Search

Software-defined networking (SDN) has become a promising trend for managing the industrial Internet of Things (IIoT) devices. As the core of sensitive data storage and business interaction, the SDN is vulnerable to advanced persistent threats (APT) attacks, while honeypots have shown great promise against APT attacks. In this paper, we propose a new SDN-based dynamic bounded rational honeypot-APT game model in IIoT. Specifically, the defender maximizes the utility by chossing the period strategy of honeypot collecting and analyzing the data, while the attacker maximizes utility by choosing the period strategy of its latency and attack. To describe the bounded rationality, we model the simultaneous dynamic attack and defense process through the prospect theory, in which the Prelec function and the value function are both introduced. Experiment results show that bounded rationality affects strategy selection and reduces defender and attacker’s utilities. Furthermore, our strategy outperforms the existing work in defensive performance.

Honeypot defense deployment is considered as a promising technology to protect the industrial Internet of Things (IIoT), especially Advanced Metering Infrastructure (AMI), threatened by cyber-attacks. AMI defensive effectiveness depends on the honeypot deployment of the small-scale electricity suppliers (SESs) in sharing defense data. However, since the honeypot system is an additional defensive tool deployed by SESs, traditional power retailers (TPRs) cannot confirm in advance that the defense data shared by SES is valid. Therefore, it is necessary to design an incentive mechanism based on the information asymmetry to encourage SES to share defense data honestly. In this paper, we propose a honeypot deployment contract-theoretic model (HDCM) to improve the defensive effectiveness of AMI, where SES will honestly share defense data and the defense cost of TPR will be reduced. We first divide the SESs’ contribution into finite types, and model the defense data sharing contract between the TPR and SESs. Then, the contract feasibility of HDCM is derived in necessary and sufficient conditions. At last, we analyze the optimal contract offered by TPR in the continuous case of SESs. Numerical simulations show that the HDCM can incentivize SESs to deploy honeypot and honestly share defense data, and make defensive effectiveness of AMI close to the information symmetry case.

With the development of detection algorithms on malicious dynamic domain names, domain generation algorithms have developed to be more stealthy. The use of multiple elements for generating domains will lead to higher detection difficulty. To effectively improve the detection accuracy of algorithmically generated domain names based on multiple elements, a domain name syntax model is proposed, which analyzes the multiple elements in domain names and their syntactic relationship, and an adaptive embedding method is proposed to achieve effective element parsing of domain names. A parallel convolutional model based on the feature selection module combined with an improved dynamic loss function based on curriculum learning is proposed, which can achieve effective detection on multielement malicious domain names. A series of experiments are designed and the proposed model is compared with five previous algorithms. The experimental results denote that the detection accuracy of the proposed model for multiple-element malicious domain names is significantly higher than that of the comparison algorithms and also has good adaptability to other types of malicious domain names.

Due to the capability of passing through heavily censored networks or gateway equipped with the traffic-monitoring module, DNS tunnel has been the dominant covert communication technique for command and control between the victim and the attacker in network attack events. Although the discovery of DNS tunnel has been intensively studied, the internal application behavior identification for DNS tunnels still remains a challenging problem. The fine-gained identification can help to reveal more behavior information wrapped in DNS tunnels. In this study, we investigate the spatial-temporal information from the raw packets to identify the internal application behaviors in DNS tunnels. Multi-dimensional features on packet length and timing for DNS tunnels with different internal application behaviors are incorporated with a machine-learning algorithm to identify the internal application behaviors in DNS tunnels. We consider 4 common types of application behaviors in our research, including browsing webpages, emailing, downloading data, and controlling the remote servers. The experimental results show that the proposed scheme can achieve higher identification accuracy with a much lower packet consuming rate when compared with the state-of-the-art internal protocol identification scheme. The experiment results depict that our proposed scheme is better in terms of F-score, which can reach 99% with only 100 packets.

The security of cyber-physical systems (CPS) has become an active research area in recent years. Autonomous micro-grid, an important component of smart grid and essentially a cyber-physical system, extends the attack surface and undermines system security. This paper proposes a game-theoretic approach to describe the plausible attack-defense dynamics for autonomous micro-grid. The game is a kind of two-player, one shot, non-cooperative, and Zero-sum game, where the goal of attackers in this game is to gain the maximum payoff under a certain cost. The behavior of attackers includes two steps, intrusion and disruption, whereas the defenders can improve their defense performance by updation or reinforcement of cyber component. The optimal strategy of attackers is deduced based on the dynamic model. Finally, the case studies validate the proposed method and demonstrate its feasibility.

