Graph neural networks (GNNs) enable many novel applications and achieve excellent performance. However, their performance may be significantly degraded by the graph adversarial attacks, which intentionally add small perturbations to the graph. Previous countermeasures usually handle such attacks by enhancing model robustness. However, robust models cannot identify thetarget nodesof the adversarial attacks, and thus we are unable to pinpoint the weak spots and analyze the causes or the targets of the attacks. In this article, we study the important research problem to detect thetarget nodesof graph adversarial attacks under theblack-box detectionscenario, which is particularly challenging because our detection models do not have any knowledge about the attacker, while the attackers usually employ unnoticeability strategies to minimize the chance of being detected. To our best knowledge, this is the first work that aims at detecting thetarget nodesof graph adversarial attacks under theblack-box detectorscenario. We propose two detection models, namedDet-HandDet-RL, which employ different techniques that effectively detect the target nodes under the black-box detection scenario against various graph adversarial attacks. To enhance the generalization of the proposed detectors, we further propose two novel surrogate attackers that are able to generate effective attack examples and camouflage their attack traces for training robust detectors. In addition, we propose three strategies to effectively improve the training efficiency. Experimental results on multiple datasets show that our proposed detectors significantly outperform the other baselines against multiple state-of-the-art graph adversarial attackers with various attack strategies. The proposedDet-RLdetector achieves an averaged area under curve (AUC) of 0.945 against all the attackers, and our efficiency-improving strategies are able save up to 91% of the training time.

The rapid development of cross-border e-commerce over the past decade has accelerated the integration of the global economy. At the same time, cross-border e-commerce has increased the prevalence of cybercrime, and the future success of e-commerce depends on enhanced online privacy and security. However, investigating security incidents is time- and cost-intensive as identifying telltale anomalies and the source of attacks requires the use of multiple forensic tools and technologies and security domain knowledge. Prompt responses to cyber-attacks are important to reduce damage and loss and to improve the security of cross-border e-commerce. This article proposes a digital forensic model for first incident responders to identify suspicious system behaviors. A prototype system is developed and evaluated by incident response handlers. The model and system are proven to help reduce time and effort in investigating cyberattacks. The proposed model is expected to enhance security incident handling efficiency for cross-border e-commerce.

User name and password are the most commonly used user authentication scheme in information systems. Strong passwords are secure but difficult to remember, so many users prefer easy-to-remember passwords. These weak passwords are also easily guessed by attackers, leading to online password guessing attacks, posing a serious security threat to information systems. Providing a reliable user authentication scheme to allow legitimate users to login while preventing online password guessing attacks is a challenge. We define a formal statistical model for the behavior of users and attackers, and differentiate users and attackers according to this model. The proposed solution computes the entropy of the passwords entered by the user and considers the user legitimate only if the entropy does not exceed a threshold. We show that entropy is an effective feature to distinguish legitimate users from attackers. We also show that the proposed user authentication scheme is effective in identifying password guessing attacks, even if the user chooses a common password. The new scheme adds an extra layer of protection to passwords, which is especially important for weak passwords. The scheme is a slight modification of the existing scheme, so it can be easily integrated into existing systems.

ABSTRACT Network continues to be under various attacks every day. One common attack is to use password guessing to intrude a machine and then to inject malware or botnet for future control. To develop counter measures, honeypot technique, which simulates a real system, is often used for capturing attack patterns, malware or botnet, and malware download sites. However, neither low‐interaction nor medium‐interaction honeypot could simulate well the behaviors in a true system as a result of the inborn restrictions in the technology so that the honeypot might be discovered by an attacker or malware. This study proposes a new honeypot system, Jingu, which is constructed with a true environment plus protection mechanism from being circumvented. The proposed high‐interactive honeypot system, Jingu, can achieve the following goals: (1) not be perceived by attackers; (2) to protect against being attacked; (3) to record and learn attack behaviors; (4) to capture malware; and (5) to collect valuable information for detection purpose. Jingu has been deployed on a real network for 2 years. Comparing with the low‐interactive honeypot, honeyd, Jingu can successfully catch attack behaviors as well as can capture malware. The results show that the proposed system is able to block real attacks and to collect valuable information for future detection and malware analysis. Copyright © 2012 John Wiley & Sons, Ltd.

