Deep learning (DL) models are increasingly deployed in safety-critical applications such as face recognition, autonomous driving, and medical diagnosis. Despite their impressive accuracy, they remain vulnerable to adversarial examples - subtle perturbations that can cause incorrect predictions, i.e., the robustness issues. While adversarial training improves robustness against known attacks, it often fails to generalize to unseen or stronger threats, revealing a critical gap in robustness generalization. In this work, we propose a dual-model fuzzing framework to enhance generalized robustness in DL models. Central to our method is a lightweight metric, the Lagrangian Information Bottleneck (LIB), which guides entropy-based mutation toward semantically meaningful and high-risk regions of the input space. The executor uses a resistant model and a more error-prone vulnerable model; their prediction consistency forms the basis of agreement mining, a label-free oracle for isolating decision-boundary samples. To ensure fuzzing effectiveness, we further introduce a task-driven seed selection strategy (e.g., SSIM for vision) that filters out low-quality inputs. We implement a prototype, TWINFUZZ, and evaluate it on six benchmark datasets and nine DL models. Compared with state-of-the-art testing approaches, TWINFUZZ achieves superior improvements in both training-specific and generalized robustness.

Abstract The rapid growth of the low-altitude economy, including unmanned aerial vehicles (UAVs) and urban air mobility (UAM), is reshaping industries from transportation to emergency response. Powered by advances in fifth-generation (5G) and 5G-advanced (5.5G) connectivity, artificial intelligence (AI), and new energy systems, these platforms are becoming increasingly autonomous and capable. However, their growing software complexity introduces critical cybersecurity risks. Vulnerabilities in communication protocols, onboard firmware, and AI systems can be exploited to hijack UAVs, disrupt operations, or leak sensitive data. While research has addressed isolated aspects, a unified security perspective is still lacking. This work presents a systematic review of software-level security challenges and defenses in low-altitude UAV/UAM systems. We first categorize major attack surfaces across communication, firmware, and AI layers. Furthermore, we survey defense mechanisms suited to real-time, resource-constrained aerial platforms. Finally, we propose future directions, including quantum-resistant communication protocols, hardware-software cosecurity, and edge-AI-driven architectures. Our work aims to inform researchers, practitioners, and regulators in developing integrated, resilient security strategies for the evolving low-altitude ecosystem.

Artificial Intelligence (AI) technology has been widely used in malware detection and has significantly improved defense against cyberattacks. Existing deep learning-based methods rely on training with large-scale data and only on predefined categories, making them inadequate for rapidly responding to novel malware attacks. Malware classification based on few-shot learning has made some progress in identifying unknown malware using limited data. However, existing methods struggle to achieve high performance because they typically focus on a single malicious feature, such as a single malware image or an API call sequence, thereby ignoring the multi-dimensional nature of malware. To deal with these challenges, we propose a multi-view few-shot learning method for malware classification. We propose a multi-view malicious feature engineering scheme, which combines domain knowledge and expert experience to analyze the malware from various perspectives. Furthermore, we propose a support-query prototype generation method based on multi-view malicious features to generate higher-quality malware prototypes, which enhances the representation of novel malware family distributions. Extensive experiments show that the proposed method outperforms existing state-of-the-art approaches. With only two samples per family, the accuracy still exceeds 90%. Our method demonstrates superior cross-dataset recognition capabilities, thereby fully illustrating its robustness and generalizability across different data distributions.

Auditing differential privacy (DP) guarantees often relies on querying trained models with specially crafted queries, such as canaries, examples differing between two neighboring datasets. However, in this work, we revisit this common approach and identify a fundamental limitation: canary-based queries may not capture the strongest privacy leakage, as the most informative queries can shift during the training process. This mismatch can result in loose lower bounds on the privacy parameter$\varepsilon$, underestimating potential risks from query-based adversaries. To address this issue, we propose two methods. First, we introduce a consistent and optimizable surrogate privacy loss function that better aligns with the true privacy loss, called Privacy-loss Maximization Method (PMM), enabling systematic discovery of stronger queries through optimization. Second, we analyze how the optimal queries evolve with model training and propose a gradient-aligned query generation algorithm, called Gradient-Guided Querying (GGQ), that rapidly identifies high-risk queries by aligning their gradients with the distribution of model parameters. Empirical evaluations across multiple tasks demonstrate that our methods consistently produce stronger privacy audit results, offering a more accurate assessment of the privacy risks associated with training algorithms.

To ensure data robustness, users typically create replicas of critical data and store them on multiple servers. However, due to server failures or malicious attacks, these replicas may face the risk of loss or tampering. Therefore, periodic auditing of data replicas is necessary to ensure their integrity. Existing solutions perform periodic auditing with generating metadata for each replica individually. However, generating auditing metadata for every replica incurs significant computational overhead, and storing metadata for multiple replicas also imposes a considerable storage burden. To reduce this overhead and optimize the efficiency of auditing towards multiple replicas, we propose collusion-resistant multi-replica data auditing with optimized metadata generation (CRMRDA). First, CRMRDA enhances replica generation efficiency by employing symmetric encryption and random masking. An indistinguishable challenge strategy is introduced, making the number of generated auditing metadata copies independent of the number of replicas. Second, we construct a security model for multi-replica data possession that allows server collusion and provide a formal security proof for CRMRDA. In addition, CRMRDA supports practical features such as dynamic operations and batch auditing. Finally, the efficiency of CRMRDA is evaluated in an experimental environment consisting of four servers, one third-party auditor, and one data owner. Compared to the latest multi-replica data auditing schemes, CRMRDA demonstrates lower computational overhead in replica generation, metadata generation, and periodic auditing.

Untargeted poisoning membership inference (PMI) attacks are a newly emerging privacy threat that evaluates the impact of poisoned samples on the privacy leakage risk in the model's training dataset. Existing approaches typically select target samples randomly from a candidate dataset to generate poisoned samples, which are then injected into the training dataset. While effective in amplifying privacy leakage risks, this random selection strategy overlooks the fact that each poisoned sample contributes unequally to the attack. In this paper, we first observe that randomly selected target samples may be distant from and dispersed relative to high-confidence benign samples, which restricts the effectiveness of membership inference attacks. We then show that selecting target samples with high confidence in their ground-truth class to generate poisoned samples contributes more significantly to the attack. Therefore, we propose a novel untargeted PMI attack incorporating the target sample selection and enhancement. Specifically, we train shadow models to select the highest-confidence target samples for poison generation. To further enhance the effectiveness of the attack, we introduce a noise generator that adds adversarial perturbations to the selected target samples. Experimental results demonstrate that our approach significantly improves the attack success rate (e.g.,$85.6\%$compared to the baseline of$71.9\%$). Notably, the ablation study shows that our noise generator enhances privacy leakage risks even when target samples are selected randomly, highlighting its effectiveness and broad applicability.

With the rapid growth of mobile applications, large volumes of private data are continuously generated on mobile devices and increasingly outsourced to cloud storage services. Due to the limited computational and energy resources of mobile devices, enabling efficient and secure periodic auditing of cloud stored data remains a challenging task. Existing cloud data auditing schemes, such as Provable Data Possession and Proof of Retrievability, require computation-intensive operations that are impractical for resource-constrained mobile environments. To address this challenge, we propose MIDAS, a mobile-friendly data auditing scheme that supports secure outsourcing of auditing metadata with balanced resource utilization. MIDAS adopts a two-phase auditing metadata structure, in which computation intensive operations are offloaded to edge nodes, while mobile devices only perform lightweight processing. In addition, identity information of edge nodes is embedded into the auditing metadata to support traceability and accountability. To further improve scalability, we design a resource scheduling model for Multi MU and Multi-EN scenarios and propose the proportional load balanced scheduling algorithm to achieve efficient and load balanced metadata generation. The security of MIDAS is rigorously proven by reducing it to the discrete logarithm problem in the RSA quadratic residue subgroup within the random oracle model. Experimental results in a real-world environment demonstrate that MIDAS significantly reduces computational overhead on mobile devices, maintains acceptable communication cost, and achieves superior scalability compared with existing schemes.

Decentralized finance has experienced phenomenal growth, revolutionizing the landscape of financial transactions and asset management via blockchain. Yet, this swift growth brings with it substantial challenges, notably the surge in scam tokens, imposing significant security threats on cryptocurrency investments and trading. Existing detection methods of scam token, primarily relying on analyzing contract codes or transaction patterns, struggle to catch increasingly sophisticated tactics employed by scammers. For example, contract-based analysis are unable to identify scams lacking overt malicious code, e.g., most rugpulls, while transaction-based methods generally lack the foresight to early-detect potential risks. In this paper, we present TOKENSCOUT, the first temporal GNN-based framework for scam token early detection. TOKEN SCOUT formulates token transfer data as a dynamic temporal attributed multigraph and leverages the temporal graph learning model to learn graph representations. It also builds a graph rep resentation refining model based on contrastive learning to learn a more discriminative representation space for risk identification. We evaluated TOKENSCOUT using a comprehensive dataset of 214,084 standard ERC20 tokens from 2015 to February 2023. TOKENSCOUT achieves a balanced accuracy of 98.41%. Additionally, from March to May 2023, deploying TOKENSCOUT on Ethereum effectively identified 706 rugpulls, 174 honeypots, and 90 Ponzi schemes, thereby alerting to potential risks exceeding $240 million.

Federated learning (FL) is a key paradigm for deploying AI models across large numbers of Internet of Things (IoT) devices in edge computing. While FL avoids uploading raw data to a central server, client privacy remains vulnerable during new client integration, when previously unseen devices first register their identities and cryptographic keys. A malicious or semi-honest central server (CS) can manipulate training to isolate target gradients, reconstruct local data, and tamper with aggregation. We study the Identity Forgery and Gradient Inversion Attack (IFGIA) against federated edge learning. By fabricating virtual clients and exploiting secure aggregation, a malicious CS can recover target gradients with success rates above 99.5% under realistic edge settings, revealing a critical weakness in existing privacy-preserving and verifiable FL schemes. To defend against IFGIA, we propose Robust Federated Learning (RFL), a framework tailored for edge computing that combines model splitting between edge clients and edge servers, lightweight differential privacy on intermediate representations, and split verification using digital signatures and homomorphic hashes. Experiments show that RFL reduces IFGIA's success rate to 73.6%, shrinks per-client communication from 375 MB to 40 KB, accelerates edge-side training by at least 10×, and maintains competitive accuracy.

Reliable protocol knowledge is often difficult to obtain in industrial networks, as industrial communications come with limited documentation, vendor-specific encodings, and opaque payloads. This lack of transparency hinders message interpretation and protocol analysis. To recover this missing protocol knowledge, network-trace-based protocol reverse engineering (PRE) infers message structure, field roles, and interaction logic directly from recorded traces. This enables protocol-aware intrusion detection, process monitoring, and protocol testing and fuzzing without access to device internals. Although PRE has advanced rapidly, existing techniques are developed under diverse objectives and assumptions. As a result, it is often unclear how isolated results relate to an end-to-end reverse-engineering workflow, and how evaluation outcomes should be compared across tasks and protocols. In this article, we cast reverse engineering of industrial protocols from network traces as a task-driven pipeline and articulate a unified task decomposition spanning message type identification, protocol syntax and semantic inference, payload pattern recognition and semantic inference, and protocol state machine reconstruction. For each task, we describe key methodological themes, common evaluation practices, and practical limitations that affect robustness and deployability in industrial settings. We further discuss security, privacy, and ethical risks that accompany increasingly capable PRE, and identify promising research directions toward more systematic, dependable, and deployment-oriented PRE methodologies.

Machine Learning (ML) demonstrates dermatologist level accuracy in skin cancer diagnosis, yet its practical adoption is constrained by data silos and privacy issues. While Federated Learning (FL) addresses these limitations, it remains susceptible to data heterogeneity and gradient leakage attacks. To overcome these challenges, we introduce a privacy-preserving FL framework tailored for encrypted dermoscopic image analysis. Our proposed framework integrates a Fully Homomorphic Encryption (FHE)-enabled variant of Stochastic Controlled Averaging (SCA), enhancing model convergence with Non-IID data. To further minimize computational and communication overhead, we develop a layer-wise Packed FHE (PFHE) approach that improves the efficiency of encrypted model aggregation. Moreover, we design a lightweight, FHE-Friendly Deep Neural Network (DNN) optimized for encrypted inference. This architecture incorporates a DO-EncConv module specifically engineered to balance inference efficiency and precision within FHE computational constraints. Experimental results on the HAM10000 and ISIC2019 datasets confirm the effectiveness of our proposed framework, demonstrating F1-Score improvements of 2.2% and 4.0%, respectively, over baseline FL approaches. Additionally, our method achieves communication overhead reductions of 94.85% and 93.48%, while encrypted inference is performed in approximately 17.8 seconds per sample, with less than 2% accuracy degradation compared to centralized plaintext models. These outcomes underscore the framework's practicality and effectiveness for secure, scalable clinical deployment.

We present GC-DP, a novel federated learning framework that enables personalized differential privacy by adaptively adjusting gradient clipping thresholds. Unlike traditional DP methods that apply a fixed clipping bound, GC-DP uses a proxy dataset to learn client-specific mappings from privacy budgets (ε) to optimal clipping thresholds (C^*), while also allowing each client to adjust its local clipping bound in real time based on the l2 norm of its local gradient. This dual adaptivity significantly improves the balance between privacy protection and model utility in heterogeneous FL settings.

The automation of unit test generation has become a critical task for improving the overall efficiency of software development and testing. Many existing techniques attempt to generate a sufficient number of test cases to achieve high code coverage. However, it has been shown that a high coverage does not necessarily guarantee effective bug discovery. A potential enhancement is to guide the unit test generation based on bug properties. However, this solution is challenged by the large number and diversity of bug types, making it difficult to comprehensively summarize bug properties.We observe that failures, presented as the results of bugs, manifest in a limited number of scenarios. Therefore, instead of bug properties, in this paper, we propose an innovative framework, named FailMapper, which uses failure scenarios to guide the generation of unit tests. We summarize nine failure scenarios and design the corresponding failure-triggering test strategies. This significantly improves the efficacy of generating test cases towards triggering bugs. To systematically explore possible failure scenarios, FailMapper employs the Monte Carlo Tree Search algorithm to search for the faults that may lead to a failure. Experiments demonstrate that, on 50 known bugs in the Defects4J benchmark, FailMapper can detect many more bugs than five typical unit testing approaches, including EvoSuite, Randoop, CoverUp, HITS, and SymPrompt (40 versus at most 12, out of all 50 bugs). Meanwhile, FailMapper detects 12 out of 20 bugs in the GitBug-Java and Bears-benchmark datasets. We reveal 36 potential issues from 2 Apache projects, and 14 of them have been confirmed as bugs, further demonstrating FailMapper’s effectiveness. The experimental results show that our new framework can significantly enhance the overall efficacy of unit testing.

The Internet of Things (IoT) is widely used in various sectors but is often prone to vulnerabilities. With the proprietary nature of IoT devices, their source code and firmware are frequently unavailable for open review, rendering blackbox fuzzing a viable approach. However, the effectiveness of blackbox fuzzing is often challenging due to the lack of feedback, especially the information of code coverage. In this paper, we propose WingMuzz to provide blackbox fuzzing of IoT protocols with effective feedback. The key is to guide blackbox fuzzing by utilizing runtime information from greybox fuzzing on counterpart open-source code. This is based on our observation that IoT protocols and open-source code conform to the same specifications, indicating that inputs exploring different code regions on open-source code may also discover new coverage on IoT protocols. WingMuzz uses a two-dimensional fuzzing schedule to optimize the process of fuzzing IoT protocols. The first dimension involves scheduling open-source implementations, referred to as wingmates, so that similar ones are preferred to guide blackbox fuzzing. The second dimension utilizes coverage-guided greybox fuzzing to test open-source code. This solution can bridge the performance gap between blackbox fuzzing and greybox fuzzing on IoT protocols. We evaluate the performance of WingMuzz across eight IoT protocols and compare it with six widely-used blackbox fuzzers. On average, WingMuzz can discover 42.1%, 26.92%, 25.01%, 34.95%, 23.56% and 11.63% more edges than Boofuzz, Spike, Peach, Snipuzz, Pulsar and ChatAFL, respectively. Additionally, WingMuzz exposes 10 bugs in IoT protocols while other fuzzers expose no more than 3 bugs. It also exposes 2 new protocol vulnerabilities in IoT devices while other fuzzers cannot identify any.

