The Internet of Vehicles (IoV) is an emerging technology that enhances traffic security and transportation efficiency by enabling smart, connected vehicles to communicate and exchange messages. IoV networks are a key component of intelligent transportation systems in smart cities. However, these networks are vulnerable to malicious vehicles that disseminate deceptive messages or impersonate legitimate entities, which compromises network security. These adversarial vehicles jeopardize the integrity and availability of the IoV network, exposing it to various security threats, including both insider and outsider attacks. Such attacks can severely undermine the trust and reliability of communication between legitimate vehicles. To address these challenges, we propose TMSU-IoV, a UAV-assisted trust management scheme that integrates identity authentication technique and trust evaluation mechanism to ensure secure communication of connected vehicles in IoV networks. To counteract outsider attacks, we introduce a certificateless signature-based authentication method that guarantees the authenticity of messages exchanged between vehicles and UAVs. To mitigate insider threats, we propose a quality of service (QoS)-based trust evaluation mechanism. This mechanism consists of a prior trust evaluation method and a posterior trust evaluation method, designed to enhance both the credibility and timeliness of trust evaluation for connected vehicles. Formal security analysis confirms that the TMSU-IoV effectively resists a variety of insider and outsider attacks. Performance evaluation experiments demonstrate that the TMSU-IoV can accurately assess the trust levels of connected vehicles and outperform traditional trust evaluation methods.

In this paper, we propose a remote attestation approach based on multiple verifiers named CARE. CARE aims to enhance the practicality and efficiency of remote attestation while addressing trust issues within environments involving multiple stakeholders. Specifically, CARE adopts the concept of swarm verification, and employs a circular collaboration model with multiple verifiers to collect and validate evidence, thereby resolving trust issues and enhancing verification efficiency. Moreover, CARE introduces a meticulously designed filtering mechanism to address the issue of false positives in verification outcomes non-invasively. CARE utilizes a multiway tree structure to construct the baseline value library, which enhances the flexibility and fine-grained management capability of the system. Security analysis indicates that CARE can effectively resist collusion attacks. Further, detailed simulation experiments have validated its capability to convincingly attest to the trustworthiness of the dynamically constructed environment. Notably, CARE is also suitable for the remote attestation of large-scale virtual machines, achieving an efficiency 9 times greater than the classical practice approach. To the best of our knowledge, CARE is the first practical solution to address inaccuracies in remote attestation results caused by the activation of Integrity Measurement Architecture (IMA) at the application layer.

Website Fingerprinting (WF) aims to identify users’ visited websites from encrypted traffic traces, disabling the anonymity of encrypted communication like the Tor network. It is practical to use historically labeled (source) data, e.g., public datasets, to pre-train a WF model, and then collect few incoming (target) data to re-train this model within a low cost. Unfortunately, there is always a considerable difference of latent feature distributions between the source and target data (i.e., the cross-domain problem) and an inevitable bias of feature distribution caused by a limited volume of target data (i.e., the biased distribution problem). Although current Few-Shot Learning-based WF (FSWF) methods achieve satisfactory performance on the efficient establishment, they lack cross-domain transferability, and meanwhile, are unable to alleviate the distribution bias. In this paper, we first systematically analyze the cross-domain problem among different domains of traffics, revealing the ubiquity and dominant factors of it. To mitigate the cross-domain and biased distribution problems, we propose a Distribution Calibrated Website Fingerprinting (DCWF) method that incorporates a two-stage distribution calibration process and a tailored circle network. In the two-stage calibration process, we first devise a re-modeling mechanism capturing the information distribution of the target domain to extract representative features, and then design a calibration process to adjust the biased distribution of the target domain. Subsequently, a tailored circle network is proposed to reduce the noise caused by the calibration process. Finally, extensive experiments are conducted and the results demonstrate the superiority of our DCWF over comparisons under both close-world and open-world settings.

