Internet of Things (IoT) devices, such as smartphones, have become important to people’s everyday usage, especially the number of smartphone shipment has surpassed six billion and is forecast to further grow. The smartphone security is the top priority as people may store various sensitive information on these devices. Currently, phone unlock patterns, e.g., Android unlock patterns, are one of the main protection methods to protect smartphones from unauthorized access. However, many research studies have revealed that cyber-attackers can easily compromise this type of unlock mechanism, i.e., learning the pattern from the touch residue. In this work, we advocate that an additional security layer should be added to enhance the security of Android unlock patterns, and thus develop a touch movement-based unlock mechanism via blockchain-enabled artificial neural networks (ANNs), named BANN-TMGuard, which can examine the biometric features of a user’s touch movement as well as the input pattern. Further, BANN-TMGuard adopts blockchain technology to secure the robustness and reliability when building the ANN models. In the evaluation, we perform a user study with 100 participants in the aspects of authentication accuracy, time consumption and user feedback. As compared with similar schemes, our BANN-TMGuard demonstrates better results and is preferred by most participants in the user study.

User authentication is a basic security mechanism under Internet-of-Things (IoT) environments, which means to verify whether the logging user is legitimate or not. Due to known limitations of existing password-based authentication, graphical password is one promising solution to enhance the current user authentication process in IoT. However, it is an open question how to design a usable and robust graphical password scheme. In this work, we introduce RoundImage, a graphical password scheme that requires users to select images in rounds (e.g., three rounds) for authentication. It can resist against some typical threats, such as shoulder-surfing attacks and provide fault tolerance. In the evaluation, we set up an IoT scenario and test its performance with 100 participants. The results demonstrate the usability and potential of our scheme in a practical IoT environment.

With the rapid growth of Internet of Things (IoT) and edge computing platforms, the Internet of Medical Things (IoMT) has become popular and important in healthcare industry, i.e., there is an increase of brainwave headsets and headbands. However, the security and privacy of shared data can be easily compromised if an attacker can access the IoMT devices and check all the data. There is a need to authenticate users before they can use the healthcare devices. For this reason, Electroencephalography (EEG) based authentication is a necessary security solution. In recent years, EEG-based authentication has witnessed significant advancements, but traditional models face challenges in capturing the complex spatial and temporal dependencies present in EEG signals. This work aims to address these limitations and explore the effect of Transformer model in the domain of EEG-based authentication. In particular, we devise a modified Vision Transformer model (ViT) to handle the specific characteristics of EEG data, such as spatial and temporal dependencies. In the evaluation, we compare our approach with the similar methods in the literature and examine the effect of fine-tune based on two datasets. The results demonstrate that our approach can effectively capture long-range dependencies and outperform conventional models.

This study presents a new biometric authentication system leveraging ear canal acoustic features for secure identity authentication. The proposed system can capture ear acoustics using an earphone integrated with a microphone, with musical signals as the probing signal. By taking the Ear Canal Transfer Function (ECTF) as the primary feature, we develop and implement a prototype that integrates data collection and deep feature extraction using particularly modified earphones. We then employ a convolutional neural network (CNN) to address the challenge of feature space overlap due to the diverse frequency components in musical signals. Our evaluation demonstrates the feasibility and the robustness of our method by using ear canal acoustics for user authentication, highlighting its potential for widespread application in security-sensitive environments.

With the widespread of cyber attacks, network intrusion detection system (NIDS) is becoming an important and essential tool to protect Internet of Things (IoT) environments. However, it is well known that the NIDS performance depends heavily on the effectiveness of the detection model, which can be influenced significantly by the learning mechanism and the available training data. Many existing studies try to mitigate the above challenges, but few of them consider the adaptability and the cost of deploying an NIDS, the integrity of the learning process, the capacity of model based on concrete traffic samples at the same time. To fill this gap and improve the detection performance, we propose a collaborative learning-based detection framework called ADCL, which can mitigate the limitations on the knowledge of a single model by leveraging multiple models trained in similar environments and detecting intrusions in a collaborative manner. Our evaluation results indicate that ADCL can provide better performance compared with a single model on detecting various attacks in IoT networks. Specifically, ADCL improves F-score by up to 80% for adaptability, 42% in mitigating the reliance on learning integrity, 85% for model capacity. Furthermore, the detection results of ADCL guide those single models to update and increase the F-score by 15%.

