With the rapid growth of the Internet of Things (IoT) devices, a lot of IoT malware has been created, and the security against IoT malware, especially the family classification, has become a more important issue. There exist three requirements which classification systems must achieve: detection of new families, precise classification for sequential inputs, and being independent of computer architectures. However, existing methods do not satisfy them simultaneously. In this paper, we propose a realtime IoT malware classification system based on pending samples. In order to detect new families and to classify sequential inputs precisely, we introduce the concept of “pending samples”. This concept is useful when heterogeneous inputs which are difficult to classify instantly come into the system. This is because the system can postpone classifying them until similar samples come. Once similar samples are gathered, we regard these samples as a new cluster, meaning that detecting new families is achieved. Moreover, we use printable strings to satisfy the requirement of being independent of architectures because strings are common among different architectures. Our results show the ability to detect new families demonstrated by finding new clusters after applying our algorithm to the initial clusters. Furthermore, our new clustering algorithms achieves a 0.130 higher V-measure compared to the k-means algorithm, which is the representative clustering algorithm.

Data flow analysis is an essential technique for understanding the complicated behavior of malicious scripts. For tracking the data flow in scripts, dynamic taint analysis has been widely adopted by existing studies. However, the existing taint analysis techniques have a problem that each script engine needs to be separately designed and implemented. Given the diversity of script languages that attackers can choose for their malicious scripts, it is unrealistic to prepare taint analysis tools for the various script languages and engines.

Malicious scripts have been crucial attack vectors in recent attacks such as malware spam (malspam) and fileless malware. Since malicious scripts are generally obfuscated, statically analyzing them is difficult due to reflections. Therefore, dynamic analysis, which is not affected by obfuscation, is used for malicious script analysis. However, despite its wide adoption, some problems remain unsolved. Current designs of script analysis tools do not fulfill the following three requirements important for malicious script analysis. (1) Universally applicable to various script languages, (2) capable of outputting analysis logs that can precisely recover the behavior of malicious scripts, and (3) applicable to proprietary script engines.

Public-key encryption with keyword search (PEKS) is a cryptographic primitive that allows us to search encrypted data for those of including particular keywords without decrypting them. PEKS is expected to be used for enhancing security of cloud storages. It is known that PEKS can be constructed from anonymous identity-based encryption (IBE), anonymous attribute-based encryption (ABE) and so on. It is believed that it is difficult to construct PEKS schemes that can specify a flexible search condition such as logical disjunctions and logical conjunctions from weaker cryptographic tools than ABE. However, this intuition has not been rigorously justified. In this paper, we formally prove it by constructing key-policy ABE from PEKS for monotone boolean formulas.

Reliable authentication requires the devices and channels involved in the process to be trustworthy, otherwise authentication secrets can easily be compromised. Given the unceasing efforts of attackers worldwide such trustworthiness is increasingly not a given. A variety of technical solutions, such as utilising multiple devices/channels and verification protocols, has the potential to mitigate the threat of untrusted communications to a certain extent. Yet such technical solutions make two assumptions: (1) users have access to multiple devices and (2) attackers will not resort to hacking the human, using social engineering techniques. In this paper, we propose and explore the potential of using human-based computation instead of solely technical solutions to mitigate the threat of untrusted devices and channels. ZeTA (Zero Trust Authentication on untrusted channels) has the potential to allow people to authenticate despite compromised channels or communications and easily observed usage. Our contributions are threefold: (1) We propose the ZeTA protocol with a formal definition and security analysis that utilises semantics and human-based computation to ameliorate the problem of untrusted devices and channels. (2) We outline a security analysis to assess the envisaged performance of the proposed authentication protocol. (3) We report on a usability study that explores the viability of relying on human computation in this context.