Code datasets are invaluable for training neural vulnerability detectors, a promising area within software engineering. Unfortunately, both proprietary and public datasets face the threat of unauthorized exploitation. Moreover, the opaque nature of neural models presents a challenge for external auditing of training datasets, exacerbating the risk of potential misuse. Although watermarking techniques have proven effective in protecting image and natural language datasets, their applicability to code datasets is limited by domain specificity. Current endeavours to preserve the copyrights of code datasets frequently neglect essential control and data dependency information, treating code as a flat structure. To address these gaps, we propose VulCodeMark, a pioneering method that incorporates data and control flow information into code dataset watermarking. VulCodeMark employs two transformations (1) Syntactic Transformation; (2) Semantic Transformation) to generate watermarks, ensuring the preservation of the original program’s functionality while maintaining context-adaptive stealthiness. Experiments have demonstrated that VulCodeMark fulfils essential properties of practical watermarks-including harmlessness, effectiveness, imperceptibility, and robustness. Besides, VulCodeMark additionally supports preliminary probing of model architecture configurations, furnishing valuable forensic evidence in cases of intellectual property infringement.

With the rapid adoption of LLM-based code assistants to enhance programming experiences, concerns over extraction attacks targeting private training data have intensified. These attacks specifically aim to extract Personal Information (PI) embedded within the training data of code generation models (CodeLLMs). Existing methods, using either manual or semi-automated techniques, have successfully extracted sensitive data from these CodeLLMs. However, the limited amount of data currently retrieved by extraction attacks risks significantly underestimating the true extent of training data leakage. In this paper, we propose an automatic PI data extraction attack framework against LLM-based code assistants, named Codebreaker. This framework is built on two core components: (i) the introduction of semantic entropy, which evaluates the likelihood of a prompt triggering the model to respond with training data; and (ii) an automatic dynamic mutation mechanism that seamlessly integrates with Codebreaker, reinforcing the iterative process across the framework and promoting greater interconnection between different PI elements within a single response. This boosts reasoning diversity, model memorization, and finally attack performance. Using six series of open-source CodeLLMs (i.e., CodeParrot, StarCoder2, Code Llama, CodeGemma, DeepSeek-Coder, DeepSeek-V3) and two commercial code assistants (i.e., CodeFuse and GPT), we demonstrate the effectiveness of our proposed framework: (i) Codebreaker outperforms all current state-of-the-art extraction attacks by 6.22% ~ 44.9% (averaging 21.79%); (ii) when PI within a single response originates from the same GitHub repository, our framework - considering multiple interconnections in the response - exceeds others by 3.88% ~ 32.37% (averaging 15.31%). Furthermore, we discuss potential defenses, highlighting the urgent need for stronger measures to prevent PI leakage at the base model level.

ABSTRACT The reliability of the catenary system is crucial for the safety and efficiency of heavy‐haul railways. This study presents a probabilistic risk analysis model for the catenary system, employing causal inference methods to capture the complex relationships among risk factors. Using historical operational data, we identify key risk contributors such as environmental conditions, vehicular loads, and equipment failures. By combining fault tree analysis (FTA) and failure mode and effects analysis (FMEA), we establish risk propagation pathways. The proposed method utilizes Bayesian networks to quantify conditional probabilities and trace the causal chains leading to potential failures. Through reverse inference, we identify critical risk nodes and their impact on system performance. This approach enhances the accuracy of risk assessment and provides an effective tool for proactive risk management in heavy‐haul railways, aiding in the optimization of maintenance strategies and strengthening the resilience of the catenary system under varying operational conditions.

Cross-chain bridges, one of the foundational infrastructures of blockchain, provide the infrastructure and solutions for inter-operability, asset liquidity, data transfer, decentralized finance, and cross-chain governance between blockchain networks. However, because cross-chain bridges often have to handle communication and asset transfers between multiple blockchains, they involve complex protocols and technologies. This complexity increases the likelihood of vulnerabilities and potential attacks. In order to ensure the security and reliability of cross-chain bridges, this article launches a thorough investigation of existing cross-chain bridge projects, clarifying bridging mechanisms, bridge types, and security features. The following part goes into the subject of security and sheds light on the considerable challenges faced by cross-chain bridges. It conducts a thorough analysis of security flaws, covering problems like smart contract vulnerabilities, centralization risks, liquidity issues, and oracle manipulations. Furthermore, this study promotes a compendium of security solutions and best practises, pointing the way toward a cross-chain bridge scenario that is more secure.

In Unmanned Aerial Vehicle Ad Hoc Networks (UANETs), rapid movement of nodes leads to frequent changes in network topology, increasing the risk of packet loss and affecting data transmission. Furthermore, current research on drone clustering lacks security considerations, which reduces the reliability of data transmission. Due to this, improving the stability and reliability of network data transmission in dynamically changing UANETs remains a challenge. In this work, we propose the reputation mechanism DSCR (Dynamically Secure Cluster Routing) Scheme for UANETs, a design for cluster head election in UANETs using the evaluated value and reputation value of drones and forms clusters through this reputation mechanism to avoid malicious nodes from interfering with the clusters to improve the security of UANETs. We apply a residual link survival time-based intra-and inter-cluster algorithm based on residual link survival time for data forwarding of nodes, optimizing the dynamic routing strategy and reducing the packet loss rate of nodes. In addition, reinforcement learning is used in UANETs to achieve cluster decisions based on the current network state and cluster dynamics, effectively improving the stability of clusters. Experiments were conducted on the proposed method to verify its efficiency and stability. Compared to the ICRA, RICR, and DCA algorithms, the stability of the cluster is improved by 11.92%, 28.12%, and 75.2%, respectively, and the packet loss rate reduced by 41.48%, 44.17%, and 55.74%, demonstrating that DSCR is a compelling dynamic routing solution applicable to UANETs.

Anonymous messaging system allows users to deliver messages without revealing the sending content and their identifiers, which has attracted ongoing concerns. However, to the best of our knowledge, all the existing solutions still fail to protect users’ privacy under coercion. That is, the user’s communication transcripts might be tracked and cached, and later coerced to reveal the underlying messages associated with the ciphertexts due to law enforcement reasons or for evil purposes. In addition, anonymity alone is not enough for some practical scenarios. For instance, a journalist just wants to communicate with those intended informants, and thereby gather information from anonymous but authenticated sources. In this paper, to address the above-mentioned issues, we introduce an authenticated and deniable anonymous messaging framework. Its core component is a new cryptographic primitive dubbed deniable identity-based matchmaking encryption (DIB-ME), which captures plausible deniability under coercion and mutual authentication without interactions simultaneously. We further present a concrete DIB-ME construction and prove its security in the random oracle model. The performance analysis indicates merits of the proposed DIB-ME scheme. We also implement the proposed DIB-ME construction and present extensive experiment results, as a proof of concept to demonstrate its soundness and practicability.

AI-enabled critical infrastructures (ACIs) integrate artificial intelligence (AI) technologies into various essential systems and services that are vital to the functioning of society, offering significant implications for efficiency, security and resilience. While adopting decentralized AI approaches (such as federated learning technology) in ACIs is plausible, private and sensitive data are still susceptible to data reconstruction attacks through gradient optimization. In this work, we propose Compressed Differentially Private Aggregation (CDPA), a leakage-resilient, communication-efficient, and carbon-neutral approach for ACI networks. Specifically, CDPA has introduced a novel random bit-flipping mechanism as its primary innovation. This mechanism first converts gradients into a specific binary representation and then selectively flips masked bits with a certain probability. The proposed bit-flipping introduces a larger variance to the noise while providing differentially private protection and commendable efforts in energy savings while applying vector quantization techniques within the context of federated learning. The experimental evaluation indicates that CDPA can reduce communication cost by half while preserving model utility. Moreover, we demonstrate that CDPA can effectively defend against state-of-the-art data reconstruction attacks in both computer vision and natural language processing tasks. We highlight existing benchmarks that generate 2.6x to over 100x more carbon emissions than CDPA. We hope that the CDPA developed in this paper can inform the federated AI-enabled critical infrastructure of a more balanced trade-off between utility and privacy, resilience protection, as well as a better carbon offset with less communication overhead.

Fuzzing is a critical technique for uncovering vulnerabilities in software libraries. However, current approaches often struggle with cross-language compatibility and integration with diverse fuzzing tools. We proposeEXo-Muta, a novel universal library fuzzing framework based on exogenous mutation. We use the term ‘exogenous’ to describe this new mutation process because it operates externally to the fuzzer's core engine, executing within the fuzz driver as an independent component, unlike traditional endogenous mutations tightly integrated within the fuzzer itself. By decoupling the mutation process from specific fuzzers,EXo-Mutaachieves unprecedented adaptability across diverse programming languages and fuzzing tools. It leverages static analysis to extract structured data representations and applies language-independent mutation operators at the code level. This design enables seamless integration with various existing fuzzers, enhancing their performance regardless of the target language. We further utilize large language models (LLM) for efficient cross-language data conversion. In experiments, we evaluatedEXo-Mutaon 20 real-world libraries across C++, Python, Java, and JavaScript, integrating it with multiple stateof- the-art fuzzers, such as AFL++ and libFuzzer, and languagespecific tools, such as Atheris and Jazzer. Results show significant improvements in code coverage across different fuzzers and languages, with up to 58% more edges discovered in C++ projects when integrated with libFuzzer, and consistent outperformance in other scenarios (27% on Python, 9% on Java, 6% on JavaScript).EXo-Mutarepresents a significant advancement in fuzzing technology, offering a universal, language-agnostic approach that substantially improves code coverage across diverse programming languages and fuzzing tools, thereby expanding the reach and effectiveness of library API testing.

Multi-client functional encryption (MCFE) is an extension of functional encryption (FE) in the multi-user setting and serves as a generalization of multi-input functional encryption (MIFE). The necessity of hiding function when it contains sensitive information, coupled with the widespread application of inner product (IP) in the descriptive statistics, has led to extensive research on function-hiding MCFE for IP. However, these works all rely on pairings and impose serious restrictions on the size of supported messages, as they all use inefficient decryption involving the extraction of discrete logarithms. On the other hand, although Abdalla et al. (CRYPTO 2018) introduced the first inner-product MIFE scheme for large message space as a special case of MCFE, it is not function-hiding. Consequently, existing inner-product MCFE schemes either exclusively support large space or solely achieve function-hiding, with no solution simultaneously achieving both properties. This paper employs an incremental construction strategy to design the function-hiding inner-product MCFE scheme, which does not require pairings. This leads to two main advances. First, we achieve the function hiding for inner-product MIFE even for messages of super-polynomial size. Second, we obtain the first function-hiding inner-product MCFE for large space, where the length of the message is of super-polynomial size.

Vulnerability detection plays a crucial role in the software development lifecycle. Commit-level vulnerability detection aims to detect whether the changed code contributed to potential vulnerabilities by the developer when submitting the code, which is also referred to as Just-In-Time (JIT) vulnerability detection. Previous JIT vulnerability detection approaches relied on code metrics and textual features, which were unable to effectively characterize vulnerability-contributing commits (VCCs). Recently, CodeJIT (a code-centric learning-based approach) has been proposed to detect vulnerability at the commit-level. However, CodeJIT still has its limitations: imprecise feature representation, static code embedding, and underutilized heterogeneous information. In this paper, we propose HgtJIT, a JIT vulnerability detection approach based on a Heterogeneous Graph Transformer (HGT) in order to address several limitations of the state-of-the-art CodeJIT approach. We propose diffPDG to represent code changes and use the CCT5 model (the latest feature encoder pre-trained on a large-scale code change corpus) to embed graph nodes to generate the most meaningful vector representations. In addition, we employ HGT to adequately utilize heterogeneous information of the graph to learn vulnerability features. Extensive experiments have shown that HgtJIT is the best-performing model, with F1 and AUC improvement of 14.6%-37.5% and 12.2%-53.7% compared to the baseline model

With the continuous development of digitization evolutions, vehicular digital twin networks (VDTNs) facilitate traffic data and optimization results to be exchanged between the vehicle and digital twin as well as shared among a group of digital twins. However, the data exchange and group sharing processes take place in real-time over public communication channels, which suffer from various security and privacy threats. Key agreement technologies are promising to enable secure data communications for entities, but the existing key agreement schemes generally fail to fulfill the requirements of synchronization, privacy, and entity management for VDTNs. Therefore, we propose a blockchain-assisted privacy-preserving and synchronized key agreement scheme for VDTNs. In the proposed scheme, the anonymous vehicle and digital twin can negotiate a secret session key in the case of synchronization to achieve secure data exchange. Meanwhile, digital twins are capable of utilizing synchronized state information to dynamically establish a common group encryption key but hold individual decryption keys, which guarantee the security of group sharing. Additionally, the proposed scheme is able to protect identity privacy and manage vehicles and digital twins with the assistance of blockchain and smart contract. The security analysis demonstrates that the proposed scheme provides security and privacy assurances for VDTNs. The performance evaluation indicates that it has excellent expressions in terms of efficiency, practicality, and smart contract consumption.

Web application firewall (WAF) examines malicious traffic to and from a web application via a set of security rules. It plays a significant role in securing Web applications against web attacks. However, as web attacks grow in sophistication, it is becoming increasingly difficult for WAFs to block the mutated malicious payloads designed to bypass their defenses. In response to this critical security issue, we have developed a novel learning-based framework calledWAFBooster, designed to unveil potential bypasses in WAF detections and suggest rules to fortify their security. Using a combination of shadow models and payload generation techniques, we can identify malicious payloads and remove or modify them as needed.WAFBoostergenerates signatures for these malicious payloads using advanced clustering and regular expression matching techniques to repair any security gaps we uncover. In our comprehensive evaluation of eight real-world WAFs,WAFBoosterimproved the true rejection rate of mutated malicious payloads from 21% to 96%, with no false rejections.WAFBoosterachieves a false acceptance rate 3× lower than State-of-the-Art methods for generating malicious payloads. WithWAFBooster, we have taken a step forward in securing web applications against the ever-evolving threats.

As one of the most successful techniques in hunting software bugs, Coverage-guided Greybox Fuzzing (CGF) intends to move fuzzing campaigns towards executions that can trigger bugs. This process can be divided into two steps, including reaching suspicious code regions and exploring their execution states. Many CGFs propose approaches to efficiently reach suspicious code regions and individual execution states, but fail to explore complex execution states. The challenge is how to explore execution states so that fuzzing can detect multiple types of bugs, while maintaining the code coverage. To address this challenge, we proposeBazzAFLto investigate code coverage and multiple types of bugs. The crux ofBazzAFLis to maintain a bunch of seed groups, where each seed saves the best performance on one objective. With the seed group,BazzAFLprioritizes code regions that most likely contain bugs based on multi-objective optimization and adaptively divides energy among the seeds in a group based on Shannon's entropy. Meanwhile, during mutation,BazzAFLtends to mutating the bytes that can change the execution states. With these solutions,BazzAFLgradually moves fuzzing campaigns towards locations and execution states of bugs. Experimental results show thatBazzAFLidentifies at least 62 more bugs on 24 programs compared with other fuzzers.

Critical infrastructures are increasingly integrating artificial intelligence (AI) technologies, including large language models (LLMs), into essential systems and services that are vital to societal functioning. Fine-tuning LLMs for specific domain tasks are crucial for their effective deployment in these contexts, but this process must carefully address both privacy and security concerns. Without proper safeguards, such integration can introduce additional risks, such as data leakage during training and diminished model trustworthiness due to the need for model compression to operate within limited bandwidth and computational capacity constraints. In this paper, we proposeHardening LLM Fine-tuning framework(HARDLLM), which addresses these challenges through two key components: (i) we develop a differentially private data selection method that ensures privacy protection by training the model exclusively on sampled and synthesized public data, thereby preventing any direct use of private data and enhancing leakage resilience throughout the training process, and (ii) we introduce a trustworthiness-aware model quantization approach to improve LLMs performance, such as reducing toxicity, enhancing adversarial robustness, and mitigating stereotypes, while maintaining negligible impact on model utility. Experimental results show that, the proposed algorithm ensures differential privacy when privacy budget is set at ϵ = 0.5, with only a 1% drop in accuracy, while other state-of-the-art methods experience an accuracy drop of at least 20% under the same privacy budget. Additionally, our quantization approach improves the trustworthiness of fine-tuned LLMs by an average of 3-4%, with only a negligible utility loss (approximately 1%) at a 50% compression rate.

Model inversion (MI) attacks, for which effective defense strategies are still lacking, pose significant risks to privacy by reconstructing private training data through access to well-trained classifiers. Addressing this concern, this study introduces TrapNet, designed to defend against advanced MI attacks while maintaining good model utility. TrapNet intentionally injects trapdoors into the classification manifold of the protected target model. In this way, TrapNet can effectively mislead MI attack optimization. Specifically, TrapNet leverages a conditional GAN (cGAN) trained on the private dataset to generate diverse and realistic trapdoor samples. In addition, we propose a graph-matching self-obfuscation strategy and an entropy regularization technique to optimize trapdoor injection while preserving model utility. Compared to the existing defense, TrapNet can provide universal protection to all target classes without access to any auxiliary public data. Extensive experiments on CelebA, VGG-Face, and VGG-Face2 datasets demonstrate TrapNet’s superior performance over existing defenses, including the most advanced NetGuard and BiDO, against state-of-the-art model inversion attacks, i.e., PLG-MI, LOMMA, and Plug&Play.