With the rapid development of personal computers and mobile devices, it is very important to properly authenticate a user’s identity to protect the information and data stored on these devices. Due to various privacy and security concerns, contactless authentication has received much attention, among which in-air gesture based authentication is one promising solution. Motivated by this observation, in this work, we develop and implement a real-time in-air hand gesture-based user authentication system, where users can define or select various gestures and generate their credentials. Our system can verify a user using a deep learning-enabled inference framework without the need of being trained by a powerful device. Different from the state-of-the-art, our system uses a method of convex hull to recognize the hand gesture. In our user study, we involve 20 participants to examine the system performance, and find that our system is viable and usable with a success rate of 95%.

Summary Network intrusions are a big security threat to current computer networks. For protection, collaborative intrusion detection networks (CIDNs) are developed attempting to reach better detection performance than a single detector, by allowing a set of detectors to switch data or information with each other. However, there is a need to implement suitable trust management schemes, with the aim to safeguard such distributed detection networks against insider threats. In the literature, previous studies have indicated that the notion of intrusion sensitivity can be used to enhance the effectiveness of trust management, by highlighting the feedback from expert nodes. In addition, machine learning can be used to assign the value of intrusion sensitivity automatically. In this work, we evaluate the performance of typical supervised learning classifiers in allocating the value of intrusion sensitivity, and figure out some limitations under different data sets. Then we investigate the impact of intrusion sensitivity in a real network environment under adversarial conditions. The results demonstrate that a wrongly assigned sensitivity value may greatly degrade the detection effectiveness of insider attacks. There is a significant need to choose a suitable classifier in allocating the value of intrusion sensitivity in practice.

Summary Due to the continuous development and progress of information technology, the Internet has also entered the era of big data based on the Internet of Things (IoT). How to protect the security of data stored and transmitted in the IoT is one of the urgent problems to be solved. This article focuses on the security issues of storage and transmission of image data in the IoT. Secret image sharing (SIS) is a kind of image protection mechanism by dividing an image into n shares, and different shares are given to different participants separately for preservation. Only when the number of shares reaches the threshold can the original image be recovered. From the perspective of image reconstruction mode, there are two types of SIS schemes: one is the traditional (k, n) threshold scheme, which provides an all‐or‐nothing reconstruction mode, the other is the progressive scheme, which can gradually restore the original image. In this article, a novel (k, k2) progressive secret image sharing based on modular operations is proposed, this method can divide the important images stored in the IoT into many parts and then transmit them to people in different places. It takes the whole as a unit in terms of the progressive recovery form. When the share reaches the threshold, certain blocks of the original image can be seen. As the share increases, the image will be clearer. When all shares participate in the reconstruction together, the original image can be restored without loss. Compared with other schemes, our scheme has the same smoothness, shadow size and satisfies the security, and is fine‐grained progressive.

202111 bcwh

Nowadays, due to the increasing capability, mobile devices especially smartphones have become a necessity in people’s daily life, which would store a lot of personal and private information. This makes smartphones a major target for cyber-attackers, i.e., either loss of such mobile deices or illegal access will cause personal data breach and economic damage. Hence it is of great importance to safeguard smartphones from unauthorized access with the purpose of reducing the risk of privacy leakage and economic losses. To achieve this purpose, designing a suitable scheme to unlock phone screen is one promising solution. For instance, Android unlock scheme is a typical example, where users can unlock the phone screen by inputting a correct pattern. However, its password space is low due to the adoption of only nine dots on a 2D grid. In this work, we design a new unlock scheme using handwritten graphics, which uses an improved DTW-based algorithm for authentication. Also, we implement a prototype and evaluate our scheme using both a public dataset (SUSIG) and a self-collected dataset (SCD). Our results indicated that our scheme could achieve 7.12% and 8.75% EER on SUSIG and SCD respectively.

