Vision–Language–Action (VLA) models underpin robotic and other embodied agents by mapping visual observations and language instructions into executable actions. Their wide adoption through open web model repositories, however, introduces new supply-chain risks: adversaries can launch adversarial attacks to manipulate the action outputs of VLAs, potentially leading to harmful real-world outcomes for embodied agents. To exploit this vulnerability, we propose MAVLA, a novel multimodal adversarial attack framework. MAVLA serves as a modular front-end that integrates seamlessly with a target VLA model, injecting perturbations into task-relevant and structure-sensitive image regions to disrupt cross-modal alignment and induce deviations in the generated action instructions. To balance attack effectiveness with stealth, we design four loss functions that jointly maximize multimodal misalignment while preserving visual stealthiness. Extensive evaluations in simulated and real-world scenarios show that at a 40% perturbation ratio, the task success rate of VLAs drops by about 70%. Compared to conventional attack baselines, MAVLA achieves superior attack effectiveness and stealthiness with low overhead. Our work reveals a practical and previously underexplored threat to embodied systems, and offers a red-team baseline to inform future defensive strategies and promote safer VLA deployment.

Abstract In recent years, cloud-edge-end collaborative federated learning frameworks have been widely used in many scenarios and achieved good results. However, with the complexity of application requirements, the problems of device heterogeneity and data heterogeneity become more prominent. Traditional frameworks often face challenges such as uneven allocation of computational resources and inefficient training when dealing with these problems. To address this problem, this paper proposes a novel federated learning framework for multi-domain collaborative analysis of networked encrypted flows. First, we split the model training tasks, intelligently assign part of the model training tasks to terminal devices based on their performance, while the remaining model training tasks that require more computational resources are handed over to edge servers. Second, we introduce a resource scheduling scheme among edge servers to reasonably allocate model training tasks and fully utilize resources. Finally, high quality global models are obtained through a weight-enabled global model aggregation scheme. Experiments show that our proposed scheme can effectively address the impact of device heterogeneity and data heterogeneity in encrypted traffic identification in cross-domain networks, and improve the training efficiency and model performance of the overall system while ensuring data privacy and security.

Abstract Microservice has become a dominant approach for building large-scale Internet applications. The microservice-based system (MS) consists of thousands of services, and its complex interactions make it highly susceptible to unforeseen cascading failures. Cascading failure models are commonly used to analyze the system’s tolerance, while the existing models overlook MS’s features and fail to incorporate real-world events, leading to bias in simulation results. To address these, we proposed a comprehensive tolerance analysis framework of MS named the MSTAF. Specifically, we extracted the real-world failure-triggering scenarios and constructed the Workload-based Cascading Failure Model (WL-CFM) to model the load initialization and redistribution. Then, we implemented the Business Loss Assessment Method (BLAM) to quantify the impact by calculating the workload loss. To validate our MSTAF, we conducted experiments on the WL-CFM and BMAL and performed an analysis on the TrainTicket (TT). The results confirm the MSTAF’s superiority. Specifically, the WL-CFM outperforms baselines, reducing simulation error by 10– 48%. The BMAL demonstrates greater accuracy, with deviations from the ground truth ranging from $$-45$$ - 45 % to + 7%. Overall, the MSTAF offers valuable insights for enhancing tolerance and provides an effective solution for developers and researchers.

Recently, computer vision systems, for example, smart traffic surveillance systems, facial recognition systems, etc., have significantly changed our daily life. Even though the neural networks in such systems are known to suffer from backdoor attacks, causing the backdoored models to behave well on benign samples but maliciously on controlled samples (with triggers applied to activate the backdoor), it is generally believed that most of the triggers, when used in physical attacks, are noticeable to victim users and not robust in various settings, such as different angles, distances, lighting conditions, etc. In this paper, we leverage electromagnetic interference (EMI) to produce a specific pattern distortion in images captured by the camera system and utilize the pattern distortion as the backdoor trigger. To avoid the overhead of manually collecting poisoned images, we introduce a simulation sample generation approach, converting clean images to poisoned ones by simulating the distortion caused by EMI against the camera system. Additionally, we propose a contrast loss function to enhance the generalization of backdoor features, improving triggers’ capability to activate the embedded backdoors. We conduct extensive physical experiments using diverse deep neural networks across various camera systems in different practical environments, achieving a 92.54% average backdoor success rate.

Guided by the principle of “Never Trust, Always Verify”, Zero Trust Architecture (ZTA) mandates continuous monitoring and analysis of users and entities, highlighting the critical role of behavior analytics. However, the growing volume of audit data and its complex contextual information render many existing behavior analytics methods insufficient. Moreover, most approaches rely on high-quality labeled data for supervised training, limiting their effectiveness against previously unseen malicious behaviors. To address these challenges, we propose the Large Language Model for Behavior Analytics (LLMBA) framework. LLMBA leverages a Large Language Model (LLM) to analyze behavioral patterns of internal users and entities, capitalizing on the LLM’s strong ability to model sequential data. We introduce a multi-level behavior encoding scheme to capture both contextual and temporal information from behavior records, producing rich input representations for the LLM-enhanced model. The LLM is fine-tuned using self-supervised learning, enabling the detection of unknown malicious behaviors. To reduce the computational and storage overhead inherent in LLMs, we apply knowledge distillation to compress the model while maintaining high detection performance. Extensive experiments on the CERT Insider Threat dataset demonstrate that LLMBA outperforms state-of-the-art baselines in detection accuracy. Furthermore, the compressed student model achieves superior performance compared with existing methods under comparable runtime constraints, making LLMBA highly suitable for real-world deployment.

Open-source software (OSS) has experienced a surge in popularity, attributed to its collaborative development model and cost-effective nature. However, the adoption of specific software versions in development projects may introduce security risks when these versions bring along vulnerabilities. Current methods of identifying vulnerable versions typically analyze and extract the code features involved in vulnerability patches using static analysis with pre-defined rules. They then use code clone detection to identify the vulnerable versions. These methods are hindered by imprecision due to (1) the exclusion of vulnerability-irrelevant code in the analysis and (2) the inadequacy of code clone detection. This paper presents VERCATION, an approach designed to identify vulnerable versions of OSS written in C/C++. VERCATION combines program slicing with a Large Language Model (LLM) to identify vulnerability-relevant code from vulnerability patches. It then backtracks historical commits to gather previous modifications of identified vulnerability-relevant code. We propose code clone detection based on expanded and normalized ASTs to compare the differences between pre-modification and post-modification code, thereby locating the vulnerability-introducing commit (vic) and enabling the identification of the vulnerable versions between the vulnerability-fixing commit and thevic. We curate a dataset linking 122 OSS vulnerabilities and 1,211 versions to evaluate VERCATION. On this dataset, our approach achieves an F1 score of 93.1%, outperforming current state-of-the-art methods. More importantly, VERCATION detected 202 incorrect vulnerable OSS versions in NVD reports.

In recent years, tremendous success has been witnessed in Retrieval-Augmented Generation (RAG), widely used to enhance Large Language Models (LLMs) in domain-specific, knowledge-intensive, and privacy-sensitive tasks. However, attackers may steal those valuable RAGs and deploy or commercialize them, making it essential to detect Intellectual Property (IP) infringement. Most existing ownership protection solutions, such as watermarks, are designed for relational databases and texts. They cannot be directly applied to RAGs because relational database watermarks require white-box access to detect IP infringement, which is unrealistic for the knowledge base in RAGs. Meanwhile, post-processing by the adversary's deployed LLMs typically destructs text watermark information. To address those problems, we propose a novel black-box ''knowledge watermark'' approach, named RAG-WM, to detect IP infringement of RAGs. RAG-WM uses a multi-LLM interaction framework, comprising a Watermark Generator, Shadow LLM & RAG, and Watermark Discriminator, to create watermark texts based on watermark entity-relationship tuples and inject them into the target RAG. We evaluate RAG-WM across three domain-specific and two privacy-sensitive tasks on four benchmark LLMs. Experimental results show that RAG-WM effectively detects the stolen RAGs in various deployed LLMs. Furthermore, RAG-WM is robust against paraphrasing, unrelated content removal, knowledge insertion, and knowledge expansion attacks. Lastly, RAG-WM can also evade watermark detection approaches, highlighting its promising application in detecting IP infringement of RAG systems.

Existing dynamic vulnerability patching techniques are not well-suited for embedded devices, especially mission-critical ones such as medical equipment, as they have limited computational power and memory but uninterrupted service requirements. Those devices often lack sufficient idle memory for dynamic patching, and the diverse architectures of embedded systems further complicate the creation of patch triggers that are compatible across various system kernels and hardware platforms. To address these challenges, we propose a hot patching framework called StackPatch that facilitates patch development based on stack frame reconstruction. StackPatch introduces different triggering strategies to update programs stored in memory units. We leverage the exception-handling mechanisms commonly available in embedded processors to enhance StackPatch's adaptability across different processor architectures for control flow redirection. We evaluated StackPatch on embedded devices featuring three major microcontroller (MCU) architectures: ARM, RISC-V, and Xtensa. In the experiments, we used StackPatch to successfully fix 102 publicly disclosed vulnerabilities in real-time operating systems (RTOSes). We applied patching to medical devices, soft programmable logic controllers (PLCs), and network services, with StackPatch consistently completing each vulnerability remediation in less than 260 MCU clock cycles.

Thousands of service units interact through dependency chains in the Microservice Application (MA) to handle various business functions. As a result, microservice applications feature complex interaction structures. Furthermore, these service units are distributed across multiple devices in the network, making them highly susceptible to cascading failures from single points of failure. Considerable efforts have been made to address and mitigate the significant risks posed by cascading failures. However, as an emerging network architecture, microservices have not yet been fully studied in terms of cascading failure modeling specific to microservice applications. This paper leverages the characteristics of the MA and proposes the Business Sink Node-Oriented Cascading Failure (BSN-OCF) model. The model extracts the network and application layers to describe the MA and models the load and capacity of service units and physical devices. The concept of a business sink node is introduced to address the challenge of directly calculating load. Furthermore, the Assessment Method of Structural Loss (AMSL) is proposed to quantify the vulnerability of the MA. This method overcomes the limitations of previous approaches, which focused solely on the loss of topology. Experiments and results validate the effectiveness of the proposed model. This work provides a self-assessment method for the MA and offers valuable support for optimizing its deployment structure in the future.

Generative pre-trained transformers are exceedingly effective as generative models and classifiers, widely used in natural language processing and computer vision. This work contributes to the exploration of generative pre-trained transformer-based models in the proprietary protocol network traffic. However, building a pre-trained model for proprietary protocol network traffic is non-trivial due to the heterogeneous unknown formats and the extreme scarcity of proprietary protocol network traffic datasets. In this paper, we present PNetGPT, a pre-trained transformer-based model for generating proprietary protocol network traffic. We have constructed the inaugural dataset of 2 real-world proprietary protocols. After training on this dataset, PNetGPT possesses the capacity to generate high-quality proprietary protocol network traffic to support various applications of proprietary protocols, including reverse analysis, protocol fuzzy testing, intrusion detection, etc. We evaluated PNetGPT with two real proprietary protocols and demonstrated state-of-the-art (SOTA) performance in handling heterogeneous unknown formats. The code and datasets are available at: https://github.com/Snail1502/PNetGPT

Transforming Linux kernel exploit primitives into full Privilege Escalation (PE) exploits is a critical, expertiseintensive, and time-consuming challenge, especially with constantly evolving kernel mitigations. While previous research has advanced automated kernel exploit development, these efforts often focused on specialized scenarios rather than providing a generalized, end-to-end framework for diverse primitives. This limitation restricts the exploration of a primitive's true exploit potential. This paper introduces Exp-Arch, a novel approach leveraging Large Language Models (LLMs) for the automated, end-to-end generation of PE exploits from kernel primitives. This process includes comprehensive initial assessment and subsequent exploitation. Exp-Arch's LLM-powered workflow systematically performs an in-depth semantic analysis of the input primitive, devises an intelligent strategic plan for the exploitation route, and then automates the synthesis and iterative closed-loop validation of the final PE exploit code. Exp-Arch offers accurate assessment of a primitive's exploitability and significantly accelerates the exploit development lifecycle. We evaluated ExpArch using various primitives from public Linux kernel 1-day vulnerabilities with commercial LLMs. The results show that Exp-Arch effectively converted 73 % (11 out of 15) of test cases into working kernel exploits, demonstrating its effectiveness in primitive evaluation.

As embedded devices become increasingly popular, monolithic firmware, known for its execution efficiency and simplicity, is widely used in resource-constrained devices. Different from ordinary firmware, the monolithic firmware image is packed without the file that indicates its format, which challenges the reverse engineering of monolithic firmware. Function identification is the prerequisite of monolithic firmware's analysis. Prior works on function identification are less effectiveness when applied to monolithic firmware due to their heavy reliance on file formats. In this paper, we propose Moye, a novel method to identify functions in monolithic firmware. We leverage the important insight that the use of registers must conform to some constraints. In particular, our approach segments the firmware, locate code sections and output the instructions. We use a masked language model to learn hiding relationships among the instructions to identify the function boundaries. We evaluate Moye using 1,318 monolithic firmware images, including 48 samples collected from widely used devices. The evaluation demonstrates that our approach significantly outperforms current works, achieving a precision greater than 98 % and a recall rate greater than 97 % across most datasets, showing robustness to complicated compilation options.

Function name inference in stripped binaries is a crucial task that supports various security applications, including vulnerability detection and malware analysis. Existing methods suffer from limited model capacity and insufficient exploitation of function semantics, which constrains their ability to comprehend binary code and leads to poor generalization on unseen binaries. To address these problems, we propose BinLLM, a novel framework that leverages large language models (LLMs) to exploit the semantic potential of binary code, thereby enhancing function name inference. Specially, BinLLM integrates three key innovations: (1) source code semantics-guided function name refinement, which mitigates the negative effects of low-quality semantic identifiers during training; (2) A context-aware data collection algorithm that seeks richer semantic dependencies to improve model training and inference performance; (3) parameter-efficient fine-tuning on a domain-specific dataset enriched with semantic knowledge to enhance the model's understanding of binary semantics. These components collectively enhance the model's performance in function name inference on unseen binaries. We evaluate BinLLM on a large-scale dataset comprising$2,864,719$functions across four architectures (x86-64, x86-32, ARM, MIPS) and four optimization levels ($\mathrm{O} 0-\mathrm{O} 3$). Experimental results show that BinLLM achieves substantial improvements over state-of-the-art (SOTA) methods, with relative gains of$320.1 \%, 274.8 \%$, and 297.6 % in precision, recall, and F1-score. Ablation studies further validate the effectiveness of each component in enhancing overall performance.

Binary Code Similarity Detection (BCSD), essential for binary-code related tasks like vulnerability detection, has attracted increasing attention in recent years. However, existing methods frequently fall short of achieving both high precision and recall at scale, and their results often lack interpretability due to the neglect of function context and reliance on purely similarity-driven outputs. Our key insights are twofold: 1) Binary functions are not self-contained; they depend on other code and data beyond their content to fulfill their functionalities. 2) Large language models (LLMs) excel not only at analyzing code but also at generating reasonable explanations. Motivated by these insights, we propose a general BCSD framework, Co2F uLL. We first systematically select stable and representative code and data features, along with their corresponding dependencies on the functions, to construct the function context. Then, by fusing function context with content similarities computed by the existing BCSD approach, we substantially narrow down the search space. Ultimately, we employ LLMs with a carefully designed prompt to verify the remaining candidates and produce clear, human-readable explanations. We conduct comprehensive experiments on a large function pool under varying compilation settings and after binary stripping. The results show that Co2F uLL based on HermesSim and DeepSeek-V3 achieves 80.5% precision and 94.4% recall, improving the baseline HermesSim by 142.5% and 42.2%, respectively, providing an accurate and interpretable solution for BCSD.

In modern software ecosystems, 1-day vulnerabilities pose significant security risks due to extensive code reuse. Identifying vulnerable functions in target binaries alone is insufficient; it is also crucial to determine whether these functions have been patched. Existing methods, however, suffer from limited usability and accuracy. They often depend on the compilation process to extract features, requiring substantial manual effort and failing for certain software. Moreover, they cannot reliably differentiate between code changes caused by patches or compilation variations.To overcome these limitations, we propose Lares, a scalable and accurate method for patch presence testing. Lares introduces Code Slice Semantic Search, which directly extracts features from the patch source code and identifies semantically equivalent code slices in the pseudocode of the target binary. By eliminating the need for the compilation process, Lares improves usability, while leveraging large language models (LLMs) for code analysis and SMT solvers for logical reasoning to enhance accuracy. Experimental results show that Lares achieves superior precision, recall, and usability. Furthermore, it is the first work to evaluate patch presence testing across optimization levels, architectures, and compilers. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/Lares.

Protocol reverse engineering (PRE) aims to infer the protocol formats of unknown protocols. Existing techniques, whether Network-Trace based or Execution-Trace based methods, face two main limitations: a reliance on the quality and scale of traffic datasets, which often leads to low accuracy and poor generalization; and a failure to adequately consider the multi-format characteristic prevalent in real-world protocols (i.e., the same protocol may support multiple different formats).To address these challenges, we propose ProbePRE—a PRE tool that performs multi-format extraction on protocol handlers by autonomously generating packets. ProbePRE employs three key techniques: (1) an execution tracing strategy enhanced with implicit data flow analysis to obtain more detailed execution information; (2) constraint extraction methods tailored for different program structures to pass protocol validation; and (3) an innovative constraint combination algorithm to construct effective packets that guide the protocol handler to execute diverse protocol parsing paths. In our experimental evaluation, we compared ProbePRE with 4 state-of-the-art PRE tools in terms of field segmentation accuracy. The results demonstrated that ProbePRE achieved an F1 score of 0.88, significantly outperforming existing methods. Furthermore, evaluations on 6 protocol handlers indicated that ProbePRE attained 83% completeness in multi-format extraction tasks. Notably, in basic block coverage tests, ProbePRE achieved a 67% improvement over traditional traffic dataset methods, which fully validates the effectiveness of its path exploration capabilities.

Machine learning (ML) has been widely used to analyze API call sequences in malware analysis, which typically requires the expertise of domain specialists to extract relevant features from raw data. The extracted features play a critical role in malware analysis. Traditional feature extraction is based on human domain knowledge, while there is a trend of using natural language processing (NLP) for automatic feature extraction. This raises a question: how do we effectively select features for malware analysis based on API call sequences? To answer it, this paper presents a comprehensive study of investigating the impact of feature engineering upon malware classification. We first conducted a comparative performance evaluation under three models, Convolutional Neural Network (CNN), Long Short-Term Memory (LSTM), and Transformer, with respect to knowledgebased and NLP-based feature engineering methods. We observed that models with knowledge-based feature engineering inputs generally outperform those using NLP-based across all metrics, especially under smaller sample sizes. Then we analyzed a complete set of data features from API call sequences, our analysis reveals that models often focus on features such as handles and virtual addresses, which vary across executions and are difficult for human analysts to interpret.

Honeypots act as a powerful security mechanism that diverts malicious actors from production systems while providing valuable insights into adversarial behaviors. Yet, the absence of a high-quality honeypot dataset has long impeded robust benchmarking and restricted the employment of advanced AI-driven honeypot defenses. In this work, we address these limitations by constructing a comprehensive shell request-response dataset from Cowrie honeypots. Such a dataset not only facilitates thorough, in-depth honeypot evaluations but also furnishes an essential research foundation for AI-based honeypot development. We analyzed tens of thousands of shell sessions collected during two distinct time frames. (2021-2022 and 2024). By systematically examining command-level usage, session behaviors, and tactics under the MITRE ATT&CK framework, we identified major shifts in adversary techniques, including mounting command complexity, shorter but more targeted infiltration sessions, a more balanced and diverse range of attack methods, and an intensified focus on circumventing defensive measures. These observations emphasize the evolving nature of shell-based intrusions and underscore the necessity for ongoing experimentation and iterative improvements in honeypot design. Through the collection and analysis of this dataset, our work highlights emerging threats in shell defense while also establishing a robust data foundation for the future development of AI-driven honeypots.

One underlying assumption of recent Federated Learning (FL) paradigms is that all local models share an identical network architecture. However, this assumption is inefficient for heterogeneous systems where devices possess varying computation and communication capabilities. The presence of such heterogeneity among devices negatively impacts the scalability of FL and slows down the training process due to the existence of stragglers. To this end, this paper proposes a novel federated compression framework for heterogeneous models , named FedHM, distributing the heterogeneous low-rank models to clients and then aggregating them into a full-rank global model. Furthermore, FedHM significantly reduces communication costs by utilizing low-rank models. Compared with state-of-the-art heterogeneous FL methods under various FL settings, FedHM is superior in the performance and robustness of models with different sizes. Additionally, the convergence guarantee of FL for heterogeneous devices is first theoretically analyzed.

