that the resilient consensus of multi-agent systems under F-total malicious network can be reached by the Weighted Mean-Subsequence-Reduced algorithm if and only if the time-varying graph is jointly ( F+1, F+1) -robust. Numerical simulations are finally performed to verify the effectiveness of the analytical results.

Opportunistic routing (OR) is gaining popularity in low-duty wireless sensor network (WSN), so the need for efficient and reliable data transmission is becoming more essential. Reliable transmission is only feasible if the routing protocols are secure and efficient. Due to high energy consumption, current cryptographic schemes for WSN are not suitable. Trust-based OR will ensure security and reliability with fewer resources and minimum energy consumption. OR selects the set of potential candidates for each sensor node using a prioritized metric by load balancing among the nodes. This paper introduces a trust-based load-balanced OR for duty-cycled wireless sensor networks. The candidates are prioritized on the basis of a trusted OR metric that is divided into two parts. First, the OR metric is based on the average of four probability distributions: the distance from node to sink distribution, the expected number of hops distribution, the node degree distribution, and the residual energy distribution. Second, the trust metric is based on the average of two probability distributions: the direct trust distribution and the recommended trust distribution. Finally, the trusted OR metric is calculated by multiplying the average of two metrics distributions in order to direct more traffic through the higher priority nodes. The simulation results show that our proposed protocol provides a significant improvement in the performance of the network compared to the benchmarks in terms of energy consumption, end to end delay, throughput, and packet delivery ratio.

Flow correlation can identify attackers who use anonymous networks or stepping stones. The current flow correlation scheme based on watermark can effectively trace the network traffic. But it is difficult to balance robustness and invisibility. This paper presents an innovative flow correlation scheme that guarantees invisibility. First, the scheme generates a two-dimensional feature matrix by segmenting the network flow. Then, features of frequency and time are extracted from the matrix and mapped into perceptual hash sequences. Finally, by comparing the hash sequence similarity to correlate the network flow, the scheme reduces the complexity of the correlation while ensuring the accuracy of the flow correlation. Experimental results show that our scheme is robust to jitter, packet insertion and loss.

Carrier-aided code tracking loop is widely used in satellite navigation receivers. This kind of loop structure can reduce code tracking noise by narrowing the bandwidth of code tracking loop. The performance of carrier-aided code tracking loop in receivers is affected by frequency deviation of reference clock source. This paper analyzes the influence of carrier frequency offset and sampling frequency offset on carrier-aided code tracking loop due to reference clock offset. The results show that large frequency offset can cause code tracking loop lose lock, code tracking loop is more sensitive to sampling frequency deviation and increasing the loop bandwidth can reduce the effects of frequency offset. This analysis provides reference for receiver tracking loop design.

The continuous change of communication frequency brings difficulties to the reconnaissance and prediction of non-cooperative communication. The core of this communication process is the frequency-hopping (FH) sequence with pseudo-random characteristics, which controls carrier frequency hopping. However, FH sequence is always generated by a certain model and is a kind of time sequence with certain regularity. Long Short-Term Memory (LSTM) neural network in deep learning has been proved to have strong ability to solve time series problems. Therefore, in this paper, we establish LSTM model to implement FH sequence prediction. The simulation results show that LSTM-based scheme can effectively predict frequency point by point based on historical HF frequency data. Further, we achieve frequency interval prediction based on frequency point prediction.

Over recent years, we have seen a significant rise in popularity of autonomous vehicle. Several researches have shown the severity of security threats that autonomous vehicles face -for example, Miller and Valasek (2015) were able to remotely take complete control over a 2014 Jeep Cherokee in a so called "Jeephack" [1]. This paper analyses the threats that the Electrical and Electronic (E/E) architecture of an autonomous vehicle has to face and rank those threats by severity. To achieve this, the Microsoft's STRIDE threat analysis technique was applied and 13 threats were identified. These are sorted by their Common Vulnerability Scoring System (CVSS) scores. Potential mitigation methods are then suggested for the five topmost severe threats.

Machine learning (ML) models are now a key component for many applications. However, machine learning based systems (MLBSs), those systems that incorporate them, have proven vulnerable to various new attacks as a result. Currently, there exists no systematic process for eliciting security requirements for MLBSs that incorporates the identification of adversarial machine learning (AML) threats with those of a traditional non-MLBS. In this research study, we explore the applicability of traditional threat modeling and existing attack libraries in addressing MLBS security in the requirements phase. Using an example MLBS, we examined the applicability of 1) DFD and STRIDE in enumerating AML threats; 2) Microsoft SDL AI/ML Bug Bar in ranking the impact of the identified threats; and 3) the Microsoft AML attack library in eliciting threat mitigations to MLBSs. Such a method has the potential to assist team members, even with only domain specific knowledge, to collaboratively mitigate MLBS threats.

