Malware classification plays a fundamental role among all the related tasks. Researchers and anti-virus vendors have proposed deep learning (DL) methods to deal with the fast emerging-malware families and samples. However, for ordinary deep learning methods, once the model is trained, the set of families that can be recognized is fixed. This is troublesome in practice to deal with emerging malware families or unknown families with scarce samples. To resolve this issue, we propose an incremental classification approach called IMC (Incremental Malware Classification) based on few-shot learning, and the classifier is implemented as a cosine similarity function between extracted features and feature vectors of target classes. IMC can efficiently extend the pre-trained model to unknown families dynamically with a handful of samples without losing the ability to recognize the families it has “seen”. In the process of adaptation, no re-training is needed and fast inference is realized by a single forward pass. We extensively evaluate our approach on a dataset named APIMDS where the framework achieves incremental ability to classify the unknown families with high accuracy while maintaining the ability to recognize the known families. To our best knowledge, this is the first approach to meet the requirements to unify the classification of both unknown and known malware families in a few-shot manner.

With the rising popularity of mobile networks and applications, network traffic classification has gradually become essential to mobile network management and cyberspace security. Existing state-of-the-art methods have achieved high accuracy in the closed-world mobile encrypted traffic classification, where the classifier only needs to process the classes seen in the training. When we update the dataset with new mobile applications, these methods must retrain a new classifier from scratch to learn the knowledge of all applications because directly fine-tuning the existing classifier would lead to the catastrophic forgetting problem. Thus, it is challenging to incrementally add new applications to the classification system while preserving the learned knowledge of the existing classifier. To tackle this issue, we propose an incremental learning framework based on the one vs rest (OvR) strategy and neural network classifiers. Moreover, we adopt a sample selection algorithm to balance the conflict between the growing training effort caused by new applications and the high classification accuracy. The experimental results demonstrate that our proposed framework achieves incremental learning with high classification accuracy like the closed-world method, and the selection algorithm significantly reduces training efforts to meet the dataset scale control and classification accuracy requirement in the lifetime incremental learning.

Nowadays, we have witnessed the rise of botnet malicious activities. These botnets, as expected, are launched by Domain generation algorithm (DGA) to evade detection. There is a growing concern that the artificially designed DGA detection features are being vulnerable to attackers, where any well-designed manipulations would evade these existing feature-based detection and even the more robust behavior-based detection. One common point of existing evasion for behavior detection is using domain names with low query rate. In this paper, we propose FProbe, a novel technology using co-occurrence matrix and relaxed clustering procedure, which performs excellent performance in the scene of detecting low query rate and multi-domain evasion. We use a simple intuition, that is, DGA queries have a strong correlation between temporal and spatial features, but these temporal and spatial correlations are not very synchronous. The FProbe uses the co-occurrence matrix, which is widely used in the field of product recommendation and word frequency co-occurrence, and use these unsupervised methods to cluster infected hosts. In particular, through this matrix, we can quickly and effectively locate infected hosts in the scene of low query rate, instead of discarding the domain for its high threshold. Then, we use the relax association rules of Frequent Sequence Tree to cluster related domain names, and use supervised learning to determine malicious clusters. The FProbe has been evaluated in the campus network (4000 active users in peak load hours) and ISP DNS traffic (one billion queries per hour). The experimental results ( 96.3% accuracy rate of 1.9% false positive on average) illustrate the efficiency and accuracy of FProbe.

