Detecting Distributed Denial of Service (DDoS) attacks effectively has long been a challenge due to their disruptive nature. As the amount of network traffic increases, artificial intelligence based methods for detecting DDoS attacks have faced challenges of lower efficiency due to model training. On that account, a DDoS alerting method based on optimal sub-OD (Origin-Destination) pairs and Markov model (SODMM) is devised. SODMM first designs a subset feature evaluation technique to identify the most informative OD pairs, subsequently forming a TM based on these pairs. Then, the Generalized Network Temperature (GNT) derived from the TM is used to define the state transition matrix of a Markov model, dynamically adjusting such a transition matrix to enhance the accuracy of DDoS attack predictions. Experimental results show that SODMM outperforms the GNT, NAEW-GNT, and Rényi-GNT methods in terms of early alerts, possessing the highest ACC of 95.6%, as well as the lowest FPR of 10.06% and FNR of 3.83%.

Online Social Networks (OSNs) face escalating security threats that imperil user privacy. Conventional Deep Learning methods, relying predominantly on fixed learning rates, encounter limitations when capturing the nuanced intricacies of OSN traffic that arise from shifting user behaviors, diverse content types, and evolving interaction patterns because of social trending topics changes. To tackle these challenges, our paper delves into the diverse variations and transitions from a uniform approach, where a single method is employed for various types of data, to a multi-variation methodology. This methodology dynamically adapts to the special characteristics of each data type, resulting in more effective data representation while alleviating the limitations associated with fixed-rate calibration. Therefore, we devise the Adaptive Swarm Reinforcement Learning (ASRL) method that leverages adaptive learning to intricately analyze a wide range of user interactions, endowing our proposed method with the capacity to flexibly adjust to the constantly shifting OSN patterns. The experiments show that the proposed ASRL method achieves an accuracy of 98.59% in detecting a range of threat patterns, surpassing other prevalent methods by an average of 5% across the datasets from Facebook, Google+, and Twitter. Meanwhile, ASRL logs suspicious activities to identify the intruder for forensic analysis. The implementation of our proposed method is now publicly accessible athttps://github.com/don2c/asrl_Project.

In wireless sensor networks (WSNs), provenance is critical for assessing the trustworthiness of the data acquired and forwarded by sensor nodes. Due to the energy and bandwidth limitations of WSNs, it is crucial that data provenance should be as compact as possible. The main drawback of the existing block provenance schemes is that to decode the provenance, all of the provenance blocks must be received by the base station (BS) correctly. To address such an issue, we propose a multigranularity graphs-based stepwise refinement provenance scheme (MSRP), among which we use the mutual information between node pair as the similarity index to classify node IDs and then generate the multigranularity topology graphs. Furthermore, the dictionary-based provenance scheme (DP) is employed to encode the provenance in a stepwise manner. The BS recovers the provenance in the same stepwise manner and performs the data trustworthiness evaluation during the decoding. We evaluate the performance of the MSRP scheme extensively by both simulations and testbed experiments. In addition to mitigating the main drawback of the existing block provenance schemes, the results show that our scheme not only outperforms the known related schemes with respect to average provenance size and energy consumption but also drastically improves data trustworthiness assessing efficiency.

In a wireless sensor network (WSN), provenance, usually considered as the tracebacks of the data packets’ acquisition and transmission, is critical for assessing data trustworthiness. However, the provenance size expands rapidly with increases in the number of packet transmission hops. Among the known provenance schemes, the dictionary based provenance (DP) scheme achieves the highest provenance compression rate up to now. Nevertheless, the average compression rate of the DP scheme decreases drastically when the WSN’s topology is not stable. To address such a disadvantage, in this paper we propose a packet path index differences based provenance (PIDP) scheme. In the PIDP scheme, the backbone paths along the gradient directions of the packet transmissions are built, and then the provenance is encoded by a selected index of a backbone path dictionaries together with a deviation from the backbone path. To further increase the provenance compression rate and decrease the computation complexity at each node, a packet path hash value based provenance (PHP) scheme is proposed as a complementary approach of the PIDP scheme, in which the provenance is encoded as the data source node ID together with a segment of the packet path’s hash value. Both the simulation and experimental results show that our proposed two schemes, the PIDP and the PHP schemes, outperform the DP scheme with respect to both provenance compression rate and energy conservation rate even when a WSN’s topology is not stable.

In wireless sensor networks (WSNs), provenance is critical for assessing the trustworthiness of data acquired and forwarded by sensor nodes, detecting early signs of attacks, etc. However, the provenance size expands rapidly with increases in the number of packet transmission hops. Among the existing provenance schemes, the dictionary based provenance scheme (DP) achieves the highest provenance compression rate. However, the major drawback of the DP scheme is that it is sensitive to the WSN's topology changes, which cannot be used in the WSNs with rapid topology changes. To overcome such a drawback and achieve a higher compression rate, we propose a path index differences based provenance scheme, in which we first establish backbone paths along the gradient direction, and then we devise a Truncation Hamming Distance (THD) based method to eliminate the backbone paths with high similarity and build the path dictionaries for the selected backbone paths of low similarity. With the support of such dictionaries, a new path is encoded by the index of a similar path in the dictionary together with the differences between them, which makes the size of the provenance stably compressed. Compared to the DP scheme, the simulation and experimental results show that our scheme can achieve a higher provenance compression ratio even if the topology structure of the WSN is not stable.

Since the classical hash function widely used are costly for resource constrained devices, in this paper we propose a new lightweight hash function LNHASH through Cellular Automata(CA), in which sponge construction is applied as the mode of operation. Both linear and non-linear CA rules are employed to construct the internal permutation to achieve high diffusion and confusion. LNHASH allows making trade-offs among security, speed, energy consumption and implementation costs by adjusting the corresponding parameters. The hardware-friendly Sbox and linear layer bring low area implementation. Security analysis results show the resistance of the LNHASH scheme against the known attacks.

In wireless sensor networks (WSNs), data provenance records the data source and the forwarding and the aggregating information of a packet on its way to the base station (BS). To conserve the energy and wireless communication bandwidth, the provenances are compressed at each node along the packet path. To perform the provenances compression in resource‐tightened WSNs, we present a cluster‐based arithmetic coding method which not only has a higher compression rate but also can encode and decode the provenance in an incremental manner; i.e., the provenance can be zoomed in and out like Google Maps. Such a decoding method raises the efficiencies of the provenance decoding and the data trust assessment. Furthermore, the relationship between the clustering size and the provenance size is formally analyzed, and then the optimal clustering size is derived as a mathematical function of the WSN’s size. Both the simulation and the test‐bed experimental results show that our scheme outperforms the known arithmetic coding based provenance compression schemes with respect to the average provenance size, the energy consumption, and the communication bandwidth consumption.