Fuzzing is a fundamental technique for detecting vulnerabilities in network protocols. However, existing approaches suffer from low fuzzing throughput caused by the overhead associated with server under test (SUT) restarts and connection setup. In this article, we present HSPFuzzer, a High-Speed Protocol Fuzzer that leverages connection reuse to reduce SUT restarts and connection re-establishments. To enable efficient connection reuse, it incorporates a prefix message identification algorithm to determine the essential packets required within a connection and a coverage monitoring mechanism to detect abnormal execution states. Additionally, HSPFuzzer employs an innovative message provision method that ensures input messages are delivered to the SUT with minimal delay within the same connection. HSPFuzzer also eliminates the need for manually implementing message-splitting logic by connection reuse. We evaluate HSPFuzzer on 12 widely used servers and experimental results show that HSPFuzzer achieves fuzzing throughput$1062{\times }$faster than AFLNet, whereas other state-of-the-art fuzzers, including AFLNet, SnapFuzz, HNPFuzzer, and AFL++, achieve, at most, a$12{\times }$speedup over AFLNet. Furthermore, HSPFuzzer attains an average code coverage increase of 25.1% compared to AFLNet, while competing fuzzers achieve, at most, 2.13% more coverage. Notably, HSPFuzzer also discovers more vulnerabilities, which further proves its effectiveness.

Abstract Counter-cryptanalysis uses cryptanalytic techniques to detect cryptanalytic attacks. It was introduced by Stevens with a collision detection algorithm that detects whether a message is one of a colliding message pair constructed using a collision attack. Later, Stevens and Shumow improved the collision detection against SHA-1 by using unavoidable conditions. However, there are no results improving collision detection against MD5 due to its weak diffusion properties. In this paper, an improved collision detection algorithm against MD5 is proposed by using the 14-bit sufficient condition combinations. This leads to the dividing the 223 classes into four sets. Each element, belonging to the first two sets, holds the same sufficient condition combination. Our new algorithm can classify 126 classes efficiently. The runtime is 28.6% of the previous collision detection method.

In current steganalysis, relying on a large scale of samples, widely-adopted supervised schemes require the training stage while few studies focus on the design of a training-free unsupervised adaptive detector with high efficiency. To fill the gap, we investigate an adaptive statistical model-based detector designed for detecting JPEG steganography. First, in virtue of hypothesis testing theory, together with the distribution of quantized DCT coefficients, we establish the general framework of the statistical model-based detector. Second, based on the framework, we mainly analyze the performance of the detector relying on the selection of the statistical model, parameters estimation, and less significant payload prediction. Third, to improve the reliability of detection, based on the strategy of assigning weights for DCT channels, the novel adaptive statistical model-based detectors are proposed to aim at detecting JPEG steganography, involving the channel-selected or non-channel-selected algorithm. Extensive experiments highlight the effectiveness of the proposed methodology. Moreover, when detecting JPEG images adopted by two steganographic schemes with the small payload, the experimental results show the Area Under Curve (AUC) of our proposed optimal adaptive detector can achieve as high as 0.9567 and 0.9895 respectively, which are both better than that of non-adaptive detector.

This article studies the attacker identification issue in the Industrial Internet of Things (IIoT). There have been already some work that uses device fingerprinting to identify attackers, and the transmission offset of the device internal clock signals is used as the device's fingerprint. However, the existing work to measure the offset relies on the periodic transmission of signals, but in many types of IIoT devices, the signal transmission is aperiodic. To eliminate the limitation on the periodicity, in this article, we design an algorithm, Fiden, to fingerprint heterogeneous IIoT devices without considering the periodicity. This algorithm extracts the patterns from the time series of signal transmission, and then learns the fingerprint of a device by clustering the patterns. We demonstrate the applicability of Fiden by a real case study on the communications environment of the vehicle industry. The results show that the proposed algorithm helps identify the devices-mounted attacks. Compared with the clock-based intrusion detection system (CIDS), when the timestamp and accumulated clock offset of the signal transmission are used as the features for pattern extraction, Fiden's accuracy is increased by 15% and 15% to these two features, precision is increased by 25% and 23%, recall is increased by 28% and 18%, and F1 score is increased by 28% and 21%.