The time-delay attacks pose serious security threats to the industrial control systems (ICSs), where ICS infrastructures (e.g., chemical factories) could suffer severe safety consequences. They could bypass current delay detection methods by avoiding triggering packet timeouts. In this article, we reveal that malicious states caused by the time-delay attacks in ICS scenarios can be detected by analyzing ICS programs. We propose detecting a time-delay attack in ICS scenarios by comparing the difference between malicious and benign states, meeting the real-time and noninterference requirements. Specifically, we utilize symbolic execution to analyze ICS programs to generate the benign states of ICS and leverage the key features of time-delay attacks to create the malicious states of ICS, where the states are transferred through the network for remote control and monitoring. We propose a multimodal neural network whose inputs are the malicious states sampled from the ICS network traffic and the time domain features, and the output is whether such a time-delay attack exists. We implement a prototype system and conduct real-world experiments to evaluate the performance of our detection approach. Our experiments cover 102 vulnerable ICS programs and five types of time-delay attacks. The evaluation results show that our approach can detect ICS time-delay attacks in 0.6 s, with 97.2% precision and 98% recall.

This paper considers a strongly connected network of agents, each capable of partially observing and controlling a discrete-time linear time-invariant (LTI) system that is jointly observable and controllable. Additionally, agents collaborate to achieve a shared estimated state, computed as the average of their local state estimates. Recent studies suggest that increasing the number of average consensus steps between state estimation updates allows agents to choose from a wider range of state feedback controllers, thereby potentially enhancing control performance. However, such approaches require that agents know the input matrices of all other nodes, and the selection of control gains is, in general, centralized. Motivated by the limitations of such approaches, we propose a new technique where: (i) estimation and control gain design is fully distributed and finite-time, and (ii) agent coordination involves a finite-time exact average consensus subroutine, allowing arbitrary selection of the convergence rate of the overall asymptotic estimation process despite the estimator's distributed nature. We verify our methodology's effectiveness using illustrative numerical simulations.

Security-Sensitive Objects (SSOs) are often critical components in the exploitation of Linux kernel memory corruption vulnerabilities. While existing research has advanced SSOs identification and classification, there remains a significant gap in systematically understanding how these objects can be effectively exploited in real-world security analysis. To address this challenge, we present PREXP, a novel approach to analyzing SSOs exploitability and automating the transformation of Proof-of-Concept (PoC) into exploitable states. Our approach encompasses three key techniques: (1) capability analysis and attribute modeling of vulnerable object (2) extraction and filtering of target SSOs and (3) automatically augmenting PoCs with SSO-specific code to create exploitation capabilities. To evaluate our approach, we tested our prototype on 30 public CVEs, successfully parsing vulnerable object in 22 cases (73.3%) and achieving accurate SSO matches in 18 (60.0%). PREXP outperformed state-of-the-art tools such as SCAVY and AlphaEXP in structure-matching, and enabled the generation of new Control Flow Hijacking Primitives (CFHPs) for 3 previously unexploited vulnerabilities, demonstrating its practical value in real-world exploit development.

Actuators are essential components in cyber-physical systems, enabling system modules to perform diverse and complex tasks. Unfortunately, the pursuit of higher functional complexity often correlates with a broader attack surface in actuators. Thus, an efficient automated attack surface assessment is crucial to avoid cyber incidents in critical infrastructures. Limited by enormous parameter spaces, current methods rely on heuristic tests to evaluate interference potential but cannot thoroughly investigate the full spectrum of potential hidden interference. The observation that similar interference trigger configurations lead to the same impact has motivated us to use machine learning algorithms for understanding different impact samples around decision boundaries. By leveraging generalized knowledge of responses against specific attack scenarios, we aim to improve the efficiency of automated attack surface assessment of electromagnetic interference on new targets. To this end, we introduce EMFuzz, an automated mechanism to fuzz hardware to quantify varying adverse effects. We evaluate EMFuzz on 16 new servos within real-world scenarios, where it achieves an 86% accuracy in classifying different attack vectors. With the same test time, EMFuzz uncovers over twice the effective attack configurations of the baseline, greatly improving assessment efficiency. To further validate its efficacy, we apply EMFuzz to assess the attack surface of a new actuator from a robot transfer unit, and it can successfully reveal three distinct adverse effects.

In high-stakes process industries, the Basic Process Control System (BPCS) relies on conventional control to enhance productivity, while the Safety Instrumented System (SIS) uses safety functions to maintain safety. Compared to the BPCS, attackers targeting the SIS can modify safety function activation conditions to trigger them prematurely or to evade the activation of the safety function. While various attack detection methods focus on the BPCS, they often overlook the SIS. This can lead to undetected safety breaches, significantly increasing the risk of catastrophic fault. Recent methods face three key limitations that hinder their practical application to SIS. First, both attackers and engineers can exploit the hot update mechanism of SIS to add or modify control logic. However, current methods lack verification for the newly added or modified logic. Second, current methods are unable to assess the rationality of dangerous value ranges. Third, these methods struggle to distinguish between faults and attacks, making it difficult to determine the appropriate time to activate the SIS’s safety function. To overcome these limitations, we propose SecureSIS, a method for securing SIS safety functions by leveraging the safety attributes of the SIS and incorporating information from the BPCS. The core of SecureSIS includes: 1) using the safety attributes of the SIS to verify automatically extracted candidate control logic detection rules; 2) utilizing information from the BPCS to verify automatically extracted candidate value range detection rules; and 3) distinguishing between safety function attacks and industrial process faults with validated rules and integration of process data from BPCS. Our scheme was evaluated using a Tricon SIS controller deployed on a gas pipeline network platform. The results indicate that SecureSIS achieved 97.3% accuracy in detecting data injection attacks and a detection accuracy of 96.0% for control logic modification attacks. Compared with the other representative detection approaches, our scheme has better detection performance.

This article proposes LATTE , the first static binary taint analysis that is powered by a large language model (LLM). LATTE is superior to the state of the art (e.g., Emtaint, Arbiter, Karonte) in three aspects. First, LATTE is fully automated while prior static binary taint analyzers need rely on human expertise to manually customize taint propagation rules and vulnerability inspection rules. Second, LATTE is significantly effective in vulnerability detection, demonstrated by our comprehensive evaluations. For example, LATTE has found 37 new bugs in real-world firmware, which the baselines failed to find. Moreover, 10 of them have been assigned CVE numbers. Lastly, LATTE incurs remarkably low engineering cost, making it a cost-efficient and scalable solution for security researchers and practitioners. We strongly believe that LATTE opens up a new direction to harness the recent advance in LLMs to improve vulnerability analysis for binary programs.

Concolic execution follows the execution paths of concrete inputs, capable of generating new inputs for unexplored code by solving negated path constraints. However, implicit flows can hinder concolic execution, reducing the code coverage. Implicit flows occur when inputs influence control flow, and the control flow variation affects the values of some variables. During concolic execution, the preceding path selections limit the potential values of these variables. This limitation may result in unsolvable constraints, subsequently restricting the generation of new inputs for unexplored paths. Our insight is that following the same preceding paths is unnecessary, and we can adapt preceding paths to make the latest constraints solvable. We divide states into general states and implicit-flow-solving states (IFSSs). We utilize the general states to perform concolic execution. When solving constraints influenced by implicit flows, we switch to the IFSSs. We use the IFSSs to explore the relevant code region and adapt paths. To mitigate path explosion and construct the relation between inputs and the variables, we merge the IFSSs. State merging does not burden the general states, and we limit the code regions for the IFSSs to minimize the introduced overhead. Finally, we replace the variable symbols in the target constraints with new expressions and attempt to solve the new constraints. We implement our approach in Backsolver and build a test suite to evaluate it. Backsolver successfully identifies all the implicit flows in the test suite and resolves most of them. When evaluated on six real-world binaries, Backsolver resolves the highest number of branches related to implicit flows in total. Besides, Backsolver has the highest code coverage in PlutoSVG and finds a 0-day vulnerability. We reported the vulnerability and obtained a CVE ID.

Code reuse in software development frequently facilitates the spread of vulnerabilities, leading to imprecise scopes of affected software in CVE reports. Traditional methods focus primarily on detecting reused vulnerability code in target software but lack the ability to confirm whether these vulnerabilities can be triggered in new software contexts. In previous work, we introduced the TransferFuzz framework to address this gap by using historical trace-based fuzzing. However, its effectiveness is constrained by the need for manual intervention and reliance on source code instrumentation. To overcome these limitations, we propose TransferFuzz-Pro, a novel framework that integrates Large Language Model (LLM)-driven code debugging technology. By leveraging LLM for automated, human-like debugging and Proof-of-Concept (PoC) generation, combined with binary-level instrumentation, TransferFuzz-Pro extends verification capabilities to a wider range of targets. Our evaluation shows that TransferFuzz-Pro is significantly faster and can automatically validate vulnerabilities that were previously unverifiable using conventional methods. Notably, it expands the number of affected software instances for 15 CVE-listed vulnerabilities from 15 to 53 and successfully generates PoCs for various Linux distributions. These results demonstrate that TransferFuzz-Pro effectively verifies vulnerabilities introduced by code reuse in target software and automatically generation PoCs.

Mining structured knowledge from tweets using named entity recognition (NER) can be beneficial for many downstream applications such as recommendation and intention under standing. With tweet posts tending to be multimodal, multimodal named entity recognition (MNER) has attracted more attention. In this paper, we propose a novel approach, which can dynamically align the image and text sequence and achieve the multi-level cross-modal learning to augment textual word representation for MNER improvement. To be specific, our framework can be split into three main stages: the first stage focuses on intra-modality representation learning to derive the implicit global and local knowledge of each modality, the second evaluates the relevance between the text and its accompanying image and integrates different grained visual information based on the relevance, the third enforces semantic refinement via iterative cross-modal interactions and co-attention. We conduct experiments on two open datasets, and the results and detailed analysis demonstrate the advantage of our model.

Industrial Control Systems (ICS), particularly programmable logic controllers (PLCs) responsible for managing underlying physical infrastructures, often operate for extended periods without interruption. Thus, it is challenging to patch security vulnerabilities of ICS in a timely manner after disclosure because it often necessitates waiting for a rare downtime window. While live patching has been introduced to avoid downtime and maintenance costs, conventional live patching methods are not viable for closed-source PLCs. Without the source code, it is difficult to understand the system behaviors and determine binary patch equivalence. To address these challenges, we present a Reliable Live Patching framework called RLPatch for applying live patches to third-party binary without source code. We design RLPatch to capture real-time conditions and dynamic behaviors of PLCs, which enables DevOps engineers to identify major non-recoverable fault (MNRF) vulnerabilities and generate hot patches. The core of RLPatch is an update agent that inserts breakpoints over the original MNRF code and then directs execution to the patches. To ensure system reliability, we use the unique constraints of PLCs to integrate the update processes with the scan cycle. We leverage RLPatch to patch 20 real vulnerabilities in three widely used Rockwell PLCs. We evaluate RLPatch in a real-world gas pipeline, demonstrating its reliability and effectiveness in practice.

Multimodal fusion aims to improve the performance of models for applications by extracting and fusing information in different modalities, including texts, images or others. Recent researches have shown that multimodal fusion is beneficial in many multimedia tasks. In this paper, we study typical multimedia classification tasks in social media posts, including sarcasm detection and sentiment analysis. This paper proposes DMF-RHGT-HPA, including dynamic Fusion multimodal fusion(DMF), a relation-aware heterogeneous graph transformer(RHGT) and hierarchical pooling alignment(HPA). To realize better multimodal fusion, the paper designs it on a heterogeneous graph with dynamic links, without any padding of texts or images. To thoroughly learn the multimodal graph and obtain the representation of nodes, the paper proposes a relation-aware heterogeneous graph transformer to fuse the node-level and edge-level features simultaneously. To get a refined representation of the multimodal graph, the paper designs a hierarchical pooling alignment to gather all nodes’ representations well. Experiments conducted on two primary and public datasets from Twitter and Yelp respectively show the ability of DMF-RHGT-HPA to gain the best performance of sarcasm detection and sentiment analysis, outperforming existing state-of-the-art baselines.

It is crucial to automatically detect anomalous patterns in system logs to protect computer systems from cyber attacks and malfunctions. However, as log data is becoming increasingly complex and labeled logs are difficult to obtain, it poses serious challenges to existing methods. To this end, this paper introduces the pre-training and fine-tuning paradigm to the log analysis domain and proposes a novel log anomaly detection framework. We propose the masked log reconstruction approach to pre-train a Transformer-based foundation model and fine-tune it for the event prediction task to obtain the anomaly detector. Our training methods exploit the sequential information within unlabeled logs with self-supervised learning. Experimental results on two public datasets demonstrate the performance superiority of our framework compared with existing state-of-the-art methods. More importantly, it is suitable for real-world scenarios where labeled logs are difficult to acquire.

Microservice is an increasingly favored architecture for constructing modern web applications and the fast-paced business requirements facilitate the transmission of microservice traffic among distributed servers. In contrast to traditional architectures, microservice architecture has tight inherent dependencies between microservice units when supporting web application business. Attackers can excavate these dependencies to maliciously orchestrate microservice requests, scheduling microservice traffic to converge on the target link. This attack disrupts link and application quality of service, bringing new potential threats to web applications and cyberspace security. This work analyzes and evaluates the threat due to the malicious orchestration of microservice requests (MOMR) with the initial intention of promoting microservice application security and other information system security based on the microservice architecture. A Cross-Layer Coupling (CLC) model is proposed that aims to describe microservice traffic transmission, which efficiently supports the threat evaluation. A Path-aware Microservice Traffic Scheduling (PMTS) attack method is imposed on the CLC model so that it can construct the MOMR threat accurately. To demonstrate the effectiveness of the proposed method in evaluating the MOMR threat, a comprehensive analysis is performed on a typical microservice application and a semi- physical simulation platform. The result shows the threat causes performance degradation and impacts the network, such as a packet loss rate of up to 79% and an RTT increase of 600% of the target link.

Open-source software (OSS) has been extensively employed to expedite software development, inevitably exposing downstream software to the peril of potential vulnerabilities. Precisely identifying the version of OSS not only facilitates the detection of vulnerabilities associated with it but also enables timely alerts upon the release of 1-day vulnerabilities. However, current methods for identifying OSS versions rely heavily on version strings or constant features, which may not be present in compiled OSS binaries or may not be representative when only function code changes are made. As a result, these methods are often imprecise in identifying the version of OSS binaries being used.

Symbolic execution is a popular program analysis technique. It systematically explores all feasible paths of a program but its scalability is largely limited by the path explosion problem, which causes the number of paths proliferates at runtime. A key idea in existing methods to mitigate this problem is to guide the selection of states for path exploration, which primarily relies on the features to represent program states. In this paper, we propose concrete constraint guided symbolic execution, which aims to cover more concrete branches and ultimately improve the overall code coverage during symbolic execution. Our key insight is based on the fact that symbolic execution strives to cover all symbolic branches while concrete branches are neglected, and directing symbolic execution toward uncovered concrete branches has a great potential to improve the overall code coverage. The experimental results demonstrate that our approach can improve the ability of KLEE to both increase code coverage and find more security violations on 10 open-source C programs.

Industrial robots are widely used in industrial control systems (ICS). Once compromised, it could be maliciously controlled by attackers, endangering manufacturing processes or even human lives. Therefore, timely discovery of vulnerabilities in industrial robots is essential. Protocol fuzzing is a popular method for discovering protocol implementation vulnerabilities. However, the intricate workflow of industrial robots imposes strict message sequence constraints on message execution. Moreover, the overhead of sequence constraint satisfaction is exacerbated by the redundant messages in message sequences and the inherent delays in physical domain execution. These challenges make it difficult for fuzzers to penetrate deep code paths for fuzzing effectively. In this paper, we propose MSGFuzzer, a message sequence-guided industrial robot protocol fuzzer. Specifically, we filter the original traffic based on message byte characteristics and gener-ate message sequences. After that, we distinguish the sequence constraints for each message through the feedback mechanism of the industrial robot. To reduce state-guidance time, we construct the minimal message sequence based on the constraint conditions of messages. We evaluated MSGFuzzer on a real industrial robot. The results show that MSGFuzzer discovered 12 unique crashes. Note that this is at least 71.4% more effective than state-of-the-art protocol fuzzers in crash discoveries

The stateful nature inherent in network protocol implementations presents distinctive challenges for testing and verification methods, including Fuzzing. However, not all states hold equal significance. Indiscriminate state selection for fuzzing could lead to intricate path mazes. Similar challenges emerge in the selection for seeds and mutation operators. Therefore, overcoming the efficiency constraints of current fuzzers crucially depends on making precise selections in fuzzing. In this study, we present AcSelector, a novel approach that incorporates the Composite State Model and Mutation Operator Value Table. By offering the most strategic combination of {state, seed, mutation operator}, AcSelector provides systematic guidance for fuzzing, leading to enhanced code coverage. To quantify value of targets, AcSelector employs a principled evaluation strategy. We evaluated AcSelector by fuzzing six network servers from popular open-source projects. Our experimental results demonstrate the effectiveness of AcSelector in increasing code coverage, even under low fuzzing throughput conditions.

Cyber-Physical Systems (CPS) are crucial for critical infrastructure sectors such as electricity, water, and transportation. Machine Learning (ML) and Deep Learning (DL)-based Intrusion Detection Systems (IDS) are widely used in CPS for security monitoring. Attack and defense confrontation is an eternal topic, leading to increased research on adversarial attacks against IDS. However, most existing research on CPS adversarial attacks focuses on improving evasion capabilities without ensuring the preservation of malicious attack functionality. To address this problem, we propose a Conditional Wasserstein GAN (CWGAN) based framework to generate adversarial examples that can not only evade IDS detection but also impose constraints on the specified target sensors to preserve the original attack functionality. Evaluation results demonstrate that our approach can effectively preserve the intended malicious functionality by significantly reducing the perturbations to specific target sensors. Specifically, we achieve an average reduction of 96.93% and 90.59%, and a maximum reduction of 93.26% and 95.94% compared to the state-of-the-art JSMA and GAN based methods, respectively, while maintaining largely unchanged evasion capabilities against IDS.

Program comprehension can help analysts understand the primary behavior of a binary and enhance the efficiency of reverse engineering analysis. The existing works focus on instruction translation and function name prediction. However, they are limited in understanding the entire program. The recovered source file information can offer insights into the primary behavior of a binary, serving as high-level program summaries. Nevertheless, the files recovered by the function clustering-based approach contain binary functions with discontinuous distributions, resulting in low accuracy. Additionally, there is no existing research related to predicting the names of these recovered files. To this end, we propose a framework for source file information recovery in binaries, DeLink. This framework first leverages a file structure recovery approach based on boundary location to recognize files within a binary. Then, it utilizes an encoder-decoder model to predict the names of these files. The experimental results show that our file structure recovery approach achieves an average improvement of 14% across six evaluation metrics and requires only an average time of 16.74 seconds, outperforming the state-of-the-art work in both recovery quality and efficiency. Additionally, our file name prediction model achieves 70.09% precision and 63.91% recall. Moreover, we demonstrate the effective application of DeLink in malware homology analysis.

Fuzz drivers are essential for library API fuzzing. However, automatically generating fuzz drivers is a complex task, as it demands the creation of high-quality, correct, and robust API usage code. An LLM-based (Large Language Model) approach for generating fuzz drivers is a promising area of research. Unlike traditional program analysis-based generators, this text-based approach is more generalized and capable of harnessing a variety of API usage information, resulting in code that is friendly for human readers. However, there is still a lack of understanding regarding the fundamental issues on this direction, such as its effectiveness and potential challenges. To bridge this gap, we conducted the first in-depth study targeting the important issues of using LLMs to generate effective fuzz drivers. Our study features a curated dataset with 86 fuzz driver generation questions from 30 widely-used C projects. Six prompting strategies are designed and tested across five state-of-the-art LLMs with five different temperature settings. In total, our study evaluated 736,430 generated fuzz drivers, with 0.85 billion token costs ($8,000+ charged tokens). Additionally, we compared the LLM-generated drivers against those utilized in industry, conducting extensive fuzzing experiments (3.75 CPU-year). Our study uncovered that: 1) While LLM-based fuzz driver generation is a promising direction, it still encounters several obstacles towards practical applications; 2) LLMs face difficulties in generating effective fuzz drivers for APIs with intricate specifics. Three featured design choices of prompt strategies can be beneficial: issuing repeat queries, querying with examples, and employing an iterative querying process; 3) While LLM-generated drivers can yield fuzzing outcomes that are on par with those used in the industry, there are substantial opportunities for enhancement, such as extending contained API usage, or integrating semantic oracles to facilitate logical bug detection. Our insights have been implemented to improve the OSS-Fuzz-Gen project, facilitating practical fuzz driver generation in industry.

The principal tasks of program analysis, including bug searching and code similarity detection, are executed at the function level. However, the accurate identification of functions within stripped binary files poses a significant challenge. This difficulty is exacerbated by unformatted monolithic firmware images typically found in industrial controlling device, rendering existing methods ineffective due to their dependence on specific metadata, which may be absent.

