Traditional intrusion detection normally struggles on effective feature modeling and model adaptation to heterogeneous data. To overcome these limitations, we propose to optimize the model applications with Multi-Source Feedback-Driven Coalition for Adaptive Intrusion Detection, a novel framework that combines dynamic task dispatching with coalition-based collaborative learning. Our method integrates feedback-aware dispatching based on data modality, coalition workload, classifier entropy, and marginal utility contributions. Heterogeneous agents are trained within coalitions, followed by intra-coalition parameter aggregation to enhance cooperation. A Shapley-value-based game-theoretic mechanism adjusts the coalition weights by evaluating their contributions to the global performance, mitigating the influence of underperforming coalitions. Empirical evaluations on CIC-IDS2017 and NSL-KDD datasets show that the proposed achieves detection accuracies of 99.20% and 98.70% respectively, outperforming the baseline methods in terms of false positive and false negative rates, and demonstrating strong robustness and generalization.

The key requirement for underwater image enhancement (UIE) is to overcome the unpredictable color degradation caused by the underwater environment and light attenuation, while addressing issues, such as color distortion, reduced contrast, and blurring. However, most existing unsupervised methods fail to effectively solve these problems, resulting in a visual disparity in metric-optimal qualitative results compared with undegraded images. In this work, we propose an implicit neural-guided cyclic generative model for UIE tasks, and the bidirectional mapping structure solves the aforementioned ill-posed problem from the perspective of bridging the gap between the metric-favorable and the perceptual-friendly versions. The multiband-aware implicit neural normalization effectively alleviates the degradation distribution. The U-shaped generator simulates human visual attention mechanisms, which enables the aggregation of global coarse-grained and local fine-grained features, and enhances the texture and edge features under the guidance of shallow semantics. The discriminator ensures perception-friendly visual results through a dual-branch structure via appearance and color. Extensive experiments and ablation analyses on the full-reference and nonreference underwater benchmarks demonstrate the superiority of our proposed method. It can restore degraded images in most underwater scenes with good generalization and robustness, and the code is available at https://github.com/SUIEDDM/INGC-GAN.

Abstract Image recognition on deep neural network is vulnerable to adversarial sample attacks. The adversarial attack accuracy is low when only limited queries on the target are allowed with the current black box environment. This paper proposes a target adversarial attack algorithm discrete cosine transform‐mean target feature attack (DTFA) based on the target features and a limited‐area sampling method. The algorithm first examines the original image and a target image to generate an initial adversarial example. Then the disturbance is sampled from the low‐frequency region intercepted by Gaussian noise after discrete cosine transform. The authors determine the size of the disturbance according to the difference between the adversarial example and the original image with consideration of the number of iterations and the position of the target feature region. The disturbance is applied on the initial adversarial example to generate the new adversarial example with the difference from the original image reduced. To evaluate the proposed algorithm, based on the common image classification model InceptionV3, and with identical queries accessing the same target model, the authors conduct experiments to compare the attack effectiveness of DTFA and the benchmark algorithms on the same image and target datasets. Experimental results show that the generated adversarial examples by the proposed algorithm are superior to 94% of those by the similar attack algorithms with less than 10,000 access queries on the target model.

Although we may observe heterogeneous traffic appearance on the network backbone, malicious traffic tends to converge with their traffic appearance similarity due to the consistent hostile behaviors of the same anomaly category. Measuring such traffic similarity of host behaviors can help us to detect anomalous traffic from benign traffic. This paper proposes a novel framework for the detection of network intrusion based on traffic similarity measures and clustering. We apply the grouping and DBSCAN method to feature dimensionality reduction so that traffic carrying the same category anomalies is concentrated in the limited amount of clusters, which can be interpreted as the structured significant characteristics of the corresponding anomaly category. The derived anomaly cluster characteristics are useful for detecting newly coming traffic in future for its maliciousness. Based on the experiment with the IDS 2018 dataset, our proposed detection procedure can effectively separate the malicious network traffic from background with an accuracy of up to 96%. Our proposed method has apparent benefits for identifying malicious traffic in large-scale network traffic data, and it is a practical intrusion detection method.

In response to the surging challenge in the number and types of mobile malware targeting smart devices and their sophistication in malicious behavior camouflage, we propose to compose a traffic behavior modeling method based on one-dimensional convolutional neural network with autoencoder and independent recurrent neural network (1DCAE-IndRNN) for mobile malware detection. The design solves the problem that most existing approaches for mobile malware traffic detection struggle with capturing the network traffic dynamics and the sequential characteristics of anomalies in the traffic. We reconstruct and apply the one-dimensional convolutional neural network to extract local features from multiple network flows. The autoencoder is applied to digest the principal traffic features from the neural network and is integrated into the independent recurrent neural network construction to highlight the sequential relationship between the highly significant features. In addition, the Softmax function with the LReLU activation function is adjusted and embedded to the neurons of the independent recurrent neural network to effectively alleviate the problem of unstable training. We conduct a series of experiments to evaluate the effectiveness of the proposed method and its performance for the 1DCAE-IndRNN-integrated detection procedure. The detection results of the public Android malware dataset CICAndMal2017 show that the proposed method achieves up to 98% detection accuracy and recall rates with clear advantages over other benchmark methods.