GOST, known as GOST-28147-89, was standardized as the Russian encryption standard in 1989. It is a lightweight-friendly cipher and suitable for the resource-constrained environments. However, due to the simplicity of GOST’s key schedule, it encountered reflection attack and fixed point attack. In order to resist such attacks, the designers of GOST proposed a modification of GOST, namely, 2-GOST. This new version changes the order of subkeys in the key schedule and uses concrete S-boxes in round function. But regarding single-key attacks on full-round 2-GOST, Ashur et al. proposed a reflection attack with data of 2 32 on a weak-key class of size 2 224 , as well as the fixed point attack and impossible reflection attack with data of 2 64 for all possible keys. Note that the attacks applicable for all possible keys need the entire plaintext space. In other words, these are codebook attacks. In this paper, we propose single-key attacks on 2-GOST with only about 2 32 data instead of codebook. Firstly, we apply 2-dimensional meet-in-the-middle attack combined with splice-cut technique on full-round 2-GOST. This attack is applicable for all possible keys, and its data complexity reduces from previous 2 64 to 2 32 . Besides that, we apply splice-cut meet-in-the-middle attack on 31-round 2-GOST with only data of 2 32 . In this attack, we only need 8 bytes of memory, which is negligible.

With wide development of various information technologies, our daily activities are becoming deeply dependent on cyberspace. People often use handheld devices (e.g., mobile phones or laptops) to publish social messages, facilitate remote e-health diagnosis, or monitor a variety of surveillance. However, security insurance for these activities remains as a significant challenge. Representation of security purposes and their enforcement are two main issues in security of cyberspace. To address these challenging issues, we propose a cyberspace-oriented access control model (CoAC) for cyberspace whose typical usage scenario is as follows. Users leverage devices via network of networks to access sensitive objects with temporal and spatial limitations. We generalize subjects and objects in cyberspace and propose scene-based access control. To enforce security purposes, we argue that all operations on information in cyberspace are combinations of atomic operations. If every single atomic operation is secure, then the cyberspace is secure. Taking applications in the browser-server architecture as an example, we present seven atomic operations for these applications. A number of cases demonstrate that operations in these applications are combinations of introduced atomic operations. We also design a series of security policies for each atomic operation. Finally, we demonstrate both feasibility and flexibility of our CoAC model by examples.

Peer-to-peer (P2P) social networks rely on voluntary resource contributions of peers, understanding and maximizing the effects of resource allocation mechanisms on resource con- tribution of peers have been a focus in such networks. In most of proposed research, the resource sharing dilemma is always modeled by a two-player donor-recipient game in which peers are limited to binary decision (e.g., contribute or not). However, in addition to contributing to multiple recipients simultaneously, a peer also can determine its contribution level in networks. In this paper, we first formulated the resource sharing transaction among a group of peers as a multi-player donor-recipient game with multiple strategies which signify contribution willingness of peers. Then, we studied the influences of two reciprocity based allocation mechanisms in which peers are served based on their direct and total contributions, on the evolution of peers' contribution strategies. Moreover, the influences of some common behaviors of peers (e.g., leave- rejoin and irrational behaviors, slandering behaviors in reporting others' contribution) are also studied. The research is expected to provide valuable information for resource allocation mechanism design in social networks.

Traffic flow prediction is an important research issue to avoid traffic congestion in transportation systems. Traffic congestion avoiding can be achieved by knowing traffic flow and then conducting transportation planning. Achieving traffic flow prediction is challenging as the prediction is affected by many complex factors such as inter-region traffic, vehicles' relations, and sudden events. However, as the mobile data of vehicles has been widely collected by sensor-embedded devices in transportation systems, it is possible to predict the traffic flow by analysing mobile data. This study proposes a deep learning based prediction algorithm, DeepTFP, to collectively predict the traffic flow on each and every traffic road of a city. This algorithm uses three deep residual neural networks to model temporal closeness, period, and trend properties of traffic flow. Each residual neural network consists of a branch of residual convolutional units. DeepTFP aggregates the outputs of the three residual neural networks to optimize the parameters of a time series prediction model. Contrast experiments on mobile time series data from the transportation system of England demonstrate that the proposed DeepTFP outperforms the Long Short-Term Memory (LSTM) architecture based method in prediction accuracy.