Biblio

Within the ASIC development process, the phase of functional verification is a major bottleneck that affects the product time to market. A technique that decreases the time cost for reaching functional coverage closure is reducing the stimuli redundancy during the test regressions. This paper addresses such a solution and presents a novel, efficient, and scalable implementation that harnesses the power of artificial neural networks. This article outlines the concept strategy, highlights the framework structure, lists the experimental results, and underlines future research directions.

As we all know, network coding can significantly improve the throughput and reliability of wireless networks. However, in the high-speed mobile environment, the packet loss rate of different wireless links may vary greatly due to the time-varying network state, which makes the adjustment of network coding redundancy very important. Because the network coding redundancy is too large, it will lead to excessive overhead and reduce the effective throughput. If the network coding redundancy is too small, it will lead to insufficient decoding, which will also reduce the effective throughput. In the design of multi-path transmission scheduling scheme, we introduce adaptive redundancy network coding scheme. By using multiple links to aggregate network bandwidth, we choose appropriate different coding redundancy for different links to resist the performance loss caused by link packet loss. The simulation results show that when the link packet loss rate is greatly different, the mechanism can not only ensure the transmission reliability, but also greatly reduce the total network redundancy to improve the network throughput very effectively.

Cyber resiliency in Cloud computing is one of the most important capability of an enterprise network that provides continues ability to withstand and quick recovery from the adversary conditions. This capability can be measured through cybersecurity risk assessment techniques. However, cybersecurity risk management studies in cloud computing resiliency approaches are deficient. This paper proposes resilient cloud cybersecurity risk assessment tailored specifically to Dropbox with two methods: technical-based solution motivated by a cybersecurity risk assessment of cloud services, and a target personnel-based solution guided by cybersecurity-related survey among employees to identify their knowledge that qualifies them withstand to any cyberattack. The proposed work attempts to identify cloud vulnerabilities, assess threats and detect high risk components, to finally propose appropriate safeguards such as failure predicting and removing, redundancy or load balancing techniques for quick recovery and return to pre-attack state if failure happens.

Software Defined Networking (SDN) is an innovative technology, which can be applied in a plethora of applications and areas. Recently, SDN has been identified as one of the most promising solutions for industrial applications as well. The key features of SDN include the decoupling of the control plane from the data plane and the programmability of the network through application development. Researchers are looking at these features in order to enhance the Quality of Service (QoS) provisioning of modern network applications. To this end, the following work presents the development of an SDN application, capable of mitigating attacks and maximizing the network’s QoS, by implementing mixed integer linear programming but also using genetic algorithms. Furthermore, a low-cost, physical SDN testbed was developed in order to evaluate the aforementioned application in a more realistic environment other than only using simulation tools.

Mesh topology networks provide Network security in the form of redundancy of communication links. But redundancy also contributes to complexity in configuration and subsequent troubleshooting. Mesh topology deployed in Critical networks like Backbone Networks (used in Cloud Computing) deploy the Mesh topology provides additional security in terms of redundancy to ensure availability of services. One amongst most prominent attacks is Distributed Denial of Service attacks which cause an immense amount of loss of data as well as monetary losses to service providers. This paper proposes a method by which using SDN capabilities and sFlow-RT application, Distributed Denial of Service (DDoS) attacks is detected and consequently mitigated by using REST API to implement Policy Based Flow Management (PBFM) through the SDN Controller which will help in ensuring uninterrupted services in scenarios of such attacks and also further simply and enhance the management of Mesh architecture-based networks.

We propose an information-theoretical method of attribution of literary texts, developed within the framework of information theory and mathematical statistics. Using the proposed method, the following two problems of disputed authorship in Russian and Soviet literature were investigated: i) the problem of false attribution of some novels to Nekrasov and ii) the problem of dubious attribution of two novels to Bulgakov. The research has shown the high efficiency of the data-compression method for attribution of literary texts.

