Network entities have important asset mapping, vulnerability, and service delivery applications. In cyberspace, where the network structure is complex and the number of entities is large, effectively obtaining the relevant attributes of entities is a difficult task. Graph neural network-based approaches focus on target IP node messaging from neighboring nodes; however, the graph learning task ignores the heterophilous relationship of network entity identification (NEI) tasks in the graph structure and fails to effectively message from non-neighboring nodes. To address the limitations of the existing task, we propose a NEI model based on heterophilous graph learning (HpGraphNEI); HpGraphNEI converts heterophilous graphs under the NEI task into homophilous graphs and uses the graph learning mechanism to carry out attribute completion task for incomplete entity attributes. First, the acquired dataset is feature-extracted by network measurement, and the clustering algorithm is employed to divide the target nodes into communities. Second, the network topology graph is constructed to embed the node attribute information and neighborhood structure information into the graph in the form of feature vectors. Then, the global attention in the community is calculated according to the attention results, the edges with strong correlation in the network are filtered, the adjacency matrix is reconstructed, and then the updated node information is aggregated to complete the incomplete attribute completion. Fourth, the updated nodes are categorized to output network entity categories and construct network entity portraits based on the attribute completion nodes. We conducted a 2-month data collection in three real regions and successfully identified 6 types of network entities. Compared with the optimal baseline, all the metrics have significantly improved, with NEI accuracy above 93.74% and up to 96.28%, improved 2.27% to 2.69%.

The application of intelligent computing in Internet of Things (IoTs) makes IoTs systems such as telemedicine, in-vehicle IoT, and smart home more intelligent and efficient. Secure communication and secure resource sharing among intelligent terminals are essential. A secure communication channel for intelligent terminals can be established through group key agreement (GKA), thereby ensuring the security communication and resource sharing for intelligent terminals. Taking into account the confidentiality level of the shared resources of each terminal, and the different permissions of the resource sharing of each terminal, a GKA protocol for intelligent IoTs is proposed. Compared with previous work, this protocol mainly has the following advantages: (1) The hidden attribute identity authentication technology can achieve the security of identity authentication and protect personal privacy from being leaked; (2) Only intelligent terminals satisfying the threshold required of the GKA can participate in the GKA, which increases the security of group communication; (3) Low-level group terminals can obtain new permissions to participate in high-level group communication if they meet certain conditions. High-level group terminals can participate in low-level group communication through permission authentication, which increases the flexibility and security of group communication; (4) The intelligent terminals in the group can use their own attribute permission parameters to calculate the group key. They can verify the correctness of the calculated group key through a functional relationship, and does not need to exchange information with other members in the same group. Under the hardness assumption of inverse computational Diffie-Hellman problem and discrete logarithm problem, it is proven that the protocol has high security, and compared with the cited literatures, it has good advantages in terms of computational complexity, time cost and communication energy cost.

Although the anonymous communication network Tor can protect the security of users’ data and privacy during their visits to the Internet, it also facilitates illegal users to access illegal websites. Website fingerprinting attacks can identify the websites that users are visiting to discern whether they are performing illegal operations. Existing methods tend to manually extract the traffic features of users visiting websites and construct machine learning or deep learning models to classify the features. While these methods can be effective in classifying unknown website traffic, the effect of classification in the use of defensive measures or onion service scenarios is not yet ideal. This paper proposes a method to identify Tor users visiting websites based on frequency domain fingerprinting of network traffic (FDF). We extract the direction and length features of circuit sequences in access traffic and combine and transform them into the frequency domain. The classification of access traffic is accomplished by using a deep learning classification model combining CNN, FC, and Self-Attention. In this paper, the proposed FDF method is experimentally validated in common scenarios of Tor networks. The results show that FDF outperforms the existing methods for classification in different Tor scenarios. It can achieve 98.8% and 94.3% classification accuracy in undefended and WTF-PAD defense scenarios, respectively. In the onion service scenario, the accuracy is improved by 4.7% over the current state-of-the-art Tik-Tok method.