DNS (Domain Name System) tunnels almost obscure the true network activities of users, which makes it challenging for the gateway or censorship equipment to identify malicious or unpermitted network behaviors. An efficient way to address this problem is to conduct a temporal‐spatial analysis on the tunnel traffic. Nevertheless, current studies on this topic limit the DNS tunnel to those with a single protocol, whereas more than one protocol may be used simultaneously. In this paper, we concentrate on the refined identification of two protocols mixed in a DNS tunnel. A feature set is first derived from DNS query and response flows, which is incorporated with deep neural networks to construct a regression model. We benchmark the proposed method with captured DNS tunnel traffic, the experimental results show that the proposed scheme can achieve identification accuracy of more than 90%. To the best of our knowledge, the proposed scheme is the first to estimate the ratios of two mixed protocols in DNS tunnels.

As one of the most critical infrastructure, the power grid has been increasingly threatened by network attacks, especially advanced persistent threats (APTs). APT in the power grid is a continual and stealthy attack that analyzes the interaction between the cyber layer and the physical layer. The existing offensive and defensive processes for power grid using honeypots against APTs are modeled based on full rationality. Therefore, both the attacker and the defender make decisions to maximize their payoffs under full rationality. However, fully rational decisions made by end-users are not always conformed with the real cases, and prospect theory is a typical boundedly rational method to model these deviations. In this study, we propose a subjective APT-honeypot game model to study the offensive and defensive interactions between the attacker and the defender based on the prospect theory. In this model, we protect the power grid bus nodes by deploying honeypots, which consider both low- and high-interaction honeypot modes. We prove the existence of Bayesian-Nash equilibrium strategies in defense and attack strategies under bounded rationality. In addition, we used IEEE-30 Bus system to verify the proposed model in this paper. Experiment results show that bounded rationality affects strategy selection and reduces attacker's payoffs.

Distinguishing malicious domain names generated by various domain generation algorithms (DGA) is critical for defending a network against sophisticated network attacks. In recent years, stealthy domain generation algorithms (SDGA) have been proposed and revealed significantly stronger stealthiness comparing to the traditional character-based DGA. Existing state-of-the-art detection schemes are not effective enough for detecting SDGA. In this paper, we exploit the character-level characteristics of the SDGA domain names and propose a heterogeneous deep neural network framework (HDNN) for detecting SDGA. HDNN employs a proposed improved parallel CNN (IPCNN) architecture with multi-sizes of convolution kernel for extracting multi-scale local features from a domain name. The framework also contains a proposed self-attention based bidirectional long short term memory (SA-Bi-LSTM) architecture which can extract the bidirectional global features with attention mechanism from a domain name. Besides that, the focal loss function is introduced to mitigate the imbalance of the sample quantity in the training phase. The benchmark experiments are carried out based on the database composed of the collected benign domain names, real-world DGA and SDGA ones. Compared to the 6 influential deep-learning-based DGA detection schemes, the proposed scheme has achieved state-of-the-art detection results on SDGAs, and also achieved state-of-the-art results on binary and multiclass classification for traditional DGAs.

A cyber‐physical system (CPS) is a new mechanism controlled or monitored by computer algorithms that intertwine physical and software components. Advanced persistent threats (APTs) represent stealthy, powerful, and well‐funded attacks against CPSs; they integrate physical processes and have recently become an active research area. Existing offensive and defensive processes for APTs in CPSs are usually modeled by incomplete information game theory. However, honeypots, which are effective security vulnerability defense mechanisms, have not been widely adopted or modeled for defense against APT attacks in CPSs. In this study, a honeypot game‐theoretical model considering both low‐ and high‐interaction modes is used to investigate the offensive and defensive interactions, so that defensive strategies against APTs can be optimized. In this model, human analysis and honeypot allocation costs are introduced as limited resources. We prove the existence of Bayesian Nash equilibrium strategies and obtain the optimal defensive strategy under limited resources. Finally, numerical simulations demonstrate that the proposed method is effective in obtaining the optimal defensive effect.