The adoption of lightweight container technology enables the cross-architecture deployment of Tiny Machine Learning (TinyML) models, while the implementation of container escape detectors ensures the security of both models and applications. However, a significant challenge faced by TinyML-based detectors is model aging, which leads to a substantial decline in their effectiveness as attack patterns evolve. Most existing approaches address this issue by retraining models through the labeling of new samples. However, this process can be costly and challenging to implement for updating models in resource-constrained UAVs networks. In this paper, we begin by analyzing the correlation of threat data and observe that throughout evolution, different versions of container escape attacks tend to maintain semantically identical or similar system calls. This observation prompts us to approach the model aging problem from a novel perspective: if the model can acquire knowledge of these fundamental system calls, it will be capable of effectively detecting emerging new attacks. Based on this perspective, we have developed sysE to capture system call data that remains unchanged or exhibits similarities to container escape attacks during evolution. This augmentation complements six TinyML-based detectors. Experimental results obtained from a large-scale evolving dataset demonstrate that our proposed approach effectively mitigates the aging rate of these models, reducing it from 7.3% to 21.5%. Additionally, it significantly decreases the labeling effort required from 28.06% to 65.47%.

Numbers of applications and businesses are hosted on cloud computing platforms, and it is essential for cloud tenants to protect their data through encryption or other methods. When tenants use encryption algorithms provided by software, they are bound to face the defect that keys are not protected by hardware. Trusted computing technology can securely store the key in the hardware device. However, the hardware TPM cannot provide services for multiple VMs simultaneously. The virtual trusted computing technology virtualizes the TPM and can assign vTPM to each VM. Currently, vTPM only supports RSA, ECDSA, SHA256, and AES algorithms, et al. Relevant studies have shown that SM2/SM3/SM4 algorithms are more secure than ECDSA/SHA256/AES. In order to cope with the limitations of the cryptographic algorithms supported by vTPM, we design the vTPM-SM scheme to provide a secure and reliable SM2/SM3/SM4 algorithm application method for cloud environments. Experiments show that vTPM-SM can effectively realize the VM using Chinese commercial cryptographic algorithms through vTPM. Compared with the existing scheme, using SM2/SM3/SM4 algorithm reduces the time overhead by about 31.6%, 83.3% and 15.5%, respectively.

There are becoming increasingly common for Android malware with packer protection, which can effectively evade malware detection. Thus the packed identification is very required. However, current packers identification schemes cannot efficiently deal with mixed packers and fail to provide a suitable unpacking scheme. In this paper, we propose a new method called ApkClassiFy. By constructing a fingerprint feature library and classification mapping library, ApkClassiFy can accurately identify and classify Android-packed malware, effectively identifying mixed packing applications and providing a corresponding unpacking scheme. To further verify the performance of ApkClassiFy, we constructed the Android malware dataset MalApk and the packed Android malware classification dataset OmixShell. The experimental results show ApkClassiFy has higher accuracy and lower false positives in detecting packed Android malware than other packed identification schemes. Besides, ApkClassiFy can also classify packers to identify mixed packers and help analysts choose the appropriate unpacking scheme.

Serverless computing has brought new changes to cloud computing. The decoupled serverless functions have more flexible scheduling methods and use resources efficiently with the help of autoscaling. However, it exposes more attack surfaces. If an insecure function becomes a serverless function, a significant security risk will be brought to its service. This paper analyzes the risk of asymmetric DDoS attacks faced by insecure serverless functions. These attacks can occupy a large amount of CPU or memory resources without redundant connections. They can affect the quality of service, delay response time, or even interrupt the service. Autoscaling lacks resilience to such attacks. We test the effects of these attacks in experimental environments and Alibaba Cloud's serverless application engine (SAE). In SAE, we increase the response time from 0.2 seconds to 25 seconds or crash the target function within 6 seconds. Compared with traditional DDoS attacks, asymmetric DDoS attacks are more effective for serverless applications. Finally, we design solutions to mitigate asymmetric DDoS attacks for applications with long and short response times in serverless environments.

The appearance of container technology has profoundly changed the development and deployment of multi-tier distributed applications. However, the imperfect system resource isolation features and the kernel-sharing mechanism will introduce significant security risks to the container-based cloud. In this paper, we propose a real-time unsupervised anomaly detection system for monitoring system calls in container cloud via BiLSTM-based variational auto-encoder (VAE). Our proposed BiLSTM-based VAE network leverages the generative characteristics of VAE to learn the robust representations of normal patterns by reconstruction probabilities while being sensitive to long-term dependencies. Our evaluations using real-world datasets show that the BiLSTM-based VAE network achieves excellent detection performance without introducing significant running performance overhead to the container platform.

