Micro-segmentation (MSG), a pillar of Zero-Trust, provides fine-grained access control for east-west traffic between cloud endpoints (VMs/containers). Admins formulate strict whitelisting MSG policies that allow necessary traffic. However, current MSG systems lack the computability foundation to resolve policy inconsistencies, where policy overlap can cause conflicts that violate the security requirements, and to verify policy reachability to avoid erroneously blocking necessary traffic. Meanwhile, current MSG systems lack comprehensive dynamicity processing, including maintaining invariants when updating MSG policies and promptly adjusting policy enforcement for endpoint status changes. We propose IMS, the first intent-driven MSG system towards computability and dynamicity. IMS innovatively defines the endpoint group space and algebra, providing the computability foundation for formally and automatically verifying and processing MSG policies. Based on this, IMS implements functionalities to resolve policy inconsistencies and to verify policy reachability. Meanwhile, IMS achieves comprehensive and prompt dynamicity processing. IMS fulfils the verification and dynamicity processing requirements of intent-driven systems. We implement a prototype and evaluations show that the processing time of IMS functionalities scales linearly with the number of policies, and the average endpoint dynamicity processing time is 5.05 ms in the setup of 1,000 endpoints, illustrating that IMS is scalable and can process dynamicity promptly.

Software-Defined Networking (SDN) decouples the data plane from the control plane, enabling centralized control and open programmability of the network. OpenFlow flow rules are the key carrier for the SDN application to configure and manage the data plane through the control plane, and the processing efficiency of flow rules of the SDN controller in the control plane is critical as it will directly impact the instantaneity of configuring and managing the data plane. Currently, the controller increases the processing efficiency of flow rules by means of multi-threaded parallel processing. However, in the experiments of the widely used SDN controller ONOS, we found a new bottleneck in the parallel processing of flow rules that causes the performance gains from parallelism to be offset. Therefore, in this paper, we locate the bottleneck and analyze its causes through source code analysis and timestamp tests, propose a parallel event queue to resolve the bottleneck, and implement it in ONOS. Experiments show that our improved ONOS effectively resolves the bottleneck problem and achieves an average 3.57x improvement in the processing efficiency of flow rules compared to the original ONOS.

Masquerade attacks are one of the most dangerous threats in the cloud environment. Attackers masquerade as legitimate users obtaining access to illegally use cloud resources. If attackers masquerades as internal administrator with top-level privileges, they can change security policies or convey confidential information, causing irreparable damage to the system. Building trust on the user side is an important auxiliary to protect cloud resources. Most user trust evaluation research mainly extracts user behavior features to train basic machine learning models, which cannot accurately track abnormal user behavior in real time. In this paper, we propose a continuous user trust assessment scheme as an additional security layer to enhance secure access to cloud resources, which can effectively fuse behavior and contextual information to automatically detect user anomalies and serve as a criterion to assess user trust status. We test on an open-source Windows security log dataset. The experiments show that our approach continuously assesses user trust with good detection performance and alerts on time.

The one-time authentication mechanism in traditional authentication methods cannot continuously authenticate smartphone users’ identities throughout the session. Continuous authentication based on the behavioral biometrics recorded by the built-in sensors can solve this issue. However, the existing methods based on multisensor have poor ability to extract valuable features that can represent smartphone users’ behavioral patterns. This article proposes a novel method combining the manual construction and the deep metric learning method to perform two-stage feature extraction, respectively. We transform the time-series raw data from three sensors (accelerometer, gyroscope, and magnetometer) into 69 statistical features in the first stage. Furthermore, unlike the existing serial feature fusion methods, we innovatively fuse the constructed statistical features from three sensors into a three-channel matrix. Then, the fused features matrix with a three-channel is fed to the deep metric learning model for the second stage of feature extraction. We use the elliptic envelope algorithm to classify the user as a legitimate user or an impostor. Finally, we evaluate the performance of the proposed method on two public data sets. Experimental results show that our method can achieve an average accuracy of 99.71% and an average equal error rate (EER) of 0.56% on the hand movement, movement, orientation, and grasp data set, and an average accuracy of 99.59% and an average EER of 0.61% on the BrainRun data set.

Abstract Keystroke-based behavioral biometrics have been proven effective for continuous user authentication. Current state-of-the-art algorithms have achieved outstanding results in long text or short text collected by doing some tasks. It remains a considerable challenge to authenticate users continuously and accurately with short keystroke inputs collected in uncontrolled settings. In this work, we propose a Timely Keystroke-based method for Continuous user Authentication, named TKCA. It integrates the key name and two kinds of timing features through an embedding mechanism. And it captures the relationship between context keystrokes by the Bidirectional Long Short-Term Memory (Bi-LSTM) network. We conduct a series of experiments to validate it on a public dataset - the Clarkson II dataset collected in a completely uncontrolled and natural setting. Experiment results show that the proposed TKCA achieves state-of-the-art performance with 8.28% of EER when using only 30 keystrokes and 2.78% of EER when using 190 keystrokes.

With the dramatic increase in network speed during the past ten years, network processing efficiency has been significantly decreased. In this paper, we propose a network accelerating scheme, which employs cache locking method to reduce data and instruction accessing latency. Interrupts handling and buffer maintenance overheads are obviously decreased. Experimental results show that our solution increases about 22% network bandwidth and reduces 10% latency.