Today, the online review system cannot fully support the business since there are fraudulent activities inside. The companies that get low score reviews are induced to raise their score for the market competition capability by paying to the platform for deleting or editing the posted reviews. Moreover, the automatic filtration system of a platform removes some reviews without the awareness of the users. The low transparency platform causes low credibility toward the reviews. Blockchain technology provides exceptionally high transparency since every action can be traced publicly. However, there are some tradeoffs that need to be considered, such as cost and response time. This work tends to find the potential of using Blockchain technology in the online review system by testing four implementation approaches of the Ethereum Smart Contract. The result illustrates that using IPFS to store the data is a practical way of reducing transaction costs. Besides, preventing using Smart Contract states can significantly reduce costs too. The response time for using the Blockchain and IPFS system is slower than the centralized system. However, posting a review does not need a fast response. Thus, it is worthy of trading response time with transparency and cost. In the business view, the review posting with cost causes more difficulty to generate fake reviews. Moreover, there are other advantages over the centralized system, such as the reward system, bogus review voting, and global database. Thus, credibility improvement for a consumer online review system is a potential application of Blockchain technology.

Despite the performance of state-of-the-art Artificial Intelligence (AI) systems, some sectors hesitate to adopt AI because of a lack of trust in these systems. This attitude is prevalent among high-risk areas, where there is a reluctance to remove humans entirely from the loop. In these scenarios, Augmentation provides a preferred alternative over complete Automation. Instead of replacing humans, AI Augmentation uses AI to improve and support human operations, creating an environment where humans work side by side with AI systems. In this paper, we discuss how AI Augmentation can provide a path for building Trustworthy AI. We exemplify this approach using Robot Teleoperation. We lay out design guidelines and motivations for the development of AI Augmentation for Robot Teleoperation. Finally, we discuss the design of a Robot Teleoperation testbed for the development of AI Augmentation systems.

We study the use of Multiform Logical Time, as embodied in Esterel/SyncCharts and Clock Constraint Specification Language (CCSL), for the specification of assume-guarantee constraints providing safe driving rules related to time and space, in the context of Automated Driving Assistance Systems (ADAS). The main novelty lies in the use of logical clocks to represent the epochs of specific area encounters (when particular area trajectories just start overlapping for instance), thereby combining time and space constraints by CCSL to build safe driving rules specification. We propose the safe specification pattern at high-level that provide the required expressiveness for safe driving rules specification. In the pattern, multiform logical time provides the power of parameterization to express safe driving rules, before instantiation in further simulation contexts. We present an efficient way to irregularly update the constraints in the specification due to the context changes, where elements (other cars, road sections, traffic signs) may dynamically enter and exit the scene. In this way, we add constraints for the new elements and remove the constraints related to the disappearing elements rather than rebuild everything. The multi-lane highway scenario is used to illustrate how to irregularly and efficiently update the constraints in the specification while receiving a fresh scene.

In view of the security threats caused by the code execution vulnerability of the industrial control system, design the trusted security architecture of the industrial control system based on the embedded system. From the trusted startup of industrial control equipment, the safety protection for industrial control system is completed. The scheme is based on TPM and Xilinx Zynq-7030 to build an industrial trusted computing environment and complete the trusted startup process. Experiment shows that this method can effectively prevent the destruction of malicious code during the startup process of embedded system and provide technical support for the construction of trusted computing environment of industrial control system.

The security of integrated circuits (IC) plays a very significant role on military, economy, communication and other industries. Due to the globalization of the integrated circuit (IC) from design to manufacturing process, the IC chip is vulnerable to be implanted malicious circuit, which is known as hardware Trojan (HT). When the HT is activated, it will modify the functionality, reduce the reliability of IC, and even leak confidential information about the system and seriously threatens national security. The HT detection theory and method is hotspot in the security of integrated circuit. However, most methods are focusing on the simulated data. Moreover, the measurement data of the real circuit are greatly affected by the measurement noise and process disturbances and few methods are available with small size of the Trojan circuit. In this paper, the problem of detection was cast as signal representation among multiple linear regression and sparse representation-based classifier (SRC) were first applied for Trojan detection. We assume that the training samples from a single class do lie on a subspace, and the test samples can be represented by the single class. The proposed SRC HT detection method on real integrated circuit shows high accuracy and efficiency.