Cyber-physical systems, which are ubiquitous in modern critical infrastructure, oftentimes rely on sending actuation commands and sensor measurements over a network, subjecting this information to potential man-in-the-middle attacks. These attacks can take the form of denial of service attacks or integrity attacks. Previous approaches at ensuring the resiliency of the overall control system against these types of attacks have leveraged functional redundancy in the system, including resilient estimation and reconfigurable control. However, these approaches are only able to ensure resiliency up to a particular subset of the actuator commands and sensor measurements being compromised. In contrast, we introduce a resiliency mechanism in this paper that can ensure safety for the overall system when all the actuator commands and sensor measurements are compromised. In addition, this approach does not require the implementation of any detection algorithm. We leverage communication redundancy in the number of pathways across the network to guarantee safety when up to a certain percentage of those pathways are compromised. The conditions under which safety is guaranteed are presented along with the resiliency mechanism itself, and our results are illustrated via simulation.

With the rapid development of networks, cyberspace security is facing increasingly severe challenges. Traditional alert aggregation process and alert correlation analysis process are susceptible to a large amount of redundancy and false alerts. To tackle the challenge, this paper proposes a network security situational awareness model KG-NSSA (Knowledge-Graph-based NSSA) based on knowledge graphs. This model provides an asset-based network security knowledge graph construction scheme. Based on the network security knowledge graph, a solution is provided for the classic problem in the field of network security situational awareness - network attack scenario discovery. The asset-based network security knowledge graph combines the asset information of the monitored network and fully considers the monitoring of network traffic. The attack scenario discovery according to the KG-NSSA model is to complete attack discovery and attack association through attribute graph mining and similarity calculation, which can effectively reflect specific network attack behaviors and mining attack scenarios. The effectiveness of the proposed method is verified on the MIT DARPA2000 data set. Our work provides a new approach for network security situational awareness.

To achieve a substantial reliability and safety level, it is imperative to provide electronic computing systems with appropriate mechanisms to tackle soft errors. This paper proposes a low-cost system-level soft error mitigation technique, which allocates the critical application function to a pool of specific general-purpose processor registers. Both the critical function and the register pool are automatically selected by a developed profiling tool. The proposed technique was validated through more than 320K fault injections considering a Linux kernel, different benchmarks and two multicore ARM processors. Results show that our technique significantly reduces the code size and performance overheads while providing reliability improvement, w.r.t. the Triple Modular Redundancy (TMR) technique.

The paper is devoted to the development and research of the redundancy cyber resiliency technique based on fast rerouting under security metric with the implementation of the basic schemes for network elements protection, namely node, link, path, and bandwidth. Within the model, the secure fast rerouting task is formulated as an optimization problem of nonlinear programming. The model is configured in order to calculate primary and backup paths that contain links with the minimum values of the probability of compromise that is achieved by using the appropriate weights in the objective function, the value of which is minimized. Numerical research has been conducted, results of which proved the proposed model efficiency and adequacy for the practical application.

Trustworthy and secure operation of the cyber-power system calls for resilience against malicious and accidental failures. The objective of a resilient system is to withstand and recover operation of the system to supply critical loads despite multiple contingencies in the system. To take timely actions, we need to continuously measure the cyberphysical security of the system. We propose a cyber-physical security assessment metric (CP-SAM) based on quantitative factors affecting resiliency and utilizing concepts from graph theoretic analysis, probabilistic model of availability, attack graph metrics, and vulnerabilities across different layers of the microgrid system. These factors are integrated into a single metric using a multi-criteria decision making (MCDM) technique, Choquet Integral to compute CP-SAM. The developed metric will be valuable for i) monitoring the microgrid resiliency considering a holistic cyber-physical model; and ii) enable better decision-making to select best possible mitigation strategies towards resilient microgrid system. Developed CP-SAM can be extended for active distribution system and has been validated in a real-world power-grid test-bed to monitor the microgrid resiliency.