Industrial Control Systems (ICS) are increasingly facing the threat of False Data Injection (FDI) attacks. Process-based anomaly detection is an emerging intrusion detection approach for I CS that effectively identifies anomalies induced by FDI attacks. Anomaly detection models are constructed to describe the normal patterns of industrial processes and subsequently perform real-time evaluation of process data. However, this approach suffers from low detection accuracy due to the complex nonlinear spatiotemporal correlations in industrial pro-cess data, which are difficult to explicitly describe using anomaly detection models. Additionally, noise and interference within the process data prevent these models from recognizing genuine anomalous events. This paper proposes a State Space-based Anomaly Detection (SSAD) approach. Specifically, to explicitly describe the spatiotemporal correlations in process data, we introduce a deep learning-based state estimation model that employs Convolutional Neural Networks (CNNs) for temporal modeling and utilizes a Selective State Space (SSS) for spatial modeling. To detect anomalies in the presence of noise and interference, we design a robust anomaly identification model that combines maximum deviation and threshold strategies to analyze the outputs of the state estimation model. Extensive experiments on two benchmark I CS security datasets demonstrate the effectiveness of SSAD.

As the Industrial Control System (ICS) increasingly merges with the Internet, the security threats have been increasing from internal users and external hackers. These challenges are further intensified by the facts: industrial control devices and protocols, leading to the inadequacy of traditional access control models in tackling the intricacies of ICS. We identify attributes that are optimally aligned with the specific needs of the ICS environment and propose the Multidimensional Industrial Control Attribute-Based Access Control Model (MICABAC) as a customized solution. MICABAC model significantly improves access control security and is finer granularity by selecting and evaluating required attributes within various ICS. We have been validated in two real-world ICS environments: the Gas Pipe Network System (GPNS) and the Computer Numerical Control (CNC) machine tool. Experiments indicate that by integrating MICABAC into the existing system, the maximum delay for access requests is 63.83 ms. In terms of accuracy in defending against malicious attacks, the GPNS achieves 96.49% and the CNC reaches 94.86%. Finally, we discuss the advantages and limitations of MICABAC and explore potential directions for future research.

Near Field Communication (NFC) has been widely used for rapid data exchange between electronic devices over a very short distance. In this paper, we reveal a new security vulnerability in NFC passive communication channels where transferred data can be modified in real-time. The security threat of data modification posed by this vulnerability is called NFCEraser. Exploiting electromagnetic interference (EMI), NFCEraser injects signals into the crystal oscillator’s electrode and adjusts the amplitude of carrier signals in NFC communication channels. By manipulating the parameters of EMI signals, NFCEraser is able to arbitrarily flip the bits in data payload sent from an NFC peer device, which may cause serious security outcomes. To assess the severity of NFCEraser, we examine six NFC modules under NFC-A/B communication modes and successfully perform reading operations under a variety of data lengths. The experimental results show that NFCEraser can modify data bits in response frames from NFC peer devices with the maximum 89% accuracy, under around 0.21μs latency. Our analysis further shows that NFCEraser can maintain an attack success rate of no less than 85% in environments with typical levels of electromagnetic noise.

In scenarios involving a single targeted application service, it is essential to monitor the security of business-oriented processes. However, there is currently a lack of lightweight, real-time online anomaly detection methods for targeted processes that do not require labeled data. This paper presents a self-supervised anomaly detection model for targeted processes, based on a minimal observation event set and utilizing eBPF and deep learning techniques. The model first selects a minimal set of observed events for the targeted process, which includes critical system calls, process scheduling, resource usage, and I/O operations. Unlike traditional system call sequence features, this model focuses on the rate of change in the frequency of feature selection calls. The detection model employs the VAE-LSTM algorithm, where the VAE module constructs robust short windows and the LSTM module estimates long-term correlations within the sequence. Through self-supervised learning, the model learns the normal behavior of targeted processes, extracts robust behavioral features, and reduces feature dimensions. By performing online detection of these learned features against runtime processes, the model achieves second-level anomaly detection for targeted processes. Finally, by simulating and constructing eight different types of process attack scenarios, the experimental results demonstrate a detection accuracy exceeding 92%, with a performance overhead of less than 10%.

The era of the Industrial Internet of Things has led to an escalating menace of Cyber-Physical Manufacturing Systems (CPMS) to cyber-attacks. Presently, the field of intrusion detection for CPMS has significant advancements. However, current methodologies require significant costs for collecting historical data to train detection models, which are tailored to specific machining scenarios. Evolving machining scenarios in the real world challenge the adaptability of these methods. In this paper, We found that the machining code of the CPMS contains a complete machining process, which is an excellent detection basis. Therefore we propose MPI-CNC, an intrusion detection approach based on Machining Process Invariant in the machining code. Specifically, MPI-CNC automates the analysis of the machining codes to extract machining process rules and key parameter rules, which serve as essential detection rules. Then, MPI-CNC actively acquires runtime status from the CPMS and matches the detection rules to identify cyber-attacks behavior. MPI-CNC was evaluated using two FANUC CNC machine tools across ten real machining scenarios. The experiment demonstrated the exceptional adaptability capability of MPI-CNC. Furthermore, MPI-CNC showed superior accuracy in detecting cyber-attacks against CPMS compared to existing state-of-the-art detection methods while ensuring normal machining operations.

Internet of Things (IoT) platforms have become widely used recently. Facilitated by these IoT platforms, users can easily use programming paradigm to develop customized rules, connect their devices with online services, and realize system automation. However, the attack surface of each device is expanded as the device interactions increase with multiple rules enabled. In this work, we present a framework to analyze the cascading threat based on device interactions in the IFTTT (IF This Then That) platform. We first extract the trigger-action rules from the description text by using an NLP-based method. Then, we create a graph-based model by combining trigger-action rules with three components, to describe the flow information of device interactions. Finally, we propose a graph-searching-based method to discover the paths and starting points of application-level cascading attacks, uncovering the attack surface of devices. We conduct the evaluation on a data set of 305534 applets from the IFTTT platform. The results evidence that cascading attacks exist in IoT deployments but can be captured by our attack surface analysis.

Edge nodes provide service cooperatively in edge computing, where third-party nodes are common. However, they cannot be fully trusted and can intentionally alter service results (e.g., edge tampering). Although some mechanisms can help detect edge tampering, they come with additional detection overhead. It is essential to note that most edge nodes are willing to serve honestly. Therefore, it is reasonable to decrease the detection frequency for those nodes, which helps reduce the overhead. Reputation is the common way to evaluate trustworthiness. In this article, we propose a reputation incentive scheme called RIETD, which evaluates the reputations of edge nodes using their detection results. Moreover, RIETD is loosely coupled with detection mechanisms as an external service. Reputation is the fundamental parameter in RIETD, as it determines an acrlong EN’s appraisal weight on other nodes, personalized detection strategy, and node’s obtained revenues in one service. We demonstrate that RIETD does not significantly reduce the overall detection capability while the overhead is reduced effectively. For instance, when the tampering rate of edge nodes is 10%, and the target detection rate is 90% of a specific detection mechanism, RIETD reduces overhead by approximately 60%. If a full-reputation node is detected to have tampered with the results, its reputation recovery time is similar to the time required for reputation to improve from 0 to 1. Moreover, a node’s expected revenue is lower than that of an honest node, emphasizing the importance of serving honestly and continuously for edge nodes to earn higher revenue.

Motion control systems, extensively utilized in domains like 3D printing, CNC machining, and robotic arm operations, are pivotal in modern manufacturing and automation processes. Consequently, a specific category of attacks, designed to target these systems, can manipulate the movements of controlled objects while replaying false sensor readings to evade existing tools, thereby severely disrupting these essential operations without being detected. To make things worse, the limited computing resources of embedded devices in these systems constrain the implementation of robust security protections and monitoring mechanisms locally. To solve this, we propose a novel side-channel method that leverages current signals emitted by motors to reconstruct trajectories for attack detection. In this paper, we design and implement a two-stage detection framework, dubbed PowerGuard. In the offline learning stage, PowerGuard first captures the current signals emitted by the servo motors and models the correlation between these signals and corresponding movement trajectories. In the real-time monitoring stage, PowerGuard finds outliers that deviate from the desired trajectory described in the benign G-code file. We have evaluated PowerGuard using a typical motion control system that contains CNC machine tools from different vendors (e.g., Siemens 828D, 840D-sl, Fanuc 0i-md, 0i-tf). We conducted extensive experiments to evaluate the reconstruction accuracy and attack detection performance. Experimental results show that PowerGuard can reconstruct movement trajectories with an error of 0.047mm, and detect 93.35% of various trajectory anomalies.

Edge preprocessing is a critical service type in edge computing. However, untrusted edges may be malicious to provide incorrect computational results (i.e., edge tampering). Although some studies have considered the correctness of results, they have limitations when applied to edge preprocessing. We present FeaShare, a feature-sharing approach, to verify edge results. The process is integrated into normal service operations. Meanwhile, to overcome feature-based limitations, terminals obtain partial edge results for a set of data by executing a small number of computations. These partial results are leveraged to construct shared features, facilitating the detection of edge tampering even when the tampered portion is not directly related to the features. Subsequently, the shared features are mapped to pseudo-data and added to the terminal's data sequence, preventing features from influencing the results of terminal data. To resist edge attacks, both feature construction and placement are time-dependent and dynamic. FeaShare is not confined to specific edge tasks. We evaluate FeaShare using 3 typical scenes encompassing 5 applications. For instance, the evaluation utilizing the VGG model and CIFAR-10 dataset demonstrates a detection rate of 97%. Terminals perform approximately 10% of the edge's computation operations, and its overhead growth rate is less than 10%.

Protocol reverse engineering (PRE) serves as an instrumental tool in various security research, such as protocol fuzzing and intrusion detection. Its primary objective lies in uncovering the format, semantics, and behavior of an unknown protocol without prior information. This paper presents DL-ProS2, a deep learning-based approach for binary protocol reversing, focusing on format segmentation and semantic inference from network traffic. Our approach is underpinned by highlighting the effectiveness of multi-scale features within the network traffic for identifying various types of fields and semantics. Based on this, DL-ProS2 employs a comprehensive end-to-end model that integrates U-Net, siamese network, and BiLSTM-CRF, which enables the effective analysis of unknown protocol traffic to extract the field boundaries and semantics. Meanwhile, to address the issue of limited data diversity and coverage, we implement an innovative knowledge-driven traffic simulation technique. This method harnesses the ChatGPT to extract protocol knowledge from publicly available protocol documents, such as RFCs, as the foundational rules for the simulation. Empirical results substantiate the efficacy of our approach, demonstrating precision rates exceeding 0.95 and recall rates surpassing 0.97 for partially unknown protocol format segmentation and semantic inference. It also retains effectiveness in the inference of completely unknown protocols, with average precision and recall rates of 0.69 and 0.62 for format segmentation, and 0.43 and 0.47 for semantic inference, respectively.

Third-party libraries (TPLs) are extensively utilized by developers to expedite the software development process and incorporate external functionalities. Nevertheless, insecure TPL reuse can lead to significant security risks. Existing methods, which involve extracting strings or conducting function matching, are employed to determine the presence of TPL code in the target binary. However, these methods often yield unsatisfactory results due to the recurrence of strings and the presence of numerous similar non-homologous functions. Furthermore, the variation in C/C++ binaries across different optimization options and architectures exacerbates the problem. Additionally, existing approaches struggle to identify specific pieces of reused code in the target binary, complicating the detection of complex reuse relationships and impeding downstream tasks. And, we call this issue the poor interpretability of TPL detection results. In this article, we observe that TPL reuse typically involves not just isolated functions but also areas encompassing several adjacent functions on the Function Call Graph (FCG). We introduce LibAM, a novel Area Matching framework that connects isolated functions into function areas on FCG and detects TPLs by comparing the similarity of these function areas, significantly mitigating the impact of different optimization options and architectures. Furthermore, LibAM is the first approach capable of detecting the exact reuse areas on FCG and offering substantial benefits for downstream tasks. To validate our approach, we compile the first TPL detection dataset for C/C++ binaries across various optimization options and architectures. Experimental results demonstrate that LibAM outperforms all existing TPL detection methods and provides interpretable evidence for TPL detection results by identifying exact reuse areas. We also evaluate LibAM’s scalability on large-scale, real-world binaries in IoT firmware and generate a list of potential vulnerabilities for these devices. Our experiments indicate that the Area Matching framework performs exceptionally well in the TPL detection task and holds promise for other binary similarity analysis tasks. Last but not least, by analyzing the detection results of IoT firmware, we make several interesting findings, for instance, different target binaries always tend to reuse the same code area of TPL. The datasets and source code used in this article are available at https://github.com/Siyuan-Li201/LibAM .

N etworked E mbedded D evices (NEDs) are increasingly targeted by cyberattacks, mainly due to their widespread use in our daily lives. Vulnerabilities in NEDs are the root causes of these cyberattacks. Although deployed NEDs go through thorough code audits, there can still be considerable exploitable vulnerabilities. Existing mitigation measures like code encryption and obfuscation adopted by vendors can resist static analysis on deployed NEDs, but are ineffective against protocol fuzzing. Attackers can easily apply protocol fuzzing to discover vulnerabilities and compromise deployed NEDs. Unfortunately, prior anti-fuzzing techniques are impractical as they significantly slow down NEDs, hampering NED availability. To address this issue, we propose Armor—the first anti-fuzzing technique specifically designed for NEDs. First, we design three adversarial primitives–delay, fake coverage, and forged exception–to break the fundamental mechanisms on which fuzzing relies to effectively find vulnerabilities. Second, based on our observation that inputs from normal users consistent with the protocol specification and certain program paths are rarely executed with normal inputs, we design static and dynamic strategies to decide whether to activate the adversarial primitives. Extensive evaluations show that Armor incurs negligible time overhead and effectively reduces the code coverage (e.g., line coverage by 22%-61%) for fuzzing, significantly outperforming the state of the art.

Deeply embedded systems powered by microcontrollers are becoming popular with the emergence of Internet-of-Things (IoT) technology. However, these devices primarily run C/C \({+}{+}\) code and are susceptible to memory bugs, which can potentially lead to both control data attacks and non-control data attacks. Existing defense mechanisms (such as control-flow integrity (CFI), dataflow integrity (DFI) and write integrity testing (WIT), etc.) consume a massive amount of resources, making them less practical in real products. To make it lightweight, we design a bitmap-based allowlist mechanism to unify the storage of the runtime data for protecting both control data and non-control data. The memory requirements are constant and small, regardless of the number of deployed defense mechanisms. We store the allowlist in the TrustZone to ensure its integrity and confidentiality. Meanwhile, we perform an offline analysis to detect potential collisions and make corresponding adjustments when it happens. We have implemented our idea on an ARM Cortex-M-based development board. Our evaluation results show a substantial reduction in memory consumption when deploying the proposed CFI and DFI mechanisms, without compromising runtime performance. Specifically, our prototype enforces CFI and DFI at a cost of just 2.09% performance overhead and 32.56% memory overhead on average.

Widespread code reuse allows vulnerabilities to proliferate among a vast variety of firmware. There is an urgent need to detect these vulnerable codes effectively and efficiently. By measuring code similarities, AI-based binary code similarity detection is applied to detecting vulnerable code at scale. Existing studies have proposed various function features to capture the commonality for similarity detection. Nevertheless, the significant code syntactic variability induced by the diversity of IoT hardware architectures diminishes the accuracy of binary code similarity detection. In our earlier study and the tool Asteria , we adopted a Tree-LSTM network to summarize function semantics as function commonality, and the evaluation result indicates an advanced performance. However, it still has utility concerns due to excessive time costs and inadequate precision while searching for large-scale firmware bugs. To this end, we propose a novel deep learning-enhancement architecture by incorporating domain knowledge-based pre-filtration and re-ranking modules, and we develop a prototype named Asteria-Pro based on Asteria . The pre-filtration module eliminates dissimilar functions, thus reducing the subsequent deep learning-model calculations. The re-ranking module boosts the rankings of vulnerable functions among candidates generated by the deep learning model. Our evaluation indicates that the pre-filtration module cuts the calculation time by 96.9%, and the re-ranking module improves MRR and Recall by 23.71% and 36.4%, respectively. By incorporating these modules, Asteria-Pro outperforms existing state-of-the-art approaches in the bug search task by a significant margin. Furthermore, our evaluation shows that embedding baseline methods with pre-filtration and re-ranking modules significantly improves their precision. We conduct a large-scale real-world firmware bug search, and Asteria-Pro manages to detect 1,482 vulnerable functions with a high precision 91.65%.

With the increasing number of Internet of Things (IoT) devices connected to the internet, the industry and research community have become increasingly concerned about their security impact. Adversaries or hackers often exploit public security flaws to compromise IoT devices and launch cyber attacks. However, despite this growing concern, little effort has been made to investigate the detection of IoT devices and their underlying risks. To address this gap, this article proposes to automatically establish relationships between IoT devices and their vulnerabilities in the wild. Specifically, we construct a deep neural network (DNN) to extract semantic information from IoT packets and generate fine-grained fingerprints of IoT devices. This enables us to annotate IoT devices in cyberspace, including their device type, vendor, and product information. We collect vulnerability reports from various security sources and extract IoT device information from these reports to automatically match vulnerabilities with the fingerprints of IoT devices. We implemented a prototype system and conducted extensive experiments to validate the effectiveness of our approach. The results show that our DNN model achieved a 98% precision rate and a 95% recall rate in IoT device fingerprinting. Furthermore, we collected and analyzed over 13,063 IoT-related vulnerability reports and our method automatically built 5,458 connections between IoT device fingerprints and their vulnerabilities. These findings shed light on the ongoing threat of cyber-attacks on IoT systems as both IoT devices and disclosed vulnerabilities are targets for malicious attackers.

Finding vulnerabilities in firmware is vital as any firmware vulnerability may lead to cyberattacks to the physical IoT devices. Taint analysis is one promising technique for finding firmware vulnerabilities thanks to its high coverage and scalability. However, sizable closed-source firmware makes it extremely difficult to analyze the complete data-flow paths from taint sources (i.e., interface library functions such as recv) to sinks.

The API call sequence based malware detectors have proven to be promising, especially when incorporated with deep neural networks (DNNs). Several adversarial attack methods are proposed to fool these detectors by introducing undetectable perturbations into normal samples. However, in real-world scenarios, the malware detector provides only the predicted label for a given sample, without exposing its network architecture or output probability, making it challenging for adversarial attacks under the decision-based black-box. Existing work in this area typically relies on random-based methods that suffer high costs and low attack success rates. To address these limitations, we propose a novel decision-based black-box attack against API sequence based malware detectors, called MalAder. Our approach aims to improve the attack success rate as well as query efficiency through a directional perturbation algorithm. First, it utilizes attention-based API ranking to assess the importance of API calls in the context of different API sequences. This assessment guides the insertion position for perturbation. Then, the perturbation is carried out using benign distance perturbing, which gradually shortens the semantic distance from adversarial API sequences to a set of benign samples. Finally, our algorithm iteratively generates adversarial malware samples by performing perturbations. In addition, we have implemented MalAder and evaluated its performance against two classic malware detectors. The results show that MalAder outperforms state-of-the-art decision-based black-box adversarial attacks, proving its effectiveness.

Modality representation learning is an important problem for multimodal sentiment analysis (MSA), since the highly distinguishable representations can contribute to improving the analysis effect. Previous works of MSA have usually focused on internal fusion strategies for different modalities within one sample, and the external usage of cross reference relations among different samples was given less attention. Recently, the rise of contrastive learning provides powerful clues for us to learn modal representation with stronger discriminative ability. In this study, we explore the approach of representations improvement and devise a three-stages framework with multi-view contrastive learning to refine representations for the specific objectives. Firstly, for each modality, we employ the supervised contrastive learning to pull samples within the same class together while the other samples are pushed apart. Then, a self-supervised contrastive learning is designed for the distilled cross-modal representations after a novel Transformer-based interaction module. At last, we leverage again the supervised contrastive learning to enhance the fused multimodal representation. We conduct extensive experiments on three open datasets, and results show the advance of our model.

Enterprise relation extraction aims to detect pairs of enterprise entities and identify the business relations between them from unstructured or semi-structured text data, and it is crucial for several real-world applications such as risk analysis, rating research and supply chain security. However, previous work mainly focuses on getting attribute information about enterprises like personnel and corporate business, and pays little attention to enterprise relation extraction. To encourage further progress in the research, we introduce the CEntRE, a new dataset constructed from publicly available business news data with careful human annotation and intelligent data processing. Moreover, we propose a joint entity and relation extraction network, which is capable of discovering enterprise entities and extracting business relations between them accurately. The network firstly encodes input sequences with strong semantic augmentation to learn contextual representation for each token, then a conditional random field (CRF) module is used for entity extraction. Subsequently, entity pairs are built and a new encoder based on the entity pairs is applied to get global information for relation extraction. Finally, a biaffine classifier is deployed to classify the relations. Extensive experiments on CEntRE demonstrate the effectiveness of our proposed method compared with other six excellent models, and thus our model can be considered as one strong baseline. The data and code are available at: https://github.com/LiuPeiP-CStMining_Entity_Relations_Among_Enterprises

Recognizing the users of devices can easily enable numerous security applications. Due to the lot's kinds of device data and a large number of missing values, it takes work to recognize the users of devices well. The community detection methods based on Graph Neural Networks (GNN) can integrate multi-source data well and cluster devices into communities with the same users. While existing GNN methods face several issues. The methods on homogeneous graphs could not utilize the multi-source data of devices, and most methods on heterogeneous graphs need specific knowledge to design meta paths. Also, the Internet-scale data of devices make it hard to learn the representation thoroughly. Further, most methods need to consider the known partial labels in the early stage of the training process. To improve the performance of user recognition, this paper proposes HGT-PL, namely a Heterogeneous Graph Transformer with Partial Labels, to calculate the representation of devices on the Internet. Then cluster methods are used to realize user recognition. Using graph transformers, HGT-PL deeply learns node features and graph structure on the heterogeneous graph of devices. By Label Encoder, HGT-PL fully utilizes the users of partial devices from preliminary rules with high confidence. Moreover, cluster methods carefully divide and modify the communities with different users. The paper conducts experiments on the web-scale data collected from the Internet. The results show that HGT-PL can recognize users of devices more accurately and effectively, with 0.5121 NMI and 0.3554 ARI, compared with existing GNN methods.