The bandgap of two-dimensional (2D) materials plays an important role in their applications to various devices. For instance, the gapless nature of graphene limits the use of this material to semiconductor device applications, whereas the indirect bandgap of molybdenum disulfide is suitable for electrical and photo-device applications. Therefore, predicting the bandgap rapidly and accurately for a given 2D material structure has great scientific significance in the manufacturing of semiconductor devices. Compared to the extremely high computation cost of conventional first-principles calculations, machine learning (ML) based on statistics may be a promising alternative to predicting bandgaps. Although ML algorithms have been used to predict the properties of materials, they have rarely been used to predict the properties of 2D materials. In this study, we apply four ML algorithms to predict the bandgaps of 2D materials based on the computational 2D materials database (C2DB). Gradient boosted decision trees and random forests are more effective in predicting bandgaps of 2D materials with an R2 >90% and root-mean-square error (RMSE) of ~0.24 eV and 0.27 eV, respectively. By contrast, support vector regression and multi-layer perceptron show that R2 is >70% with RMSE of ~0.41 eV and 0.43 eV, respectively. Finally, when the bandgap calculated without spin-orbit coupling (SOC) is used as a feature, the RMSEs of the four ML models decrease greatly to 0.09 eV, 0.10 eV, 0.17 eV, and 0.12 eV, respectively. The R2 of all the models is >94%. These results show that the properties of 2D materials can be rapidly obtained by ML prediction with high precision.

In order to solve the labelling component hotspots of drawings problem with database for power plant, an Optical character recognition (OCR) hot spot recognition model based on template matching (OCRTM) is used in this paper. In our opinion a very important percent of text used to be “OCRed” is coming from labeling components of drawings and realizing the links and matching function according to the method of operating hotspot, thus also encapsulates method of editing hotspot in this component which include the add operation, modify operation and delete operation of hotspot. Empirical results show that the relationship structure can be established from the top floor drawings to the lowest level drawings, and the relationship structure can facilitate users to get drawings information through hot spots. The proposed architecture based on template matching. Performance can effectively solve the recognition hot spots and the relationship between drawing and hot spots problem.

In highly sophisticated network attacks, command-and-control (C&C) servers always use domain generation algorithms (DGAs) to dynamically produce several candidate domains instead of static hard-coded lists of IP addresses or domain names. Distinguishing the domains generated by DGAs from the legitimate ones is critical for finding out the existence of malware or further locating the hidden attackers. The word-based DGAs disclosed in recent network attack events have shown significantly stronger stealthiness when compared with traditional character-based DGAs. In word-based DGAs, two or more words are randomly chosen from one or more specific dictionaries to form a dynamic domain, these regularly generated domains aim to mimic the characteristics of a legitimate domain. Existing DGA detection schemes, including the state-of-the-art one based on deep learning, still cannot find out these domains accurately while maintaining an acceptable false alarm rate. In this study, we exploit the inter-word and inter-domain correlations using semantic analysis approaches, word embedding and the part-of-speech are taken into consideration. Next, we propose a detection framework for word-based DGAs by incorporating the frequency distribution of the words and that of part-of-speech into the design of the feature set. Using an ensemble classifier constructed from Naive Bayes, Extra-Trees, and Logistic Regression, we benchmark the proposed scheme with malicious and legitimate domain samples extracted from public datasets. The experimental results show that the proposed scheme can achieve significantly higher detection accuracy for word-based DGAs when compared with three state-of-the-art DGA detection schemes.

As the main active traffic analysis method, network flow watermarking (NFW) has been proven effective for flow correlation in anonymous communication system or stepping stone detection. In various types of network flow watermarking schemes, the interval-based ones can achieve significant better capability of resisting network interference. However, there still exists no work to give a comprehensive analysis of them, specifically on practicability as the implementation of NFW in Internet still remains a great challenge. In this paper, the existing interval-based NFW schemes are comparatively analyzed by benchmarking their performance on robustness, invisibility and practicability. Different from some prior work, we pay special attention to the practicability evaluation, which is related to time and storage overhead, communication and computation overhead, and the statistical model demand. Experimental results on CAIDA dataset give an overview of the existing interval-based NFW schemes.

The construction of S-boxes is crucial to the design of block ciphers. In this paper, the scheme for constructing S-boxes based on 3-D four-wing autonomous chaotic system is proposed. It can be used to batch-generating $$8\times 8$$ S-boxes conveniently. With the analysis based on typical evaluation criteria including nonlinearity, differential uniformity, strict avalanche criterion, output bits independence criterion and bijective property, the optimal S-box is selected from all the generated ones. The comparison with the existing chaos-based schemes shows that the proposed S-box achieves better cryptographical performance. So it can be employed in new block cipher systems.

Network covert channel is a covert communication method by hiding covert messages into overt network packets. In recent years, with the development of various hiding methods, network covert channel has become a new kind of threat for network security. The covert channel that uses the redundancies existing in TCP protocol to make hiding is called TCP covert channel. In this paper, the behaviors of TCP flows are modeled by the Markov chain composed of the states of TCP packets. And the abnormality caused by TCP covert channel is described by the difference between the overt and covert TCP transition probability matrix. The detection method based on MAP is proposed to detect the covert communication hidden in TCP flows under various applications such as HTTP, FTP, TELNET, SSH and SMTP. Experiments show that the proposed algorithm achieves better detection performance than the existing methods.