The ever-increasing growth of urban populations coupled with recent mobile data usage trends has led to an unprecedented increase in wireless devices, services and applications, with varying quality of service needs in terms of latency, data rate, and connectivity. To cope with these rising demands and challenges, next-generation wireless networks have resorted to cloud radio access network (Cloud-RAN) technology as a way of reducing latency and network traffic. A concrete example of this is New York City's LinkNYC network infrastructure, which replaces the city's payphones with kiosk-like structures, called Links, to provide fast and free public Wi-Fi access to city users. When enabled with data storage capability, these Links can, for example, play the role of edge cloud devices to allow in-network content caching so that access latency and network traffic are reduced. In this paper, we propose HybridCache, a hybrid proactive and reactive in-network caching scheme that reduces content access latency and network traffic congestion substantially. It does so by first grouping edge cloud devices in clusters to minimize intra-cluster content access latency and then enabling cooperative-proactively and reactively-caching using LSTM-based prediction to minimize in-network content redundancy. Using the LinkNYC network as the backbone infrastructure for evaluation, we show that HybridCache reduces the number of hops that content needs to traverse and increases cache hit rates, thereby reducing both network traffic and content access latency.

Two-Dimensional barcodes are used as data authentication storage tool on several cryptographic architectures. This article describes a novel meaningful image authentication method for data validation using the Meaningless Reversible Degradation concept and QR Codes. The system architecture use the Meaningless Reversible Degradation algorithm, systematic Reed-Solomon error correction codes, meaningful images, and QR Codes. The encoded images are the secret key for visual validation. The proposed work encodes any secret image file up to 3.892 Bytes and is decoded using data stored in a QR Code and a digital file retrieved through a wireless connection on a mobile device. The QR Code carries partially distorted and stream ciphered bits. The QR Code version is defined in conformity with the secret image file size. Once the QR Code data is decoded, the authenticating party retrieves a previous created Reed-Solomon redundancy file to correct the QR Code stored data. Finally, the secret image is decoded for user visual identification. A regular QR Code reader cannot decode any meaningful information when the QR Code is scanned. The presented cryptosystem improves the redundancy download file size up to 50% compared to a plaintext image transmission.

Recommender systems (RSs) are intelligent systems to help e-commerce users to find their preferred items among millions of available items by considering the profiles of both users and items. These systems need to predict the unknown ratings and then recommend a set of high rated items. Among the others, Collaborative Filtering (CF) is a successful recommendation approach and has been utilized in many real-world systems. CF methods seek to predict missing ratings by considering the preferences of those users who are similar to the target user. A major task in Collaborative Filtering is to identify an accurate set of users and employing them in the rating prediction process. Most of the CF-based methods suffer from the cold-start issue which arising from an insufficient number of ratings in the prediction process. This is due to the fact that users only comment on a few items and thus CF methods faced with a sparse user-item matrix. To tackle this issue, a new collaborative filtering method is proposed that has a trust-aware strategy. The proposed method employs the trust relationships of users as additional information to help the CF tackle the cold-start issue. To this end, the proposed integrated trust relationships in the prediction process by using the Ant Colony Optimization (ACO). The proposed method has four main steps. The aim of the first step is ranking users based on their similarities to the target user. This step uses trust relationships and the available rating values in its process. Then in the second step, graph clustering methods are used to cluster the trust graph to group similar users. In the third step, the users are weighted based on their similarities to the target users. To this end, an ACO process is employed on the users' graph. Finally, those of top users with high similarity to the target user are used in the rating prediction process. The superiority of our method has been shown in the experimental results in comparison with well-known and state-of-the-art methods.