The integration of the space–air–ground-integrated network and the Internet of Vehicles (IoV) enables the IoV to achieve full network coverage and better network performance. However, the large scale of the network and the complex cooperation mechanism make the credibility of the nodes in the network and the service delivery questioned. In this article, the hardware trusted module is used as the root of trust to build the trust chain and the trusted running environment and provide protection and trusted state attestation for services. In order to overcome the large-scale and high-concurrency performance bottlenecks in the remote verification of trusted states in the IoV, a novel batch remote approach for trusted states is proposed. The simulation results show that the proposed approach can effectively attest to the trusted state of each network node and virtual service in the IoV and enhance the trustworthiness of the network.

As a lightweight, flexible, and high-performance operating system virtualization, containers are used to speed up the big data platform. However, due to the imperfection of the resource isolation mechanism and the property of shared kernel, the meltdown and spectre attacks can lead to information leakage of kernel space and coresident containers. In this article, a noise-resilient and real-time detection system, named ContainerGuard, is proposed to detect meltdown and spectre attacks in the container-based big data platform. ContainerGuard uses a nonintrusive manner to collect lifecycle multivariate time-series performance event data of processes in containers and then uses ensemble of variational autoencoders as generative neural networks to learn the robust representations of normal patterns. Therefore, ContainerGuard meets the urgent need for information protection in the container-based big data platform. Our evaluations using real-world datasets show that ContainerGuard achieves excellent detection performance and only introduces about 4.5% of running performance overhead to the platform.

In the network security risk assessment on critical information infrastructure of smart city, to describe attack vectors for predicting possible initial access is a challenging task. In this paper, an attack vector evaluation model based on weakness, path and action is proposed, and the formal representation and quantitative evaluation method are given. This method can support the assessment of attack vectors based on known and unknown weakness through combination of depend conditions. In addition, defense factors are also introduced, an attack vector evaluation model of integrated defense is proposed, and an application example of the model is given. The research work in this paper can provide a reference for the vulnerability assessment of attack vector.

With the rapid development of Internet of things technology, the application of intelligent devices in the medical industry has become ubiquitous. Connected devices have revolutionized clinicians and patient care but also made modern hospitals vulnerable to cyber attacks. Among the security risks, botnets are of particular concern, which can be used to control thousands of devices for remote data theft and equipment destruction. In this paper, we propose a non-Markovian spread dynamics model to understand the effects of botnet propagation, which can characterize the hybrid contagion situation in reality. Based on the Susceptible-Adopted-Recovered model, we introduce nonredundant memory spread mechanism for global propagation, as a tuner to adjust spreading rate difference. For describing the proposed model, we extend a heterogeneous edge-based compartmental theory. Through extensive numerical simulations, we reveal that the growth pattern of the final adoption size versus the information transmission probability is discontinuous and how the final adoption size is affected by hybrid ratio α, global scope control factor ϵ, accumulated received information threshold T, and other parameters on ER network. Furthermore, we give the theory and simulation result on BA network and also compare the two hybrid methods—single infection in one time slice and double infections in one time slice—to evaluate the influence on final adoption size. We found in SIOT hybrid contagion scenario the final adoption size shows the phenomenon of a decline followed by an increase versus different hybrid ratio, and it is both verified in theory and numerical simulation. Through validation by thousands of experiments, our developed theory agrees well with the numerical simulations.

The Internet of Things (IoT) offers a wide variety of benefits to our daily lives in many ways, ranging from smart wearable devices to industrial systems. However, it also brings well‐known security and compliance concerns, especially in the physical layer. In addition, due to numerous IoT architectures which have been developed and deployed based on the cloud, the security and compliance of IoT depend on the cloud thoroughly. In this paper, a secure and compliant continuous assessment framework (SCCAF) is proposed to evaluate the security and compliance levels of cloud services in life‐cycle. The SCCAF facilitates cloud service to customers to select an optimal cloud service provider (CSP) which satisfies their desired security requirements. Moreover, it also enables cloud service customers to evaluate the compliance of the selected CSP in the process of using cloud services. To evaluate the performance and availability of SCCAF, we carry out a series of experiments with case study and real‐world scenario datasets. Experimental results show that SCCAF can assess the security and compliance of CSPs efficiently and effectively.