A botnet is a network of remote-controlled devices that are infected with malware controlled by botmasters in order to launch cyber attacks. To evade detection, the botmaster frequently changes the domain name of his Command and Control (C&C) server. Notice that most of these types of domain names are generated by domain generation algorithms (DGAs). In this paper, we propose Khaos, a novel DGA with high anti-detection ability based on neural language models and the Wasserstein Generative Adversarial Network (WGAN). The key insight of our research is that real domain names are composed of readable syllables and acronyms, and thus we can arrange syllables and acronyms using neural language models to mimic real domain names. In Khaos, we first find the most common n-grams in real domain names, then tokenize these domain names into n-grams, and finally synthesize new domain names after learning arrangements of n-grams from real domain names. We carry out experiments using a variety of state-of-the-art DGA detection approaches: the statistics-based, the distribution-based, the LSTM-based and the graph-based detection approach. Our experimental results show that the average distance for detecting Khaos under the distribution-based detection approach is 0.64, the AUCs of Khaos under the statistics-based and the LSTM-based detection approach are 0.76 and 0.57, respectively, and the precision of Khaos under the graph-based detection approach is 0.68. Our work proves that the existing detection approaches have big troubles in detecting Khaos, and Khaos has better anti-detection ability than state-of-the-art DGAs. In addition, we find that training the existing detection approach on a dataset including the domain names generated by Khaos can improve its detection ability.

With the unprecedented prevalence of mobile network applications, cryptographic protocols, such as the Secure Socket Layer/Transport Layer Security (SSL/TLS), are widely used in mobile network applications for communication security. The proven methods for encrypted video stream classification or encrypted protocol detection are unsuitable for the SSL/TLS traffic. Consequently, application-level traffic classification based networking and security services are facing severe challenges in effectiveness. Existing encrypted traffic classification methods exhibit unsatisfying accuracy for applications with similar state characteristics. In this paper, we propose a multiple-attribute-based encrypted traffic classification system named Multi-Attribute Associated Fingerprints (MAAF). We develop MAAF based on the two key insights that the DNS traces generated during the application runtime contain classification guidance information and that the handshake certificates in the encrypted flows can provide classification clues. Apart from the exploitation of key insights, MAAF employs the context of the encrypted traffic to overcome the attribute-lacking problem during the classification. Our experimental results demonstrate that MAAF achieves 98.69% accuracy on the real-world traceset that consists of 16 applications, supports the early prediction, and is robust to the scale of the training traceset. Besides, MAAF is superior to the state-of-the-art methods in terms of both accuracy and robustness.

We revisit the problem of basing signcryption SC tag key encapsulation mechanism KEM on standard assumptions and standard model and present direct constructions of SC-KEM/tag-KEM, which satisfy confidentiality and unforgeability with respect to adversarially chosen keys where the adversary is given more advantageous attack environment than existing models in the literature;are based on the standard decisional bilinear Diffie-Hellman and computational Diffie-Hellman assumptions without random oracle;do not use strongly unforgeable signature schemes as building blocks; andprovide comparable performance to existing SC-KEM/tag-KEM schemes.

A typical but trivial layout of alphanumeric buttons in the touchscreen setting is to arrange the 10 digits and 26 letters in a natural order. This arrangement does not take into account the frequencies of letters and digits when the users touch the buttons to key in their passwords or messages. We examine large scale datasets of over 141 million passwords collected from several leading websites for social networking, Internet forums, gaming, dating, and various other online service providers in China, and find that the distribution of letters in passwords is quite close to that in Chinese language. Based on the letter/digit frequencies, we further propose an alphanumeric button layout scheme with the following advantages: the buttons are clicked as uniformly as possible, so that the lifetime of the touchscreen can be prolonged and finger oil residues may scatter more evenly over the button area of the screen; and in the meantime, the movements of users' fingers are improved to enhance good user experience when inputting messages. The idea behind the layout is potentially applicable to diversified races.

Graphical password methods rely on human experience and hand selection (not well-quantified metric) to evaluate the appropriateness and the confusion of the challenge images. In this paper we propose to use for authentication Chinese characters, for which the entropy can be up to 9.65 (much larger than other languages). We first show an algorithmic framework to authenticate a user and then present an empirical analysis conducted at a university. The advantages of the framework include the following: the storage overhead is low; no personal experience or hand selection is involved; there is no predefined dictionary of likely choices; and it can be easily referenced by personal-style cues. Our study shows that the number of participants that prefer our framework is much close to that in favor of graphical passwords, with an interesting outcome that the two groups of participants present significantly distinct backgrounds. Our framework and graphical passwords can be used as candidate authentication methods for users with different backgrounds. We also measure user choices of patterns and find that there is a slight preference of the 3$\times$3 grid to the circle patterns. While the proposed framework prescribes the challenge characters, the users have the option to define challenge characters of their own.