Recent work has quantified the degradations that occur in convolutional neural nets (CNN) deployed in harsh environments like space-based image or radio frequency (RF) processing applications. Such degradations yield a robust correlation and causality between single-event upset (SEU) induced errors in memory weights of on-orbit CNN implementations. However, minimal considerations have been given to how the resilience of CNNs can be improved algorithmically as opposed to via enhanced hardware. This paper focuses on RF-processing CNNs and performs an in-depth analysis of applying software-based error detection and correction mechanisms, which may subsequently be combined with protections of radiation-hardened processor platforms. These techniques are more accessible for low cost smallsat platforms than ruggedized hardware. Additionally, methods for minimizing the memory and computational complexity of the resulting resilience techniques are identified. Combined with periodic scrubbing, the resulting techniques are shown to improve expected lifetimes of CNN-based RF-processing algorithms by several orders of magnitude.

We focus on resilience towards covert attacks on Cyber-Physical Systems (CPS). We define the new k-steerability and l-monitorability control-theoretic concepts. k-steerability reflects the ability to act on every individual plant state variable with at least k different groups of functionally diverse input signals. l-monitorability indicates the ability to monitor every individual plant state variable with £ different groups of functionally diverse output signals. A CPS with k-steerability and l-monitorability is said to be (k, l)-resilient. k and l, when both greater than one, provide the capability to mitigate the impact of covert attacks when some signals, but not all, are compromised. We analyze the influence of k and l on the resilience of a system and the ability to recover its state when attacks are perpetrated. We argue that the values of k and l can be augmented by combining redundancy and diversity in hardware and software techniques that apply the moving target paradigm.

In the existing scheduling algorithms of mimicry structure, the random algorithm cannot solve the problem of large vulnerability window in the process of random scheduling. Based on known vulnerabilities, the algorithm with diversity and complexity as scheduling indicators can not only fail to meet the characteristic requirements of mimic's endogenous security for defense, but also cannot analyze the unknown vulnerabilities and measure the continuous differences in time of mimic Executive Entity. In this paper, from the Angle of attack surface is put forward based on mimicry attack the mimic Executive Entity scheduling algorithm, its resources to measure analysis method and mimic security has intrinsic consistency, avoids the random algorithm to vulnerability and modeling using known vulnerabilities targeted, on time at the same time can ensure the diversity of the Executive body, to mimic the attack surface web server scheduling system in continuous time is less, and able to form a continuous differences. Experiments show that the minimum symbiotic resource scheduling algorithm based on time continuity is more secure than the random scheduling algorithm.

Security maintenance of Supervisory Control and Data Acquisition (SCADA) systems has been a point of interest during recent years. Numerous research works have been dedicated to the design of intrusion detection systems for securing SCADA communications. Nevertheless, these data-driven techniques are usually dependant on the quality of the monitored data. In this work, we propose a novel feature selection approach, called MSFS, to tackle undesirable quality of data caused by feature redundancy. In contrast to most feature selection techniques, the proposed method models each class in a different subspace, where it is optimally discriminated. This has been accomplished by resorting to ensemble learning, which enables the usage of multiple feature sets in the same feature space. The proposed method is then utilized to perform intrusion detection in smaller subspaces, which brings about efficiency and accuracy. Moreover, a comparative study is performed on a number of advanced feature selection algorithms. Furthermore, a dataset obtained from the SCADA system of a gas pipeline is employed to enable a realistic simulation. The results indicate the proposed approach extensively improves the detection performance in terms of classification accuracy and standard deviation.

Intrusion Detection System (IDS) is a network security software and hardware widely used to detect anomaly network traffics by comparing the traffics against rules specified beforehand. Snort is one of the most famous open-source IDS system. To write a rule, Snort specifies structure and values in Snort manual. This specification is expressive enough to write in different way with the same meaning. If there are rule redundancy, it could distract performance. We, thus, propose a proof of semantical issues for Snort rule and found four pairs of Snort rule combinations that can cause redundancy. In addition, we create a tool to verify such redundancy between two rules on the public rulesets from Snort community and Emerging threat. As a result of our test, we found several redundancy issues in public rulesets if the user enables commented rules.