In cloud Electronic Medical Records (EMRs), health-related private information such as genetics and diseases is contained. Thus, the secure ownership transfer protocol should protect users’ privacy. In certain scenarios, some users, including patients, doctors, medical and research institutions, may be offline. As a result, existing protocols cannot be directly employed. Motivated by these observations, in this paper we propose a secure and efficient ownership transfer for cloud EMRs auditing protocol. Specifically, our protocol allows the existence of offline users while ensuring users anonymity, it is achieved using different signature constructions. Additionally, a tracing mechanism is introduced to safeguard against malicious users. We rigorously prove the security of our protocol, comprehensively evaluate the performance of it, and compare our protocol with a few closely relevant protocols. According to the evaluations, our protocol significantly improves ownership transfer efficiency while achieving additional functionalities, including public verifiability, multi-ownership transferability, anonymity, and traceability.

The utilization of machine learning algorithms in distributed web applications is experiencing significant growth. One notable approach is Federated Learning (FL) Recent research has brought attention to the vulnerability of FL to gradient inversion attacks, which seek to reconstruct the original training samples, posing a substantial threat to client privacy. Most existing gradient inversion attacks, however, require control over the central server and rely on substantial prior knowledge, including information about batch normalization and data distribution. In this study, we introduce Poisoning Gradient Leakage from Client (PGLC), a novel attack method that operates from the clients’ side. For the first time, we demonstrate the feasibility of a client-side adversary with limited knowledge successfully recovering training samples from the aggregated global model. Our approach enables the adversary to employ a malicious model that increases the loss of a specific targeted class of interest. When honest clients employ the poisoned global model, the gradients of samples become distinct in the aggregated update. This allows the adversary to effectively reconstruct private inputs from other clients using the aggregated update. Furthermore, our PGLC attack exhibits stealthiness against Byzantine-robust aggregation rules (AGRs). Through the optimization of malicious updates and the blending of benign updates with a malicious replacement vector, our method remains undetected by these defense mechanisms. We conducted experiments across various benchmark datasets, considering representative Byzantine-robust AGRs and exploring different FL settings with varying levels of adversary knowledge about the data. Our results consistently demonstrate the ability of PGLC to extract training data in all tested scenarios.

Pump-and-Dump (PD) schemes pose a significant threat to the stability and fairness of Decentralized Finance (DeFi) markets, often resulting in substantial financial losses for investors. The early and accurate detection of these schemes is crucial for preserving trust in the rapidly expanding cryptocurrency ecosystem. However, existing detection methods primarily rely on post-event analysis and heuristic-based approaches, which are often inadequate for real-time and precise identification of PD activities. In this paper, we present PUMPWATCHER, an innovative framework that employs Graph Neural Networks (GNNs) and contrastive learning to detect PD schemes by modeling transaction behaviors within temporal graphs. PUMPWATCHER integrates advanced transaction graph construction, temporal GNNs, and contrastive learning techniques to enhance node and edge representations, thereby improving the detection of intricate and covert PD operations. We validate PUMPWATCHER on a dataset from Uniswap, encompassing 924,508 transactions across 858 tokens within December 2022. The results show that PUMPWATCHER outperforms state-of-the-art models, achieving a superior balanced accuracy of 92.3%, while significantly minimizing false positives and negatives. These outcomes highlight its potential to set a new standard in real-time detection of market manipulation, paving the way for more secure and resilient DeFi ecosystems.

In the era of zero trust security models and next-generation networks (NGN), the primary challenge is that network nodes may be untrusted, even if they have been verified, necessitating continuous validation and scrutiny. Effective intrusion detection systems (IDS) are crucial for continuously monitoring network traffic and identifying potential threats. However, traditional IDS approaches often struggle to keep pace with evolving threats, requiring extensive supervised training on labeled datasets. This limitation leads to high false positive rates, low detection accuracy, and a failure to provide real-time detection, thereby undermining the security of NGNs. This paper proposed the first self-supervised learning-based IDS, designed on temporal contrastive graph neural network (GNN), namely$\mathsf{TCG}\text{-}\mathsf{IDS}$. It innovatively integrates three contrastive learning strategies: temporal contrasting to capture temporal dependencies, asymmetric contrasting to account for the diverse interactions within network data, and masked contrasting to enhance the learning of node representations by masking parts of the data during training. Performance evaluation was conducted on two publicly available network traffic datasets, NF-CSE-CIC-IDS2018-V2 and NF-UNSW-NB15-V2.$\mathsf{TCG}\text{-}\mathsf{IDS}$achieved a balanced accuracy of 99.48% and 91.48% on two datasets respectively, significantly outperforming state-of-the-art graph learning models. In multi-class detection,$\mathsf{TCG}\text{-}\mathsf{IDS}$attained a mean false positive rate of 4.15% and 3.34% on the two datasets respectively. Besides, it exhibits high efficiency with its running time of 0.37s and 0.51s on the two datasets to predict per batch of 100 samples. Results highlight the effectiveness and efficiency of$\mathsf{TCG}\text{-}\mathsf{IDS}$in accurately detecting various types of network intrusions. This work significantly advances the field of network intrusion detection via self-supervised temporal graph learning, offering a promising solution for future network security systems.

With the rapid growth of cloud storage technology, the demand for efficient and secure search of outsourced encrypted data has become increasingly critical. However, existing conjunctive keyword dynamic searchable encryption schemes often expose the Keyword Pair Result Pattern (KPRP) during index matching, compromising privacy. Additionally, frequent index updates require expensive group exponentiations, leading to high client-side overhead. To tackle these challenges, we propose LRP-HDSE, a lightweight dynamic conjunctive keyword searchable encryption scheme that hides KPRP while minimizing client computation costs. To enhance privacy, we introduce the Vector Hidden Subset Predicate Encryption (VH-SPE) mechanism, which enables the server to implicitly detect cross-tag in the membership matching index, effectively mitigating KPRP leakage. For improved efficiency, the scheme designs a lightweight membership matching index structure, LSet, based on low-cost multiset hash operations, reducing reliance on costly exponentiations and lowering client overhead. Our security analysis confirms that LRP-HDSE provides robust KPRP hiding along with forward and backward security in dynamic environments. Asymptotic analysis, along with experiment evaluations on two real-world datasets, show that our scheme offers superior client-side computational efficiency compared to existing approaches, making it both practical and effective.

As the Industrial Internet of Things (IIoT) continues to expand, the need for effective device identification becomes critical for securing industrial environments. Network traffic fingerprinting has emerged as an important technique for IIoT device identification, leveraging the unique communication patterns embedded in network traffic. Despite significant efforts in this area, a comprehensive overview of the relevant research is still missing. To address the lack of comprehensive research, this paper, for the first time, identifies critical knowledge gaps constraining IIoT device identification through network traffic analysis: obscure fingerprint feature space, limited generalizability to unknowns, and scarce data sources. Focusing on these gaps, existing methods are analyzed and summarized in detail across network traffic fingerprinting, IIoT device identification, and public IIoT datasets. Specifically, network traffic fingerprinting methods are categorized into three levels: Packet-level, flow-level, and business-level, and relevant methods are examined in terms of data formats, segmentation units, and extraction or generation techniques. In the context of IIoT device identification, tasks such as device type, model, and instance recognition, as well as abnormal device detection, are extensively investigated using rule-based, traditional machine learning- based, and deep learning-based approaches, with a focus on device fingerprints and application scenarios. Furthermore, main public datasets from the IoT, ICS, and IIoT scenarios are highlighted to support the development of fingerprinting and identification methods. Finally, several future research directions are proposed to guide new advancements in this area.

The Internet of Robotic Things (IoRT) has experienced rapid growth and garnered increased attention in recent years. Applications (Apps) play a crucial role in IoRT, as they provide users with an intuitive interface to access and operate services. However, as user demands increase, Apps become more complex, leading to longer operation sequences and more vulnerabilities. The existing testing methods for Apps can be categorized into random, reinforcement learning, and AI-based approaches. AI-based methods offer a solution to the low coverage efficiency of random-based methods and the weak guidance of reinforcement learning-based methods. However, current AI-based methods have difficulty in capturing long-term dependencies, resulting in low coverage and less detected crashes when testing Apps with long operation sequences. To address the limitation, we propose InforTest, a novel AI-based method based on the Informer prediction model and the component tree structure. InforTest leverages Informer, which excels at extracting long-term dependencies from operation sequences, to generate human-like moves for testing Apps. To improve the efficiency of training and prediction, InforTest uses the component tree, a concise structure to represent primary data sources, i.e., screenshots. After training InforTest on the Rico dataset, our experiments with Apps in the IoRT scenario demonstrated its superiority over existing methodologies such as Monkey, Humanoid, MUBot, and Ape. Notably, InforTest achieved significant enhancements in coverage rates (increases of 67%, 34%, 19%, and 27%, respectively) and in crash detection capabilities (improvements of 175%, 81%, 71%, and 139%, respectively).

With the expansion of mobile devices and cloud computing, massive spatial trajectory data is generated and outsourced to the cloud for storage and analysis, enabling location-based mobile computing services. However, due to the sensitivity of the trajectory data, sharing it in plaintext could lead to privacy risks, especially in operations like contact queries. Thus, achieving secure and efficient contact queries based on the trajectory data in the cloud is a significant challenge. In this paper, we propose a privacy-preserving contact query processing over trajectory data in mobile cloud computing. The projection-based secure trajectory encoding is designed to convert trajectories into secure codes such that the comparison between the distance of two moving objects and the contact distance threshold is transformed into a problem of secure code matching. Adopting the secure code matching method, a baseline privacy-preserving contact query processing is proposed. To improve the query accuracy and efficiency, an amplification factor, an HTG-index and a filter table are designed for query processing optimization, based on which an enhanced privacy-preserving contact query processing is proposed. The game stimulation-based security analysis and experimental results show that the proposed query scheme is secure and performs well in query accuracy and efficiency.

The continuous development of mobile terminal applications, online maps, and other navigation services have become widely used, simultaneously giving rise to significant security risks. To address the issues of privacy leakage and low efficiency in traditional graph shortest path retrieval schemes, an efficient privacy-preserving graph shortest path retrieval scheme is proposed, called EP-GSPR. Specifically, this scheme addresses the privacy security problems in the existing graph shortest path retrieval solutions by ensuring the bilateral privacy protection of the user's query location and the database privacy of the cloud server. Throughout the retrieval process, the cloud server cannot obtain the user's location information, and the user cannot access any database information other than the retrieval results. To overcome the performance bottlenecks in existing schemes, a progressive iterative retrieval framework is designed as the fundamental modular, called Pirf, achieving sub-linear retrieval costs and low storage overhead on the cloud server side. Finally, the security analyses demonstrate the EP-GSPR scheme achieves the bilateral privacy-preserving in terms of user and server sides. The comprehensive experiment evaluations also state the efficiency and practicality of the proposed scheme

No abstract available.

Facing enormous data generated at the network edge, edge intelligence (EI) emerges as the fusion of edge computing and AI, revolutionizing edge data processing and intelligent decision-making. Nonetheless, this emergent mode presents a complex array of security challenges, particularly prominent in image-centric applications due to the sheer volume of visual data and its direct connection to user privacy. These challenges include safeguarding model/image privacy and ensuring model integrity against various security threats, such as model poisoning. Essentially, those threats originate from data attacks, suggesting data protection as a promising solution. Although data protection measures are well-established in other domains, image-centric EI necessitates focused research. This survey examines the security issues inherent to image-centric EI and outlines the protection efforts, providing a comprehensive overview of the landscape. We begin by introducing EI, detailing its operational mechanics and associated security issues. We then explore the technologies facilitating security enhancement (e.g., differential privacy) and EI (e.g., compact networks and distributed learning frameworks). Next, we categorize security strategies by their application in data preparation, training, and inference, with a focus on image-based contexts. Despite these efforts on security, our investigation identifies research gaps. We also outline promising research directions to bridge these gaps, bolstering security frameworks in image-centric EI applications.

Inter-datacenter network applications generate massive coflows for purposes, e.g., backup, synchronization, and analytics, with deadline requirements. Decentralized coflow scheduling frameworks are desirable for their scalability in cross-domain deployment but grappling with the challenge of information agnosticism for lack of cross-domain privileges. Current information-agnostic coflow scheduling methods are incompatible with decentralized frameworks for relying on centralized controllers to continuously monitor and learn from coflow global transmission states to infer global coflow information. Alternative methods propose mechanisms for decentralized global coflow information gathering and synchronization. However, they require dedicated physical hardware or control logic, which could be impractical for incremental deployment. This article proposes Slark, a decentralized deadline-aware coflow scheduling framework, which meets coflows’ soft and hard deadline requirements using only local traffic information. It eschews requiring global coflow transmission states and dedicated hardware or control logic by leveraging multiple software-implemented scheduling agents working independently on each node and integrating such information agnosticism into node-specific bandwidth allocation by modeling it as a robust optimization problem with flow information on the other nodes represented as uncertain parameters. Subsequently, we validate the performance robustness of Slark by investigating how perturbations in the optimal objective function value and the associated optimal solution are affected by uncertain parameters. Finally, we propose a firebug-swarm-optimization-based heuristic algorithm to tackle the non-convexity in our problem. Experimental results demonstrate that Slark can significantly enhance transmission revenue and increase soft and hard deadline guarantee ratios by 10.52% and 7.99% on average.

Federated Learning (FL) has emerged as a key enabler of privacy-preserving distributed model training in edge computing environments, crucial for service-oriented applications such as personalized healthcare, smart cities, and intelligent assistants. However, existing privacy-preserving FL methods are susceptible to multiple privacy leakage attacks (MPLA), where adversaries infer sensitive information through repeated gradient updates. This paper proposes a Robust and Communication-Efficient Federated Learning (RCFL) framework designed to enhance privacy protection and communication efficiency in edge-based service environments. RCFL integrates a global privacy-preserving mechanism with an innovative privacy encoding strategy that minimizes privacy risks over multiple data releases while significantly reducing communication overhead. The proposed framework's theoretical analysis demonstrates its ability to maintain differential privacy across numerous interactions, ensuring robust model convergence and efficiency. Experimental results using MNIST and CIFAR-10 datasets reveal that RCFL can lower the MPLA success rate from 88.56% to 42.57% compared to state-of-the-art methods, while reducing communication costs by over 90%. These findings underscore RCFL's potential to enhance security, efficiency, and scalability in service-oriented edge computing applications.

Rowhammer has drawn much attention from both academia and industry in the past years as rowhammer exploitation poses severe consequences to system security. Since the first comprehensive study of rowhammer in 2014, a number of rowhammer attacks have been demonstrated against dynamic random access memory (DRAM)-based commodity systems to break software confidentiality, integrity and availability. Accordingly, numerous software defenses have been proposed to mitigate rowhammer attacks on commodity systems of either legacy (e.g., DDR3) or recent DRAM (e.g., DDR4). Besides, multiple hardware defenses (e.g., Target Row Refresh) from the industry have been deployed into recent DRAM to eliminate rowhammer, which we categorize as production defenses.

Decentralized finance has experienced phenomenal growth, revolutionizing the landscape of financial transactions and asset management via blockchain. Yet, this swift growth brings with it substantial challenges, notably the surge in scam tokens, imposing significant security threats on cryptocurrency investments and trading. Existing detection methods of scam token, primarily relying on analyzing contract codes or transaction patterns, struggle to catch increasingly sophisticated tactics employed by scammers. For example, contract-based analysis are unable to identify scams lacking overt malicious code, e.g., most rugpulls, while transaction-based methods generally lack the foresight to early-detect potential risks.

A backdoor attack in deep learning inserts a hidden backdoor in the model to trigger malicious behavior upon specific input patterns. Existing detection approaches assume a metric space (for either the original inputs or their latent representations) in which normal samples and malicious samples are separable. We show that this assumption has a severe limitation by introducing a novel SSDT (Source-Specific and Dynamic-Triggers) backdoor, which obscures the difference between normal samples and malicious samples.To overcome this limitation, we move beyond looking for a perfect metric space that would work for different deep-learning models, and instead resort to more robust topological constructs. We propose TED (Topological Evolution Dynamics) as a model-agnostic basis for robust backdoor detection. The main idea of TED is to view a deep-learning model as a dynamical system that evolves inputs to outputs. In such a dynamical system, a benign input follows a natural evolution trajectory similar to other benign inputs. In contrast, a malicious sample displays a distinct trajectory, since it starts close to benign samples but eventually shifts towards the neighborhood of attacker-specified target samples to activate the backdoor.Extensive evaluations are conducted on vision and natural language datasets across different network architectures. The results demonstrate that TED not only achieves a high detection rate, but also significantly outperforms existing state-of-the-art detection approaches, particularly in addressing the sophisticated SSDT attack. The code to reproduce the results is made public on GitHub.