The number of Internet device vulnerabilities has been quickly rising in recent years, rendering an explosion of network attacks. Device fingerprinting serves as the primary means for vulnerability awareness and attacker tracking. The current device fingerprinting approach can only achieve model-level identification within the Internet scope or individual-level identification for specific protocols (e.g., SSL) or scenarios (e.g., LAN). However, it is still difficult for these methods to achieve individual-level identification on a global Internet scale. In this paper, we propose a fingerprint extraction approach that is accurate to the individual level of the device by using a combination of clustering, multiple sequence alignment, and based on the geographic location stability of the device. In a continuous 3-month observation for several cities around the world, at least 1.54% of devices can be accurately extracted with unique IDs, with an accuracy rate of 99.30%, which is capable of being used in production environments.

Malware classification based on dynamic feature analysis works by running malware in controlled and isolated environments to observe how it behaves. This technology widely uses the sequence of run-time API calls to classify. Malware often adopts evasion techniques such as obfuscation, encryption, and code injection to obfuscate classification results by introducing noise into the API sequence. The existing methods lack explicit means of filtering noise components in the data, which affects the accuracy of malware detection. To address this issue, we propose DenoMC, a malware classification method with an explicit denoising module. Firstly, we employ dynamic analysis and embedding techniques to encode the API sequence. Then, we introduce a soft thresholding mechanism in the residual network to achieve active filtering of noise components in API sequences. Finally, a BiLSTM model is adopted to enhance the temporal correlation among sequence of API calls and improve classification performance. Experiments conducted on real datasets demonstrate that DenoMC significantly improves malware classification accuracy compared to other state-of-art models. In addition, we validate the effectiveness of each module in DenoMC through extensive ablation studies.

Although the importance of using static taint analysis to detect taint-style vulnerabilities in Linux-based embedded firmware is widely recognized, existing approaches are plagued by following major limitations: (a) Existing works cannot properly handle indirect call on the path from attacker-controlled sources to security-sensitive sinks, resulting in lots of false negatives. (b) They employ heuristics to identify mediate taint source and it is not accurate enough, which leads to high false positives.

Both the real network environment of IoT devices and the most of publicly available datasets suffer from the problem of sample imbalance. Traditional intrusion detection models fail to effectively identify minority samples. Therefore, this paper proposes a CNN-PSO-KELM model aimed at enhancing the model’s detection capabilities in imbalanced data, particularly, for minority samples. This model employs an improved dual-layer convolutional neural network (CNN) for feature extraction, followed by label classification using kernel extreme learning machine (KELM). It achieves the combination of the generalization ability of CNN and the high learning ability of KELM. To address the performance degradation caused by the random initialization of KELM parameters, particle swarm optimization (PSO) is introduced to assist in parameter acquisition for KELM. The effectiveness of this improvement has been verified on three IoT datasets: NSL-KDD, CIC-IDS2017, and Bot-IoT. Compared to traditional deep learning algorithms, CNN-PSO-KELM significantly improves the detection accuracy for imbalanced data.

Recently, Graph neural networks (GNNs) have been adopted to model a wide range of structured data from academic and industry fields. With the rapid development of Internet technology, there are more and more meaningful applications for Internet devices, including device identification, geolocation and others, whose performance needs improvement. To replicate the several claimed successes of GNNs, this paper proposes DeviceGPT based on a generative pre-training transformer on a heterogeneous graph via self-supervised learning to learn interactions-rich information of devices from its large-scale databases well. The experiments on the dataset constructed from the real world show DeviceGPT could achieve competitive results in multiple Internet applications.

The democratization of artificial intelligence has made substantial progress by leveraging open-source large language models (LLMs), enabling researchers across domains to train customized models to meet their specific needs. Given the confidentiality and significance of cybersecurity, obtaining private and localized LLMs is imperative. However, general LLMs are not designed to cater specifically to this field, their general knowledge often falls short when addressing such specialized problems. In this paper, we categorize the domain instructions based on cybersecurity knowledge to guide the construction of high-quality instructions and conversations, ultimately enhancing the specialized capabilities of LLMs. The resulting fine-tuned LLMs, collectively termed HackMentor, are evaluated using WinRate, EloRating, and ZenoEval methods along with other popular LLMs. The experiments demonstrate that the proposed method yields significant performance improvements, surpassing the native LLMs by 10-25% when aligned with cybersecurity prompts. More, HackMentor exhibits comparable conversational quality to ChatGPT, while providing more concise and humanlike responses. This study demonstrates the efficacy of HackMentor in augmenting LLMs for cybersecurity requirements, paving the way for localized LLMs that meet specialized needs without compromising general capabilities.

Recognizing the users of devices (or clusters of devices) who use IP addresses as unique identities on the Internet can easily enable numerous security applications. Fast and accurate user recognition is critical for supervisors to find influenced organizations connected to their networks in light of new security threats. Many users’ information scatters in the multisource data of IP addresses. Up until now, user recognition of devices has had two main problems. On the one hand, existing methods could not fully use multisource data of the IP addresses and wastes the valuable information of labels. On the other hand, only a tiny portion of devices can be tagged with highly confident known users manually, making it an urgent need to infer unknown users of devices. So, the problem of user recognition on devices is to guess the unknown user with multisource data and existing devices with known users. Therefore, this paper proposes a multiview fusion method to deal with multisource data from devices with a small number of manually labelled samples. The paper uses GraphSAGE to obtain an exemplary representation of IP addresses and designs a label encoder to fully use a small number of devices with known users. Then, the paper builds a specific unified transformer to achieve high performance to determine whether two devices have the same user. At the same time, the paper conducts real‐world experiments and finds that the proposed method can achieve 0.9158 accuracy and 0.6131 F1 to find devices with the same users on the constructed dataset in the real world.

Physical-layer secret key generation (PLKG) is a new research area that has emerged in recent years. It is aimed at scenarios where legitimate IoT devices communicate directly, interacting with confidential information for lower overhead and higher security by using wireless channel. When applying it to wireless feature extraction, noise removal is not taken into account in current deep learning networks. To address these problems, the PLKG scheme based on bidirectional convergence feature learning convolutional network (BCFL-based scheme) is proposed, which consists of neural network called BCFL and a new quantization method to achieve better secret key generation. Unlike existing PLKG schemes that enabling both parties to communicate for obtaining higher channel feature similarities, when training it, channel state information (CSI) obtained by channel estimation for two legitimate devices during coherent time is used as inputs; and mean square error (MSE) between two outputs is used as a result of loss function for iterative training. Thus, it can obtain better denoising ability with guaranteed low computational resource consumption, and two legitimate devices can obtain highly correlated channel features. Multiple quantization method is also proposed to address low secret key generation rate (KGR) and low-secret key randomness (KR). The results show that the proposed BCFL-based scheme has a lower MSE than other schemes in different scenarios, indicating that it has better capability to learn channel reciprocity; and secret key error rate (KER) and time consumption are only about 50% of other schemes, which is a significant performance improvement.

Nowadays, Industrial Internet of Things (IIoT) technology has made a great progress and the industrial control systems (ICSs) have been used extensively, which has brought more and more serious information security threats to the ICS at the same time. The authenticated key agreement (AKA) protocol is a common method to ensure the communication security. This work proposes a lightweight AKA protocol based on the elliptic curve cryptography (ECC) algorithm to adapt to the resource-constrained environment. We only employ hash operation, XOR operation, and ECC algorithm to encrypt the data in the authentication and key agreement phase, and avoid involving the register center while proceeding the key agreement, to give consideration to both performance and security. The security analyses indicate that our protocol can meet nine critical security requirements, more than all of the existing protocols, and the performance analysis carried out indicates that our protocol has less computational and communication overheads in contrast to other corelative protocols.

With the digital transformation of the energy industry, energy blockchain is playing an important role in application areas, such as energy data sharing and distributed power trading. In this process, the use of energy data is a top priority. Federated learning (FL) can enable the analysis and computation of energy data while protecting their privacy. However, traditional FL relies on a central server and parties involved are not fully trusted. In energy blockchain environment, FL also faces data poisoning attacks launched by energy departments, besides, the supervisory committee carrying out checking models can launch deception attacks. Therefore, we propose a game theory-based incentive mechanism for collaborative security of FL in energy blockchain environment, which can discourage nodes from taking malicious behaviors in iterative training of FL. First, we propose an FL model in energy blockchain environment, which can protect privacy and achieve collaborative security. Considering that game theory can be used to analyze the strategies of participants, we build a game model with energy departments and supervisory committee as players and design our incentive mechanism based on game theory, which is implemented by smart contracts. Even if the accuracy of model checking algorithm is low, malicious behaviors in FL can be reduced by using our incentive mechanism. In particular, we prove that our mechanism can lead game model to a Nash equilibrium (NE) that achieve collaborative security. Security analysis and experimental evaluation show that our incentive mechanism is feasible in energy blockchain with robustness, reliability, and low complexity.

Nowadays, various Internet of Things (IoT) devices, such as routers, webcams, and network printers, have been deployed across the Internet. For security and management purposes, it is important to accurately fingerprint IoT devices. In this work, we build a first benchmark called DevTag (IoT Device Tagging) for fingerprinting IoT devices. Specifically, DevTag supports retrieving packet-level features from IoT devices through two different data collections, passive monitoring, and active probing. For detecting IoT devices, DevTag integrates model-based and rule-based fingerprinting methods. For the model-based detection, we reimplemented five typical deep algorithms to infer IoT device classification models. For the rule-based detection, we generated nearly 41 117 rules in a unified format by analyzing several open-source tools. Furthermore, we conducted a systematic analysis to explore the advantages and limitations of those two methods for detecting IoT devices. Our analysis results reveal that the model-based detection has a significant advantage in distinguishing coarse-grained IoT devices (e.g., device type and vendor), while it is not suitable to detect product information as the label amount is massive. The rule-based detection is capable of extracting fine-grained device information with high precision in a short time. However, rules also suffer several inherent problems, such as multiple matching, conflicting, and overlapping issues. Finally, we implemented and distributed a prototype of DevTag working as the first benchmark for detecting IoT devices in the network community.

Industrial Control System (ICS) protocols have built a tight coupling between ICS components, including industrial software and field controllers such as Programmable Logic Controllers (PLCs). With more ICS components are exposed on the Internet, huge threats are emerging through the exploitation on the inherent defects of ICS protocols. However, the proprietary of ICS protocols makes it extremely hard to build intrusion detection system or perform penetration tests for ICS security reinforcement. In this work, we introduce a symbolic-execution based protocol reverse analysis framework to extract the message format and field type of ICS protocols from real-world PLC firmware. We design new coverage metric and path prioritization strategy to enhance symbolic execution for extensive protocol reverse analysis. Moreover, we propose a field-expression based method on protocol message format inference, along with the analysis on the value ranges of fields which are ignored by previous work. Our evaluation shows that our methods can extract more protocol information during symbolic execution, and achieve high accuracy on protocol reverse analysis compared to Wireshark. Furthermore, we equip the results on private ICS protocols with a black-box fuzzer to test two real-world PLCs. In total, we have found 10 vulnerabilities, including 4 new vulnerabilities.

Fingerprinting Internet-of-Things(IoT) devices on types and brands is a necessary work for security analysis in the cyberspace. The existing approaches mainly rely on the dominant features of devices which is response to information in order to identify these online devices. However, the web server components reusing and products rebranding are the common phenomenons of these embedded IoT devices. It caused the existing approaches difficult to identify most devices even errors due to the similar responses. In this paper, we present an approach, IoTXray, which improves the work efficiently of information collection about accelerating the relations between reusing/rebranding devices with the corresponding manufacturers. And these relations can generate more accurate and reliable fingerprints than previous approaches. Using the mixed neural networks, IoTXray comprehensively detects the real manufactures of online IoT devices upon three different kinds of data sources. In the experiment, our approach can identify 7,025,854 IoT devices on HTTP-hosts. The identification rate has reached to several times higher than previous approaches. Our approach has especially detected 3,268,953 reusing and 963,653 rebranding devices with their original manufacturers.

With the development of the Industrial Internet of Things, industrial control systems have become more open and intelligent. However, large numbers of unknown protocols exist in IIoT, threatening the security of IIoT devices and systems. Protocol reverse engineering extracts the grammar and semantics of the protocol by monitoring and analyzing the traffic trace or the execution process of instructions, without the need for protocol description. As the executable programs are mainly integrated into the IIoT devices and the communication traffic is relatively sparse, the traditional protocol analyzing method is not suitable for the IIoT environment. This paper proposes an improved sparse protocol parsing method of IIoT protocol based on the BPSO-vote-HMM hybrid model. The binary particle swarm optimization algorithm is introduced to expand the captured IIoT protocol message sequence, solving the problems of sparse samples in IIoT and the low efficiency of the GA-based data expansion model. Besides, we improve on the parameter training part to improve the efficiency and get better model parameters by dividing the training set into several sub-sets, conducting the parameter update parallel, and inputting the results into a voter to generate the final parameter of HMM, which is used in protocol field prediction. Finally, by combining the BPSO-based data expansion model and the protocol field parsing model based on vote-HMM, a hybrid analytical model is constructed to improve the analytical accuracy in a gradual evolutionary manner. Through a series of comparative experiments, the improved protocol field parsing model has better performance on IIoT protocol.

Vulnerability is a major threat to software security. It has been proven that binary code similarity detection approaches are efficient to search for recurring vulnerabilities introduced by code sharing in binary software. However, these approaches suffer from high false-positive rates (FPRs) since they usually take the patched functions as vulnerable, and they usually do not work well when binaries are compiled with different compilation settings. To this end, we propose an approach, named Robin , to confirm recurring vulnerabilities by filtering out patched functions. Robin is powered by a lightweight symbolic execution to solve the set of function inputs that can lead to the vulnerability-related code. It then executes the target functions with the same inputs to capture the vulnerable or patched behaviors for patched function filtration. Experimental results show that Robin achieves high accuracy for patch detection across different compilers and compiler optimization levels respectively on 287 real-world vulnerabilities of 10 different software. Based on accurate patch detection, Robin significantly reduces the false-positive rate of state-of-the-art vulnerability detection tools (by 94.3% on average), making them more practical. Robin additionally detects 12 new potentially vulnerable functions.

Nowadays, massive Internet-of-Thing (IoT) devices are connecting with cyberspace, yet they suffer increased attack risks from known vulnerabilities to low-hanging exploitable manners. A proactive defense can help security professionals to discover potential risks, where IoT device identification is a necessary requisite. However, existing approaches suffer from coarse-grained and manual labor. In this work, we propose an automated semantic extraction approach, called IoTminer, which generates IoT device annotation from the packet payload. Specifically, IoTminer leverages relations between device types, vendors, and products to mine relevant entities for an annotation tuple (type, vendor, product). Further, we have implemented a prototype of IoTminer and conducted a real-world experiment to validate its efficacy. Results show that our IoTminer generates IoT device information at a fine-grained level, achieving 91.33% precision, 93% recall, and 90% F1 score. Moreover, the IoTminer can discover new IoT devices compared with state-of-the-art tools.

The safety and security of IoT devices in smart home systems is attracting booming attention, due to the cascading threat introduced by the interoperability of IoT devices. It is observed that semantic information of behaviors could be utilized to identify anomalies of IoT devices, and some prior works have attempted to detect single abnormal behavior based on the mined semantic patterns. However, the performance of these methods could be usually affected by some noisy data (e.g., user activities), suffering from false alarms of detection. In this work, we propose a semantic-aware framework of compromised IoT devices detection, which extracts the Mutual Information feature from the semantic information of IoT devices to eliminate interference of the noise. The proposed framework includes three modules: semantic analysis to generate event correlations, feature extraction to construct the feature vector, and detection model to train binary classifiers for detection. To collect real-world data for evaluation, we construct three testbeds of the following scenes: bedroom, living room and kitchen. The performance on the collected dataset shows that our method achieves high accuracy (the average is over 90.0%) on the compromised devices detection.

Embedded devices, represented by Internet of Things devices, bring great convenience to our daily life. Firmware is the core of the embedded device operation. However, vulnerabilities in the firmware can be exploited remotely by hackers through the network. Unfortunately, existing methods are only suitable for finding vulnerabilities in binaries (border-binary) that interact directly with users. When applied to other binaries (internal-binary) that indirectly interact with users, the lack of analysis sources and constraint conditions leads to many false negatives and false positives. In this paper, we propose a new keyword-sensitive data flow analysis approach to address the challenge. Specifically, we leverage crawlers to collect clues related to vulnerability reports from the Internet. Then we use the clues and communication paradigm finders to establish the relationship between different binaries in the firmware sample to form binary dependency graphs. At the same time, based on the functional features, we further dig out the binary relationships that have no Internet clues. Finally, we perform static taint analysis based on binary dependency graphs to determine vulnerabilities. We implemented and evaluated our prototype system FBI. Compared with Karonte, a state-of-the-art tool, FBI found significantly more true positives in Karonte’s data set.

Protocol reverse engineering can be applied to various security applications, including fuzzing, malware analysis, and intrusion detection. It aims to acquire an unknown protocol's format, semantic, and behavior specifications, where format extraction is the primary task. One subset of the mainstream research utilizes the network traffic for the reverse analysis. These approaches leverage various algorithms, such as multiple sequence alignment, frequent itemset mining, and information entropy to extract format information from messages. However, they are primarily intended to locate the keyword fields and have limitations in extracting contextual features or dealing with large data sets. This paper presents ProsegDL, a deep learning-based format extraction tool for binary protocol, with a specially designed method of generating training data sets. ProsegDL innovatively leverages image semantic segmentation and siamese network techniques, focusing on extracting the features of fields and identifying field boundaries for fixed format protocols. The tool is evaluated on six popular protocols. The results show that it has at most 13% higher precision, 23% higher recall than the comparison methods when inferring with a small data set, and at most 18% higher precision, 28% higher recall when inferring with a large number of messages.

Concolic execution is widely used for binary analysis and is commonly embedded in hybrid fuzzing to find bugs. However, implicit flows in loops can hinder concolic execution and lead to the reduction of code coverage. The implicit flow variables cannot be symbolized and will block the constraint solver from generating new inputs. We propose a new approach to mitigate the problem. We obtain the implicit flow variables by taint analysis in advance and symbolize them during the concolic execution. Then, when the symbols of the variables are in the path constraints and need to be solved, we backtrack to the corresponding loops and perform static symbolic executions in the loops. During the static symbolic executions, we relate the variables with the input symbols by state merging and solve the constraints to generate inputs for new execution paths. We present SIFOL, a hybrid fuzzer based on Driller, and evaluate it on CB-multios. Results show that SIFOL has 5.4% higher code coverage than Driller and finds 5.9% more crashes. Furthermore, after manually adding implicit flows and checks to the target programs, SIFOL only drops 2.6% on coverage and 5.6% on the crash number, while Driller is severely affected (drops 46.1% on coverage and 47.1% on the crash number).

Greybox fuzzing has become one of the most effective vulnerability discovery techniques. However, greybox fuzzing techniques cannot be directly applied to applications in IoT devices. The main reason is that executing these applications highly relies on specific system environments and hardware. To execute the applications in Linux-based IoT devices, most existing fuzzing techniques use full-system emulation for the purpose of maximizing compatibility. However, compared with user-mode emulation, full-system emulation suffersfrom great overhead. Therefore, some previous works, such as Firm-AFL, propose to combine full-system emulation and user-mode emulation to speed up the fuzzing process. Despite the attempts of trying to shift the application towards user-mode emulation, no existing technique supports to execute these applications fully in the user-mode emulation. To address this issue, we propose EQUAFL, which can automatically set up the execution environment to execute embedded applications under user-mode emulation. EQUAFL first executes the application under full-system emulation and observe for the key points where the program may get stuck or even crash during user-mode emulation. With the observed information, EQUAFL can migrate the needed environment for user-mode emulation. Then, EQUAFL uses an enhanced user-mode emulation to replay system calls of network, and resource management behaviors to fulfill the needs of the embedded application during its execution. We evaluate EQUAFL on 70 network applications from different series of IoT devices. The result shows EQUAFL outperforms the state-of-the-arts in fuzzing efficiency (on average, 26 times faster than AFL-QEMU with full-system emulation, 14 times than Firm-AFL). We have also discovered ten vulnerabilities including six CVEs from the tested firmware images.