ABSTRACT Optimal signatures (generating signatures as short as possible), which achieve the optimal bandwidth for communication, are extremely useful in bandwidth‐critical networks. Previous approaches use the random permutations with large block size as building blocks, which incurs less efficient implementations in the real world. Meanwhile, all the practical signature schemes are not optimal in bandwidth including PSS‐R (probabilistic signature scheme with message recovery ), FDH ( Full Domain Hash), and DSA (Digital Signature Algorithm). This paper presents three constructions for optimal signature schemes. All the proposals use both the random oracles and the ideal ciphers with smaller block sizes as building blocks to obtain optimal paddings for signature schemes. The ideal ciphers in our schemes can be implemented by real block ciphers (e.g., AES (Advanced Encryption Standard)‐256). Concrete implementations of these signature schemes can utilize the trapdoor permutations of Rabin and RSA, respectively. Surprisingly, RSA and Rabin (trapdoor permutations) lead to not only optimality in bandwidth but also a tight security. Therefore, besides yielding secure signatures with high efficiency, our proposals can also be flexibly applied to the bandwidth‐limited networks that reduces the communication cost as less as possible. Copyright © 2014 John Wiley & Sons, Ltd.

ABSTRACT Anonymous password authenticated key exchange (APAKE) protocols allow the server to authenticate its clients without revealing their identities. In this paper, we first construct a basic protocol SAPAKE by using the homomorphic encryption scheme and an auxiliary memory device. Compared with the previous ones, SAPAKE is more suitable for those privacy‐sensitive applications (e.g., cloud computing) where reducing server payload and improving user experience are both essential. Furthermore, we refine SAPAKE by removing the use of the memory device to gain an enhanced extension SAPAKE+ without increasing the resources consumption. SAPAKE+ achieves better user‐friendliness than SAPAKE while it requires publishing more public parameters. Both of our protocols are practical due to their low (computation and communication) resources consumption and better user‐friendliness, and achieve provable security in the random oracle model. Copyright © 2012 John Wiley & Sons, Ltd.

ABSTRACT Blind signatures are generated by means of a protocol between the signer and a user such that the signer can neither see the message being signed and nor learn any information on the signature being produced. Time/space complexity and security model (random oracle model versus standard model; sequential, parallel, or concurrent security) are commonly used to evaluate blind signature schemes. The paper presents the first round‐optimal blind signatures without random oracles or non‐interactive zero‐knowledge proofs. The proposed blind signature scheme achieves concurrent security and perfect blindness while preserving the efficiency of computation and communication. A novel class of computational problems, called one‐more‐output (OMO) problems, is introduced to prove the unforgeability of the scheme. The paper states the corresponding lower bound of the OMO problem in the generic group model. Such a computational problem might be of independent interests in designing other cryptographic protocol and primitives. Copyright © 2011 John Wiley & Sons, Ltd.

It is very important to analyze the bandwidth and transmission error rate in the study of probabilistic timing covert channels. For the purpose, a simulation system of probabilistic timing covert channels has been set up in the paper. The simulation results show that (1) the bandwidth and the transmission error rate of probabilistic timing covert channels are closely related to the hardware/software environment, probability factor, time factor and/or coding methods as well as scheduling times; (2) the approximate transmission error rate can be measured with the central limit theorem; (3) it is not accurate to estimate the amount of information leakage based on weak probabilistic bisimulation; and (4) in probabilistic timing covert channels, there exist some characteristics which are different from non-deterministic covert channels.