In recent years, the utilization of Ethereum has significantly increased, positioning it as a favored platform among criminal entities. A recently proposed blacklisting method offers a compelling approach; however, its implementation faces numerous challenges. For instance, criminals may circumvent the blacklisting mechanism by creating new addresses and there are several ambiguities in their explanation. This paper explores the increasing use of Ethereum for criminal activities, focusing on the challenges of enforcing blacklisting to curb illegal transactions. We analyse blacklisting within cryptocurrency networks, particularly Ethereum, and develop features to detect illegal patterns. The study identifies unique issues in transaction networks that require specialised solutions beyond general cryptocurrency techniques. We propose a detection model based on these features and validate its effectiveness using real Ethereum datasets. The paper also reviews regulatory guidelines, highlighting ambiguities in their interpretation. Experiments on real-world data underscore the need to integrate technical methods and consider Shapley-value-based frameworks in designing effective solutions. The novelty of the method lies in its development of a feature-based detection model, leveraging Shapley-value frameworks to enhance explanation, address Ethereum’s unique challenges, and empirically validate its effectiveness using real Ethereum data, offering a more robust solution than traditional blacklisting approaches.

Since the outbreak of the coronavirus 2019 (COVID-19) pandemic, telehealth services are regarded as a good approach to keep health workers and patients safe while simultaneously managing available resources.In this paper, we discuss the impact that COVID-19 has on telehealth services and on telehealth users' opinion of the service.We collected 245 Android telehealth apps, 144 iOS telehealth apps and 86 telehealth websites, and performed a systematic analysis on this dataset.In this analysis, we conducted a comparison analysis and relevant content analysis of the telehealth apps as well as their security risks.Apart from the mobile platforms, we also inspected the telehealth websites' features, particularly those related to the use of metaverse to improve current telehealth solutions.To further understand people's attitude towards telehealth services, we invited users to participate in a user study aimed at revealing what impact COVID-19 has on users' willingness to adopt telehealth services and revealing the gap between the telehealth service and its users.Our result shows that 27.1% new iOS apps and 27.4% new Android apps were released after the COVID-19 announcement, and a surge of updates were noted within 4 weeks after the COVID-19 announcement.We further found that COVID-19 is frequently mentioned in telehealth app reviews in the second and third quarter of 2020, and the most mentioned aspects related to COVID-19 include family, test result and vaccine.According to our user study, COVID-19 has a significant impact on the selection of telehealth services, especially for female participants, people aged 46-55, and students.The investigation also finds out that the use of metaverse will significantly improves the effectiveness of traditional telehealth solutions.

A smart contract is a computerised transaction agreement that carries out predefined terms without human involvement or third-party intermediaries. It serves as a trust intermediary in several industries, including finance, insurance, and supply chain management, in the blockchain 2.0 era. With the increasing interest in smart contracts, security has become a serious problem. Examining typical vulnerability types and vulnerability detection methodologies is of special importance. In this research, a comprehensive evaluation of common smart contract security vulnerabilities is conducted, and a three-tier threat model is then provided to classify the vulnerabilities. In addition, we examine fourteen existing smart contract analysis tools for finding vulnerabilities and classify them according to the main technique they apply. This article is designed to serve as a reference for people who wish to analyse deployed code and enhance existing detection techniques. At the conclusion, open issues and future research paths regarding smart contract vulnerability detection are presented.

Inferring the home locations of online social network (OSN) users from their corresponding account data is an important process for many applications, such as personal privacy protection and business advertising applications. The existing methods typically use a supervised learning method to infer a user's home location according to a single or partial aspect of their OSN information. However, the home location of a user may be represented in a biased way if only a single or partial aspect of the information is used, and the performances of the supervised learning-based methods are also very sensitive to the quality of the training set utilized. To address these problems, this article presents a novel unsupervised method for inferring the home locations of the OSN users. The method first builds a heterogeneous network model to comprehensively represent the complex location information in the OSN data and then recursively infers users’ home locations by fusing the direct and indirect location information of the users. Experiments that compared our method with five existing typical Twitter user home location inference methods on a Twitter dataset demonstrate that the proposed method can significantly improve the accuracy and reliability of user home location inference.

AI-powered programming language generation (PLG) models have gained increasing attention due to their ability to generate source code of programs in a few seconds with a plain program description. Despite their remarkable performance, many concerns are raised over the potential risks of their development and deployment, such as legal issues of copyright infringement induced by training usage of licensed code, and malicious consequences due to the unregulated use of these models. In this paper, we present the first-of-its-kind study to systematically investigate the accountability of PLG models from the perspectives of both model development and deployment. In particular, we develop a holistic framework not only to audit the training data usage of PLG models, but also to identify neural code generated by PLG models as well as determine its attribution to a source model. To this end, we propose using membership inference to audit whether a code snippet used is in the PLG model's training data. In addition, we propose a learning-based method to distinguish between human-written code and neural code. In neural code attribution, through both empirical and theoretical analysis, we show that it is impossible to reliably attribute the generation of one code snippet to one model. We then propose two feasible alternative methods: one is to attribute one neural code snippet to one of the candidate PLG models, and the other is to verify whether a set of neural code snippets can be attributed to a given PLG model. The proposed framework thoroughly examines the accountability of PLG models which are verified by extensive experiments. The implementations of our proposed framework are also encapsulated into a new artifact, named CODEFORENSIC, to foster further research.

The privacy of social media users is a major concern when the users share their content to the public. Sensitive information such as the location of the users can be inferred from relevant content without arising the awareness of the users. With blooming services provided by social media platforms, the users have more freedom to share information via diverse data formats. The multi-modality of the shared information may, in return, worsen the private information leakage caused by inference attacks. In this paper, we first examine the problem of location inference on multi-modal data comprised of textual information and visual content. It is observed that the visual content, such as photos shared by social media users, can significantly boost the success rate of location inference. To thwart adversaries who are driven by visual-related data, we propose a defence that mitigates the threat of location privacy breach under an imperceptible utility loss. Our defence, namely LocGuard, perturbs the photos in a one-off manner before sharing them. The perturbations, along with a simple but effective bipartite perturbation strategy, ensure that LocGuard is resistant to adaptive adversaries who can perform adversarial training based on the perturbed photos. Moreover, LocGuard remains effective against open-set adversaries whose data categories in the training dataset are hidden from the defender. In the evaluation, we conduct extensive experiments based on real-world datasets and compare our work with previous methods. The results show that LocGuard significantly outperforms the existing defences. In particular, LocGuard not only achieves better privacy protection and utility preservation for image sharing, but also can effectively defend against adversarial-training-capable attackers.

Proofs of Retrievability (PoRs) and Provable Data Possession (PDP) are efficient cryptographic solutions to monitoring the state of storage, enabling integrity verification without the necessity of retrieving data. However, such protocols fail to guarantee data availability, since it is too late for cloud clients to recover the corrupted data when notified. To remedy it, these protocols are extended to verify integrity of both the stored data and their redundant copies in the multi-replica environment. Most of the existing multi-replica PDP protocols not only consume considerable computation and bandwidth resources of clients to generate and upload replicas, but also lead economic losses to service providers due to abused replica discounts. Though the other few considered these problems and proposed some countermeasures, they imposed the linear cost of generating and uploading copy parameters on clients in replication algorithms and fail to realize public verifiability. In this paper, we propose a public proofs of data replication and retrievability protocol with user-friendly replication for the first time. One distinguishable property is the simultaneous achievement of user-friendly replication and public verifiability. Specifically, we design a novel replication algorithm, which imposes nearly no computation and a constant-size communication cost on clients. Subsequently, we employ non-interactive succinct proofs to make the verification public. Furthermore, we present a comprehensive analysis and extensive experiments to demonstrate the security and efficiency of the proposed protocol.

It is important to understand the evolution of Android malware as this facilitates the development of defence techniques by proactively capturing malware features. So far, researchers mainly rely on dendrogram or family-tree analysis for malware's evolutionary development. However, our research finds that these techniques cannot support comprehensive malware evolution modelling, which provides a detailed explanation for why Android malware samples evolve in specific ways. This shortcoming is mainly caused by the coarse-grained clustering and analysis of malware samples. For example, because these works do not divide malware samples of a family into variant sets and explore the evolution principles among those sets, they usually fail to capture new variants that have been empowered by the feature ‘drifting’ in evolution. To address this problem, we propose a fine-grained and in-depth analysis of Android malware. Our experimental work systematically reveals the phylogenetic relationships among the variant sets for a deeper malware evolution analysis. We introduce five metrics: silhouette coefficient, creation date, variant labels, the presentativeness of the variant set formula, and the correctness of the linked edges to evaluate the correctness of our analysis. The results show that our variant clustering achieved a high silhouette value at a small sample distance (0.3), a small standard deviation (three months and 16 days) date based on when the malware samples are lastly modified, a high label consistency (91.4%), a high representativeness (93.1%) of the variant set formula. All the linked variant sets are connected based on our PhyloNet construction rules. We further analyse the coding details of Android malware for each variant set and summarise models of their evolutionary development. In this work, we successfully expose two major models of malware evolution:active evolutionandpassive evolution. We also disclose four technical explanations on the incentives of the two evolution models (two for each model respectively). These findings are valuable for proactive defence against newly emerged malware samples.

In recent years, DeepFake technologies have seen widespread adoption in various domains, including entertainment and film production. However, they have also been maliciously employed for disseminating false information and engaging in video fraud. Existing detection methods often experience significant performance degradation when confronted with unknown forgeries or exhibit limitations when dealing with low-quality images. To address this challenge, we introduceDiff-ID, a novel approach designed to elucidate and quantify the identity loss induced by facial manipulations. When assessing the authenticity of an image,Diff-IDleverages a genuine image of the same individual as a reference and processes two images jointly. It aligns the reference image and the test image into the same identity-insensitive attribute feature space using a face-swapping generator. This alignment allows us to observe the identity disparities between the two images through the differences in the aligned generation pairs. Subsequently, we have developed a custom metric designed to quantify the identity loss relative to the reference image in the test image. This metric effectively distinguishes forgery images from the real ones. Extensive experiments have demonstrated the exceptional performance of our approach. It achieves a high level of detection accuracy on DeepFake images and showcases state-of-the-art generalization capabilities when confronted with previously unknown forgery methods. Moreover, it exhibits robustness even in the presence of image distortions.

Transfer learning, successful in knowledge translation across related tasks, faces a substantial privacy threat from membership inference attacks (MIAs). These attacks, despite posing significant risk to ML model’s training data, remain limited-explored in transfer learning. The interaction between teacher and student models in transfer learning has not been thoroughly explored in MIAs, potentially resulting in an under-examined aspect of privacy vulnerabilities within transfer learning. In this paper, we propose a new MIA vector against transfer learning, to determine whether a specific data point was used to train the teacher model while only accessing the student model in a white-box setting. Our method delves into the intricate relationship between teacher and student models, analyzing the discrepancies in hidden layer representations between the student model and its shadow counterpart. These identified differences are then adeptly utilized to refine the shadow model’s training process and to inform membership inference decisions effectively. Our method, evaluated across four datasets in diverse transfer learning tasks, reveals that even when an attacker only has access to the student model, the teacher model’s training data remains susceptible to MIAs. We believe our work unveils the unexplored risk of membership inference in transfer learning.

Google suggests using only the APIs documented in Android SDK. However, many app developers still choose Java Native Interface (JNI) to access system libraries because of the flexibility and freedom that non-SDK methods provide in implementing complex functions. However, using JNI may have unexpected consequences, including low-level bug-driven crashes. The bugs in system libraries can propagate to Android apps, and further cost much time and energy for developers to debug them. We develop a fuzzing tool, called JDYNUZZ, that exposes the bugs in system JNI to mitigate the aftermath of direct invocation of JNI. To fuzz a system library, one needs to not only prepare appropriate inputs, but also deal with the challenge of maintaining a correct sequence of API calls, both syntactically and semantically. To solve the challenge, the crux of JDYNUZZ is the dynamic refinement of a data dependency graph, which gradually resolves the problem of syntactic and semantic incorrectness when constructing API sequences. JDYNUZZ achieves the dynamic refinement based on the feature of Java reflection, which enables us to dynamically modify API sequences and test different code regions. We evaluate JDYNUZZ on the most recent version of Android Open Source Project (AOSP),i.e., version android-12.0.0 r31. In our experiments, JDYNUZZ discovers 34 new bugs in system JNI libraries, all confirmed by Google.

The widespread application of Internet of Things technology in the medical field results in the generation of a large amount of healthcare data. Adequately learning valuable knowledge from the massive healthcare data brings a huge potential for improving the efficiency, quality, and safety of healthcare services. Online learning over the cloud offers decent training and fast inference services. However, outsourcing healthcare data learning to the cloud might cause patient privacy disclosure and data integrity and authenticity compromises. These security threats further affect the accuracy of the trained model or distort the inference results. Although researchers have tried to solve the privacy-preserving or data integrity issues with different techniques, none of them satisfy the security demands in online training of healthcare data. In this paper, we present an efficient redactable group signature scheme (RGSS) for the online learning healthcare system. The security analysis shows that our construction not only prevents privacy compromise but also provides integrity and authenticity verification. In addition to the private property of RGSS, the signer-anonymous also enhances patient privacy-preserving. Compared with other solutions, our RGSS is secure and efficient in promoting scientific research on learning large amounts of healthcare data that aim to improve healthcare services.

Recently, unobservable physiological signals have received widespread attention from researchers as unique identifiers of users in biometrics. However, due to the lack of data sets, existing methods are limited in evaluating cross-session scenarios. Cross-session means that signals are collected at different sessions (times). In real scenarios, authentication is almost always cross-session. Currently, the datasets commonly used for Photoplethysmogram (PPG) signal authentication span around one month, which is insufficient for authentication. On the other hand, different demographic groups have different hemodynamic characteristics, but existing methods lack an assessment of these aspects. This paper introduces a dataset to provide insights into PPG signal-based authentication across different time spans and user groups (age, gender). As physiological signals offer unique advantages for user authentication, the potential of PPG signals is gradually explored. Furthermore, our comparative analysis of recent publications on data-driven user authentication using PPG can further identify the similarities and differences among the performance of the proposed authentication models. Our findings may help future research towards a consensus on an appropriate set of performance metrics.

Consumer-grade virtual reality head-mounted displays (VR-HMD) are becoming increasingly popular. Despite VR’s convenience and booming applications, VR-based authentication schemes are underdeveloped. The recently proposed authentication methods (Electrooculogram based, Electrical Muscle Stimulation-based, and alike) require active user involvement, disturbing many scenarios like drone flight and telemedicine. This paper proposes an effective and efficient user authentication method in VR environments resilient to impersonation attacks using physiological signals — Photoplethysmogram (PPG), namely SigA. SigA exploits the advantage that PPG is a physiological signal invisible to the naked eye. Using VR-HMDs to cover the eye area completely, SigA reduces the risk of signal leakage during PPG acquisition. We conducted a comprehensive analysis of SigA’s feasibility on five publicly available datasets, nine different pre-trained models, three facial regions, various lengths of the video clips required for training, four different signal time intervals, and continuous authentication with different sliding window sizes. The results demonstrate that SigA achieves more than 95% of the average F1-score in a one-second signal to accommodate a complete cardiac cycle for most adults, implying its applicability in real-world scenarios. Furthermore, experiments have shown that SigA is resistant to zero-effort attacks, statistical attacks, impersonation attacks (with a detection accuracy of over 95%) and session hijacking attacks.

Businesses face a range of cyber risks, both external threats and internal vulnerabilities that continue to evolve over time. As cyber attacks continue to increase in complexity and sophistication, more organisations will experience them. For this reason, it is important that organisations seek timely consultancy from cyber professionals so that they can respond to and recover from cyber attacks as quickly as possible. However, huge surges in cyber attacks have long left cyber professionals short of what is required to cover the security needs. This problem is getting worse when an increasing number of people choose to work from home during the pandemic because this situation usually yields extra communication cost.

The fast online classification (FOC) of network traffic plays a critical role in the network resource management and quality of service support. However, traditional network flow features result in poor performance in FOC (with fewer packets). To tackle the issue, this study proposes two new features: (1) The conditional frequency of packet size (PSize), for which the PSize is quantized into several equal bins and the PSize-level conditional frequency of two consecutive packets is calculated; (2) The statistical feature of rate sequence that is obtained by dividing the inter-arrival time into the PSize sequences. Due to the real-time requirement of online classification, we analyze the time complexity of flow feature calculation and attempt to balance the classification speed and the accuracy in feature selection by reducing the feature dimensionality. In addition, a new feature-embedded hierarchical classification structure is developed for the scenario in which the network video traffic accounts for a relatively large proportion. Fewer packets are used in the early stage of binary classification of non-video vs. video, and then, the subsequent data packets are employed for the fine-grained classification of their respective flows. The effectiveness of the proposed method is evaluated on two real-world network datasets, and our method is compared with the state-of-the-art methods in terms of time performance, resource usage, and classification accuracy . The experimental results confirm the superiority of our approach in fast online classification.