The object detection tasks based on edge computing have received great attention. A common concern hasn't been addressed is that edge may be unreliable and uploads the incorrect data to cloud. Existing works focus on the consistency of the transmitted data by edge. However, in cases when the inputs and the outputs are inherently different, the authenticity of data processing has not been addressed. In this paper, we first simply model the tampering detection. Then, bases on the feature insertion and game theory, the tampering detection and economic incentives mechanism (TDEI) is proposed. In tampering detection, terminal negotiates a set of features with cloud and inserts them into the raw data, after the cloud determines whether the results from edge contain the relevant information. The honesty incentives employs game theory to instill the distrust among different edges, preventing them from colluding and thwarting the tampering detection. Meanwhile, the subjectivity of nodes is also considered. TDEI distributes the tampering detection to all edges and realizes the self-detection of edge results. Experimental results based on the KITTI dataset, show that the accuracy of detection is 95% and 80%, when terminal's additional overhead is smaller than 30% for image and 20% for video, respectively. The interference ratios of TDEI to raw data are about 16% for video and 0% for image, respectively. Finally, we discuss the advantage and scalability of TDEI.

With the rapid growth and popularization of Internet of Things (IoT), more and more devices are deployed in homes, enterprises, cities, etc. The existed methods to classify types and relations of devices are usually two separate tasks. So, it is difficult to quickly provide attributes of devices in the smart network for operators at the same time. At this situation, the paper presents a framework JCIDR for Joint Classification of IoT Device and Relations In the Internet with Network Traffic. By fusing the numerical features and binary image features of traffic, the devices and relations of devices can be recognized simultaneously. The experiment is carried out in a real IoT environment and the accuracy of JCIDR is over 86% with about half time reduction. Therefore, JCIDR could provide operators with a fast, easy, low-cost network device monitoring method without professional equipment or protocols.

Along with the rapid-growth number of Internet of Things (IoT) devices, significant security concerns are raised due to the hidden vulnerabilities among them. Illuminating the characteristics of online devices would shed a light on protecting these potential vulnerable devices. State-of-arts methodologies enumerate devices characteristics as keywords and rules and match them with IoT network data. However, the heterogeneous implementations of IoT devices introduce intricate characteristics features, which impede the large-scale identification. In this work, we close this gap and present a semantic extraction-based approach that can automatically and effectively characterize online devices. We leverage the observation that IoT devices can be identified by analyzing the semantic information of the network packets. Specifically, we first collect the network data of IoT devices and utilize a co-training algorithm to annotate the data. We propose a residual dilate gated convolutional neural network (RDGCNN)-based encoder to extract semantic features from the annotated data. Then, we put forward an entity relationship-based decoder to generate the characteristic triplet (type, brand, and model) of IoT devices by decoding extracted features. We have implemented the prototype of the system and conducted real-world experiments to evaluate the performance. Results show that our approach achieves 92.16% precision and 86.79% recall. In addition, we apply our proposed method to characterize 15 millions IoT devices on the Internet.

Industrial Control System (ICS) security has become increasingly important as attacks targeting ICSs are more prominent. Although many off-the-shelf industrial network intrusion detection mechanisms have been presented in the past, attackers have always found unique disguisable ways to bypass detections and disrupt actual industrial control processes. To mitigate this deficiency, we present a novel scheme for the detection of industrial process control attacks, calledShadowPLCs. Specifically, the scheme first automatically analyzes the PLC control code, then extracts key parameters of the PLCs including valid register addresses, valid range of values, and control logic rules as a basis for evaluating attacks. The attack behavior is detected in real-time from different perspectives through active communication with PLCs and passive monitoring of the network traffic. We implemented a prototype system with Siemens S7-300 series PLCs as a case study. Our scheme was evaluated using two Siemens S7-300 PLCs deployed on a gas pipeline network platform. Experiments demonstrate that the presented scheme can accurately detect process control attacks in real-time without affecting the normal operations of PLCs. Compared with the other four representative detection models, our scheme has better detection performance with detection accuracy of 97.3 percent.

Yucheng Wang, Bowen Yu, Hongsong Zhu, Tingwen Liu, Nan Yu, Limin Sun. Proceedings of the 59th Annual Meeting of the Association for Computational Linguistics and the 11th International Joint Conference on Natural Language Processing (Volume 1: Long Papers). 2021.

The supervisory software is widely used in industrial control systems (ICSs) to manage field devices such as PLC controllers. Once compromised, it could be misused to control or manipulate these physical devices maliciously, endangering manufacturing process or even human lives. Therefore, extensive security testing of supervisory software is crucial for the safe operation of ICS. However, fuzzing ICS supervisory software is challenging due to the prevalent use of proprietary protocols. Without the knowledge of the program states and packet formats, it is difficult to enter the deep states for effective fuzzing.

Open Information Extraction (OpenIE) aims to discover textual facts from a given sentence.In essence, the facts contained in plain text are unordered.However, the popular Ope-nIE systems usually output facts sequentially in the way of predicting the next fact conditioned on the previous decoded ones, which enforce an unnecessary order on the facts and involve the error accumulation between autoregressive steps.To break this bottleneck, we propose MacroIE, a novel non-autoregressive framework for OpenIE.MacroIE firstly constructs a fact graph based on the table filling scheme, in which each node denotes a fact element, and an edge links two nodes that belong to the same fact.Then OpenIE can be reformulated as a non-parametric process of finding maximal cliques from the graph.It directly outputs the final set of facts in one go, thus getting rid of the burden of predicting fact order, as well as the error propagation between facts.Experiments conducted on two benchmark datasets show that our proposed model significantly outperforms current state-of-theart methods, beats the previous systems by as much as 5.7 absolute gain in F1 score.

As a decoy for hackers, honeypots have been proved to be a very valuable tool for collecting real data. However, due to closed source and vendor-specific firmware, there are significant limitations in cost for researchers to design an easy-to-use and high-interaction honeypot for industrial control systems (ICSs). To solve this problem, it’s necessary to find a cost-effective solution. In this paper, we propose a novel honeypot architecture termed HoneyVP to support a semi-virtual and semi-physical honeypot design and implementation to enable high cost performance. Specially, we first analyze cyber-attacks on ICS devices in view of different interaction levels. Then, in order to deal with these attacks, our HoneyVP architecture clearly defines three basic independent and cooperative components, namely, the virtual component, the physical component, and the coordinator. Finally, a local-remote cooperative ICS honeypot system is implemented to validate its feasibility and effectiveness. Our experimental results show the advantages of using the proposed architecture compared with the previous honeypot solutions. HoneyVP provides a cost-effective solution for ICS security researchers, making ICS honeypots more attractive and making it possible to capture physical interactions.

Binary function matching has been proposed to detect the known vulnerabilities. However, the high similarity between the vulnerable and patched versions leads to a large of false positives. Patch detection is proposed to improve the accuracy of function matching by identifying the patched functions from matching results. However, the accuracy of existing methods decreases significantly due to the function changes introduced by high compiler optimization levels.In this paper, we propose PMatch, a method based on code semantic similarity to detect the patched binary functions. Firstly, PMatch extracts patch-affected code snippets from the patched binary function. Secondly, PMatch leverages a novel unsupervised sentence embedding technique in Natural Language Processing (NLP) to generate the semantic representations of binary code. Finally, PMatch matches the patch-affected code snippets with target blocks obtained by function diffing. To evaluate PMatch, we collect 101 CVEs and compile 304 binary programs with 4 different optimization levels. PMatch achieves an 86.43% average accuracy in detecting the patched functions, which outperforms the state-of-the-art work, and costs only 65.14ms per function. Besides, at the O3 high optimization level, PMatch achieves an accuracy improvement of over 20%.

Source code summarization is the task of generating a readable natural language to describe the functionality of source code. Code summarization is rapidly expanding, especially as the research takes great advantage of advances in neural networks and artificial intelligence technologies. Some mainstream methods input the structural information (abstract syntax tree (AST)) of the source code into the language model to generate relatively satisfactory comments. However, existing methods can not capture code’s long dependencies from AST for effective code summarization. In this paper, we provide a novel way to generate code summaries by combining a graph-based neural network and a Transformer-XL network. We utilize the graph-based neural network to better capture the structure information of AST, and the Transformer-XL network to learn important tokens in the AST and alleviate the problem of long dependency. We evaluate our technique on the standard Java dataset. The experimental results show that the effectiveness of our model is remarkable. It pushes the precision score to 60.73% (5.21% absolute improvement) and the F1 score to 51.06%.

Abstract Social engineering has posed a serious threat to cyberspace security. To protect against social engineering attacks, a fundamental work is to know what constitutes social engineering. This paper first develops a domain ontology of social engineering in cybersecurity and conducts ontology evaluation by its knowledge graph application. The domain ontology defines 11 concepts of core entities that significantly constitute or affect social engineering domain, together with 22 kinds of relations describing how these entities related to each other. It provides a formal and explicit knowledge schema to understand, analyze, reuse and share domain knowledge of social engineering. Furthermore, this paper builds a knowledge graph based on 15 social engineering attack incidents and scenarios. 7 knowledge graph application examples (in 6 analysis patterns) demonstrate that the ontology together with knowledge graph is useful to 1) understand and analyze social engineering attack scenario and incident, 2) find the top ranked social engineering threat elements (e.g. the most exploited human vulnerabilities and most used attack mediums), 3) find potential social engineering threats to victims, 4) find potential targets for social engineering attackers, 5) find potential attack paths from specific attacker to specific target, and 6) analyze the same origin attacks.

In recent years, Internet-of-Things (IoT) platforms and systems have been rapidly emerging. Although IoT is a new technology, new does not mean simpler (than existing networked systems). Contrarily, the complexity (of IoT platforms and systems) is actually being increased in terms of the interactions between the physical world and cyberspace. The increased complexity indeed results in new vulnerabilities. This article seeks to provide a review of the recently discovered logic bugs that are specific to IoT platforms and systems and discuss the lessons we learned from these bugs. In particular, 20 logic bugs and one weakness falling into seven categories of vulnerabilities are reviewed in this survey.

IP-based geolocation is essential for various location-aware Internet applications, such as online advertisement, content delivery, and online fraud prevention. Achieving accurate geolocation enormously relies on the number of high-quality (i.e., the fine-grained and stable over time) landmarks. However, the previous efforts of garnering landmarks have been impeded by the limited visible landmarks on the Internet and manual time cost. In this paper, we leverage the availability of numerous online webcams used to monitor physical surroundings as a rich source of promising high-quality landmarks for serving IP-based geolocation. In particular, we present a new framework called GeoCAM, which is designed to automatically generate qualified landmarks from online webcams, providing an IP-based geolocation service with high accuracy and wide coverage. GeoCAM periodically monitors websites hosting live webcams and uses the natural language processing technique to extract the IP addresses and latitude/longitude of webcams for generating landmarks at a large-scale. Given latency and topology constraints among webcam landmarks, GeoCAM uses the maximum likelihood estimation to approximately pinpoint the geolocation of a target host. We develop a prototype of GeoCAM and conduct real-world experiments for validating its efficacy. Our results show that GeoCam can detect 282,902 live webcams hosted in webpages with 94.2% precision and 90.4% recall, and then generate 16,863 stable and fine-grained landmarks, which are two orders of magnitude more than the landmarks used in prior works. To demonstrate the superiority of using large-scale webcams as landmarks, we implement four different geolocation algorithms and compare their performance between webcam landmarks and open-source landmarks. The evaluation results show that all the algorithms can significantly improve geolocation accuracy by using webcam landmarks.

Extracting entities and relations from unstructured text has attracted increasing attention in recent years but remains challenging, due to the intrinsic difficulty in identifying overlapping relations with shared entities.Prior works show that joint learning can result in a noticeable performance gain.However, they usually involve sequential interrelated steps and suffer from the problem of exposure bias.At training time, they predict with the ground truth conditions while at inference it has to make extraction from scratch.This discrepancy leads to error accumulation.To mitigate the issue, we propose in this paper a one-stage joint extraction model, namely, TPLinker, which is capable of discovering overlapping relations sharing one or both entities while immune from the exposure bias.TPLinker formulates joint extraction as a token pair linking problem and introduces a novel handshaking tagging scheme that aligns the boundary tokens of entity pairs under each relation type.Experiment results show that TPLinker performs significantly better on overlapping and multiple relation extraction, and achieves state-of-the-art performance on two public datasets 1 .

As the intelligentization of Industrial Internet of Things (IIoT) broke the relatively closed and credible industrial environment, IIoT faces increasingly serious security problems. The commonly used vulnerability discovery method is protocol reverse engineering. However, it is difficult to analyze IIoT protocols with existing protocol reverse engineering approaches, as they influence the normal operation or have spare sample data. In this paper, a sparse protocol parsing method for IIoT protocols is proposed. The parsing method expands the samples of the captured IIoT protocol message sequences using a genetic algorithm (GA), which designs its fitness function based on the protocol response data to select high-quality samples. By combining the GA with the hidden Markov model (HMM) with lower algorithm complexity, a hybrid parsing model is constructed to improve accuracy in a gradual evolution way. Through comparison experiments on various IIoT protocols, our HMM hybrid model has better performance than RNN hybrid models under sparse samples.

The development of vehicular networks has greatly improved the efficiency and safety of intelligent traffic systems. However, it also introduces additional security threats into the system. The special characteristics of vehicular networks, such as dynamic topology, huge network scale and so on, make it difficult to adopt the traditional security solutions directly into this scenario. In addition, the single point failure problem of the centralized security mechanisms is also a big challenge. Recently, blockchain technology, which is a distributed database, is a potential approach to address these security issues. In this paper, a comprehensive review of the existing blockchain-based cybersecurity mechanisms is presented with the corresponding performance analysis. The purpose of this work is to provide a guideline for the further study in the application of blockchain in the vehicular network security area.

Renewable energy powered road side units(RSUs) in Internet of Vehicles(IoVs) are a desirable green alternative choice compared to the traditional electric grid, because it not only extends the service range of IoVs but also saves the cost on energy. However, the energy on RSUs is limited and usually influenced by communication policies. Therefore, the communication scheduling policy on RSUs plays an important role on the persistence of network, which is still an open topic to be solved. In this paper, we focus on the communication scheduling problem on RSUs, and propose an LSTM-based communication scheduling algorithm for RSUs in IoVs. The scheduling algorithm is composed of three parts - deep learning clustering, LSTM-based traffic prediction, and a vehicle access scheduling algorithm. At last, we conduct an extensive simulation, and the simulation results indicate that our algorithm can achieve a better performance than the no scheduling mechanism.

Programmable logic controller (PLC) is an industrial digital computer that has been ruggedized and adapted for the control of manufacturing processes, such as automobile manufacture, or gas pipelines, or power generation. Due to closed source and vendor-specific proprietary firmware, it is difficult to develop a scalable high-interaction honeypot for PLCs. In this paper, we present and discuss a new scalable high-interaction PLC honeypot framework based on physical devices. This framework aims to solve the problems of existing physical honeypots while providing the advantages of virtual honeypots. Specially, we first introduce the main gap existing in virtual PLC honeypots. Then, we present a cheap, flexible, and large-scale-deployment solution for physical PLC honeypots according to the concrete problems. Finally, we evaluated our framework based on Siemens S7-300 PLCs. Our experiment shows that physical PLC honeypots have the absolute advantage in interaction capability and it is entirely feasible to extend the deployment scope with low response delay.

IP-based geolocation is essential for various location-aware Internet applications, such as online advertisement, content delivery, and online fraud prevention. Achieving accurate geolocation enormously relies on the number of high-quality (i.e., the fine-grained and stable over time) landmarks. However, the previous efforts of garnering landmarks have been impeded by the limited visible landmarks on the Internet and manual time cost. In this paper, we leverage the availability of numerous online webcams that are used to monitor physical surroundings as a rich source of promising high-quality landmarks for serving IP-based geolocation. In particular, we present a new framework called GeoCAM, which is designed to automatically generate qualified landmarks from online webcams, providing IP-based geolocation services with high accuracy and wide coverage. GeoCAM periodically monitors websites that are hosting live webcams and uses the natural language processing technique to extract the IP addresses and latitude/longitude of webcams for generating landmarks at large-scale. We develop a prototype of GeoCAM and conduct real-world experiments for validating its efficacy. Our results show that GeoCam can detect 282,902 live webcams hosted in webpages with 94.2% precision and 90.4% recall, and then generate 16,863 stable and fine-grained landmarks, which are two orders of magnitude more than the landmarks used in prior works. Thus, by correlating a large scale of landmarks, GeoCAM is able to provide a geolocation service with high accuracy and wide coverage.

Nowadays, the industrial control system (ICS) plays a vital role in critical infrastructures like the power grid. However, there is an increasing security concern that ICS devices are being vulnerable to malicious users/attackers, where any subtle changing or tampering attack would cause significant damage to industrial manufacturing. In this paper, we propose the iFinger, a novel detection approach designed to mitigate ICS attacks adapting to various industrial scenes. We take advantage of an important insight that industrial protocol packets include register status values that are used to reflect the physical characteristics of ICS controllers. The iFinger utilizes register states to generate ICS fingerprints to detect malicious attacks on industrial networks. Specifically, the boolean logic represents every register state sequence of the ICS controller, and the deterministic finite automaton (DFA) generates a device fingerprint. To discover the ICS attacks, we propose two detection approaches based on device fingerprints, including passive and active detection. We present a prototype of the iFinger and conduct real-world experiments to validate its performance. Results show that our approach achieves 97.1% F1 score in ICS device identification. Furthermore, we simulate two typical ICS attacks (replacement and code modification) to validate the effectiveness of our iFinger in industrial networks. Our device fingerprints would detect those malicious attacks within 2s latency at 98.0% recall.

Nowadays, a large number of printers are connecting to the Internet. It is undoubtedly true that these online printers are facing severe cyber threats. However, the research/researchers so far cannot answer the current security status of Internet-wide printers. The principal difficulty is to identify the exact brand and model of online printers with high coverage, which is the primary element in vulnerability description. In this work, we design and implement a system called PrinterRadar. Based on Neural Network, PrinterRadar can automatically generate fingerprints from the application layer protocol banners of online printers, and the precision and recall rate of fingerprints can achieve 98% and 97%. By fingerprint matching with the banners which were collected from Censys and Shodan, PrinterRadar found that 508,719 printers were connected to the Internet, covering 92 printer brands and 4,188 printer models. As to the discovered printers, it is about twice the number of those detected by Censys and Shodan.

Compiler optimization level recognition can be applied to vulnerability discovery and binary analysis. Due to the exists of many different compilation optimization options, the difference in the contents of the binary file is very complicated. There are thousands of compiler optimization algorithms and multiple different processor architectures, so it is very difficult to manually analyze binary files and recognize its compiler optimization level with rules. This paper first proposes a CNN-based compiler optimization level recognition model: BinEye. The system extracts semantic and structural differences and automatically recognize the compiler optimization levels. The model is designed to be very suitable for binary file processing and is easy to understand. We built a dataset containing 80028 binary files for the model training and testing. Our proposed model achieves an accuracy of over 97%. At the same time, BinEye is a fully CNN-based system and it has a faster forward calculation speed, at least 8 times faster than the normal RNN-based model. Through our analysis of the model output, we successfully found the difference in assembly codes caused by the different compiler optimization level. This means that the model we proposed is interpretable. Based on our model, we propose a method to analyze the code differences caused by different compiler optimization levels, which has great guiding significance for analyzing closed source compilers and binary security analysis.

Off-the-shelf machine learning based intrusion detection systems (IDS) have proved not suitable for protecting industrial control systems (ICS), as they do not consider cooperative regularities between controllers of control loops, and the serious shortage of attacking training sets. We study the consensus and complementary (2C) features which are widely observed in control loops. Subsequently, a multi-view learning framework is proposed to boost the effectiveness of detecting attacks on ICS by using a large number of unlabeled examples with 2C features. Comprehensive attacks of ICS are designed and implemented on a physical testbed, and the experimental data are collected from the historical sequences and IDS alerts. The experimental results demonstrate that the framework is highly adaptive, and it can rapidly match the dynamics of ICS operating environment. Meanwhile, the effectiveness of the method is discussed when parameters take different values, and it exhibits low false-positive rates but high precision. In addition, the case of error propagation of the framework is analyzed.

For the reasons that defect remedy is an endless arduous work for static network defense technologies and cyberspace security remains unguaranteed, moving target defense (MTD) is proposed to stem the tide. Whereas, as an important branch of MTD, route mutation technologies still have limitations against some sophisticated adversaries like Advanced Persistent Threat (APT), multiple-step complex or combined attacks. In this paper, we propose a new spatio-temporal route mutation method based on MTD. We first take the maximization of resistibility towards not only multiple forms of attacks but also attackers' long-term background knowledge into consideration. We also formulate the problem into a stochastic optimization model and make it possible to agilely generate the satisfying mutation route meets the demands of various parties jointly by only solving one uniform problem. Thus, network Security is guaranteed from both flows(users) and nodes(infrastructure) perspectives. Experimental results highlight the security advantages as traffic dispersion, potential victim number and attack failure rates of our method compared to existing solutions.