Sometimes a security-critical decision must be made using information provided by peers. Think of routing messages, user reports, sensor data, navigational information, blockchain updates. Attackers manifest as peers that strategically report fake information. Trust models use the provided information, and attempt to suggest the correct decision. A model that appears accurate by empirical evaluation of attacks may still be susceptible to manipulation. For a security-critical decision, it is important to take the entire attack space into account. Therefore, we define the property of robustness: the probability of deciding correctly, regardless of what information attackers provide. We introduce the notion of realisations of honesty, which allow us to bypass reasoning about specific feedback. We present two schemes that are optimally robust under the right assumptions. The “majority-rule” principle is a special case of the other scheme which is more general, named “most plausible realisations”.

OAuth 2.0 is one of the most widely used Internet protocols for authorization/single sign-on (SSO) and is also the foundation of the new SSO protocol OpenID Connect. Due to its complexity and its flexibility, it is difficult to comprehensively analyze the security of the OAuth 2.0 standard, yet it is critical to obtain practical security guarantees for OAuth 2.0. In this paper, we present the first computationally sound security analysis of OAuth 2.0. First, we introduce a new primitive, the three-party authenticated secret distribution (3P-ASD for short) protocol, which plays the role of issuing the secret and captures the token issue process of OAuth 2.0. As far as we know, this is the first attempt to formally abstract the authorization technology into a general primitive and then define its security. Then, we present a sufficiently rich three-party security model for OAuth protocols, covering all kinds of authorization flows, providing reasonably strong security guarantees and moreover capturing various web features. To confirm the soundness of our model, we also identify the known attacks against OAuth 2.0 in the model. Furthermore, we prove that two main modes of OAuth 2.0 can achieve our desired security by abstracting the token issue process into a 3P-ASD protocol. Our analysis is not only modular which can reflect the compositional nature of OAuth 2.0, but also fine-grained which can evaluate how the intermediate parameters affect the final security of OAuth 2.0.

As a general interface for chip system testing and on-chip debugging, JTAG is facing serious security threats. By analyzing the typical JTAG attack model and security protection measures, this paper designs a secure JTAG debugging model based on Schnorr identity authentication protocol, and takes RISCV as an example to build a set of SoC prototype system to complete functional verification. Experiments show that this secure JTAG debugging model has high security, flexible implementation, and good portability. It can meet the JTAG security protection requirements in various application scenarios. The maximum clock frequency can reach 833MHZ, while the hardware overhead is only 47.93KGate.

Within a framework for verifying parametric network protocols through induction, one needs to find invariants based on a protocol instance of a small number of nodes. In this paper, we propose a new approach to accelerate parameterized verification by adopting decision trees to represent the state space of a protocol instance. Such trees can be considered as a knowledge base that summarizes all behaviors of the protocol instance. With this knowledge base, we are able to efficiently construct an oracle to effectively assess candidates of invariants of the protocol, which are suggested by an invariant finder. With the discovered invariants, a formal proof for the correctness of the protocol can be derived in the framework after proper generalization. The effectiveness of our method is demonstrated by experiments with typical benchmarks.

Visually similar characters, or homoglyphs, can be used to perform social engineering attacks or to evade spam and plagiarism detectors. It is thus important to understand the capabilities of an attacker to identify homoglyphs - particularly ones that have not been previously spotted - and leverage them in attacks. We investigate a deep-learning model using embedding learning, transfer learning, and augmentation to determine the visual similarity of characters and thereby identify potential homoglyphs. Our approach uniquely takes advantage of weak labels that arise from the fact that most characters are not homoglyphs. Our model drastically outperforms the Normal-ized Compression Distance approach on pairwise homoglyph identification, for which we achieve an average precision of 0.97. We also present the first attempt at clustering homoglyphs into sets of equivalence classes, which is more efficient than pairwise information for security practitioners to quickly lookup homoglyphs or to normalize confusable string encodings. To measure clustering performance, we propose a metric (mBIOU) building on the classic Intersection-Over-Union (IOU) metric. Our clustering method achieves 0.592 mBIOU, compared to 0.430 for the naive baseline. We also use our model to predict over 8,000 previously unknown homoglyphs, and find good early indications that many of these may be true positives. Source code and list of predicted homoglyphs are uploaded to Github: https://github.com/PerryXDeng/weaponizing\_unicode.

The goal of a decision-based adversarial attack on a trained model is to generate adversarial examples based solely on observing output labels returned by the targeted model. We develop HopSkipJumpAttack, a family of algorithms based on a novel estimate of the gradient direction using binary information at the decision boundary. The proposed family includes both untargeted and targeted attacks optimized for $\mathscrl$ and $\mathscrlınfty$ similarity metrics respectively. Theoretical analysis is provided for the proposed algorithms and the gradient direction estimate. Experiments show HopSkipJumpAttack requires significantly fewer model queries than several state-of-the-art decision-based adversarial attacks. It also achieves competitive performance in attacking several widely-used defense mechanisms.