Biometric authentication prospered because of its convenient use and security. Early generations of biometric mechanisms suffer from spoofing attacks. Recently, unobservable physiological signals (e.g., Electroencephalogram, Photoplethysmogram, Electrocardiogram) as biometrics offer a potential remedy to this problem. In particular, Photoplethysmogram (PPG) measures the change in blood flow of the human body by an optical method. Clinically, researchers commonly use PPG signals to obtain patients' blood oxygen saturation, heart rate, and other information to assist in diagnosing heart-related diseases. Since PPG signals contain a wealth of individual cardiac information, researchers have begun to explore their potential in cyber security applications. The unique advantages (simple acquisition, difficult to steal, and live detection) of the PPG signal allow it to improve the security and usability of the authentication in various aspects. However, the research on PPG-based authentication is still in its infancy. The lack of systematization hinders new research in this field. We conduct a comprehensive study of PPG-based authentication and discuss these applications' limitations before pointing out future research directions.

NEO is one of the top public chains worldwide. It adopts a new consensus algorithm calleddelegated Byzantine Fault Tolerance(dBFT). In this article, we formalize dBFT via the state machine replication model and point out its potential issues. Our theoretical analysis indicates that dBFT could guarantee neitherlivenessnorsafety, even if the number of Byzantine nodes is no more than the threshold, which has contradicted the established security claim. Then, we identify two attacks and successfully simulate them. Finally, we provide recommendations. Notably, NEO official team has accepted our suggested fixes.

Garg et al. (TCC 2018) defined the notion of registration-based encryption (RBE) where the private key generator (PKG) is decoupled from key management and replaced by a key curator (KC). KC does not possess any cryptographic secrets and only plays the role of aggregating the public keys of all the registered users and updating the public parameters whenever a new user joins the system, which solves the key escrow issue. Notwithstanding, RBE still places a significant amount of trust in KC, whose actions are not accountable, e.g., it could secretly register multiple keys for already registered users. In this article, we propose a blockchain-based RBE framework, which provides total transparency and decentralization of KC by leveraging smart contracts. Our framework transfers the right of key management from KC to individual participants and keeps publicly upgradable parameters on-chain. We provide a basic construction that calculates the public parameter on-chain and an extended construction with better efficiency, which merely calculates the roots of trees on-chain. Our basic version is theoretically feasible, while the extended version is practically feasible. In particular, the enhanced scheme reduces computing complexity to a constant level. Our prototype implementation and evaluation results demonstrate that our extended construction is satisfactorily efficient.

The cooperative works between connected smart devices in the Industrial Internet of Things (IIoT) have greatly made the growth in productivity and economics for the conventional industry. However, due to the introduction of the communication network, the budding IIoT also confronts the unprecedented cyber threats. To prevent the data from being intercepted by malicious intruders, we propose an efficient and fully secure data sharing work with a short revocation list (DS-SRL) for IIoT. The DS-SRL not only enables flexible access control to the massive data in IIoT but also provides a direct revocation approach for handling the potential issues of key disclosure and membership expiring in application scenarios. Particularly, compared with existing directly revocable ABE works, the revocation list in the DS-SRL scheme will keep constant size even with the increasing number of users. Thus, the consumption for computing and disseminating the revoke-related part of ciphertext are low. This resource-saving merit makes our DS-SRL scheme suitable for IIoT where the smart devices are weak in the ability of both processing and storage. The DS-SRL works without boundary such that the public parameters involved in the system require no predefinitions and can be dynamically adjusted after deployment. Furthermore, the proposed DS-SRL work is demonstrated to be fully secure under the decisional linear assumption. Hence, it owns high flexibility, scalability, and security, which are essential and desirable in real-life applications. Finally, the superior feasibility, efficiency, as well as effectiveness of our DS-SRL work are fairly confirmed by the detailed performance evaluation.

The weaknesses of Internet of Things (IoT) devices leads to vulnerabilities easily, which can be exploited by criminals to launch Distributed Denial-of-Service (DDoS) attacks, becoming a major security hazard. Nowadays, the rapid development of the IoT makes the IoT-based DDoS attacks have the characteristics of wide distribution, large scale, and more stealthy that brings greater challenges for the DDoS detection. In this article, we conduct our research based on the edge side of IoT for providing earlier detection capability and more efficient resource utilization. We propose a novel reinforcement learning-based collaborative DDoS detection method and design a lightweight unsupervised classifier based on statistics. We deploy the classifiers in IoT edge gateways to detect anomalies by analyzing network traffic features in time. In order to deal with the dynamic changes of the IoT environment, we use the soft actor–critic (SAC) reinforcement learning model deployed on the edge server to adjust the parameter configuration of the underlying unsupervised classifier dynamically, which can ensure excellent detection effect for different types of IoT devices. In addition, a collaborative aggregation module is designed in the edge server to share the observation state and historical experience, which has a unique collaborative reward mechanism for the reinforcement learning model to fully mobilize the collaborative work capability. The experiments on public data set and constructed real-world testbed demonstrate that our proposed method has excellent detection performance and especially it can also discover stealthy IoT-based DDoS attacks accurately.

Due to advancements in semiconductor technologies, Internet of Things (IoT) applications have penetrated into a wide spectrum of aspects of human lives. This widespread penetration is also thanks to significant contributions from many emerging technologies, e.g., artificial intelligence (AI) and blockchain[1],[2]. The fast development of AI technologies like deep learning is a promising approach for extracting accurate information from massive raw sensor data in IoT applications[3]. In addition, due to its tamper-proof characteristic and distributed nature, blockchain has received increasing attentions in emerging IoT applications to tackle security and privacy issues[4],[5]. AI and blockchain have become killer technologies to advance the fast development of IoT ecosystems with incredible growth, impact, and potential.

The proliferation of various items recommended by Internet-based systems has resulted in the exponential growth of the number of ratings in the big data era. Recent advances in matrix factorization have made it an effective way to process these ratings for recommendations. However, we confront a challenge in deploying a matrix factorization model for recommendations in big data that arises from the typically resource-constrained local devices regarding their storage space and computing capacity. This paper proposes a novel lightweight matrix factorization for recommendations. Our scheme deploys shard grandients training on user local internet of things(IoT) devices, which makes it possible for users to train big data model locally. We design a two-phase solution to protect the security of users’ data and reduce the dimension of the items. Moreover, we optimize the proposed scheme by introducing a stabilization mechanism to decrease the scale of the perturbed gradients. Some experimental results are given with two real online datasets, MovieLens and LibimSeTi. The theoretical analysis and experimental results demonstrate that compared with other methods, the proposed scheme achieves a good performance in terms of security, accuracy, and efficiency.

Recent advancements in the Internet of Things (IoT) and cloud computing technologies have accelerated the development of various practical applications, including healthcare systems. Adequately revealing the collected healthcare data in a cloud-assisted healthcare IoT system brings a huge potential for improving the safety, quality, and efficiency of healthcare services. However, often the data collected in a healthcare IoT system is vital and sensitive. The dissemination of such data is also vulnerable to malicious attacks such as tampering, eavesdropping, and forgery. Thus, disseminated data's integrity, authenticity, and privacy are elementary security demands to end-users and owners. Also, the resource-constrained nature of healthcare IoT devices invalidates the existing solutions. To address the above challenges, we propose a lightweight and secure redactable signature scheme with coarse-grained additional redaction control (CRS) for secure dissemination of healthcare data in a cloud-assisted healthcare IoT system. The security analysis indicates our CRS is secure against signature forgery, additional redaction attacks, and redacted version linkability. Compared to other existing solutions, our scheme can achieve some level of security but less computational complexity and communication overhead.

To satisfy the requirement of data portability, current service providers (or resource servers) usually provide OAuth-based schemes for third party applications (or clients) to access user data with the user's consent. To shoulder the costs of maintaining relationships with potential third party applications, a service provider may adopt delegate the task of authentication and authorization to an authorization server. However, current OAuth specification does not specify the interactions between an authorization server and a resource server. To address this limitation, this study proposes the MyDataChain framework to enhance the existing OAuth specification with blockchain technology. The proposed framework utilizes smart contracts to establish the standard interface to support the processes of authorization requesting, granting, and revocation. As blockchain technologies can ensure data integrity, the framework can use the data stored in the blockchain to resolve disputes among different parities. Moreover, as the proposed framework uses the Non-Interactive Zero-Knowledge (NIZK) scheme, the proposed framework can achieve its purpose without storing any personal identifiable or traceable data in the blockchain. Therefore, people cannot utilize information stored in the blockchain to compromise user privacy. Furthermore, this study implements a prototype system using Quorum blockchain technology. The experimental results show that the framework can be realized with existing blockchain technologies. Therefore, this study can provide a feasible privacy preserving means of achieving data portability and providing individuals the rights to be forgotten considering dispute resolution.

The rapid growth of the blockchain size is a major bottleneck hindering its implementations in data-heavy applications. Current efforts improve the distributed storage ways and transactions' storage mechanisms of blockchain, however, the blockchain distribution and integrity are destroyed. Simplified Payment Verification (SPV) is closely related to blockchain storage, but the current solutions did not explore the privacy-preserving SPV. In this paper, we propose a new storage structure for blockchain transactions, called Coloring Index (CI), to reduce the blockchain's space occupation. Specifically, we devise an index building algorithm to simply calculate the indices of transactions for the sake of information concealing. By improving the Coloring Embedder for multi-sets query, we can store the indices into the Coloring Embedder to achieve the structured storage of transactions with small space occupation. Using CI, SPV query proceeds without revealing the user's address, thereby achieving secure data sharing in applications such as the intelligent vehicles' communications and distributed IoT. We prove CI's security against malicious full nodes when establishing possible connections between the address and the user. The experiments show that blockchain systems using our CI store one time more transactions than Merkle tree and half more than Bloom filter.

Evolving Android malware poses a severe security threat to mobile users, and machine-learning (ML)-based defense techniques attract active research. Due to the lack of knowledge, many zero-day families’ malware may remain undetected until the classifier gains specialized knowledge. The most existing ML-based methods will take a long time to learn new malware families in the latest malware family landscape. Existing ML-based Android malware detection and classification methods struggle with the fast evolution of the malware landscape, particularly in terms of the emergence of zero-day malware families and limited representation of single-view features. In this article, a new multiview feature intelligence (MFI) framework is developed to learn the representation of a targeted capability from known malware families for recognizing unknown and evolving malware with the same capability. The new framework performs reverse engineering to extract multiview heterogeneous features, including semantic string features, API call graph features, and smali opcode sequential features. It can learn the representation of a targeted capability from known malware families through a series of processes of feature analysis, selection, aggregation, and encoding, to detect unknown Android malware with shared target capability. We create a new dataset with ground-truth information regarding capability. Many experiments are conducted on the new dataset to evaluate the performance and effectiveness of the new method. The results demonstrate that the new method outperforms three state-of-the-art methods, including: 1) Drebin; 2) MaMaDroid; and 3)$N$-opcode, when detecting unknown Android malware with targeted capabilities.

The amount of cybersecurity-related information is extraordinarily increasing, given the fast-growing number of cybersecurity attacks and the significant influence brought by them. How to efficiently obtain and precisely understand the relevant knowledge in the sea of information on cybersecurity becomes a challenge. In this article, we propose an innovative cybersecurity retrieval scheme that supports automatic indexing and searching of cybersecurity information based on semantic contents and hidden metadata. The proposed scheme leverages a customized neural model that incorporates new linguistic features and word embedding by identifying the entities related to cybersecurity incidents from the text. We implement a novel cybersecurity search engine to demonstrate effective, understandable and pragmatic cybersecurity information retrieval based on the proposed schema. Comprehensive performance evaluation over real-world datasets has been conducted to validate the new algorithms and techniques developed for cybersecurity information retrieval. The new engine makes it possible to conduct augmented search, cybersecurity analytics, and visualization, with the ultimate goal of providing direct and efficient results to help people obtain and truly understand cybersecurity information.

Behaviour analysis is essential for the security verification of suspicious Android applications, but analysts are usually faced with a huge obstacle when conducting the app behaviour analysis. They are expected to have comprehensive knowledge of different IT fields and a strong awareness of cyber threats. However, training a new security analyst typically requires a significant amount of time and can be extremely costly. Although there are tools available to assist analysts in studying Android behaviour and security, the completion of this task still heavily relies on the experience of the analysts. To address this problem, we recognise visualisation as a promising method and conduct a series of controlled experiments to demonstrate its effectiveness in the context of Android app behaviour and security analysis. We accordingly develop a visualisation tool based on apps’ call graphs (CG) (namedVisualDroid) and conduct an experiment and a follow-up interview. Compared to existing solutions, the results suggest that the CG-based visualisation solution (VisualDroid) can lower the barriers to Android behaviour and security analysis. The user study reveals that the platform includes CG-based visualisation components leads to a statistically significant improvement in Android behaviour analysis and security awareness. More specifically, it improvesAPK Analyzer,JD-GUI,JD-GUI+FlowDroidby 71.4%, 35.7%, and 39.2% in terms of the effectiveness of behaviour analysis. Participants who useVisualDroidalso show improvements in the aspect of security awareness with an increase of 155% againstAPK Analyzer, 96% againstJD-GUI, and 59.3%JD-GUI+FlowDroid.

In federated learning (FL), each client collaboratively trains the global model through the cloud server (CS) without sharing its original dataset in edge computing. However, CS can analyze and forge the uploaded parameters and infer the privacy of clients, which calls for the necessity of verifying the integrity and protecting the privacy for aggregation. Although there are some works to ensure the verifiability of aggregation results, there is still a lack of work on analyzing the relationship between verification and dropout rate for edge computing. In this work, we propose privacy-preserving and verifiable federated learning (PVFL) with low communication and computation overhead for verification. We theoretically demonstrate that PVFL has three properties: 1) the communication overhead for verification is independent of the dropouts and the dimension of the parameter vector; 2) the computation overhead for verification is independent of the dropouts; 3) the value of the loss function is negatively correlated with the number of dropouts. Experimental results demonstrate the correctness of our theoretical results and practical performance with a high dropout rate, thereby facilitating the design of privacy-preserving and verifiable FL algorithms for edge computing with a high dimension of parameter vectors and a high dropout rate.

Multi-turn response selection is a key issue in retrieval-based chatbots and has attracted considerable attention in the NLP (Natural Language processing) field. So far, researchers have developed many solutions that can select appropriate responses for multi-turn conversations. However, these works are still suffering from the semantic mismatch problem when responses and context share similar words with different meanings. In this article, we propose a novel chatbot model based on Semantic Awareness Matching, called SAM. SAM can capture both similarity and semantic features in the context by a two-layer matching network. Appropriate responses are selected according to the matching probability made through the aggregation of the two feature types. In the evaluation, we pick 4 widely used datasets and compare SAM’s performance to that of 12 other models. Experiment results show that SAM achieves substantial improvements, with up to 1.5% R 10 @1 on Ubuntu Dialogue Corpus V2, 0.5% R 10 @1 on Douban Conversation Corpus, and 1.3% R 10 @1 on E-commerce Corpus.

In this paper, we propose LBS@E, a new architecture for location-based services (LBSs) facilitated by the mobile edge computing paradigm. LBS@E tackles the location privacy problem innovatively by delocalizing LBSs so that mobile users of LBSs implemented based on LBS@E do not have to reveal their locations. They retrieve local information from nearby edge servers around them instead of the cloud. In this way, we resolve the root cause of the conventional location privacy problem. However, LBS@E raises new challenges to location privacy. A mobile user can still be localized to a particular privacy area co-covered by the edge servers accessed by the mobile user. A small privacy area puts the mobile users location at the risk of being approximated. In the meantime, the size of the utility area, which determines the amount of local information retrievable for the mobile user, is positively correlated with the number of edge servers accessed by the mobile user. We model this problem as a constrained optimization problem and propose an optimal approach for solving it based on integer programming. Extensive experiments are conducted on a widely-used real-world dataset to demonstrate effectiveness and efficiency.

In QoS-aware service selection, merely considering the prediction accuracy of QoS is prone to redundant results, which hinders practical service composition and also undermines user's preference for rich service attributes. To address the problem, a novel diversity-aware graph-based QoS prediction model—DSSN (Diversified Service Selection Network) is proposed in this work. DSSN alleviates selection redundancy through enhancing the selection diversity besides QoS prediction accuracy. To improve the model performance, techniques like high-order message propagation and multi-task structure are integrated into the graph based neural network model. And to enhance the service diversity, a service distance based attention mechanism is designed to embed the users in the model, so that users are connected to services with diverse attributes. We evaluate DSSN on a public dataset via extensive comparison experiments with both diversity-aware and non-diversified service selection models. In the comparison experiments, the DSSN: 1) clearly outperforms the state-of-the-art diversity-aware models in both accuracy and diversity; 2) achieves concrete diversity improvement at the cost of an acceptable decrease in the QoS prediction compared to non-diversified baselines. The results demonstrate that DSSN is more suitable for diversity-aware service selection with ambiguous user requirements than traditional QoS-centric selection scenarios.