Instant Messaging has been widely applied for both corporate use and personal use in recent years. Major Instant Messaging service providers adopt the Push Technology to ensure the immediacy of message forwarding, which efficiently provides a great convenience for user. However, the immediacy feature causes side-channel information leakage even if some protection measures has been implemented, such as information encryption strategy. In particular, we observe that senders' traffic flows have a strong temporal correlation with those of corresponding recipients, since the messages are forwarded to recipients as soon as they are received by servers. Based on the observation, attackers can infer real-time communications between pairwise users and even the social connections of users. In this paper, we present a methodology framework to validate this side-channel information leakage, which identifies users of real-time communications by matching the pairwise time sequences of traffic flows. We evaluate the method on the collected real-world data. The experimental results show that users' communications can be identified with a high accuracy, and 6 groups of users are inferred to have strong connections based on the data collected from a local area networks.

With the rapid growth of Linux-based IoT devices such as network cameras and routers, the security becomes a concern and many attacks utilize vulnerabilities to compromise the devices. It is crucial for researchers to find vulnerabilities in IoT systems before attackers. Fuzzing is an effective vulnerability discovery technique for traditional desktop programs, but could not be directly applied to Linux-based IoT programs due to the special execution environment requirement. In our paper, we propose an efficient greybox fuzzing scheme for Linux-based IoT programs which consist of two phases: binary static analysis and IoT program greybox fuzzing. The binary static analysis is to help generate useful inputs for efficient fuzzing. The IoT program greybox fuzzing is to reinforce the IoT firmware kernel greybox fuzzer to support IoT programs. We implement a prototype system and the evaluation results indicate that our system could automatically find vulnerabilities in real-world Linux-based IoT programs efficiently.

An emerging Internet business is residential proxy (RESIP) as a service, in which a provider utilizes the hosts within residential networks (in contrast to those running in a datacenter) to relay their customers' traffic, in an attempt to avoid server- side blocking and detection. With the prominent roles the services could play in the underground business world, little has been done to understand whether they are indeed involved in Cybercrimes and how they operate, due to the challenges in identifying their RESIPs, not to mention any in-depth analysis on them. In this paper, we report the first study on RESIPs, which sheds light on the behaviors and the ecosystem of these elusive gray services. Our research employed an infiltration framework, including our clients for RESIP services and the servers they visited, to detect 6 million RESIP IPs across 230+ countries and 52K+ ISPs. The observed addresses were analyzed and the hosts behind them were further fingerprinted using a new profiling system. Our effort led to several surprising findings about the RESIP services unknown before. Surprisingly, despite the providers' claim that the proxy hosts are willingly joined, many proxies run on likely compromised hosts including IoT devices. Through cross-matching the hosts we discovered and labeled PUP (potentially unwanted programs) logs provided by a leading IT company, we uncovered various illicit operations RESIP hosts performed, including illegal promotion, Fast fluxing, phishing, malware hosting, and others. We also reverse engi- neered RESIP services' internal infrastructures, uncovered their potential rebranding and reselling behaviors. Our research takes the first step toward understanding this new Internet service, contributing to the effective control of their security risks.

Effectively identifying IoT devices in cyberspace is significant for grasping the security posture of cyberspace. However, there are still some IoT devices without vendor or product keywords in response data that cannot be identified by existing device identification engines. In this paper, we propose a new engine (IoT Tracker)for identifying IoT devices by leveraging the highest similarity of response data between IoT devices of the same vendor or product. Based on the protocol features, IoT Tracker divides application-layer protocols into semistructured data protocols and unstructured data protocols. For each category, IoT Tracker extracts structure structure, style structure or simhash feature. Then, IoTTracker utilizes features extracted from the response data to identify IoT devices. We implement a prototype of our proposed engine and evaluate its effectiveness through real-world experiments. The experimental results show that IoTTracker yield very high accuracy with 95.54 % precision and 93.08 % recall at vendor-level. Compared with existing methods, IoT Tracker adds 40.76% of identifiable devices after de-duplicating the identified dataset.

IP geolocation determines geographical location by the IP address of Internet hosts. IP geolocation is widely used by target advertising, online fraud detection, cyber-attacks attribution and so on. It has gained much more attentions in these years since more and more physical devices are connected to cyberspace. Most geolocation methods cannot resolve the geolocation accuracy for those devices with few landmarks around. In this paper, we propose a novel geolocation approach that is based on common routers as secondary landmarks (Common Routers-based Geolocation, CRG). We search plenty of common routers by topology discovery among web server landmarks. We use statistical learning to study localized (delay, hop)-distance correlation and locate these common routers. We locate the accurate positions of common routers and convert them as secondary landmarks to help improve the feasibility of our geolocation system in areas that landmarks are sparsely distributed. We manage to improve the geolocation accuracy and decrease the maximum geolocation error compared to one of the state-of-the-art geolocation methods. At the end of this paper, we discuss the reason of the efficiency of our method and our future research.

With the dramatically increasing deployment of IoT devices, storing and protecting the large volume of IoT data has become a significant issue. Traditional cloud-based IoT structures impose extremely high computation and storage demands on the cloud servers. Meanwhile, the strong dependencies on the centralized servers bring significant trust issues. To mitigate these problems, we propose a distributed data storage scheme employing blockchain and cetrificateless cryptography. Our scheme eliminates the traditional centralized servers by leveraging the blockchain miners who perform “transaction” verifications and records audit with the help of certificateless cryptography. We present a clear definition of the transactions in a non-cryptocurrency system and illustrate how the transactions are processed. To the best of our knowledge, this is the first work designing a secure and accountable IoT storage system using blockchain. Additionally, we extend our scheme to enable data trading and elaborate how data trading can be efficiently and effectively achieved.

A rising number of embedded devices are reachable in the cyberspace, such as routers, cameras, printers, etc. Those devices usually run firmware whose code is proprietary with few public documents. Furthermore, most of the firmware images cannot be analyzed in dynamic analysis due to various hardware-specific peripherals. As a result, it hinders traditional static analysis and dynamic analysis techniques. In this paper, we propose a static binary analysis approach, DTaint, to detect taint-style vulnerabilities in the firmware. The taint-style vulnerability is a typical class of weakness, where the input data reaches a sensitive sink through an unsafe path. Specifically, we generate data dependency in a bottom-up manner through traversing callees before callers. To reduce the influence of the binary firmware, DTaint identifies pointer aliasing, interprocedural data flow, and similarity of the data structure layout. We have implemented a prototype of DTaint and conducted experiments to evaluate its performance. Our results show that DTaint discovers more vulnerabilities in less time, compared with the existing techniques. Furthermore, we illustrate the effectiveness of DTaint through applying it over six firmware images from four manufacturers. We have found 21 vulnerabilities, where 13 of them are previously-unknown and zero-day vulnerabilities.

The security of Industrial Control Systems (ICS) is closely related to national security. With secret exploration and analysis of a target ICS, highly-skilled attackers can gain enough key knowledge about the system (e.g., the physical model of the system and the corresponding detection threshold), and then launch stealthy attacks by keeping the detection indicator under its threshold, thus bypasses existing intrusion detection mechanisms. However, we discover that all devices in industrial control systems consume energy at run time and the energy consumption varies according to different operation types and system states. Therefore, there exists relationships between control operation, system state and energy consumption of the device. Accordingly, we put forward a novel ICS intrusion detection approach based on multi-dimensional data fusion. This approach collects information about power consumption of physical devices, control operation and system state, and then identifies stealthy attacks by feeding the multi-dimensional information into a cascade detection algorithm. Experimental results verify that our approach has a better detection performance than other detection methods.

The Industrial Control System (ICS) refers to the national critical infrastructure, such as Energy and Water facility, which is significant for the national security. Sequence attack is a unique attack type in ICS, and many detection approaches have been proposed. A common and unrealistic hypothesis of these approaches is that they have gained the command sequences. In the real world, we can only obtain the observations from sensors. The single observation detection technique is a common approach to find anomalies by the observations. However, the highly skilled attacker can compromise some Programmable Logic Controllers (PLCs) in ICS and fake their sensor measurements. Under this circumstance, this detection approach becomes invalid and increases the false-negative rate. In this paper, we first analyze the sequence attack by their attack capability in ICS. Then we propose a State-Based Sequence Detection approach (SBSD). The SBSD uses the equipment's observation information, belonging to many PLCs, to create Hidden Markov Models (HMMs) for detecting the sequence attack. The experiment results in an ICS testbed have shown the effectiveness of SBSD.

Open source components are widely used by IoT vendors to develop firmwares in devices. The exposure of vulnerabilities existing in some specific versions of the core components may cause severe security incidents such as the Heartbleed event in 2014 and the Sambacry event in 2016. Extracting the version information from various firmware binaries is significant for evaluating the influence of such incidents and providing emergency response services. To the best of our knowledge, there are still no scalable and efficient extraction methods for binary version information in IoT firmwares. The commonly used method for traditional softwares requires the running up of the firmwares and interaction such as '-version' to obtain the version information. This method is not applicable for IoT devices, as they are built from various platforms which makes it impossible to simulate all of the interested firmwares at large scale. In this paper, we design, implement and evaluate a scalable and efficient binary version extraction framework (termed as PANDORA) for IoT firmwares, which does not rely on the real runtime environment. The main idea of our methodology is to leverage version strings in binaries to get version information. We design a string recover engine (SRE) to recover the missing pieces of those incomplete version strings. We test PANDORA in a dataset containing 2683 IoT binary files. Surprisingly 2267 of them are version-extractable and the recognition rate can reach 84.5%.

An increasing number of embedded devices are connecting to the Internet at a surprising rate. Those devices usually run firmware and are exposed to the public by device search engines. Firmware in embedded devices comes from different manufacturers and product versions. More importantly, many embedded devices are still using outdated versions of firmware due to compatibility and release-time issues, raising serious security concerns. In this paper, we propose generating fine-grained fingerprints based on the subtle differences between the filesystems of various firmware images. We leverage the natural language processing technique to process the file content and the document object model to obtain the firmware fingerprint. To validate the fingerprints, we have crawled 9,716 firmware images from official websites of device vendors and conducted real-world experiments for performance evaluation. The results show that the recall and precision of the firmware fingerprints exceed 90%. Furthermore, we have deployed the prototype system on Amazon EC2 and collected firmware in online embedded devices across the IPv4 space. Our findings indicate that thousands of devices are still using vulnerable firmware on the Internet.

As closed Industrial Control Systems (ICS) gradually evolve toward networking, ICS data and operational processes can be easily tampered with by attackers, causing industrial control equipment to fail or become damaged. Depending on the characteristics of ICS business logic stability, this paper proposes a novel two-level anomaly detection framework to ensure that system data and business logic are safe and reliable. Specifically, basic information is obtained from network traffic. In our framework, the first-level detection uses convolutional neural network (CNN) to feature extraction and anomaly identification. In the second-level detection, we propose a process state transfer algorithm. The feature extracted by the CNN model is invoked as the input of the algorithm to construct the normal state process transfer model of ICS. The model detects whether the current data meets the normal state transition process of the system, and may find unknown attacks or 0-day attacks. Finally, through laboratory gas pipeline network system verification, we found that the anomaly detection framework combined with the two methods has more outstanding performance than several current latest technologies.

The firmware information for IoT devices includes the manufacturer, the device type, the device model and the firmware version, etc. Identifying firmware information helps build firmware knowledge graph for many security applications, such as homologous analysis and vulnerability detection of firmware. The traditional firmware information identifying method only utilizes the content-based information, lacks the utilization of the structure information of the firmware, and more importantly, it lacks the use of timing information. Lacking of structural information can reduce prediction accuracy, and lacking of timing information will make it difficult to predict the firmware version. In order to address the disadvantages of the existing method, this paper abstracts the directories or files (components) of the firmware into the nodes of the graph and abstracts the relationships between the nodes into the edges of the graph. Timing information such as component creation time and component version are also attached to the node properties to introduce the time sequence features. As a result, the experimental results show that the accuracy of our method is better than that of random forest for the all four tasks (manufacture, device type, device model and firmware version identification). Particularly, and the accuracy rate is greatly improved in the firmware version identification task.

Industrial control system (ICS) devices play a crucial role in critical infrastructures, such as power grid. In recent years, numerous ICS devices are accessible on the Internet, resulting in potential security issues. However, there is a lack of deep understanding of these devices' characteristics in the cyberspace. In this paper, we take the first step in this direction by investigating these visible ICS devices on the Internet. Because of the critical nature of ICSs, the detection of online ICS devices should be done in a nonintrusive and timely manner. We first analyze 17 industrial protocols widely used in ICSs and train a probability model through the learning algorithm to improve detection accuracy. Then, we discover online ICS devices in the IPv4 space while reducing the negative effects caused by industrial honeypots and dynamic IP addresses. To observe the dynamics of ICS devices in a relatively long run, we have deployed our discovery system on Amazon EC2 and detected online ICS devices in the whole IPv4 space for eight times from August 2015 to March 2016. Based on the ICS device data collection, we conduct a comprehensive data analysis to characterize the usage of ICS devices, especially in answer to the following three questions: 1) what are the distribution features of ICS devices; 2) who use these ICS devices; and 3) what are the functions of these ICS devices.

In this paper, the anti-jamming issue in unmanned aerial vehicle (UAV) networks is analyzed in a static game and a dynamic game. We investigate the effect of wireless channel fading characteristics from a UAV to a ground station and flying cost on the performance of a closed-form Nash equilibrium (NE) in the static game. Besides, in a Stackelberg dynamic game, wherein the system model is hard to determine, we propose a Q- learning based anti-jamming scheme and evaluate its performance via exhaustive simulations, which can achieve relatively higher average utility and Signal to Interference plus Noise Ratio (SINR) than a benchmark method.

The popularity of location-based services and the ubiquity of Internet of Things (IoT) devices have resulted in rich spatiotemporal data. These data enable researchers to study people's social relationship based on their co-occurrences and many inference models were proposed. However, there are still two challenges: How to distinguish co-occurrences between acquaintances and strangers? What kind of co-occurrence contributes to strong social strength? In this paper, we propose a mobility pattern based relationship inference model (MPRI) to address above challenges. We extract mobility patterns from spatiotemporal data and adopt them to characterize co-occurrences. A classification model is trained for social relationship inference. The experimental results on two real-world datasets demonstrate that the proposed MPRI model can properly differentiate co-occurrences by simultaneously considering spatial and temporal features. The comparison results also indicate that MPRI model significantly outperforms state-of-the-art social relationship inference models.

The covert communication in the physical layer and WiFi network is an important tendency for the current research on covert channel. On the other hand, the MIMO beamforming technique used in the physical layer of WiFi networks provides great potential for developing covert transmission scheme. To fill this gap, this paper presents a novel covert channel based on the coordinated operations in the control channel and data channel of MIMO system, called CovertMIMO. Under this scheme, the covert transmitter can make some slight modification on the normal uplink process, such that the recovered physical layer signal at the receiver side deviates from the pre-agreed overt signal. Through the deviation, some covert information can be encoded and delivered. To implementing CovertMIMO, this paper considers two kinds of wardens that follow the minimum principle and distribution principle respectively. Against them, the parameter identification is transformed into solving an optimization problem or nonlinear equation set. The transmission capacity and undetectability of CovertMIMO are also analyzed in detail. At last, the effectiveness of CovertMIMO is validated through extensive experiments.

Surveillance devices with IP addresses are accessible on the Internet and play a crucial role in monitoring physical worlds. Discovering surveillance devices is a prerequisite for ensuring high availability, reliability, and security of these devices. However, today's device search depends on keywords of packet head fields, and keyword collection is done manually, which requires enormous human efforts and induces inevitable human errors. The difficulty of keeping keywords complete and updated has severely impeded an accurate and large-scale device discovery. To address this problem, we propose to automatically generate device fingerprints based on webpages embedded in surveillance devices. We use natural language processing to extract the content of webpages and machine learning to build a classification model. We achieve real-time and non-intrusive web crawling by leveraging network scanning technology. We implement a prototype of our proposed discovery system and evaluate its effectiveness through real-world experiments. The experimental results show that those automatically generated fingerprints yield very high accuracy of 99% precision and 96% recall. We also deploy the prototype system on Amazon EC2 and search surveillance devices in the whole IPv4 space (nearly 4 billion). The number of devices we found is almost 1.6 million, about twice as many as those using commercial search engines.

Random numbers are widely used in 5G communication security. In this paper, we propose a wireless physical layer (PHY-layer) characteristics based random number generator in vehicular networks. Firstly, the closed form expression of random transmission success probability is derived under the presence of multiple jamming attackers in a Nakagami-m fading channel. Secondly, a novel Random Transmission Success Probability based Physical Random Number Generator (RTSP-PhRNG) is presented. Finally, numerical results are conducted and a Universal Software Radio Peripheral (USRP) based prototype is implemented to validate our proposed method. Furthermore, the standard randomness test suite from NIST shows that our proposed PhRNG reveals good randomness.

In this paper, we address the interference problem caused by the cross-polarization components in a massive dualpolarized MIMO (DP-MIMO) system over Ricean-K fading Channel. To effectively suppress the interference, a novel precoding design based on oblique projection is proposed. Furthermore, compared with an Nt × Nr uni-polarized MIMO (UP- MIMO), Nt×Nr DP-MIMO can maintain the same diversity order while achieve twice the multiplexing gain of UP-MIMO in symbol error rate (SER) performance by using the proposed precoding design. The expression of the moment generation function (MGF) of signal noise ratio (SNR) for the proposed scheme is derived, and an analytical expression of SER with M-ary phase-shift keying (M-PSK) modulation is obtained. The effectiveness of the proposed scheme is demonstrated through extensive numerical results.

IP geolocation determines geographic location by the IP address of Internet hosts. The physical location of Internet hosts is critical for many location-aware applications. Most geolocation methods are based on linear assumption of correlation between network latency and geographic distance on a large scale. In this paper, a lightweight geolocation approach is proposed to accurately determine the location of Internet hosts. This approach takes advantage of relative delay measurement and common routers. We studied localized delay- distance correlation in small region. We proposed an approach of discovering the accurate positions of common routers and converted common routers as secondary landmarks on a small scale and evaluated the efficiency of our method in the city level. The evaluation results show that the proposed algorithm improves the accuracy of IP geolocation by about 9.5% compared to Street-level Geolocation (SLG), one of the latest methods.

Identifying sensitive user inputs is a prerequisite for privacy protection in mobile applications. When it comes to today's program analysis systems, however, only those data that go through well-defined system Application Program Interface (system controlled resources) can be automatically labeled. In this paper, we show that this conventional approach is far from adequate, as most sensitive inputs are actually entered by the user at an app's runtime. In this paper, we inspect 13,072 top apps from Google Play, and find that 38.69% of them involve sensitive user inputs. Just like system controlled resources, these data are also exposed to a series of privacy leakage threats. For these sensitive user inputs, manually marking them involves a lot of efforts, impeding a large-scale, automated analysis of apps to defend against potential privacy leakage. To address this important issue, we present UIPicker, an adaptable framework for automatic identification of sensitive user inputs as the first step. UIPicker is designed to detect the semantic information within the application layout resources and the program code, and further analyze it for the locations where security-critical information may show up. This approach can support a variety of existing security analysis on mobile apps. We evaluate our approach over randomly selected popular apps on Google Play. UIPicker is able to accurately label sensitive user inputs most of the time, with 94.0% precision and 96.0% recall.

The popularity of location-based services (LBS) and the ubiquity of sensor device have resulted in rich spatiotemporal data. A large number of human behaviors had been recorded including cooccurrence which refers to the phenomenon that two people have been to the same places at the same time. These data enable attackers to infer people’s social relationship based on their cooccurrences and many attack models were proposed. However, current attack models still cannot effectively address the following two challenges: How to distinguish cooccurrences between acquaintances and strangers? What kind of cooccurrence contributes to strong social strength? In this paper, we present a novel social relationship attack model—the Mobility Intention-based Relationship Inference (MIRI) model—which can solve the above two issues. Firstly, we extract mobility intentions and adopt them to characterize cooccurrences. A classification model is trained for attacking social relationship. The experimental results on two real-world datasets demonstrate that the proposed MIRI model can properly differentiate cooccurrences by simultaneously considering spatial and temporal features. The comparison results also indicate that MIRI model significantly outperforms state-of-the-art social relationship attack models.

In this paper, we investigate the PHY-layer authentication that exploits radio channel information to detect spoofing attacks in multiple- input multiple-output (MIMO) systems. We formulate the interactions between a receiver and a spoofing node in the spoofing detection as a zero-sum game. In this game, the receiver chooses the test threshold of the hypothesis test in the PHY-layer authentication to maximize its utility based on the Bayesian risk in the spoofing detection, while the adversary chooses its attack frequency, i.e., how often a spoofing packet is sent over multiple antennas. The unique Nash equilibrium of the static MIMO authentication game is derived and the condition for its existence is discussed. We investigate the impact of the number of antennas on the performance of the dynamic authentication game. We propose a PHY-layer spoofing detection based on Q-learning for MIMO systems to achieve the optimal test threshold in the spoofing detection via trials, and implement it over universal software radio peripherals. The performance of the spoofing detection algorithm is evaluated via experiments in indoor environments.