In modern times, the definition and the library’s expected functionality did not change much as before. It is still a place for us to hold massive collections of information. Traditionally, libraries require physical storage space for writings and publications, but storing and managing costs can be tremendous. Although the aid of digital promises and computers allows a super high density of information storage, it does not lower the library’s complexity. As our main source of information is moving away from physical writings toward digital, the new digital library (i.e., state-run library) faces the challenges of records’ integrity and storage efficiency. Focused on this issue, we learn the demands from the Royal Library in Denmark and try to explore the use of blockchain technology. We introduce a system named LibBlock, by integrating with both smart contract and IPFS in order to provide a robust, decentralized, flexible, and adaptive e-Library, which enables the ease of scalability and rigid record keeping. In the evaluation, we investigate the initial performance of LibBlock with Ethereum and show its viability and efficiency.

With more devices being inter- or intra-connected, Internet of Things (IoT) has gradually been adopted in many disciplines, such as healthcare industry, coined as Internet of Medical Things (IoMT). The purpose of IoMT is to facilitate the efficiency and effectiveness of medical operations, i.e., remotely monitoring the status of patients. In such healthcare environments, smartphones have become an important device to communicate with others and update the information of patients, resulting in a special type of IoMT called Medical Smartphone Networks (MSNs). To reinforce the distributed architecture, trust management schemes are often implemented to defend against insider attacks. However, how to maintain the robustness of trust management in heavy traffic networks still remains a challenge, i.e., COVID-19 incident would cause excessive traffic for healthcare organizations and increase the difficulty of validating trustworthiness among MSN nodes. In this work, we focus on this issue and propose a blockchain-enabled adaptive traffic sampling method to help enhance the robustness of trust management under high traffic environments. The use of blockchain technology aims to build a verified database of malicious traffic among all nodes. The evaluation in a real healthcare environment demonstrates the viability and effectiveness of our approach.

Intrusion detection systems are widely implemented to protect computer networks from threats. To identify unknown attacks, many machine learning algorithms like neural networks have been explored for anomaly based detection. However, in real-world applications, the performance of classifiers might be fluctuant with different data sets, while one main reason is due to some redundant or ineffective features. To mitigate this issue, this study investigates some feature selection methods and introduces an ensemble of Neural Networks and Random Forest to improve the detection performance. In particular, we design an intelligent system that can choose an appropriate algorithm in an adaptive way. In the evaluation, we study the feasibility of our approach with KDD99 data set and evaluate its practical performance with a real data set collected from a Honeynet environment. The experimental results indicate that as compared with similar approaches, our approach can overall provide a better result, through identifying important and closely related features.

With the speedy growth of distributed networks such as Internet of Things (IoT), there is an increasing need to protect network security against various attacks by deploying collaborative intrusion detection systems (CIDSs), which allow different detector nodes to exchange required information and data with each other. While due to the distributed architecture, insider attacks are a big threat for CIDSs, in which an attacker can reside inside the network. To address this issue, designing an appropriate trust management scheme is considered as an effective solution. In this work, we first analyze the development of CIDSs in the past decades and identify the major challenges on building an effective trust management scheme. Then we introduce a generic framework aiming to enhance the security of CIDSs against advanced insider threats by deriving multilevel trust. In the study, our results demonstrate the viability and the effectiveness of our framework.

Crowdsourcing refers to a distributed problem-solving mechanism that solves complex problems which are difficult for a single individual to solve by integrating the unknown free and voluntary masses on the Internet. In the existing crowdsourcing systems, requesters and workers are usually required to use the crowdsourcing platform as the trust center, and the payment of the fee depends on the third-party central payment institutions. This centralized service mechanism has a large security risk. Once these centers are attacked, or the centers are doing evil, it will bring greater losses to the crowdsourcing parties. Based on the blockchain technology, we propose a new and decentralized trusted service mechanism for crowdsourcing system. The crowdsourcing service process is divided into nine stages, and the smart contract controls the execution of each step in each stage. In addition, the payment is completed by transferring within the blockchain. Finally, we develop smart contracts to conduct experiments based on Ethereum, and conduct comparison experiments. The experimental results show that the effectiveness and applicability of the service of the crowdsourcing system service mechanism without the central institutions.