Proof of Authority (PoA) is a type of permissioned consensus algorithm with a fixed committee. PoA has been widely adopted by communities and industries due to its better performance and faster finality. In this paper, we explore the unfairness issue existing in the current PoA implementations. We have investigated 2,500+ in the wild projects and selected 10+ as our main focus (covering Ethereum, Binance smart chain, etc.). We have identified two types of order manipulation attacks to separately break the transaction-level (a.k.a. transaction ordering) and the block-level (sealer position ordering) fairness. Both of them merely rely on honest-but-profitable sealer assumption without modifying original settings. We launch these attacks on the forked branches under an isolated environment and carefully evaluate the attacking scope towards different implementations. To date (as of Nov 2021), the potentially affected PoA market cap can reach up to 681,087 million USD. Besides, we further dive into the source code of selected projects, and accordingly, propose our recommendation for the fix. To the best of knowledge, this work provides the first exploration of the unfairness issue in PoA algorithms.

The ubiquity of sensor technology through the Internet of Things and mobile devices has led to a surge in the generation of personal data. The use of personal data to provide personalized services and optimize business decision-making has recently become a popular trend. The data marketplace is one of the most critical places where companies can source data to organize the variety of data source formats and improve individuals’ data self-management (e.g., data access control and usage). This paper proposes a Databox-based delivery service via blockchain that provides data consumers with secure and controlled access to requested data sources of interest. It consists of a databox-based data delivery module and decentralized activities service module. The former is responsible for data delivery and the latter is to provide a one-stop data sharing service on blockchain. We implement a preliminary prototype and conduct an evaluation of system activities and smart contracts utility.

The Android system manages access to sensitive APIs by permission enforcement. An application (app) must declare proper permissions before invoking specific Android APIs. However, there is no official documentation providing the complete list of permission-protected APIs and the corresponding permissions to date. Researchers have spent significant efforts extracting such API protection mapping from the Android API framework, which leverages static code analysis to determine if specific permissions are required before accessing an API. Nevertheless, none of them has attempted to analyze the protection mapping in the native library (i.e., code written in C and C++), an essential component of the Android framework that handles communication with the lower-level hardware, such as cameras and sensors. While the protection mapping can be utilized to detect various security vulnerabilities in Android apps, such as permission over-privilege, imprecise mapping will lead to false results in detecting such security vulnerabilities. To fill this gap, we thereby propose to construct the protection mapping involved in the native libraries of the Android framework to present a complete and accurate specification of Android API protection. We develop a prototype system, named NatiDroid, to facilitate the cross-language static analysis and compare its performance with two state-of-the-practice tools, termed Axplorer and Arcade. We evaluate NatiDroid on more than 11,000 Android apps, including system apps from custom Android ROMs and third-party apps from the Google Play. Our NatiDroid can identify up to 464 new API-permission mappings, in contrast to the worst-case results derived from both Axplorer and Arcade, where approximately 71% apps have at least one false positive in permission over-privilege. We have disclosed all the potential vulnerabilities detected to the stakeholders.

The security of crypto wallets is a major concern in light of the recent prevalence of thefts. Aiming at the problem that there is no complete and reliable security detection model for Android-based crypto wallets, this study provides an evaluation framework based on the standard Android application security detection and unique security assessment of crypto wallets. The framework presents an attack-based detection approach, which identifies potential wallet security issues by simulating attacks and exploiting vulnerabilities. Ten popular Android crypto wallets are evaluated and compared to validate the framework’s practicability and accuracy. The test results demonstrate that the framework can accurately reflect the performance security of wallets. Additionally, the study proposes the corresponding actions to address the identified common security threats in crypto wallets.

Summary Network intrusions are a big security threat to current computer networks. For protection, collaborative intrusion detection networks (CIDNs) are developed attempting to reach better detection performance than a single detector, by allowing a set of detectors to switch data or information with each other. However, there is a need to implement suitable trust management schemes, with the aim to safeguard such distributed detection networks against insider threats. In the literature, previous studies have indicated that the notion of intrusion sensitivity can be used to enhance the effectiveness of trust management, by highlighting the feedback from expert nodes. In addition, machine learning can be used to assign the value of intrusion sensitivity automatically. In this work, we evaluate the performance of typical supervised learning classifiers in allocating the value of intrusion sensitivity, and figure out some limitations under different data sets. Then we investigate the impact of intrusion sensitivity in a real network environment under adversarial conditions. The results demonstrate that a wrongly assigned sensitivity value may greatly degrade the detection effectiveness of insider attacks. There is a significant need to choose a suitable classifier in allocating the value of intrusion sensitivity in practice.

Federated Learning (FL) presents a privacy-compliant approach by sharing model parameters instead of raw data. However, how to motivate data owners to participate in and stay within an FL ecosystem by continuously contributing their data to the FL model remains a challenge. In this article, we propose a hybrid incentive mechanism based on blockchain to address the above challenge. The proposed mechanism comprises two primary smart contract-based modules, namely the reputation module and the reverse auction module. The former is used to dynamically calculate the reputation score of each FL participant. It employs a trust-jointed reputation scheme to balance the weights between trust values of parameters and bid prices. The latter is responsible for initiating FL auction tasks, calculating price rankings, and assigning corresponding token rewards. Experiments are conducted to evaluate the feasibility and performance of the proposed mechanism against the three typical threats. Experimental results indicate that our mechanism can successfully reduce incentive costs while preventing participants from colluding and over-bidding in the data sharing auction.

Machine learning (ML) techniques are increasingly important in cybersecurity, as they can quickly analyse and identify different types of threats from millions of events. In spite of the increasing number of possible applications of ML, successful adoption of ML models in cybersecurity still highly relies on the explainability of those models that are used for making predictions. Explanations that support ML model outputs are crucial in cybersecurity-oriented ML applications because people need to get more information from the model than just binary output for analysis. The explainable models help ML developers solve the “trust” problem for a security application prediction in a faithful way: validating model behaviours, diagnosing misclassifications and sometimes automatically patching errors in the target models. Therefore, explainable ML for cybersecurity has become a necessary and important research branch. In this paper, we present the topic of explainable ML in cybersecurity through two general types of explanations: (1) ante hoc explanation, and (2) post hoc explanation, with their methodologies. We systematically review and categorise the state-of-the-art research, and provide comparative studies to help researchers find the optimal solutions to specific problems. We further list open issues in this field to facilitate future studies. This survey will benefit diverse groups of readers from both academia and industries, who want to effectively use ML to solve cybersecurity challenges.

As one of the most frequently used Internet-of-Things (IoT) devices, energy smart meter has been widely adopted to facilitate the measures of residential energy use. Residents pay for the bills from energy suppliers according to their monthly/seasonal usage. Practically, there is a demand from residents/governments to check whether the bills are in line with their real consumptions. However, it is challenging to realize this demand due to two critical problems. The first problem refers to the nonrepudiated privacy issue caused by access to residents’ energy consumption history (e.g., data integrity may be questioned, and residents’ daily timetables may be exposed). The second problem comes from the efficiency requirement for bulk auditing requests on residents’ bills and consumptions, usually risen by governments. So far, we have not found any solutions that can be directly used in this case. In this article, we propose using homomorphic encryption cooperated with the blockchain technique to leverage the data auditing and privacy-preserving requirements. We also employe a certificateless signature to resolve the efficiency bottleneck in batch auditing. This framework, calledpAuditChain, not only accepts personal requests from residents for consumption checking but also handles bulk auditing requests issued by governments. To validate the correctness of the framework functions, we carried out a series of theoretical analysis, especially on the privacy preserving and auditing processes. To the best of our knowledge, the proposed framework is among the first solutions to improve the security and privacy of bills without losing the auditing function. Our approach concerns with IoT smart meters in energy supply industries and could be further extended to other forms of IoT devices with the bill demands.

Due to the characteristics of wireless network transmission, smart home devices are vulnerable to malicious attacks. Malicious attackers can not only intercept the transmission data of smart home devices to grasp the user’s personal privacy information but also can eavesdrop the transmission between devices to forge the user’s legal information. These attacks have brought great security risks to people’s daily lives. In order to ensure the security of transmitted data, establishing keys for smart home devices is necessary. In this article, an adaptive physical-layer key generation scheme based on received signal strength (RSS) is proposed in Smart Homes. The scheme performs group quantization and adaptive quantization on the collected RSS measurements. The design of group quantization improves the randomness of the generated keys and makes 0 and 1 in generated keys more evenly distributed. The advantage of adaptive quantization is to design adaptive quantization intervals. The smart home devices can select the appropriate quantized reference levels according to the RSS measurements in different scenarios. In order to verify the practicability of the key generation scheme, we analyze the performance of the proposed scheme in static and dynamic scenarios. In addition, this scheme is compared with other key generation schemes from various performance indicators. The comparison results show that our scheme is better than other schemes in terms of randomness.

In the edge computing environment, app vendors can cache their data on a large number of geographically distributed edge servers to serve their users. However, those cached data are particularly vulnerable to both intentional and accidental corruption, which makes data security a major concern in the EC environment. Given limited computing resources of edge servers, how to effectively and efficiently inspect those data over tremendous edge servers is a critical and open problem. To tackle this edge data integrity (EDI) problem, we first study the entities, threats, system objectives, and the inspection mechanism, then propose a novel approach named EDI-S for inspecting the integrity of edge data and localizing the corrupted ones. Based on the elliptic curve cryptography, EDI-S generates one digital signature as the integrity proof for each replica. Then, multiple integrity proofs can be inspected altogether via an aggregate verification. This allows the integrity of tremendous cache data on multiple edge servers can be inspected more efficiently. EDI-S also provides two methods for localizing the corrupted data on edge servers, one for small-scale scenarios and the other for large-scale scenarios. Both theoretical analysis and experimentally evaluation demonstrate that EDI-S can solve the EDI problem effectively and efficiently.

This article demonstrates that nonmaximum suppression (NMS), which is commonly used in object detection (OD) tasks to filter redundant detection results, is no longer secure. Considering that NMS has been an integral part of OD systems, thwarting the functionality of NMS can result in unexpected or even lethal consequences for such systems. In this article, an adversarial example attack that triggers malfunctioning of NMS in OD models is proposed. The attack, namely, Daedalus, compresses the dimensions of detection boxes to evade NMS. As a result, the final detection output contains extremely dense false positives. This can be fatal for many OD applications, such as autonomous vehicles and surveillance systems. The attack can be generalized to different OD models, such that the attack cripples various OD applications. Furthermore, a way of crafting robust adversarial examples is developed by using an ensemble of popular detection models as the substitutes. Considering the pervasive nature of model reuse in real-world OD scenarios, Daedalus examples crafted based on an ensemble of substitutes can launch attacks without knowing the parameters of the victim models. The experimental results demonstrate that the attack effectively stops NMS from filtering redundant bounding boxes. As the evaluation results suggest, Daedalus increases the false positive rate in detection results to 99.9% and reduces the mean average precision scores to 0, while maintaining a low cost of distortion on the original inputs. It also demonstrates that the attack can be practically launched against real-world OD systems via printed posters.

Edge computing (EC) is an emerging paradigm that extends cloud computing by pushing computing resources onto edge servers that are attached to base stations or access points at the edge of the cloud in close proximity with end-users. Due to edge servers’ geographic distribution, the EC paradigm is challenged by many new security threats, including the notorious distributed Denial-of-Service (DDoS) attack. In the EC environment, edge servers usually have constrained processing capacities due to their limited sizes. Thus, they are particularly vulnerable to DDoS attacks. DDoS attacks in the EC environment render existing DDoS mitigation approaches obsolete with its new characteristics. In this article, we make the first attempt to tackle the edge DDoS mitigation (EDM) problem. We model it as a constraint optimization problem and prove its$\mathcal {NP}$-hardness. To solve this problem, we propose an optimal approach named EDMOpti and a novel game-theoretical approach named EDMGame for mitigating edge DDoS attacks. EDMGame formulates the EDM problem as a potential EDM Game that admits a Nash equilibrium and employs a decentralized algorithm to find the Nash equilibrium as the solution to the EDM problem. Through theoretical analysis and experimental evaluation, we demonstrate that our approaches can solve the EDM problem effectively and efficiently.

Audit log contains the trace of different activities in computing systems, which makes it critical for security management, censorship, and forensics. However, experienced attackers may delete or modify the audit log after their attacks, which makes the audit log unavailable in attack investigation. In this article, we focus on the log integrity audit in the same domain, in which a number of servers update audit logs for a single or several organizations as an alliance. We propose a distributed efficient log integrity audit framework, called DELIA, which employs the distributed ledger technique to protect audit information, and utilizes the idea of state channel to improve the throughput of distributed ledger. To generate stable state from the rapidly-updated logs in the domain, we propose a log state generation scheme, which not only generates state suitable for audit logs, but also enables mutual supervision within the domain. To overcome the high latency in existing state channel schemes, we propose a hierarchal multi-party state channel scheme, which makes the latency in our framework independent of the number of servers in the domain. We implement DELIA on Ethereum and evaluate its performance. The results show that our framework is efficient and secure in practice.

Machine learning (ML) has been widely used for malware detection on different operating systems, including Android. To keep up with malware's evolution, the detection models usually need to be retrained periodically (e.g., every month) based on the data collected in the wild. However, this leads to poisoning attacks, specifically backdoor attacks, which subvert the learning process and create evasion ‘tunnels’ for manipulated malware samples. To date, we have not found any prior research that explored this critical problem in Android malware detectors. Although there are already some similar works in the image classification field, most of those similar ideas cannot be borrowed to solve this problem, because the assumption that the attacker has full control of the training data collection or labelling process is not realistic in real-world malware detection scenarios. In this article, we are motivated to study the backdoor attack against Android malware detectors. The backdoor is created and injected into the model stealthily without access to the training data and activated when an app with the trigger is presented. We demonstrate the proposed attack on four typical malware detectors that have been widely discussed in academia. Our evaluation shows that the proposed backdoor attack achieves up to 99 percent evasion rate over 750 malware samples. Moreover, the above successful attack is realised by a small size of triggers (only four features) and a very low data poisoning rate (0.3 percent).

A major cause of security incidents such as cyber attacks is rooted in software vulnerabilities. These vulnerabilities should ideally be found and fixed before the code gets deployed. Machine learning-based approaches achieve state-of-the-art performance in capturing vulnerabilities. These methods are predominantly supervised. Their prediction models are trained on a set of ground truth data where the training data and test data are assumed to be drawn from the same probability distribution. However, in practice, the test data often differs from the training data in terms of distribution because they are from different projects or they differ in the types of vulnerability. In this article, we present a new system forCrossDomain SoftwareVulnerabilityDiscovery (CD-VulD) using deep learning (DL) and domain adaptation (DA). We employ DL because it has the capacity of automatically constructing high-level abstract feature representations of programs, which are likely of more cross-domain useful than the handcrafted features driven by domain knowledge. The divergence between distributions is reduced by learning cross-domain representations. First, given software program representations, CD-VulD converts them into token sequences and learns the token embeddings for generalization across tokens. Next, CD-VulD employs a deep feature model to build abstract high-level presentations based on those sequences. Then, the metric transfer learning framework (MTLF) technique is employed to learn cross-domain representations by minimizing the distribution divergence between the source domain and the target domain. Finally, the cross-domain representations are used to build a classifier for vulnerability detection. Experimental results show that CD-VulD outperforms the state-of-the-art vulnerability detection approaches by a wide margin. We make the new datasets publicly available so that our work is replicable and can be further improved.

The rapid development of low-power integrated circuits, wireless communication, intelligent sensors, and microelectronics has allowed the realization of wireless body area networks (WBANs), which can monitor patients’ vital body parameters remotely in real time to offer timely treatment. These vital body parameters are related to patients’ life and health; and these highly private data are subject to many security threats. To guarantee privacy, many secure communication protocols have been proposed. However, most of these protocols have a one-to-one structure in extra-body communication and cannot support multidisciplinary team (MDT). Hence, we propose a lightweight and certificateless multi-receiver secure data transmission protocol for WBANs to support MDT treatment in this article. In particular, a novel multi-receiver certificateless generalized signcryption (MR-CLGSC) scheme is proposed that can adaptively use only one algorithm to implement one of three cryptographic primitives: signature, encryption or signcryption. Then, a multi-receiver secure data transmission protocol based on the MR-CLGSC scheme with many security properties, such as data integrity and confidentiality, non-repudiation, anonymity, forward and backward secrecy, unlinkability and data freshness, is designed. Both security analysis and performance analysis show that the proposed protocol for WBANs is secure, efficient, and highly practical.