Abstract In this paper, we present a proxy re‐encryption (PRE) scheme via an indistinguishability obfuscation ( ) by adding two algorithms to the public key encryption scheme by Sahai and Waters' (STOC 2014). Although a re‐encryption function from one public key to another can be considered as a randomized functionality on the underlying plaintext and that functionality can be achieved by using a probabilistic by Canettiet al.(TCC2015), we need a sub‐exponential to construct the probabilistic . In our construction, we need not the probabilistic but the standard . In addition, our proposed PRE scheme has some good properties. That is, unidirectional re‐encryption, unbounded multi‐hop re‐encryption, constant‐size ciphertext, and fast decryption. To the best of our knowledge, this is the first construction of a multi‐hop and unidirectional PRE scheme. Copyright © 2016 John Wiley & Sons, Ltd.

C LOUD computing is the future but it will not be if users' security concerns remain unaddressed.Cloud security issues include data privacy, data integrity, and service availability, among others.Due to the extra computing involved, security controls often incur a certain amount of performance degradation in cloud computing where performance is crucial and its computation and communication complexities are already high.This poses challenges to system developers with regards to preventing privacy leaks, performing data auditing, and guaranteeing high availability in the face of various security attacks.On the other hand, should the task of addressing these security issues be solely placed on the shoulders of the cloud service providers, or indeed should both the service providers and the service users be responsible for this task?A number of studies have been carried out that investigate the fundamental properties of cloud security issues, including data auditing, searchable data encryption, hypervisor protection, cloud forensics, and disaster recovery, to name but a few.In fact, cloud security is driving how we define and develop cloud computing solutions.The objective of this special issue is to provide a forum for researchers working on cloud security to present their recent research results.This special issue attracted 58 submissions of high quality research from around the world.Through a rigorous review process, the following 10 papers were selected for publication.These papers present results of analysis, experimentation, simulation, advanced theories, and system implementation.More specifically, they cover the topics of Operating System (OS) Fingerprinting, Side-Channel Attacks, Attribute-Based Signatures (ABSs), Fuzzy Authorization for Cloud Storage, Secure Software-Defined Network (SDN) Architecture for Cloud, Self-Destructing Data, Secure Group Data Sharing, Data Access Control for Peer-to-Peer Storage Cloud, SQL Operations on Encrypted Data, and Linear Regression

It is known that different users have different degrees of accuracy in biometric authentication, and claimants and enrollees who cause false accepts against many others are referred to as wolves and lambs, respectively. The aim of this paper is to develop a fusion algorithm, which has security against both of the animals while minimizing the number of query samples a genuine claimant has to input. To achieve our aim, we first introduce a taxonomy of wolves and lambs, and propose a minimum log-likelihood ratio-based sequential fusion scheme (MLR scheme). We prove that this scheme keeps wolf attack probability and lamb accept probability, the maximum of the claimant-specific false accept probability (FAP), and the enrollee-specific FAP, less than a desired value if log-likelihood ratios are perfectly estimated, except in the case of adaptive spoofing wolves. We also prove that this scheme is optimal with regard to false reject probability (FRP), and asymptotically optimal with respect to the average number of inputs (ANIs) under some conditions. We further propose an input order decision scheme based on the Kullback-Leibler (KL) divergence, which maximizes the expectation of a genuine log-likelihood ratio, to further reduce ANI of the MLR scheme in the case where the KL divergence differs from one modality to another. The results of the experimental evaluation using a virtual multimodal (one face and eight fingerprints) data set showed the effectiveness of our schemes.

The advance of ISM-band radio-based tracking systems (for example, wireless LAN-based tracking system) extends the application of location-based services (LBS), but it also threatens to allow the movement of users to be tracked when they are transmitting frames. Several protection methods based on periodic address updates have already been proposed. However, new correlation attacks, which utilize the correlation between the old and new addresses of the same node, can defeat current protection methods. To combat such attacks, we propose the concept of a silent period. A silent period is defined as a transition period between the use of new and old pseudonyms, when a node is not allowed to disclose either the old or the new address. Through analysis, we find that a silent period should contain a constant period and a variable period. The effect of the constant period is to mix the spatial relation between the node's disappearing points and emerging points. The variable period mixes the temporal relation between the node's disappearing times and emerging times. We evaluate the performance of the silent period through simulation. The results show that the silent period proposal significantly reduces the duration of time a node can be tracked continuously. There are still many open research problems before random address can be implemented to protect wireless location privacy, but silent period protocol is the first step to realizing it.