Side-channel analysis (SCA) becomes a serious realistic threat to crypto devices, it is thus imperative to evaluate the resistance of a device to SCA. Side-channel leakage detection aiming to identify the leakage points potentially revealing secrets in side channel signals, is considered as a preliminary step before further security assessment. This work proposes a novel black-box leakage detection approach, which views the side channel as a constant parameter communication channel when it outputs leakage points. The approach distinguishes leakage points by utilizing the kurtosis-based consistency check for channel parameter estimators. To examine the efficiency of this approach, false negative and false positive rates were first quantitatively analyzed by comprehensive experiments. Considering the fact that side-channel leakage can be from multiple channels in practice, we further investigated the applicability of the proposed approach to multi-channel leakage detection. Interestingly, equipped with the proposed detection approach, we correspondingly devised a novel side-channel attack exploiting a kurtosis-based distinguisher. Overall, extensive experiments have validated the efficiencies of our proposed leakage detection method and the novel SCA attack.

This paper proposes a novel approach to software defined networking, which not only gives smaller organizations a means to access enterprise networking features that are normally out of their price range (such as BGP sessions and utilizing their own public IP address spaces), but also offers a simplified network topology for organizations whose physical segments are disaggregated throughout a large number of smaller branch offices as opposed to a few large offices. In addition, this approach provides an efficient means of adopting of IPv6 in regions where native IPv6 is not yet available.

In this paper, we present a modeling and learning method to analyze the network behavior of mobile applications based on the Android platform. Various application system sand environmental factors are simulated in order to trigger different categories of application behaviors. The sequence of network event behavior is retrieved and classified according to the behavior sequence combination using a Bi-directional Long Short-term Memory network. The trained classifier is applied to separate Android apps in eight different categories for normal behaviors, and achieves an optimal classification accuracy of 96.89%. The trained model can further be extended for the purpose of malware detection. In addition, we use Wasserstein Generative Adversarial networks to enhance the data and thus efficiently magnify the underlying behavior features in the training dataset. This solves the problem of limited data samples and time overhead and increases the diversity of data. The accuracy of the original Bi-LSTM model is further improved by 9% across the tested categories of Android apps.

LEO constellation has received intensive research attention in the field of satellite communication. The existing centralized authentication protocols traditionally used for MEO/GEO satellite networks cannot accommodate LEO satellites with frequent user connection switching. This paper proposes a fast and efficient access verification protocol named BAVP by combining identity-based encryption and blockchain technology. Two different key management schemes with IBE and blockchain, respectively, are investigated, which further enhance the authentication reliability and efficiency in LEO constellation. Experiments on OPNET simulation platform evaluate and demonstrate the effectiveness, reliability, and fast-switching efficiency of the proposed protocol. For LEO networks, BAVP surpasses the well-known existing solutions with significant advantages in both performance and scalability which are supported by theoretical analysis and simulation results.

Grid computing, as a technology to coordinate loosely-coupled computing resources for dynamic virtual organizations, has become prevalent in both industry and academia in the past decade. While providing or utilizing heterogeneous and distributed grids, people can never alleviate their security concerns on the resources and data. Globus Toolkit as an open-source grid environment has implemented the public key infrastructure (PKI) and extended it for proxy-certificate-based delegation propagation with a series of separate and command-line-based components and services. We have built an integrated web service system to coordinate all of Globus's components and services that are needed for user credential management. Our system can reduce the necessary operations on creating and maintaining user credentials in Globus. The system also simplifies the procedure of deploying or accessing Globus services for user authentication, authorization, and identity and authority delegation. We provide a light-weighted Mozilla Firefox add-on on the client side to interact with our online system. On the server side, we implement web services for CA functionality, VOMS attribute certificate generation, and proxy delegation and retrieval, which satisfy the typical needs of most Globus users. Although our current solution is designed for integrating and automating all the credential-related operations for Globus users, it is portable for other online service platforms using similar PKI and delegation mechanisms.

Network telescopes have been invaluable for collecting information about dynamics of large-scale worm events. Yet, a telescope's observation may be incomplete due to scan congestion drops, hardware limitations, filtering and presence of NATs, a worm's non-uniform scanning strategy or its short life. We investigate inaccuracies in telescope observations that arise from worm-induced congestion drops of worm scans and show that they may lead to significant underestimates of the number of infectees and their scanning rate. We propose a method to infer worm-induced congestion drops from telescope's observations and use them to accurately estimate global worm dynamics. We apply our methods to CAIDA telescope's observations of Witty worm's spread, and release corrected statistics of worm dynamics for public use.