Nowadays industrial control devices are crucial for infrastructure-critical systems such as factories, power plants, and water treatment facilities. Devices with IP addresses are visible on the Internet and they connect cyber space and physical world. The first step in protecting devices from attackers is a deep understanding of the devices' characteristics in the cyber space. In this paper, we take a first step in this direction by investigating physical devices running one of the two specific protocols that are widely adopted in industrial control systems. In order to detect these devices in real-time, we propose a two-stage discovery mechanism: first filtering out unqualified hosts from 4 billion remote hosts and then identifying physical devices from qualified candidates. We have conducted a real-world experiment to verify the mechanism and identified dozens of thousands of physical devices from the entire Internet. Results show that our method discovers all devices in 20 hours with 89.5% precision and 79.3% recall.

In this paper, we propose a new security design, called as Zero Reconciliation Secret Key Extraction, for backscatter wireless systems, in which a reader needs to establish secret keys for multiple tags. Our design is able to eliminate the reconciliation process in conventional physical layer based key establishment, therefore improving the efficiency while still maintaining security in such a process. The essence in our design is to use a channel state information (CSI) characteristic, named CSI Ratio, at the reader to differentiate multiple tags, then employ multiple-input multiple-output (MIMO) precoding for legitimate tags to effectively and securely establish secret keys, at the same time leveraging artificial jamming to forestall eavesdropping attacks in the network. We evaluate our design with real-world experimental data and show that the proposed approach can achieve relatively high secret key extraction rates and maintain low bit error rates.

Nowadays, more and more physical devices embed computing and networking capabilities and are visible on the Internet. These devices include webcams, net-printers, and industrial control equipments, etc. Collecting information about these devices is crucial to preserve cyber-security and facilitate security auditing for system administrators. In this paper, we propose a scalable framework for physical device profiling. It leverages banner grabbing to identify device types and running services, and uses clock skew to determine a device ID. Our framework scales well. We implement a prototype system and use it to profile Webcams and industrial control device. The results show that our system can effectively profile and identify Webcams in real time. We deploy it on the cloud server and use it to detect 4 billion IP addresses to profile 1.2 million Webcams and more than 60 thousand industrial control devices in 20 hours.

Industrial control system (ICS) devices with IP addresses are accessible on the Internet and play a crucial role for critical infrastructures like power grid. However, there is a lack of deep understanding of these devices' characteristics in the cyberspace. In this paper, we take a first step in this direction by investigating these accessible industrial devices on the Internet. Because of critical nature of industrial control systems, the detection of online ICS devices should be done in a real-time and non-intrusive manner. Thus, we first analyze 17 industrial protocols widely used in industrial control systems, and train a probability model through the learning algorithm to improve detection accuracy. Then, we discover online ICS devices in the IPv4 space while reducing the noise of industrial honeypots. To observe the dynamics of ICS devices in a relatively long run, we have deployed our discovery system on Amazon EC2 and detected online ICS devices in the whole IPv4 space for eight times from August 2015 to March 2016. Based on the ICS device data collection, we conduct a comprehensive data analysis to characterize the usage of ICS devices, especially in the answer to the following three questions: (1) what are the distribution features of ICS devices, (2) who use these ICS devices, and (3) what are the functions of these ICS devices.

Industrial control system (ICS) devices with IP addresses are accessible on the Internet and play a crucial role for critical infrastructures like power grid. However, there is a lack of deep understanding on these devices' characteristics in the cyber space. In this paper, we propose ASCEND, a search engine for online industrial control devices. ASCEND analyse 17 industrial protocols and use it to discover almost all online ICS devices in the IPv4 while reducing the noise of industrial honeypots. It provides a big picture of online ICS devices: who are using ICS devices; where they are located and what functions these ICS device have. In order to demonstrate how ASCEND works, we have implemented the prototype system and verified it in the real-world experiments.

Nowadays, the number of visible physical devices exposed on the Internet is dynamically increasing and they play a crucial role for bridging between the cyber space and the physical world, such as network printer, Webcam, and industrial control devices. Discovering these devices brings about the deep understanding on these devices' characteristics and help secure device security in the cyber space. A device fingerprint is a prerequisite of device discovery in the Internet. However, today's online device search depends on keywords of packet head fields and the keyword collection is done manually. This impedes an accurate and large-scale device discovery, due to high human efforts and inevitable human errors, as well as the difficulty of keeping keywords complete and updated. To address this problem, we propose GUIDE, a framework to automatically generate device fingerprints based on webpages embedded in these devices. In order to demonstrate how GUIDE works, we also develop its prototype system and provide a case study which discover surveillance devices in the cyber space.

Video surveillance has been widely adopted to ensure home security in recent years. Most video encoding standards such as H.264 and MPEG-4 compress the temporal redundancy in a video stream using difference coding, which only encodes the residual image between a frame and its reference frame. Difference coding can efficiently compress a video stream, but it causes side-channel information leakage even though the video stream is encrypted, as reported in this paper. Particularly, we observe that the traffic patterns of an encrypted video stream are different when a user conducts different basic activities of daily living, which must be kept private from third parties as obliged by HIPAA regulations. We also observe that by exploiting this side-channel information leakage, attackers can readily infer a user's basic activities of daily living based on only the traffic size data of an encrypted video stream. We validate such an attack using two off-the-shelf cameras, and the results indicate that the user's basic activities of daily living can be recognized with a high accuracy.

The latest Federal Communications Commission (FCC) ruling has enforced database-driven cognitive radio networks (CRNs), in which all secondary users (SUs) can query a database to obtain spectrum availability information (SAI). Database-driven CRNs are regarded as a promising approach for dynamic and highly efficient spectrum management paradigm for large-scale Internet of Things (IoT). However, as a typical location-based service (LBS), before providing services to the user, there is no verification of the queried location, which is very vulnerable to location spoofing attack. A malicious user can report a fake location to the database and access the channels that may not be available for its location. This will introduce serious interference to the primary users (PUs). In this study, we identify a new kind of attack coined as location cheating attack, which allows an attacker to spoof other users to another location and make them query the database with wrong location, or allows a malicious user to forge location arbitrarily and query the database for services. To thwart this attack, we propose a novel infrastructure-based approach that relies on the existing WiFi or cellular network access points (or AP) to provide privacy-preserving location proof. With the proposed solution, the database can verify the locations without knowing the user's accurate location. We perform comprehensive experiments to evaluate the performance of the proposed approach. Experimental results show that our approach, besides providing location proofs effectively, can significantly improve the user's location privacy.

Nowadays people spend a substantial amount of time waiting in different places such as supermarkets and amusement parks. Detecting the status of queuing may benefit both users and business. In this paper, we present QueueSense, a queuing recognition system to assist in a queue management system. QueueSense consists of clients on smartphones that provide automatic, energy-efficient, and accurate queuing recognition, and a server in the cloud that collects data, identifies multi-queue lines, and provides waiting time estimation. In order to be useful, QueueSense should be able to recognize queuing behavior in various queuing scenarios without greatly decreasing the battery life of mobile phones. We present features of queuing and build the classifier on smartphones to automatically recognize queue classifier without human input. We investigate the complicated nature of energy consumption for queue recognition on phones and design an effective algorithm to maximize energy savings while guaranteeing accuracy of queue recognition. We evaluate QueueSense performance using the data set from real world queuing scenarios collected over a three-month period. Empirical results show that QueueSense is adaptive to various queuing scenarios with both high recognition accuracy and energy efficiency. We further implemented a prototype of QueueSense, the first queue detection system using smartphones. We conducted real-world experiments in a dining hall and a supermarket near a university campus. Through implementation and evaluation, we demonstrate that QueueSense is capable of detecting waiting lines that occur in our daily lives.

With the fast advance of mobile chips technologies, a node in a smart camera network can afford sophisticated processing via on-board multicore CPUs and GPUs, e.g., face detection. The performance of a general purpose face detector, however, may degrade seriously under specific situations with unexpected challenges such as facial coverage or bad illumination. This degradation is due to the difference of probability distributions between training data and testing data, known as source data domain and target data domain, respectively. To better adapt a smart camera network to a specific situation, some form of target domain adaptation is needed, which usually requires both the source domain data and as much as possible target domain data at each node, which may strain storage capacity and bandwidth. In this paper, we propose an adaptation method which fuses the source specific hypotheses (SSHs) and target specific hypotheses (TSHs) - requiring only a pre-trained face detector and a few target data to be shared by peer-to-peer communications, thus relieving the storage and bandwidth constraints. The method uses the "accuracy-regularization" objective as the adaptation model, to fuse SSHs and TSHs, and tries to minimize the misclassification error on target data. With an existing frontal face detector, we conduct experiments to verify our algorithm, covering cases of video surveillance, extreme pose challenge, and different illumination spectra. Significant performance gains are observed with only dozens of target data in all the experiments, demonstrating the effectiveness of the proposed adaptation model. Therefore, the proposed adaption can be applied to a smart camera network with peer-to-peer communications to improve the network's overall face detection performance.

This paper proposes a machine-learning technique to detect vehicle anomalies from data captured by automatic number plate recognition (ANPR) system. The proposed anomaly detection technique is specially engineered to exploit both spatial and temporal features of vehicles captured by ANPR system, so as to accurately detect anomaly vehicles. We extensively evaluated the proposed technique using a two- month long dataset collected by a real world ANRP system, which has more than three hundred cameras deployed in a big city of China. The evaluation results show that our technique can effectively detect vehicle anomalies from the huge amount of data collected by the ANPR system. More importantly, our technique significantly outperforms existing schemes especially when the data collected by the ANRP system are noisy due to poor weather condition.

CSI fingerprint localization is an advanced and promising technique for indoor localization, which identifies the user's location by mapping his measured CSI against the server's CSI fingerprint database. This approach is highlighted due to its high granularity for location distinction and strong robustness to noise disturbances, but it also causes potential privacy leakage for the three participants in localization process: the user, the server, and the AP. Currently, there has been little research done on this issue, and the existing work often ignores the privacy concern on the AP. To fill the gap, this paper develops a privacypreserving fuzzy localization scheme with CSI fingerprint. On one hand, it leverages the property of CSI training to guarantee the randomness and independence of the user's measurement in each time of localization, and uses homomorphic encryption to achieve the data transmission and measurement comparison in cipher. These operations enable our scheme to preserve the location privacy of the user and APs as well as the data privacy of the server. On the other hand, the adoption of CSI fingerprint and fuzzy logic enhances the localization accuracy greatly. Through simulation experiments performed on CRAWDAD database, the efficiency of our proposed scheme is validated.

There has been a significant body of work on evaluating node criticality in information networks. However, most of the existing works are developed for static networks and are not applicable to dynamic settings where connectivities among nodes change frequently over time. In this paper, we treat an opportunistic mobile social network as a time-evolving, dynamic graph, and propose a scheme to ascertain the information dissemination capability for each node based on its contact history. In particular, we analyze the node importance in spreading or forwarding real-time messages which are assumed to become less important or even stale over time. To this end, we take a dynamic walk counting approach to calculate all possible temporal-spatial routes associated with each node, by using the down-weighting method. Since the age of a message increases with time, the old walks are discounted to represent the fading influence on the target node. Extensive experiments are conducted based on 4 real-world trace datasets, and the results show that, our analytical result is effective at ranking the node criticality in disseminating or acquiring real-time messages in opportunistic mobile social networks.

The ownership transfer of RFID tag means a tagged product changes control over the supply chain. Recently, Doss et al. proposed two secure RFID tag ownership transfer (RFID-OT) protocols based on quadratic residues. However, we find that they are vulnerable to the desynchronization attack. The attack is probabilistic. As the parameters in the protocols are adopted, the successful probability is 93.75%. We also show that the use of the pseudonym of the tag h(TID) and the new secret key KTIDare not feasible. In order to solve these problems, we propose the improved schemes. Security analysis shows that the new protocols can resist in the desynchronization attack and other attacks. By optimizing the performance of the new protocols, it is more practical and feasible in the large-scale deployment of RFID tags.

Detecting abnormal events plays an essential role in video content analysis and has received increasing attention in surveillance system. One of the major problems in abnormal event detection is the imbalanced classification issue due to the rare abnormal samples. Another problem is the difficulty of detecting anomalies within a reasonable amount of computation time. To address these problems, we propose an adaptive cascade dictionary learning framework for detecting the anomalies. The framework considers anomaly detection as an one-class classification problem with a cascade of dictionaries. Each stage of the cascade constructs an adaptive dictionary to detect the anomalies with costless least square optimization solution. The experiments on benchmark datasets demonstrate that the proposed method has a better performance while comparing with several state-of-the-art methods.

The wireless information-theoretic security from inter-session interference has attracted considerable attention recently. A prerequisite for available works is the precise distinction between legitimate nodes and eavesdroppers. However, the authentication error always exists in the node authentication process in Two-Hop wireless networks. This paper presents an eavesdropper model with authentication error and two eavesdropping ways. Then, the number of eavesdroppers can be tolerated is analyzed while the desired secrecy is achieved with high probability in the limit of a large number of relay nodes. Final, we draw two conclusions for authentication error: 1) the impersonate nodes are chosen as relay is the dominant factor of the transmitted message leakage, and the impersonation attack does seriously decrease the number of eavesdroppers can be tolerated. 2) The error authentication to legitimate nodes is almost no effect on the number of eavesdroppers can be tolerated.

Clock synchronization is critical for many WSNs due to the need of inter-node coordination and collaborative information processing. Existing protocols based on message passing achieve satisfactory clock synchronization accuracy, however, incur prohibitively high overhead especially in large-scale networks. In this paper, we propose a new clock synchronization approach called ROCS which exploits the radio data system (RDS) from FM radio stations. First, we design a new hardware FM receiver that can extract a periodic pulse from FM broadcasts, referred to as RDS clock. We then conduct a large-scale measurement study of RDS clock in our lab for a period of six days and on a vehicle driving through a metropolitan area of over 40km2. Our results show that RDS clock is highly stable and hence is a viable means to calibrate the clocks of large-scale city-wide sensor networks. To reduce the high power consumption of FM receiver, ROCS adaptively calibrates the native clock via the RDS clock. We implement ROCS in TinyOS on our hardware FM receiver and a TelosB-compatible WSN platform. Our extensive experiments using a 12-node testbed and our driving measurement traces show that ROCS achieves accurate and precise clock synchronization with low power consumption.

Automatic Number-Plate Recognition (ANPR) system is commonly deployed on the road networks and used in field of safety and security systems. It is interesting to figure out the purpose of each vehicles based on the huge amount of ANPR data captured daily by embedded ANPR cameras. In this paper, we propose spatial and temporal quantitative indicators of vehicle trace features and the extraction algorism. We applied data-mining techniques to analysis vehicle activity patterns from ANPR data, and proposed centroids based activity classification method. Evaluations show the capability and efficiency of the proposed approach.

Eye localization is a key step in many face analysis related applications. In this paper, we present a novel eye localization method based on a group of trained filters called correlation filter bank (CFB). We formulate the eye localization problem as an optimization problem with a well-defined cost function based on CFB. The CFB is trained with an EM-like adaptive clustering approach. The trained filter bank includes several discriminative filter templates, each of them suits to a different face condition from the others, thus can provide accurate eye localization ability for variable poses, appearances and illuminations. Simulation comparisons with cascade classifier-based method [1], traditional single correlation filter based methods [2][3] and pictorial structure model based method [4] demonstrates the superiority of the proposed method both in detection ratio and localization accuracy.

WiFi fingerprint-based localization is regarded as one of the most promising techniques for indoor localization. The location of a to-be-localized client is estimated by mapping the measured fingerprint (WiFi signal strengths) against a database owned by the localization service provider. A common concern of this approach that has never been addressed in literature is that it may leak the client's location information or disclose the service provider's data privacy. In this paper, we first analyze the privacy issues of WiFi fingerprint-based localization and then propose a Privacy-Preserving WiFi Fingerprint Localization scheme (PriWFL) that can protect both the client's location privacy and the service provider's data privacy. To reduce the computational overhead at the client side, we also present a performance enhancement algorithm by exploiting the indoor mobility prediction. Theoretical performance analysis and experimental study are carried out to validate the effectiveness of PriWFL. Our implementation of PriWFL in a typical Android smartphone and experimental results demonstrate the practicality and efficiency of PriWFL in real-world environments.

No abstract available.

Nowadays people spend a substantial amount of time waiting in different places such as supermarkets and amusement parks. Detecting the status of queuing may benefit both users and business. In this paper, we present QueueSense, a queuing recognition system on mobile phones to assist in a queue management system. QueueSense extracts features of queuing behavior and classifies queueing via collaboration among people waiting in line. It measures the disparity of people in different lines using relative position changing rate and partitions different queues using a hierarchical clustering approach. We implement a prototype of QueueSense on Android platforms using widely available multi-modal sensors and it is the first queue detection system on mobile phones. We conduct real-world experiments at a dining hall and a supermarket near a university campus. Through implementation and evaluation, we demonstrate that QueueSense is capable of detecting waiting lines that occur in our daily lives with high accuracy.

User intent is an integral part of mobile phone applications as it delivers events to applications, notifies applications of relevant events, or triggers applications. Current smartphone applications either require users to manually start them or they run as background jobs. In this work, we propose UserIntent, a new paradigm for automatically selecting the right smartphone application based on user intent captured. UserIntent consist of two parts: user intent detection and mechanism for triggering a smartphone app. Action cues act as user intent and a context-aware selection algorithm chooses a suitable smartphone application. In order to demonstrate how UserIntent works, we also develop a concrete application that recognizes speaker and talk content based on gestures captured.

Wireless sensor networks (WSNs) have witnessed rapid advancement in medical applications from real-time telemonitoring and computer-assisted rehabilitation to emergency response systems. In this paper, we present the state-of-the-art research from the ubiquity perspective, and discuss the insights as well as vision of future directions in WSN-based healthcare systems. First, we propose a novel tiered architecture that can be generally applied to WSN-based healthcare systems. Then, we analyze the IEEE 802 series standards in the access layer on their capabilities in setting up WSNs for healthcare. We also explore some of the up-to-date work in the application layer, mostly on the smartphone platforms. Furthermore, in order to develop and integrate effective ubiquitous sensing for healthcare (USH), we highlight four important design goals (i.e., proactiveness, transparency, awareness, and trustworthiness) that should be taken into account in future systems.

Wi-Fi networks have enjoyed an unprecedent penetration rate in recent years. However, due to the limited coverage, existing Wi-Fi infrastructure only provides intermittent connectivity for mobile users. Once leaving the current network coverage, Wi-Fi clients must actively discover new Wi-Fi access points (APs), which wastes the precious energy of mobile devices. Although several solutions have been proposed to address this issue, they either require significant modifications to existing network infrastructures or rely on context information that is not available in unknown environments. In this work, we develop a system called ZiFithat utilizes ZigBee radios to identify the existence of Wi-Fi networks through unique interference signatures generated by Wi-Fi beacons. We develop a new digital signal processing algorithm called common multiple folding (CMF) that accurately amplifies periodic beacons in Wi-Fi interference signals. ZiFi also adopts a constant false alarm rate (CFAR) detector that can minimize the false negative (FN) rate of Wi-Fi beacon detection while satisfying the user-specified upper bound on false positive (FP) rate. We have implemented ZiFi on two platforms, a Linux netbook integrating a TelosB mote through the USB interface, and a Nokia N73 smartphone integrating a ZigBee card through the miniSD interface. Our experiments show that, under typical settings, ZiFi can detect Wi-Fi APs with high accuracy (<;5 percent total FP and FN rate), short delay (~780 ms), and little computation overhead.

Recent years have witnessed the pilot deployments of audio or low-rate video wireless sensor networks for a class of mission-critical applications including search-and-rescue, security surveillance, and disaster management. In this article, we report the design and implementation of Quality-aware Voice Streaming (QVS) for wireless sensor networks. QVS is built upon SenEar, a new sensor hardware platform we developed for high-bandwidth wireless audio communication. QVS comprises several novel components, which include an empirical model for online voice-quality evaluation and control, dynamic voice compression/duplication adaptation for lossy wireless links, and distributed stream admission control that exploits network capacity for rate allocation. We have extensively tested QVS on a 20-node network deployment. Our experimental results show that QVS delivers satisfactory voice quality under a range of realistic settings while achieving high network capacity utilization.

Nowadays smartphone users often enjoy the availability of multi-networks by switching between the networks for better network performance, energy efficiency of smartphones, and more data offloading to less expensive networks. However, network switching inevitably brings about network disruptions leading to user experience degradation. In this paper, we propose an application context model that is used in conjunction with a heuristic network selection mechanism, which selects a network using three metrics (i.e., network performance, energy consumption, and cost). A Bayes classifier is used to provide a probability for the network selection given applications running during network disruptions. We construct the classifier via crowd-sourced data by considering smartphone users profile and the operating environments. We implement a prototype context-aware handoff on the Android platform and conducted an experiment in a real world scenario through one case study, switching between cellular and WiFi networks. The evaluation results suggest that context aware handoff achieves 25% energy cost, nearly one-third data offloading, and more than twice throughput with only one third of the network switchings.