Summary To protect assets and resources from being hacked, intrusion detection systems are widely implemented in organizations around the world. However, false alarms are one challenging issue for such systems, which would significantly degrade the effectiveness of detection and greatly increase the burden of analysis. To solve this problem, building an intelligent false alarm filter using machine learning classifiers is considered as one promising solution, where an appropriate algorithm can be selected in an adaptive way in order to maintain the filtration accuracy. By means of cloud computing, the task of adaptive algorithm selection can be offloaded to the cloud, whereas it could cause communication delay and increase additional burden. In this work, motivated by the advent of edge computing, we propose a framework to improve the intelligent false alarm reduction for DIDS based on edge computing devices. Our framework can provide energy efficiency as the data can be processed at the edge for shorter response time. The evaluation results demonstrate that our framework can help reduce the workload for the central server and the delay as compared to the similar studies.

Intrusion detection systems (IDSs) are one of the widely adopted security tools in protecting computer networks, whereas it is still a big challenge for a single IDS to identify various threats in practice. Collaborative intrusion detection networks (CIDNs) are then developed in order to enhance the detection capability of a single IDS. However, CIDNs are known to suffer from insider attacks, in which malicious nodes can perform adversary actions. To mitigate this issue, challenge-based trust mechanisms are one of the promising solutions in literature, which are robust against various common insider threats. With the popularity of mobile devices, medical smartphone networks (MSNs) have become an emerging network architecture for healthcare organizations to improve the quality of medical services. Due to the sensitivity, there is a great need to defend MSNs against insider attacks. In this work, we conduct an empirical study to investigate and evaluate the implementation of challenge-based mechanism in MSNs. Our work aims to complement current literature, through providing insights and learned lessens (i.e., whether it is suitable to deploy such a mechanism in MSNs).

Overhead network packets are a big challenge for intrusion detection systems (IDSs), which may increase system burden, degrade system performance, and even cause the whole system collapse, when the number of incoming packets exceeds the maximum handling capability. To address this issue, packet filtration is considered as a promising solution, and our previous research efforts have proven that designing a trust-based packet filter was able to refine unwanted network packets and reduce the workload of a local IDS. With the development of Internet cooperation, collaborative intrusion detection environments (e.g., CIDNs) have been developed, which allow IDS nodes to collect information and learn experience from others. However, it would not be effective for the previously built trust-based packet filter to work in such a collaborative environment, since the process of trust computation can be easily compromised by insider attacks. In this paper, we adopt the existing CIDN framework and aim to apply a collaborative trust-based approach to reduce unwanted packets. More specifically, we develop a collaborative trust-based packet filter, which can be deployed in collaborative networks and be robust against typical insider attacks (e.g., betrayal attacks). Experimental results in various simulated and practical environments demonstrate that our filter can perform effectively in reducing unwanted traffic and can defend against insider attacks through identifying malicious nodes in a quick manner, as compared to similar approaches.

The memorability of multiple passwords is an important topic for user authentication systems. With the advent of Android unlock pattern mechanism, research studies started investigating its usability and security features. This paper presents a study of recalling multiple passwords between text passwords and touch screen unlock patterns, as well as exploring whether users have difficulty in remembering those patterns after a period of time. In our study, participants create unlock patterns for various account scenarios. Our results reveal that participants in the unlock pattern condition with three accounts can outperform those in the text password condition (i.e., achieve higher success rates), not only in a one-hour session (short-term), but also after two weeks (long-term). However, there was no statistically significant difference between participants in the text password and unlock pattern condition in the long-term, when dealing with six accounts.

Purpose This paper aims to propose and evaluate an intrusion sensitivity (IS)-based approach regarding the detection of pollution attacks in collaborative intrusion detection networks (CIDNs) based on the observation that each intrusion detection system may have different levels of sensitivity in detecting specific types of intrusions. Design/methodology/approach In this work, the authors first introduce their adopted CIDN framework and a newly designed aggregation component, which aims to collect feedback, aggregate alarms and identify important alarms. The authors then describe the details of trust computation and alarm aggregation. Findings The evaluation on the simulated pollution attacks indicates that the proposed approach is more effective in detecting malicious nodes and reducing the negative impact on alarm aggregation as compared to similar approaches. Research limitations/implications More efforts can be made in improving the mapping of the satisfaction level, enhancing the allocation, evaluation and update of IS and evaluating the trust models in a large-scale network. Practical implications This work investigates the effect of the proposed IS-based approach in defending against pollution attacks. The results would be of interest for security specialists in deciding whether to implement such a mechanism for enhancing CIDNs. Originality/value The experimental results demonstrate that the proposed approach is more effective in decreasing the trust values of malicious nodes and reducing the impact of pollution attacks on the accuracy of alarm aggregation as compare to similar approaches.

