Recently, differential-neural cryptanalysis, which combines deep learning with differential cryptanalysis, has gained attention as a powerful and practical cryptanalysis method. In this approach, a neural distinguisher is trained to distinguish the target cipher with specific differential properties from other ciphers, and its statistical analysis is used to guess the key. This approach offers the advantage of enabling deep learning to analyze cryptographic properties, traditionally demanding substantial time and expertise. Nevertheless, the black-box nature of deep learning models poses challenges for cryptanalysts in comprehending the construction of the differential dataset and the neural distinguisher. In particular, since the differential dataset serves as the foundation for generating the neural distinguisher, there is a pressing need for an effective methodology to construct a high-quality differential dataset. However, the existing approaches for the generation of differential dataset is based on the well-known differential characteristic or exploring through the training neural distinguisher. In this paper, we analyzed the intrinsic property of differential dataset and proposed a novel approach to construct a good differential dataset for differential-neural cryptanalysis. First, we conducted an analysis to find the difference between well-trainable differential datasets and other differential datasets using Principal Component Analysis (PCA) and K-means clustering. As a result, the well-trainable differential dataset has a property that there are some principal components who can well express the variance of the whole dataset, the data construct clusters in the principal components-based reduced dimension. Building upon our analysis results, we proposed the exploring algorithm for the generation of well-trainable differential dataset. This proposed algorithm assesses the input differences within the differential dataset by identifying significant principal components. If such components are found, a cluster evaluation is performed on the differential dataset using the silhouette score, which quantifies the quality of cluster formation. In our experiments, the proposed algorithm successfully identified favorable input differences, leading to improved accuracy in neural distinguisher training for SPECK and SIMON. Compared to the performance of the existing Gohr's neural input difference algorithm, our proposed algorithm was more effective in finding good input differences with higher accuracy. From the perspective of execution time, it showed an improvement of approximately 30%.

Huang et al. introduced the conditional cube attack at EUROCRYPT 2017, where it was presented as a conditional cube variable with specific key bit conditions that significantly reduced diffusion. This attack necessitates a set of cube variables that are not multiplied in the first round, while the conditional cube variable is not multiplied with ordinary cube variables during the initial two rounds. Sycon v1.0 is part of the first lightweight cryptography standardization processes initiated by the National Institute of Standards and Technology (NIST). Sycon was proposed as a high-performing simple permutation due to its resistance to cryptanalytic attacks. Sycon-AEAD consists of two authenticated encryption with associated data (AEAD) schemes: 1) Sycon-AEAD-64 and 2) Sycon-AEAD-96. This study presents a novel partial state recovery conditional cube attack on Sycon-AEAD-64, which can recover 141 out of 256 bits of partial secret state with a data complexity of$2^{52.21}$.

Cyber-threat intelligence (CTI) is a knowledge-based threat management system that addresses increasing cyber threats. The CTI system creates reputation information for network resources such as IP, URL, and file hash-based on security data collected from security information and event management (SIEM) systems. This information can be applied extensively in industrial infrastructures to provide an effective response process for cyber attacks. This information can also be applied to the security systems of internal IT and OT infrastructures such as Internet objects (IoT) and Surveillance Control and Data Acquisition (SCADA) networks. However, because the performance of infrastructure security using CTI depends on the accuracy of the data on which the system is based, careful consideration of the accuracy of the data is required. In this paper, we propose a new model that can analyze the reliability and validity of data by using comparative analysis between CTI data and present a criterion for evaluating the reliability of feed providing CTI data. The experiment uses approximately 40 000 datasets to provide data accuracy results for four CTI feeds. These results can serve as a basis for substantive validation to use CTI data.

This paper proposes a tracklet-based algorithm for online multiple-target tracking. The algorithm performs tracking in three steps: (1) tracklet initialization, (2) tracklet refinement, and (3) tracklet association. Given detection responses, tracklets are initialized by finding a near-optimum path in the min-cost flow network using a greedy-based algorithm. Based on an appearance-based model, the tracklets are refined so that the detection responses within the tracklet become more homogeneous. Finally, the tracklets are linked based on a novel affinity measure, then by optimizing a min-cost flow network with links, the final tracks are generated. For real-time multi-target tracking, every step is processed in a segment-wise manner. On popular public datasets and strictly in an online fashion, the proposed multi-target tracking algorithm performed comparable to that of many state-of-the-art algorithms.

Sharing copyright protected content without the copyright holder’s permission is illegal in many countries. Regardless, the number of illegal file sharing using BitTorrent continues to grow and most of file sharers and downloader are unconcerned legal action to transfer copywrite-protected files. However, it is difficult to gather enough probative evidence to prosecute illegal file sharers in criminal court and/or sued for damages in civil court. Further, there is a lack of research on investigation techniques to reveal illegal BitTorrent sharers. This is because the role of the server in BitTorrent networks has been changed compared to servers in conventional P2P networks. As a result, it is difficult to apply previous investigation processes for investigation of conventional P2P networks to the investigation of suspected illegal file sharing using BitTorrent. This paper proposes a methodology for the investigation of illegal file sharers using BitTorrent networks through the use of a P2P digital investigation process.

Real-time multi-object tracking is one of the most challenging problem in computer vision. Based on integer linear programming (ILP) formulation for object tracking [1, 2], we propose the greedy algorithm for real-time multi-object tracking. The experimental result shows that the performance of the proposed algorithm is competitive to the previous state-of-the-art algorithms on off-line video data, and its running time is also sufficient for analyzing the tracks of object in real-time video data.

ABSTRACT When a forensic investigation is carried out in the enterprise environment, most of the important data are stored in database servers, and data stored in them are very important elements for a forensic investigation. As for database servers with such data stored, there are over 10 various kinds, such as SQL Server and Oracle. All the methods of investigating a database system are important, but this study suggests a single methodology likely to investigate all the database systems while considering the unique characteristics of each database system. A method of detecting a server and acquiring and investigating data in the server can be effectively used for such an investigation on the enterprise environment. For the existing investigation on server systems, severs should be shut down, and disc imaging should be conducted first. However, such a method may inflict great losses on the company in some cases. That is why we need a method to acquire data of a server in on‐line state, and this study discusses this method. Besides, on the basis of methodology, this study attempts to determine a possibility that this new forensic investigation method can be practically used by directly applying this method to SQL Server and MySQL databases. Copyright © 2012 John Wiley & Sons, Ltd.