Extracting packet signatures automatically and accurately are the foundation of traffic identification for most network monitoring and forensics application. The Apriori algorithm is a common and useful method to fulfill the task. For huge amount Internet traffic, the traditional Apriori algorithm, produce huge candidate itemsets and will occupy large I/O costs in scanning database. An improvement method is proposed in this paper. Based on the pruning to the candidate and the public signature database, it dynamically reduced the number of the scanning itemsets to make the scanning efficient. The experiment proved that the proposed algorithm can also effectively improve the mining rate.

A video encryption scheme combining with advanced video coding (AVC) is presented and analyzed in this paper, which is different from the ones used in MPEG1/2 video encryption. In the proposed scheme, the intra-prediction mode and motion vector difference are encrypted with the length-kept encryption algorithm (LKE) in order to keep the format compliance, and the residue data of the macroblocks are encrypted with the residue data encryption algorithm (RDE) in order to keep low cost. Additionally, a key distribution scheme is proposed to keep the robustness to transmission errors, which assigns sub-keys to different frames or slices independently. The encryption scheme's security, time efficiency and error robustness are analyzed in detail. Experimental results show that the encryption scheme keeps file format unchanged, is secure against replacement attacks, is efficient in computing, and is robust to some transmission errors. These properties make it a suitable choice for real-time applications, such as secure IPTV, secure videoconference or mobile/wireless multimedia, etc.

Image splicing is an image editing method to copy a part of an image and paste it onto another image, and it is commonly followed by postprocessing such as local/global blurring, compression, and resizing. To detect this kind of forgery, the image rich models, a feature set successfully used in the steganalysis is evaluated on the splicing image dataset at first, and the dominant submodel is selected as the first kind of feature. The selected feature and the DCT Markov features are used together to detect splicing forgery in the chroma channel, which is convinced effective in splicing detection. The experimental results indicate that the proposed method can detect splicing forgeries with lower error rate compared to the previous literature.

Tardos constructed the optimal probabilistic codes that are e-secure against c pirates have length and are full power of randomization. Many improved versions of Tardos’ codes are proposed to shorten its code length while they are still not used in multimedia content. In this paper, the multimedia content tracing scheme based on the Tardos’ fingerprint codes is proposed. Before embedding/extracting the Tardos’ in the multimedia content, the fingerprint bit is modulated/demodulated with spread-spectrum modulation and quantization-index modulation. The collusion resistance of the Tardos’ fingerprint based on the different watermark modulation techniques is analyzed. Simulation results show that based on different watermarking modulation technique the collusion resistance of Tardos’ fingerprint is different.

This paper analyzes the security of content-based watermarking authentication framework in the extraction of the feature watermark and the watermark embedding using information theory. Security analysis of feature watermark is composed of four parts, that is, the extracted feature is as watermark, the encrypted feature after extracted is as watermark, the encrypted feature before extracted is as watermark and the encrypted feature while extracted is as watermark. Security of watermark embedding is analyzed from two parts, that is, the watermark embedding is controlled by secret key and the watermark embedding is no secret key. Additionally, the integration security of the feature watermark and the watermark embedding is analyzed from eight aspects. Through the security analysis of these architectures, some important conclusions are proved and drawn, and the corresponding suggestions are pointed out.

In this paper, a novel concept "authentication set" is used to analyze the security of the authentication schemes in detail. Several novel concepts on the authentication set are defined, which are called "cover authentication set", "attack authentication set", "watermark-based authentication set" or "signature-based authentication set", "verified authentication set" and "malicious-attack authentication set". According to the relation among the aforementioned sets, the security of the authentication schemes is exploited. Furthermore, a conclusion is drawn according to the analysis result. At the same time the principle that guides the design of the more secure authentication schemes is presented. Finally, as an example, a novel authentication design method based on multi-feature watermarks is proposed according to the design principle. The experimental results prove the validity of the design method and the significance of the guide principle.

In this paper, a new and efficient image hiding scheme is proposed. Different from the existing methods, the secret data is embedded into the prediction errors produced by the neural network nonlinear predictor, and the non-uniform quantization method is used to embed secret data. The proposed method can achieve higher embedding payload while keeping smaller distortion, and experimental results are given to show the advantage of this scheme.