Wireless sensor networks usually are deployed in the complex environments and take a long time to run without human intervention. In addition, the sensor nodes have limited resources and use unstable wireless link for communication, which cause wireless sensor networks various problems in the actual operation. Therefore, the real-time monitoring tools are needed to maintain the operation of wireless sensor networks, which are capable of monitoring network operating conditions, assessing network performance, detecting network failure and optimizing network operation. A network monitoring and packet sniffing tool for wireless sensor networks (NSSN) is presented and implemented in this paper. As a kind of real-time monitoring tools based sniffers, NSSN can capture the radio packets from the normal nodes using NSSNer nodes, so that it can monitor network status, find network problems and optimize network configuration without any interference in the normal operation of wireless sensor networks. The functions which NSSN has implemented include network monitoring, protocol parsing and display, network diagnosis and performance measurement, data mining and statistical analysis. According to the actual deployment, NSSN has been verified good monitoring performance.

In wireless mobile networks, energy can be saved by using dynamic transmission scheduling with pre-knowledge about channel conditions. Such pre-knowledge can be obtained via profiling as proposed by several existing systems which assumed that the existence of spatial link correlation makes the measured channel status at one location reusable over a long period of time. Our empirical data, however, tells a different story: spatial link correlation only maintains well within a short duration (from seconds to tens of seconds) while decreases significantly afterwards, a phenomena we call ephemeral link correlation. By leveraging this observation, we design and implement a real-time transmission scheduling system, named PreSeer, on the railway platform for cargo transportation, where the transmission of a sink (to cellular towers) can be scheduled intelligently by utilizing future channel status measured by sinks located in front of it on the same train. We have implemented and evaluated the PreSeer system on the collected data extensively over 7,000-kilometer railway routes during a period of one and half years. Results reveal that PreSeer can help save as much as 40% energy, comparing with three base-line algorithms. More importantly, lessons learned from this major effort provide useful guidelines for transmission scheduling in highly-dynamic mobile environments, where (i) channel measurements cannot be perfectly aligned due to varying vehicle velocities, and (ii) the accuracy of channel measurements is subject to hardware discrepancy as well as environment irregularity.

Low-power Wireless Networks (LWNs) have become increasingly available for mission-critical applications such as security surveillance and disaster response. In particular, emerging low-power wireless audio platforms provide an economical solution for ad hoc voice communication in emergency scenarios. In this paper, we develop a system called Adaptive Stream Multicast (ASM) for voice communication over multihop LWNs. ASM is composed of several novel components specially designed to deliver robust voice quality for multiple sinks in dynamic environments: 1) an empirical model to automatically evaluate the voice quality perceived at sinks based on current network condition; 2) a feedback-based Forward Error Correction (FEC) scheme where the source can adapt its coding redundancy ratio dynamically in response to the voice quality variation at sinks; 3) a Tree-based Opportunistic Routing (TOR) protocol that fully exploits the broadcast opportunities on a tree based on novel forwarder selection and coordination rules; and 4) a distributed admission control algorithm that ensures the voice quality guarantees when admitting new voice streams. ASM has been implemented on a low-power hardware platform and extensively evaluated through experiments on a test bed of 18 nodes. The experiment results show that ASM can achieve satisfactory multicast voice quality in dynamic environments while incurring low-communication overhead.

In the field of Cyber Physical Systems and Pervasive Computing, physical resources and web resources can be easily handled and seamlessly integrated into our life. However, due to the heterogeneity of devices and tight coupling of individual information systems, the developers cannot easily create their specific applications by combining with physical and web resources. In this paper, we proposed Rest Thing which is a restful web service infrastructure based on REST principles in order to hide the heterogeneity of devices and provide a seamless way to integrate embedded devices with existing web applications. Besides, we implemented a prototyping system, which provided the restful accessible way of the wireless sensors, and built a demo application on the smart phone to collect and merge physical and web resources. Finally, we gave the performance evaluation of the prototyping system.

A typical application of wireless sensor networks is navigation for emergency evacuation whose goal is to guide people escaping from hazardous areas safely and quickly. In practical scenarios, the evacuating time depends not only on the length of the path but also on the congestion degree. However, as far as we know, the state of art fails to quantify congestion degree accurately in evacuation process. In this paper, we propose a novel congestion-aware navigation algorithm which has several key advantages: First, we use the concept of moving speed to evaluate the congestion degree to accurately estimate the evacuating time. Second, we avoid the frequent in-situ interactions between users and the navigation system by using the sensors at intersections for displaying the escape directions. Third, our algorithm can reduce the direction oscillations due to the network communication delay and adapt to the variation of hazardous regions. We evaluate our algorithm by simulations under various realistic settings. Simulation results show that our algorithm has the shorter evacuating time and fewer oscillations than state-of-the-art work.

Location information improves the routing effectiveness and facilitates the development of diverse novel applications in mobile networking. While they can lead to better user experiences, given privacy concerns and hardware constraints, a mobile user often exposes a limited number of locations only. We are thus interested in the Trajectory Exposure Problem in this context, i.e., to what degree that the user's trajectory (i.e., its route) is exposed? Furthermore, can the user adaptively control the exposure of its trajectory and yet offer useful information for location-based services? In this paper, we explore Gaussian Process Regression, an effective tool to re-construct the trajectory of the mobile user with selected exposed locations. We examine how the re-constructed trajectory differs from the real trajectory, i.e., evaluating the exposure rate. We present an effective heuristic that adaptively controls the trajectory exposure rate by carefully choosing the exposed locations. We further demonstrate a practical routing protocol, MoRPTE, which, controlled by a single parameter, utilizes location information flexibly and adaptively in the spectrum from zero knowledge to full knowledge to fit the applications' demands.

Location Based Notification (LBN) aims to alert the users in a target area with the information of interest to them. With a wide range of applications, LBN has been gaining more and more attraction among wireless users and service providers. The mainstream centralized solution based on cellular networks may incur high service cost. In this paper, we present an innovative scheme called Phoenix, which does not rely on any infrastructure, to implement for location based notification service. In our design, devices (users) across the target area form a dynamic peer-to-peer network, where a user can be a message source, a message carrier, or a message subscriber. When a user meets the message carrier, the user can get a copy of the message. Phoenix keeps messages of interest being circulated in the target area, hence users are being notified. To achieve desired notification performance, Phoenix adaptively controls when a user should take the carrier role and help disseminating a message in order to keep the message ``alive", given the fact that message carriers may leave the target area and drop the message. Extensive simulations have been conducted to show the efficacy of Phoenix notification system.

Clock synchronization is critical for Wireless Sensor Networks (WSNs) due to the need of inter-node coordination and collaborative information processing. Although many message passing protocols can achieve satisfactory clock synchronization accuracy, they incur prohibitively high overhead when the network scales to more than tens of nodes. An alternative approach is to take advantage of the global time reference induced by existing infrastructures including GPS, timekeeping radio stations, or power grid. However, high power consumption and geographic constraints present them from being widely adopted in WSNs. In this paper, we propose ROCS, a new clock synchronization approach exploiting the Radio Data System (RDS) of FM radios. First, we design a new hardware FM receiver that can extract a periodic pulse from FM broadcasts, referred to as RDS clock. We then conduct a large-scale measurement study of RDS clock in our lab for a period of six days and on a vehicle driving through a metropolitan area of over 40 $km^2$. Our results show that RDS clock is highly stable and hence is a viable means to calibrate the clocks of large-scale city-wide sensor networks. To reduce the high power consumption of FM receiver, ROCS intelligently predicts the time error due to drift, and adaptively calibrates the native clock via the RDS clock. We implement ROCS in TinyOS on our hardware FM receiver and a TelosB-compatible WSN platform. Our extensive experiments using a 12-node testbed and our driving measurement traces show that ROCS achieves accurate and precise clock synchronization with low power consumption.

(1) Institute of Software, Chinese Academy of Sciences, China; (2) Graduate University, Chinese Academy of Sciences, China; (3) Department of Computer Science and Engineering, Michigan State University, United States

Wireless sensor networks consist of a large number of low-cost and micro sensor nodes, which form the networks in wireless and ad hoc way to achieve the tasks that contain gathering, processing and transferring data in the deployment region. Sensor network management is to monitor and control the operational status of sensor networks, enabling them to provide effective, reliable, safe and economical services. With the increase of WSNs applications. WSNs management has become more and more important. A network management system for large-scale wireless sensor networks (WSNMS) is presented and implemented in this paper, which is designed and implemented with the characteristics of WSNs. The functions which WSNMS has implemented include four categories: configuration management, performance management, fault management and accounting management. According to the results of actual experiments which consist of 215 nodes as managed objects and a gateway, WSNMS is able to undertake the large-scale network management functions and has good performance.

Existing time synchronization algorithms and protocols mostly focus on improving the synchronization accuracy. However, they usually require frequent resynchronization to keep designed precision in actual applications, which leads to high energy consumption and heavy traffic load. This paper presents a Prediction based Long-cycle Time Synchronization algorithm (PLTS), which puts emphasis on reducing the resynchronization frequency while guaranteeing a given accuracy. PLTS is a combination of periodic synchronization and prediction synchronization. It makes use of an existing time synchronization protocol to accomplish the periodic synchronization, while during the intervals of periodic synchronization, each node applies a prediction model to calibrate its own logic time according to the crystal oscillator's frequency characteristics. By this means, all nodes can keep synchronization till next periodic synchronization starts. Experiment results show that PLTS can reduce resynchronization frequency remarkably and possesses good merits in saving energy and reducing traffic load.

In this paper, we propose a priority (or progressive) linear coding based opportunistic routing mechanism (OR-PLC) for H.264 video streaming over multi-hop ad hoc networks. OR-PLC assigns different error protection priorities to video packets according to their perceptual importance to mitigate error propagation problem so that the video quality is enhanced in receiver. Furthermore, OR-PLC exploits the broadcast feature of wireless medium to improve the bandwidth utility. Compared with other opportunistic routing schemes, OR-PLC reduces the delay by progressive encoding and decoding. The experiments show that our mechanism outperforms two state-of-the-art schemes, i.e., MORE and MP-RTP. It turns out that OR-PLC delivers more than 3.5 dB PSNR gains in average, while using less bandwidth.

Geographic message forwarding in vehicular ad hoc networks (VANET) has attracted much attention and become one of the most promising research areas recent years. In this paper, inspired with the intuition that drivers' route are with high regularity, we propose a prediction-based message forwarding strategy named Seer. Seer trains a 2nd-order Markov model based on long-term historic trip GPS data. Then probabilistic predictions about driving trend is made by looking at the intersections the driver just passed by. Seer can work without special service such as the traffic navigation systems and it can avoid leaking the position privacy of the driver. With extensive simulation in ONE, we show that Seer can achieve higher packet delivery ratio and lower delay, comparing with random or position-based message forwarding strategies.

A mobile opportunistic network consists of sparsely scattered mobile nodes communicating via short range radios. It is characterized by frequent and unpredictable network partitions and intermittent connectivity. Anycast in opportunistic networks is anticipated in many application scenarios, and deserves great attention. In this paper, we propose an anycast routing algorithm in which each node is associated with a forwarding metric indicating its delivery probability to the destination anycast group and the node with lower value hands over the message to the encountered node with higher metric. The forwarding metric is determined according to historical node encounter information. We use three different forwarding metrics (variables) to guide the transmission of messages. The Group Forwarding Metric (GFM) treats the entire group as a whole, and it is defined as the probability of meeting any member in the anycast group to deliver a message. Similar to GFM, Probability Forwarding Metric (PFM) is defined as the probability of encountering at least one anycast group member, but it relies on the probability of meeting individual group members. The Distance Forwarding Metric (DFM) takes a function of the delivery probability to an anycast group member as the distance to the member. The DFM is the combination of these distances to forward messages towards the higher member density. Different metrics can be adopted for different mobile opportunistic networks based on the connectivity characteristics of the networks. We analyze the control overhead of the anycast algorithm and the message delivery delay of the routing protocol. Extensive simulations are carried out to evaluate the performance of the proposed solution under synthetic and realistic traces. The results show that our algorithm will significantly improve the anycast delivery performance when compared with simple routing algorithms in term of average message delivery delay and transmission overhead.

A growing number of applications require disseminating information around specific geographical areas within a limited valid time. For example, the store in the mall area expects to publish the time-limited sales promotion to all the potential clients in the nearby area, before the discount activity end. In this paper, we study the problem of deploying infostation for geographical information dissemination. It aims to achieve the desired dissemination ratio under the given time constraint and to minimize the infostation deployment cost. Inspired by several observations in recent studies on realistic mobility model, we build a mobility graph to reflect the statistical characteristic of users movement in a area. Based on this graph, we formulate the infostation deployment problem as an optimization problem. Then, we prove it is NP-hard by reducing it to the classical vertex cover problem and then develop a greedy heuristic algorithm DGREEDY with the polynomial time complexity. Extensive simulations based on the real human mobility traces have been carried out to show the efficacy of our approach.

WiFi networks have enjoyed an unprecedent penetration rate in recent years. However, due to the limited coverage, existing WiFi infrastructure only provides intermittent connectivity for mobile users. Once leaving the current network coverage, WiFi clients must actively discover new WiFi access points (APs), which wastes the precious energy of mobile devices. Although several solutions have been proposed to address this issue, they either require significant modifications to existing network infrastructures or rely on context information that is not available in unknown environments. In this work, we develop a system called ZiFi that utilizes ZigBee radios to identify the existence of WiFi networks through unique interference signatures generated by WiFi beacons. We develop a new digital signal processing algorithm called Common Multiple Folding (CMF) that accurately amplifies periodic beacons in WiFi interference signals. ZiFi also adopts a constant false alarm rate (CFAR) detector that can minimize the false negative (FN) rate of WiFi beacon detection while satisfying the user-specified upper bound on false positive (FP) rate. We have implemented ZiFi on two platforms, a Linux netbook integrating a TelosB mote through the USB interface, and a Nokia N73 smartphone integrating a ZigBee card through the miniSD interface. Our experiments show that, under typical settings, ZiFi can detect WiFi APs with high accuracy (<5% total FP and FN rate), short delay (~780 ms), and little computation overhead

Low-power Wireless Networks (LWNs) have become increasingly available for mission-critical applications such as security surveillance and disaster response. In particular, emerging low-power wireless audio platforms provide an economical solution for ad hoc voice communication in emergency scenarios. In this paper, we develop a system called Adaptive Stream Multicast (ASM) for voice communication over multi-hop LWNs. ASM is composed of several novel components specially designed to deliver robust voice quality for multiple sinks in dynamic environments: 1) an empirical model to automatically evaluate the voice quality perceived at sinks based on current network condition, 2) a feedback-based Forward Error Correction scheme where the source can adapt its coding redundancy ratio dynamically in response to the voice quality variation at sinks, 3) a Tree-based Opportunistic Routing (TOR) protocol that fully exploits the broadcast opportunities on a tree based on novel forwarder selection and coordination rules, and 4) a distributed admission control algorithm that ensures the voice quality guarantees when admitting new voice streams. ASM has been implemented on a low-power hardware platform and extensively evaluated through experiments on a testbed of 18 nodes.

Wireless sensor networks (WSNs) deployed for mission-critical applications face the fundamental challenge of meeting stringent spatiotemporal performance requirements using nodes with limited sensing capacity. Although advance network planning and dense node deployment may initially achieve the required performance, they often fail to adapt to the unpredictability and variability of physical reality. This paper explores efficient use of mobile sensors to address limitations of static WSNs for target detection. We propose a data-fusion-based detection model that enables static and mobile sensors to effectively collaborate in target detection. An optimal sensor movement scheduling algorithm is developed to minimize the total moving distance of sensors while achieving a set of spatiotemporal performance requirements including high detection probability, low system false alarm rate, and bounded detection delay. The effectiveness of our approach is validated by extensive simulations based on real data traces collected by 23 sensor nodes.

Recent years have witnessed the pilot deployments of audio or low-rate video wireless sensor networks for a class of mission-critical applications including search and rescue, security surveillance, and disaster management. In this paper, we report the design and implementation of Quality-aware Voice Streaming (QVS) for wireless sensor networks. QVS is built upon SenEar, a new sensor hardware platform we developed for high-bandwidth wireless audio communication. QVS comprises several novel components, which include an empirical model for online voice quality evaluation and control, dynamic voice compression/duplication adaptation for lossy wireless links, and distributed stream admission control that exploits network capacity for rate allocation. We have extensively tested QVS on a 20-node network deployment. Our experimental results show that QVS delivers satisfactory voice quality under a range of realistic settings while achieving high network capacity utilization.

The NISAT testbed consists of a center server and many test units. The test units probe the internal interconnected signals inside the motes with extra hardware sniffers. The server gathers, parses and analyzes all data from test units to obtain the information on the network behavior. By adopting the passive sniffing mechanism, NISAT has no side effect on the normal behavior of sensor networks, and it is transparent to the software running on motes. NISAT offers accurate and precise test data for the studies on sensor networks, especially for the high-precision performance measurements and black-box tests without source codes.

Aiming at the periodical data gathering application of wireless sensor network, the transmission delay and the network traffic loads are analyzed for the route-based data aggregation algorithm. It is then investigated how to minimize the network traffic within the data delay bound. An optimization problem is deduced based on the traffic aggregation model. Inspired by the hill-climbing algorithm, a centralized algorithm named as ldquoEffectiveness based Aggregation Time Allocation (EATA)rdquo is introduced and evaluated. In our simulation experiments, EATA can lead the network to a maximal traffic aggregation performance and good adaptability compared with other existing algorithms.

Aiming at the periodical data gathering application of Wireless Sensor Network, this paper first analyzed the network traffic flow and transmission delay in typical aggregation model. Then it investigated how to properly allocate aggregation time to minimize total network traffic within certain delay bound. An optimization problem was deduced and numerical solutions for regular network are calculated. Inspired by the numerical results, this paper introduced the concept of the critical aggregation level and presented an algorithm called Triangle-shaped Hierarchy aggregation Time Allocation (THTA). In our simulation experiments, THTA can lead the network to the maximum aggregation performance and fine adaptability compared with other existing algorithms.

In a wireless sensor network for data-gathering applications, if all network data congregate to a stationary sink node hop by hop, the sensor nodes near the sink have to consume more energy on forwarding data for other nodes, which probably causes the early function loss of the sensor network. Employing a mobile sink can alleviate the hotspot problem and balance the energy consumption among the sensor nodes. In this paper, we propose two autonomous moving schemes for the mobile sink. In our schemes, the sink makes moving decisions without complete knowledge of network topology and the energy distribution of all sensor nodes. We evaluated the performance of our moving schemes by simulation and the results show that both the two schemes can extend the network lifetime prominently.

In this paper, a novel non-saturation analytical model for priority based IEEE 802.11 network is introduced. Unlike previous work that is focused on MAC backoff for saturation stations, this model uses Markov and M/ M/1/K theories to predict MAC and queuing service time and loss. Then a performance prediction based enhancement scheme is proposed. By dynamic tuning of protocol options, this proposed scheme limits end-to-end delay and loss rate of real-time traffic and maximizes throughput. Consequently, call admission control is taken to protect existing traffics when the channel is saturated. Simulations validate this model and the comparison with IEEE802.11e EDCA shows that our mechanism can guarantee quality of service more efficiently.

In this paper, a novel performance analytical model, which uses discrete Markov and M/M/1/K theory, is presented for IEEE 802.11 based wireless networks with finite load. Delay and loss caused by MAC contention and buffer queuing are studied in detail. This model and analysis give an in-depth insight and understanding to the unfairness between uplink and downlink flows that are forwarded by access point. Futhermore, based on this model, a resource allocation scheme for access point is proposed. This hybrid scheme uses bandwidth reservation based admission control and priority scheduling to guarantee bounded delay and loss for real-time traffics. Simulation results validate the analytical model and show that our scheme can avoid congestion and provide QoS under high traffic load

In this paper, the influence of wireless channel fading on packet loss and delay for wireless local area networks is studied in detail. It shows that in CSMA/CA MAC scheme, packets with bad channel state will engross MAC buffer and deteriorate other downlink flows' performance. To overcome this problem, a novel channel state aware scheduling algorithm is presented to reduce the QoS degradation caused by channel fluctuation. It schedules every downlink flow into separated LLC layer queue firstly. Then, aided by the physical layer information, SNR, a channel flag based queue selection algorithm is used to isolate traffics with high PER (packet error rate). Simulation study shows this cross-layer scheme can decrease sending delay and packet loss for downlink real-time flows, and use wireless link resource more effectively

The future telecommunication systems will be surely characterized by the convergence of mobile technologies and Internet protocols, achieved through a network platform totally based on TCP/IP protocols ("all-IP network").In such a system, both wired and wireless parts are built on a common network platform based on TCP/IP protocol. However, TCP/IP protocol headers overheads are large and need to be compressed to save radio channel bandwidth which is the most expensive and scarce resource of the whole wireless system, especially for some services whose payload size is small. In this paper, a new adaptive robust TCP/IP header compression algorithm for 3G wireless networks is proposed and analyzed. The aim of this algorithm is to adjust the dimension of variable sliding window (VSW) in W-LSB encoding wiith the accurate estimation o wireless channel state to achieve the good balance of compression ratio and error-resistant robustness for the adaptive use in wireless link. We present simulation results that demonstrate the effectiveness of this adaptive algorithm over wireless link.