Deep neural networks (DNNs) are known to be vulnerable to adversarial examples which contain human-imperceptible perturbations. A series of defending methods, either proactive defence or reactive defence, have been proposed in the recent years. However, most of the methods can only handle specific attacks. For example, proactive defending methods are invalid against grey-box or white-box attacks, while reactive defending methods are challenged by low-distortion adversarial examples or transferring adversarial examples. This becomes a critical problem since a defender usually does not have the type of attack asa prioriknowledge. Moreover, existing two-pronged defences (e.g., MagNet), which take advantage of both proactive and reactive methods, have been reported as broken under transferring attacks. To address this problem, this article proposed a novel defensive framework based on collaborative multi-task training, aiming at providing defence for different types of attacks. The proposed defence first encodes training labels into label pairs and counters black-box attacks leveraging adversarial training supervised by the encoded label pairs. The defence further constructs a detector to identify and reject high-confidence adversarial examples that bypass the black-box defence. In addition, the proposed collaborative architecture can prevent adversaries from finding valid adversarial examples when the defence strategy is exposed. In the experiments, we evaluated our defence against four state-of-the-art attacks on$MNIST$and$CIFAR10$datasets. The results showed that our defending method achieved up to 96.3 percent classification accuracy on black-box adversarial examples, and detected up to 98.7 percent of the high confidence adversarial examples. It only decreased the model accuracy on benign example classification by 2.1 percent for the$CIFAR10$dataset.

Coverage-guided fuzzing is one of the most effective solutions for vulnerability discovery. Among coverage-guided fuzzing, full-speed fuzzing, such as UnTracer, traces test cases only when they discover new coverage. Due to the high expense of tracing test cases, full-speed fuzzers improve the efficiency of fuzzing by tracing only coverage-increasing test cases. However, the existing full-speed fuzzer (i.e., UnTracer) is based on basic block coverage, suffering a severe problem called edge collision. Moreover, such fuzzers neglect the path frequency, which affects fuzzing effectiveness. In this article, we propose CSI-Fuzz, a fuzzer utilizing coverage sensitive instrumentation to address the problems of existing full-speed fuzzing. CSI-Fuzz directly instruments at edges, which solves the problem of edge collision. Meanwhile, CSI-Fuzz sets path identifiers to count the frequency of covered paths. Our CSI-Fuzz can be recognized as an add-on and seamlessly applied to existing coverage-guided fuzzers. We accordingly implement CSI-Fuzz based on two widely-adopted fuzzers, AFL and AFLFast, to evaluate its performance. The experiments demonstrate that CSI-Fuzz discovers more edges than AFL, AFLFast, and UnTracer. Additionally, CSI-Fuzz exposes more bugs than the other fuzzers.

With the growth in the use of smart mobile devices and the development of information technologies, worms and malware can spread from mobile networks into heterogeneous and hierarchical networks. Thus, the spread of these worms constitutes an increasing potential threat. For understanding the propagation of the aforementioned wireless hybrid worms, current researches have three critical problems:Structural simplification of network topologies(previous research object for wireless worms is the mobile network),Homogenous population of network devices(properties of network devices are the same), andInaccuracy of propagation models(traditional deterministic differential or stochastic difference models cannot model propagation of wireless hybrid worms accurately). To address them, we propose a novel compartmental population-based propagation model oriented towards heterogeneous and hierarchical networks with human behaviors, and then study the impacts of user mobility and operation behaviors on worm propagation. Meanwhile, we conduct extensive simulations to show our model can characterize propagation features accurately. The results in this paper not only provide a deep understanding of new worm propagation, but also serve as fundamental defense guidelines.

Edge computing, as a relatively recent evolution of cloud computing architecture, is the newest way for enterprises to distribute computational power and lower repetitive referrals to central authorities. In the edge computing environment, Generative Models (GMs) have been found to be valuable and useful in machine learning tasks such as data augmentation and data pre-processing. Federated learning and distributed learning refer to training machine learning models in the edge computing network. However, federated learning and distributed learning also bring additional risks to GMs since all peers in the network have access to the model under training. In this article, we study the vulnerabilities of federated GMs to data-poisoning-based backdoor attacks via gradient uploading. We additionally enhance the attack to reduce the required poisonous data samples and cope with dynamic network environments. Last but not least, the attacks are formally proven to be stealthy and effective toward federated GMs. According to the experiments, neural backdoors can be successfully embedded by including merely 5\% poisonous samples in the local training dataset of an attacker.

Computer users are generally faced with difficulties in making correct security decisions. While an increasingly fewer number of people are trying or willing to take formal security training, online sources including news, security blogs, and websites are continuously making security knowledge more accessible. Analysis of cybersecurity texts from this grey literature can provide insights into the trending topics and identify current security issues as well as how cyber attacks evolve over time. These in turn can support researchers and practitioners in predicting and preparing for these attacks. Comparing different sources may facilitate the learning process for normal users by creating the patterns of the security knowledge gained from different sources. Prior studies neither systematically analysed the wide range of digital sources nor provided any standardisation in analysing the trending topics from recent security texts. Moreover, existing topic modelling methods are not capable of identifying the cybersecurity concepts completely and the generated topics considerably overlap. To address this issue, we propose a semi-automated classification method to generate comprehensive security categories to analyse trending topics. We further compare the identified 16 security categories across different sources based on their popularity and impact. We have revealed several surprising findings as follows: (1) The impact reflected from cybersecurity texts strongly correlates with the monetary loss caused by cybercrimes, (2) security blogs have produced the context of cybersecurity most intensively, and (3) websites deliver security information without caring about timeliness much.

Multi-access Edge Computing (MEC), as an extension of cloud computing, provides storage resources at the network edge to enable low-latency data retrieval for users. Due to limited physical sizes and constrained storage resources, individual edge servers cannot store a large amount of data when operating independently. They often need to offload data to other edge servers to serve users collaboratively. Operated by different edge infrastructure providers, edge servers usually work in a distrusted environment. Incentive and trust are the two main challenges in facilitating collaborative edge storage. This article proposes CSEdge, a novel decentralized system that tackles these challenges to enable collaborative edge storage based on blockchain. On CSEdge, edge servers can submit data offloading requests for others to contend for. Winners are selected based on their reputations. They will store the offloaded data and receive rewards for successfully finishing data offloading tasks. Via a distributed consensus, their performance will be recorded on blockchain for future reputation evaluation. A prototype of CSEdge is built on Hyperledger Sawtooth and experimentally evaluated against a baseline system and two start-of-the-art systems in a simulated MEC environment. The results demonstrate that CSEdge can effectively and efficiently facilitate collaborative edge storage among edge servers.

The new edge computing paradigm extends cloud computing by allowing service vendors to deploy their service instances and data on distributed edge servers to serve their service users in close geographic proximity to those edge servers. Caching edge data on edge servers profoundly reduces the retrieval latency perceived by users. However, these edge data are subject to corruption due to intentional and/or accidental exceptions. This is a major challenge for service vendors but has been overlooked. Thus, verifying the integrity of edge data accurately and efficiently is a critical security problem in the edge computing environment. A unique characteristic of the edge computing environment is that edge servers suffer from constrained computing capacities. Thus, verifying data integrity on massive edge servers individually is computationally expensive and impractical. In this paper, we tackle this Edge Data Integrity (EDI) problem with an inspection and corruption localization scheme for EDI named ICL-EDI. This scheme allows service vendors to inspect data integrity and localize corrupted edge data cached on multiple edge servers accurately and efficiently. To evaluate its performance, we implement ICL-EDI and conduct extensive experiments to demonstrate its effectiveness and efficiency.

With the advance of cloud computing technology, increasingly more documents are encrypted before being outsourced to the cloud for great convenience and economic savings. Thus, how to design a fast and accurate multi-keyword ranked search scheme over encrypted cloud data is of paramount importance. In this article, we propose a fast and accurate searchable encryption (FASE) scheme that supports accurate top-k multi-keyword retrieval. We utilize a homomorphic order-preserving encryption algorithm to encrypt the index and query vectors. The encryption method supports homomorphic addition, homomorphic multiplication, and order comparison over encrypted data, and it implements the secure calculation of relevance score between encrypted index and query vectors. The encryption method can not only ensure that the calculation of relevance score ($SI_i * T$) is not exposed to the cloud server, but also protect the privacy of ranking operator. Compared to the traditional method, there are no dummy keywords added to the query vector and document vector, and the top-k search precision of the FASE scheme is 100 percent. To improve the search efficiency, a large number of irrelevant documents are effectively filtered by matching the document mark vector and query mark vector, and the time cost for calculating the relevance score and ranking is greatly reduced. Furthermore, according to the two-round ranking of the keyword matching degree and the relevance score, not only more accurate search result is returned, but the search efficiency is also further improved. The theoretical analysis and experimental results show that the FASE scheme can achieve fast and accurate multi-keyword ranking search. In addition to ensuring data privacy and security, it can also effectively improve the search efficiency and reduce the time cost of creating an index, and it can return ranking results which more satisfy the user needs.

With the comprehensive development of cloud computing technology, more and more enterprises and individuals tend to outsource computing, data, and other resources to the cloud service providers to save the data management cost. Since the plaintext data outsourcing in the cloud could leak users’ private information, it is highly recommended to encrypt them before outsourcing. However, it is a challenge to perform searches over encrypted cloud data. In this paper, we adopt the keyword grouping idea into the traditional inverted index and propose a keyword-grouping inverted index (KGI-index). Based on the index, we propose a privacy-preserving KGI-index based multi-keywords ranked search scheme (KMRS). To improve the search efficiency, we adopt two strategies including grouping high relevant keywords and using the complete binary tree structure to optimize the index. The security analysis and experimental result show that the proposed scheme is a privacy-preserving and efficient multi-keyword ranked search scheme over encrypted cloud data.

The proliferation of Internet of Things (IoT) devices has made people's lives more convenient, but it has also raised many security concerns. Due to the difficulty of obtaining and emulating IoT firmware, in the absence of internal execution information, black-box fuzzing of IoT devices has become a viable option. However, existing black-box fuzzers cannot form effective mutation optimization mechanisms to guide their testing processes, mainly due to the lack of feedback. In addition, because of the prevalent use of various and non-standard communication message formats in IoT devices, it is difficult or even impossible to apply existing grammar-based fuzzing strategies. Therefore, an efficient fuzzing approach with syntax inference is required in the IoT fuzzing domain.

Abstract With the rapid development of deep learning techniques, the popularity of voice services implemented on various Internet of Things (IoT) devices is ever increasing. In this paper, we examine user-level membership inference in the problem space of voice services, by designing an audio auditor to verify whether a specific user had unwillingly contributed audio used to train an automatic speech recognition (ASR) model under strict black-box access. With user representation of the input audio data and their corresponding translated text, our trained auditor is effective in user-level audit. We also observe that the auditor trained on specific data can be generalized well regardless of the ASR model architecture. We validate the auditor on ASR models trained with LSTM, RNNs, and GRU algorithms on two state-of-the-art pipelines, the hybrid ASR system and the end-to-end ASR system. Finally, we conduct a real-world trial of our auditor on iPhone Siri, achieving an overall accuracy exceeding 80%. We hope the methodology developed in this paper and findings can inform privacy advocates to overhaul IoT privacy.

Currently, with the booming growth of cloud computing, workloads from broad ranges of functions and demands are crammed into a single physical machine. They lay considerable stress on the need of evolution of the operating system underneath, especially the memory subsystem. Even enhancing large pages with main memory compression is not intuitively straightforward due to rigid rules imposed by the state-of-the-art manager Buddy System from the beginning of the design. To relieve the aforementioned problems and provide broader design space for system designers, we propose Zweilous, a clean slate physical memory management framework. It is self-contained, highly decoupled, and thus can co-exist with the vanilla memory manager. Separate self-contained metadata/functions guarantee a flexible extension with little modification to current frameworks. To show it is easy to add enhanced functions that accelerate the evolution of the memory management subsystem, we implement Hzmem, a new large page memory manager redesign enhanced with the function of main memory compression. Our method achieves competitive performance compared with native and virtualized large page support, effective memory size increased and fewer impacts on other parts of the operating system.

With the increasing development of cloud computing, a number of users choose to outsource their data to a remote database service provider and enjoy flexible data sharing with multiple parties. However, the integrity and confidentiality of outsourced data in a remote cloud server are the main threats users are concerned about. The tree structure is one of the most widely used data organization structures. It is crucial to guarantee the integrity and privacy not only for the content but also for the structure if sensitive information is organized in this structure. At present, despite some solutions have been put forward, none of these considers the additional redaction attack on tree-structured data from attackers while sharing data with others. In this article, we provide a construction of secure redactable signature scheme for tree-structured data which features a multi-party control on the redaction of vertexes in a tree while the authenticity and privacy are assured. Then, we prove that our scheme is unforgeable, private, and transparent. Furthermore, extensive theoretical and experimental analyses are conducted to assess the efficiency of our scheme. The results demonstrate our scheme achieves multi-party redaction control without sacrificing sensible resources especially when a tree has a larger number of vertexes and siblings per vertex.

Android platform is gaining explosive popularity. This leads developers to invest resources to maintain the upward trajectory of the demand. Unfortunately, as the profit potential grows higher, the chances of these Apps getting attacked also get higher. Therefore, developers improved the security of their Apps, which limits attackers ability to compromise upgraded versions of the Apps. However, developers cannot enhance the security of earlier versions that have been released on the Play Store. The earlier versions of the App can be subject to reverse engineering and other attacks. In this paper, we find that attackers can use these earlier versions as attack vectors, which threatens well protected upgraded versions. We show how to attack the upgraded versions of some popular Apps, including Facebook, Sina Weibo and Qihoo360-Cloud-Driven by analyzing the vulnerabilities existing in their earlier versions. We design and implement a tool named DroidSkynet to analyze and find out vulnerable apps from the Play Store. Among 1,500 mainstream Apps collected from the real world, our DroidSkynet indicates the success rate of attacking an App using an earlier version is 34 percent. We also explore possible mitigation solutions to achieve a balance between utility and security of the App update process.

Nowadays, in machine learning based intrusion detection systems, ensemble learning is a commonly adopted method to improve the detection accuracy. Unfortunately, the existing works have not considered the accumulation and reuse of historical knowledge, as well as the sensitivity of the detection model to different types of attacks, which leads to a low detection accuracy. To address the issue, this article proposes a model based on sustainable ensemble learning. In the model training stage, by taking the individual classifiers probability output and classification confidence as the training data, we build multi-class regression models such that ensemble learning adapts to different attacks. Besides, in the updating stage, an iterative updating method is presented, where the parameters and decision results of the historical model are added to the training process of the new ensemble model to realize the incremental learning. Experiment results show that the proposed model significantly outperforms the existing solutions in terms of detection accuracy, false alarm, stability and robustness.

Machine learning (ML) has great potential in automated code vulnerability discovery. However, automated discovery application driven by off-the-shelf machine learning tools often performs poorly due to the shortage of high-quality training data. The scarceness of vulnerability data is almost always a problem for any developing software project during its early stages, which is referred to as the cold-start problem. This article proposes a framework that utilizes transferable knowledge from pre-existing data sources. In order to improve the detection performance, multiple vulnerability-relevant data sources were selected to form a broader base for learning transferable knowledge. The selected vulnerability-relevant data sources are cross-domain, including historical vulnerability data from different software projects and data from the Software Assurance Reference Database (SARD) consisting of synthetic vulnerability examples and proof-of-concept test cases. To extract the information applicable in vulnerability detection from the cross-domain data sets, we designed a deep-learning-based framework with Long-short Term Memory (LSTM) cells. Our framework combines the heterogeneous data sources to learn unified representations of the patterns of the vulnerable source codes. Empirical studies showed that the unified representations generated by the proposed deep learning networks are feasible and effective, and are transferable for real-world vulnerability detection. Our experiments demonstrated that by leveraging two heterogeneous data sources, the performance of our vulnerability detection outperformed the static vulnerability discovery toolFlawfinder. The findings of this article may stimulate further research in ML-based vulnerability detection using heterogeneous data sources.

In the context of Information Societies, a tremendous amount of information is daily exchanged or released. Among various information-release cases, medical document release has gained significant attention for its potential in improving healthcare service quality and efficacy. However, integrity and origin authentication of released medical documents is the priority in subsequent applications. Moreover, sensitive nature of much of this information also gives rise to a serious privacy threat when medical documents are uncontrollably made available to untrusted third parties. Redactable signatures allow any party to delete pieces of an authenticated document while guaranteeing the origin and integrity authentication of the resulting (released) subdocument. Nevertheless, most of existing redactable signature schemes (RSSs) are vulnerable to dishonest redactors or illegal redaction detection. To address the above issues, we propose two distinct RSSs with flexible release control (RSSs-FRC). We also analyse the performance of our constructions in terms of security, efficiency and functionality. The analysis results show that the performance of our construction has significant advantages over others, from the aspects of security and efficiency.