The prevailing of mobile network provides increasing web applications and services available on mobile devices. However, most of the websites are developed with limited security consideration, let alone web services for mobile users. Hackers take advantage of the web-based vulnerabilities to inject malicious JavaScript into compromised web pages, and a mobile victim visits the site will be compromised. Current anti-virus software for mobile devices is not adequate to protect mobile users from malicious web pages. Based on our observation, mobile malicious web pages have unusual behaviors for evading detection which makes them different form normal ones. Therefore, we propose a client-side malicious web page detection method based on anomaly behaviors observed from web page analysis. Based on the experimental results, our method can identify malicious web page efficiently and warn the website visitors before browsing.

With the incoming of information era, web-based service has been developed rapidly and offered more and more business. These “open”, and widely “web enabled” applications are subject to greater and greater levels and types of attacks as hackers exploit vulnerabilities within the software like SQL Injection and Cross Site Scripts (XSS) attack. In this paper, we proposed a type of novel Embedded Markov Model (EMM) to detect different web application attacks, monitor the on-line user behavior and defend the malevolent user promptly. Comparing to previous web application attacks detecting approaches, our EMM approach can not only detect user’s invalidated input errors but also find out the unreasonable page transition behavior. By detecting unreasonable page transition, we can immediately defend the malevolent or silly user behavior to avoid the further web system failures and sensitive information disclosure. Furthermore, we implement an on-line user behavior surveillance system and use the real web traffic to evaluate the performance of our system. The experiment results show that our proposed EMM method can discover the abnormal behavior of malevolent user and detect the invalidated input attacks like SQL injection, XSS and string buffer overflow attacks.

This paper proposes a tree-based adaptive broadcasting (TAB) algorithm for data dissemination to improve data access efficiency. The proposed TAB algorithm first constructs a broadcast tree to determine the broadcast frequency of each data, and splits the broadcast tree into some broadcast wood to generate the broadcast program. We learn from the experimental results that the bandwidth for both index channel and data channel can be optimally allocated to maximize bandwidth utilization.

In this study, we propose an object-based multimedia model for specifying quality of service (QoS) requirements, such as the maximum data-dropping rate or the maximum data-delay rate. We also present a resource allocation model, the net-profit model, in which the satisfaction of users' QoS requirements is measured by the net profit earned by the system. Based on the net-profit model, the system is rewarded if it can allocate enough resources to a multimedia delivery request and fulfill the QoS requirements specified by the user. At the same time, the system is penalized if it cannot allocate enough resources to a multimedia delivery request. The paper examines the problem of how to allocate a resource efficiently such that the QoS satisfaction is maximized, based on the net-profit model. We derive optimal scheduling schemes according to the QoS requirements specified by users. Partial data dropping can reduce the bandwidth consumption, while some important data for multimedia playback might be missed. Transmission delay allows transmitting more data with loose QoS requirements, but it might be unacceptable for real-time multimedia data. Thus, our scheduling policy is based on the hybrid scheme of the dropping and delaying policies.

We consider the scheduling problem for periodic tasks with relative timing requirements. Specifically, the timing constraints imposed on the consecutive executions of a task and the inter-task temporal constraints across task periods are considered. A pre-run-time timing analysis technique is applied to the set of tasks. A schedule is generated in which the length of the schedule is the least common multiple (LCM) of all periods. Experiments are conducted to evaluate the performance of the algorithm.

We study resource synchronization in multiprocessor hard real-time systems. Specifically, we propose a multiprocessor resource control protocol which allows a job to simultaneously lock multiple global resources, removing a restriction from previous protocols. Allowing nested critical sections may permit a finer granularity of synchronization, increasing parallelism and throughput. All the protocols discussed belong to the class of priority inheritance protocols and rely in some fashion on priority ceilings for global semaphores. The extended protocol prevents deadlock and transitive blocking. We derive bounds for worse case blocking time, and describe sufficient conditions to guarantee that m sets of periodic tasks can be scheduled on an m multiprocessor system.