The paper provides an analysis of the performance of an administrative component that helps the hypervisor to manage the resources of guest operating systems under fluctuation workload. The additional administrative component provides an extra layer of security to the guest operating systems and system as a whole. In this study, an administrative component was implemented by using Xen-hypervisor based para-virtualization technique and assigned some additional roles and responsibilities that reduce hypervisor workload. The study measured the resource utilizations of an administrative component when excessive input/output load passes passing through the system. Performance was measured in terms of bandwidth and CPU utilisation Based on the analysis of administrative component performance recommendations have been provided with the goal to improve system availability. Recommendations included detection of the performance saturation point that indicates the necessity to start load balancing procedures for the administrative component in the virtualized environment.

We address the problem of distributed state estimation of a linear dynamical process in an attack-prone environment. A network of sensors, some of which can be compromised by adversaries, aim to estimate the state of the process. In this context, we investigate the impact of making a small subset of the nodes immune to attacks, or “trusted”. Given a set of trusted nodes, we identify separate necessary and sufficient conditions for resilient distributed state estimation. We use such conditions to illustrate how even a small trusted set can achieve a desired degree of robustness (where the robustness metric is specific to the problem under consideration) that could otherwise only be achieved via additional measurement and communication-link augmentation. We then establish that, unfortunately, the problem of selecting trusted nodes is NP-hard. Finally, we develop an attack-resilient, provably-correct distributed state estimation algorithm that appropriately leverages the presence of the trusted nodes.

Fog computing faces various security and privacy threats. Internet of Things (IoTs) devices have limited computing, storage, and other resources. They are vulnerable to attack by adversaries. Although the existing privacy-preserving solutions in fog computing can be migrated to address some privacy issues, specific privacy challenges still exist because of the unique features of fog computing, such as the decentralized and hierarchical infrastructure, mobility, location and content-aware applications. Unfortunately, privacy-preserving issues and resources in fog computing have not been systematically identified, especially the privacy preservation in multiple fog node communication with end users. In this paper, we propose a dynamic MDP-based privacy-preserving model in zero-sum game to identify the efficiency of the privacy loss and payoff changes to preserve sensitive content in a fog computing environment. First, we develop a new dynamic model with MDP-based comprehensive algorithms. Then, extensive experimental results identify the significance of the proposed model compared with others in more effectively and feasibly solving the discussed issues.

{1 We present a construction for exact-repair regenerating codes with an information-theoretic secrecy guarantee against an eavesdropper with access to the content of (up to) ℓ nodes. The proposed construction works for the entire range of per-node storage and repair bandwidth for any distributed storage system with parameters (n

Cyber physical system (CPS) is often deployed at safety-critical key infrastructures and fields, fault tolerance policies are extensively applied in CPS systems to improve its credibility; the same physical backup of hardware redundancy (SPB) technology is frequently used for its simple and reliable implementation. To resolve challenges faced with in simulation test of SPB-CPS, this paper dynamically determines the test resources matched with the CPS scale by using the adaptive allocation policies, establishes the hierarchical models and inter-layer message transmission mechanism. Meanwhile, the collaborative simulation time sequence push strategy and the node activity test mechanism based on the sliding window are designed in this paper to improve execution efficiency of the simulation test. In order to validate effectiveness of the method proposed in this paper, we successfully built up a fault-tolerant CPS simulation platform. Experiments showed that it can improve the SPB-CPS simulation test efficiency.

Security policy is widely used in network management systems to ensure network security. It is necessary to detect and resolve conflicts in security policies. This paper analyzes the shortcomings of existing security policy conflict detection methods and proposes a B+ tree-based security policy conflict detection method. First, the security policy is dimensioned to make each attribute corresponds to one dimension. Then, a layer of B+ tree index is constructed at each dimension level. Each rule will be uniquely mapped by multiple layers of nested indexes. This method can greatly improve the efficiency of conflict detection. The experimental results show that the method has very stable performance which can effectively prevent conflicts, the type of policy conflict can be detected quickly and accurately.