Spam emails are considered as one of the biggest challenges for the Internet. Thus email classification, which aims to correctly classify legitimate and spam emails, becomes an important topic for both industry and academia. To achieve this goal, machine learning techniques, especially supervised machine learning algorithms, have been extensively applied to this field. In literature, several studies reveal that supervised machine learning (SML) suffers from some limitations such as performance fluctuation, hence many works start focusing on designing more complex algorithms. However, we identify that most existing research efforts are based on datasets, while more research should be conducted to investigate the performance of SML in real environments. In this paper, we thus perform an empirical study with three different environments and over 1,000 users regarding this issue. In the study, we find that SML classifiers like decision tree and SVMs are acceptable by users in real email classification. In addition, we discuss promising directions and provide new insights in this area.

Abstract Network intrusion detection systems (NIDSs) have been widely deployed in various network environments to defend against different kinds of network attacks. However, a large number of alarms especially unwanted alarms such as false alarms and non‐critical alarms could be generated during the detection, which can greatly decrease the efficiency of the detection and increase the burden of analysis. To address this issue, we advocate that constructing an alarm filter in terms of expert knowledge is a promising solution. In this paper, we develop a method of knowledge‐based alert verification and design an intelligent alarm filter based on a multi‐classk‐nearest‐neighbor classifier to filter out unwanted alarms. In particular, the alarm filter employs a rating mechanism by means of expert knowledge to classify incoming alarms to proper clusters for labeling. We further analyze the effect of different classifier settings on classification accuracy with two alarm datasets. In the evaluation, we investigate the performance of the alarm filter with a real dataset and in a network environment, respectively. Experimental results indicate that our alarm filter can effectively filter out a number of NIDS alarms and can achieve a better outcome under the advanced mode. Copyright © 2015 John Wiley & Sons, Ltd.

Email classification is an important topic in literature attempting to correctly classify user emails and filter out spam emails. In this paper, we identify some challenges regarding this topic and propose an effective email classification model based on both data reduction and disagreement-based semi-supervised learning. In particular, the main objective of the data reduction is to select an optimum collection of email features and reduce the pointless data, while the objective of the disagreement-based approach is to enhance the accuracy of detecting spam emails by utilizing unlabeled data automatically. In the evaluation, we explore the performance of our proposed email classification model using two public datasets and a private dataset. The experimental results demonstrate that our proposed model can overall enhance the performance of email classification through improving detection accuracy and reducing false rates.

The goal of email classification is to classify user emails into spam and legitimate ones. Many supervised learning algorithms have been invented in this domain to accomplish the task, and these algorithms require a large number of labeled training data. However, data labeling is a labor intensive task and requires in-depth domain knowledge. Thus, only a very small proportion of the data can be labeled in practice. This bottleneck greatly degrades the effectiveness of supervised email classification systems. In order to address this problem, in this work, we first identify some critical issues regarding supervised machine learning-based email classification. Then we propose an effective classification model based on multi-view disagreement-based semi-supervised learning. The motivation behind the attempt of using multi-view and semi-supervised learning is that multi-view can provide richer information for classification, which is often ignored by literature, and semi-supervised learning supplies with the capability of coping with labeled and unlabeled data. In the evaluation, we demonstrate that the multi-view data can improve the email classification than using a single view data, and that the proposed model working with our algorithm can achieve better performance as compared to the existing similar algorithms.

Currently, signature-based network intrusion detection systems (NIDSs) are being widely deployed in distributed network environment with the purpose of protecting network communications from various attacks. However, signature matching has become a key limiting factor to restrict the performance of a signature-based NIDS in large-scale distributed network environment. The overhead network packets can greatly reduce the effectiveness of such detection systems and heavily consume computer resources. To mitigate this issue, a more efficient signature matching algorithm is desirable. In this paper, we therefore develop an adaptive character frequency-based exclusive signature matching scheme that can be implemented in a signature-based NIDS to help improve the performance of signature matching. In the experiment, we implemented our scheme in a distributed network environment and evaluated the performance of our scheme compared with Snort. The experimental results show that, in our distributed network environment, our scheme can positively reduce the time consumption in the range from 11.2% to 37.6%.