Deep Neural Networks (DNNs) are vulnerable to deliberately crafted adversarial examples. In the past few years, many efforts have been spent on exploring query-optimisation attacks to find adversarial examples of either black-box or white-box DNN models, as well as the defending countermeasures against those attacks. In this article, we explore vulnerabilities of DNN models under the umbrella of Man-in-the-Middle (MitM) attacks, which have not been investigated before. From the perspective of an MitM adversary, the aforementioned adversarial example attacks are not viable anymore. First, such attacks must acquire the outputs from the models multiple times before actually launching attacks, which is difficult for the MitM adversary in practice. Second, such attacks are one-off and cannot be directly generalised onto new data examples, which decreases the rate of return for the attacker. In contrast, using generative models to craft adversarial examples on the fly can mitigate the drawbacks. However, the adversarial capability of the generative models, such as Variational Auto-Encoder (VAE), has not been extensively studied. Therefore, given a classifier, we investigate using a VAE decoder to either transform benign inputs to their adversarial counterparts or decode outputs from benign VAE encoders to be adversarial examples. The proposed method can endue more capability to MitM attackers. Based on our evaluation, the proposed attack can achieve above 95 percent success rates on both MNIST and CIFAR10 datasets, which is better or comparable with state-of-the-art query-optimisation attacks. In the meantime, the attack is 104times faster than the query-optimisation attacks.

With the growth of public demand for online access to health services, many efforts have been devoted to personal health records (PHR) in cloud computing. It enables patients to manage their personal health information (PHI) in cloud servers, which greatly facilitates the collection, access and sharing of PHI. Since cloud servers are not fully trusted, it is desirable that the PHI can be encrypted for privacy protection before uploaded to the cloud. Besides the privacy of PHI, fine-grained and flexible search control is also strongly desired for a secure PHR system. In this article, we first present attribute set based keyword search (ASBKS) which can realize fine-grained keyword search of encrypted PHR. Compared with the existing searchable encryption with access control, the proposed ASBKS can achieve more flexibility in user attributes organization and more efficiency in specifying policies. Furthermore, we present a hierarchical ASBKS scheme to improve scalability by extending ASBKS with a hierarchical structure of users. We implement our ASBKS scheme and the experimental results demonstrate that it is both efficient and flexible for encrypted PHR in cloud computing.

Dynamic Searchable Symmetric Encryption (DSSE) enables users to search on the encrypted database stored on a semi-trusted server while keeping the search and update information under acceptable leakage. However, most existing DSSE schemes are not efficient enough in practice due to the complex structures and cryptographic primitives. Moreover, the storage cost on the client side grows linearly with the number of keywords in the database, which induces unaffordable storage cost when the size of keyword set is large. In this article, we focus on secure dynamic searchable symmetric encryption with constant client storage cost. Our framework is boosted by fish-bone chain, a novel two-level structure which consists of Logical Keyword Index Chain (LoKIC) and Document Index Chain (DIC). To instantiate the proposed framework, we propose a forward secure DSSE scheme, called CLOSE-F, and a forward and backward secure DSSE scheme, called CLOSE-FB. Experiments showed that the computation cost of CLOSE-F and CLOSE-FB are as efficient as the state-of-the-art solutions, while the storage costs on the client side are constant in both CLOSE-F and CLOSE-FB, which are much smaller than existing schemes.

The new mobile edge computing (MEC) paradigm fundamentally changes the data caching technique by allowing data to be cached on edge servers attached to base stations within hundreds of meters from users. It provides a bounded latency guarantee for latency-sensitive applications, e.g., interactive AR/VR applications, online gaming, etc. However, in the highly distributed MEC environment, cache data is subject to corruption and their integrity must be ensured. Existing centralized data integrity assurance schemes are rendered obsolete by the unique characteristics of MEC, i.e., unlike cloud servers, edge servers have only limited computing and storage resources and they are deployed massively and distributed geographically. Thus, it is a new and significant challenge to ensure cache data integrity over tremendous geographically-distributed resource-constrained edge servers. This paper proposes the CooperEDI scheme to guarantee the edge data integrity in a distributed manner. CooperEDI employs a distributed consensus mechanism to form a self-management edge caching system. In the system, edge servers cooperatively ensure the integrity of cached replicas and repair corrupted ones. We experimentally evaluate its performance against three representative schemes. The results demonstrate that CooperEDI can effectively and efficiently ensure cache data integrity in the MEC environment.

Rowhammer is a destructive software-induced DRAM fault, which an attacker can leverage to break system security. Both individual customers and enterprise users (e.g., cloud providers) might refrain from using a computing system if it is vulnerable to rowhammer vulnerability. In this paper, we provide the first end-to-end tool, coined BitMine, that systematically assesses a DRAM chip’s vulnerability to rowhammer bit flips. BitMine is an extension of DRAMDig. As DRAM address mappings are proprietary techniques and critical in inducing rowhammer bit flips, DRAMDig, our prior work, leverages domain knowledge to efficiently and deterministically reverse-engineer DRAM address mappings on Intel machines. By incorporating DRAMDig, BitMine configures three key parameters, i.e., hammer methods, hammer patterns, data patterns, on the effectiveness of finding rowhammer bit flips. BitMine by default implements 13 hammer methods, 4 hammer patterns and 16 data patterns and is extensible to support more. We evaluate DRAMDig and BitMine against multiple machine models that combine different DRAM chips and Intel microarchitectures. Our experiment results show that DRAMDig efficiently uncovers a deterministic DRAM address mapping for each machine model, and every implemented parameter in BitMine has its distinct effectiveness in triggering bit flips for different machine models.

The primitive of verifiable database (VDB) can enable a resource-limited client to securely outsource an encrypted database to an untrusted cloud server and the client could efficiently retrieve and update the data at will. Meanwhile, the client can undoubtedly detect any misbehavior by the server if the database has been tampered with. We argue that most of the existing VDB schemes can only support the updating operation of replacement, rather than other common updating operations such asinsertionanddeletion. Recently, the first publicly verifiable VDB schemes that supports all updating operations was proposed based on the idea of hierarchical vector commitment. However, one disadvantage of the proposed VDB scheme is that the computation and storage complexity increases linearly when the client continually inserts data records in the same index of the database. As a result, it remains an open problem how to construct an efficient (and publicly verifiable) VDB scheme that can support all updating operations regardless of the manner of insertion. In this paper, we first introduce a new primitive called committed invertible Bloom filter (CIBF) and utilize it to propose a new publicly verifiable VDB scheme that can support all kinds of updating operations. Additionally, the proposed construction is efficient regardless of the manner of updating operations and thus provides an affirmative answer to the above open problem.

Demand response (DR) has been widely adopted as a strategic plan of the electricity market in maintaining power grid reliability, sustainability, and stability. In a typical emergency DR (EDR) that arises in colocation data centers, participating tenants can reduce their power consumption when the supply of electricity is a shortage and be rewarded with financial compensation. In this paper, we study a mechanism design problem of motivating tenants for colocation EDR (MEDR). To solve the MEDR problem, we present a truthful Fully Polynomial-Time Approximation Scheme (FPTAS) which is theoretically proved deterministic, truthful and near-optimal, and can be approximated within 1 + ϵ for any given ϵ > 0, while the running time is in the polynomial of the number of tenants n and ε. To speed up the calculation of the payments, we further study the Vickrey-Clarke-Groves (VCG) based mechanism. Moreover, we build a MEDR auction system (MEDRAS) and implement all mechanism algorithms for a colocation data center. Comprehensive and detailed experiments have been implemented to validate the efficiency of our proposed mechanisms.

Edge computing allows app vendors to deploy their applications and relevant data on distributed edge servers to serve nearby users. Caching data on edge servers can minimize users' data retrieval latency. However, such cache data are subject to both intentional and accidental corruption in the highly distributed, dynamic, and volatile edge computing environment. Given a large number of edge servers and their limited computing resources, how to effectively and efficiently audit the integrity of app vendors' cache data is a critical and challenging problem. This article makes the first attempt to tackle this Edge Data Integrity (EDI) problem. We first analyze the threat model and the audit objectives, then propose a lightweight sampling-based probabilistic approach, namely EDI-V, to help app vendors audit the integrity of their data cached on a large scale of edge servers. We propose a new data structure named variable Merkle hash tree (VMHT) for generating the integrity proofs of those data replicas during the audit. VMHT can ensure the audit accuracy of EDI-V by maintaining sampling uniformity. EDI-V allows app vendors to inspect their cache data and locate the corrupted ones efficiently and effectively. Both theoretical analysis and comprehensively experimental evaluation demonstrate the efficiency and effectiveness of EDI-V.

Cloud service selection is becoming more complex with the arrival of a large number of cloud providers offering various service packages on the market. These cloud service packages are generally provisioned by Spot, On-demand and Reserved Instances. Typically, a user's service requirements contain many independent sub-tasks (Bag-of-Tasks), and have budget limitations and additional constraints. To select reasonable cloud instances to run the user's sub-tasks, we propose a strategy, OSPN (Optimal Service Provisioning with Negotiation), to support the allocation of tasks to services offered by multi-cloud providers. OSPN consists of two phases: in the first phase, a one-to-many parallel Spot Instance pricing negotiation is applied; in the second phase, service provisioning strategy profiles on the three types of cloud instances are calculated. Specifically, the first phase employs an improved double auction in which the price and availability of providers' instances are taken into account; then the second phase gives the utility Nash equilibrium model and derives the optimal provisioning strategy profiles. The experimental results show that our service provisioning strategy is more cost-effective, namely, the most gains of both the user and providers in the changing scenes, and the least payments of the user than the existing relevant strategies.

Cyber-physical-social systems (CPSS) are revolutionizing the relationships between humans, computers, and things. Outsourcing computation to the cloud can offer resources-constrained enterprises and consumers sustainable computing in CPSS. However, ensuring the security of data in such an outsourced environment remains a research challenge. Principal eigentensor computation has emerged as a powerful tool dealing with multidimensional cyber-physical-social systems data. In this paper, we present two novel secure principal eigentensor computation (SPEC) schemes for sustainable CPSS. To the best of our knowledge, this is the first effort to address SPEC over encrypted data in the cloud without the interaction need between multiple users and cloud. More specifically, we leverage cloud server and trusted hardware component to design a collaborative cloud model. Using the model, we propose (1) a basic SPEC scheme based on homomorphic computing and (2) an efficient SPEC scheme that combines the advantages of homomorphic computing and garbled circuits, and exploits packing technology to reduce computational cost. Finally, we theoretically and empirically analyze the security and efficiency of our SPEC schemes. Findings demonstrate that the proposed schemes provide a secure and efficient way of outsourcing computation for CPSS. In addition, from the cloud user's perspective, our proposal is lightweight.

Users receive a multitude of security information in written articles, e.g., newspapers, security blogs, and training materials. However, prior research suggests that these delivery methods, including security awareness campaigns, mostly fail to increase people's knowledge about cyber threats. It seems that users find such information challenging to absorb and understand. Yet, to raise users' security awareness and understanding, it is essential to ensure the users comprehend the provided information so that they can apply the advice it contains in practice. We conducted a subjective study to measure the level of users' understanding of security texts. We find that 61% of the terms security experts used in their writings are hard for the public to understand, even for people with some IT backgrounds. We also observe that 88% of security texts have at least one such term. Moreover, we notice that existing dictionaries, including the online ones (e.g., Google Dictionary), cover no more than 35% of the terms found in security texts. To improve users' ability to understand security texts, we developed a framework to build a user-oriented security-centric dictionary from multiple sources. To evaluate the effectiveness of the dictionary, we developed a tool as a service to detect technical terms and explain their meanings to the user in pop-ups. The results of a subjective study to measure the tool's performance showed that it could increase users' ability to understand security articles by 30%.

The advanced persistent threat (APT) landscape has been studied without quantifiable data, for which indicators of compromise (IoC) may be uniformly analyzed, replicated, or used to support security mechanisms. This work culminates extensive academic and industry APT analysis, not as an incremental step in existing approaches to APT detection, but as a new benchmark of APT related opportunity. We collect 15,259 APT IoC hashes, retrieving subsequent sandbox execution logs across 41 different file types. This work forms an initial focus on Windows-based threat detection. We present a novel Windows APT executable (APT-EXE) dataset, made available to the research community. Manual and statistical analysis of the APT-EXE dataset is conducted, along with supporting feature analysis. We draw upon repeat and common APT paths access, file types, and operations within the APT-EXE dataset to generalize APT execution footprints. A baseline case analysis successfully identifies a majority of 117 of 152 live APT samples from campaigns across 2018 and 2019.

Since insider attacks have been recognised as one of the most critical cyber security threats to an organisation, detection of malicious insiders has received increasing attention in recent years. Previously, we proposed an approach that performs the detection by analysing various security logs with Word2vec, which not only removes the reliance on prior knowledge but also greatly simplifies the process of decision making and improves the interpretability of the alerts. In this paper, following the similar idea, a new Doc2vec based approach is proposed to overcome the previous approach's limitations: (1) the behaviour metrics can be acquired straightforwardly due to the Doc2vec's capability in inferring unseen texts of any length; (2) other than the temporal metrics, some spatial metrics can also be realised, providing a more comprehensive insight into the unusual behaviours; and (3) a range of corpora are produced by adopting different keywords to aggregate, each of which may be suited to a specific type of behaviour metrics. A large number of numerical experiments are conducted using the same benchmark insider threat database, for the purpose of testing how the corpora, metrics and training parameters impact on the performance and be related to each other. The experiments demonstrate that the proposed approach can achieve a similar performance with greater simplicity and flexibility.

Blockchain brings opportunities and challenges for financial data sharing services. The essential properties in a distributed multi-parties system are data access control and privacy control. This paper proposes a hierarchical data access model for financial services, which contains consent management and dynamic credits management. We implement fine-grained data access control through rating accredited data recipients (ADRs). By accessing corresponding blockchain service logs, ADRs' credits will dynamically be updated. The credits evaluation algorithm is responsible for calculating ADRs' credits based on their completion rate, business ethics rate, and feedback positive rate. Moreover, through applying smart contracts, the efficiency of consent management can be improved, and privacy policies can be managed elastically. Finally, we deploy smart contracts on the Ethereum Rinkeby testnet to evaluate the model feasibility. Furthermore, the theoretical analysis and experimental results indicate that the prototype is secure and efficient.

Relieving users from the burden of remembering and inputting authentication information explicitly, such as passwords/PINs and lock patterns, implicit authentication mechanisms have gained an increasing concern. When providing authentication, the existing implicit methods only depend on a specific behavior, such as typing on the screen, performing gestures, or taking a walk. However, in real applications, a user's behavioral characteristics are also decided by the context where behavior is performed. Thus, those existing methods show limited authentication accuracy and usability. To address these issues, we propose CaIAuth, a reliable context-aware implicit authentication framework, which profiles users' behavior and context characteristics in a holistic fashion. It observes the states of context-sensing entities for different smartphone usage patterns and builds a context-aware model to distinguish between legitimate users and illegal ones. We conducted extensive experiments to evaluate system performance with a large data set collected from 142 subjects. The experimental results show that our system achieves a low equal error rate (EER) (e.g., less 7%) and is resilient against common threats, including zero-effect attack and mimicry attack. In addition, CaIAuth achieves a low authentication delay and overhead.

Cryptographic keys should be established for the smart home devices in order to secure home area networks. In certain smart home applications, however, the devices might be produced by different factories. As a result, it becomes impractical to assume devices are preloaded with secrets before leaving factories. Moreover, in some scenarios, smart home devices have no access to an online trusted third party. These problems make conventional key agreement schemes inapplicable for these devices. It is investigated that devices can extract secrets from received signal strength (RSS) measurements at the physical layer. However, the bit extraction rate is low. The Merkle puzzle is introduced to design the key agreement scheme by expanding the low entropy seed to high entropy secret key. However, it introduces considerable time and computation costs. To alleviate these problems, in this article, we design a hybrid key agreement scheme for smart homes. Namely, smart home devices first extract short random keys at the physical layer. Then, they establish secret communication keys at higher layers by making use of the Merkle puzzle. In this way, secret keys can be established without using any preloaded secrets or online trusted third party. We prove the security of the new scheme and present a prototype implementation using Ralink WiFi cards. Moreover, we evaluate the performance of our scheme and compare it with other related schemes. The analysis shows that comparing with the related schemes, in our scheme, the time cost is at least one order of magnitude lower, the computation cost is at least five orders of magnitude lower, and the extra communication cost is moderate.

The constantly increasing number of disclosed security vulnerabilities have become an important concern in the software industry and in the field of cybersecurity, suggesting that the current approaches for vulnerability detection demand further improvement. The booming of the open-source software community has made vast amounts of software code available, which allows machine learning and data mining techniques to exploit abundant patterns within software code. Particularly, the recent breakthrough application of deep learning to speech recognition and machine translation has demonstrated the great potential of neural models’ capability of understanding natural languages. This has motivated researchers in the software engineering and cybersecurity communities to apply deep learning for learning and understanding vulnerable code patterns and semantics indicative of the characteristics of vulnerable code. In this survey, we review the current literature adopting deep-learning-/neural-network-based approaches for detecting software vulnerabilities, aiming at investigating how the state-of-the-art research leverages neural techniques for learning and understanding code semantics to facilitate vulnerability discovery. We also identify the challenges in this new field and share our views of potential research directions.

Social and Internet traffic analysis is fundamental in detecting and defending cyber attacks. Traditional approaches resorting to manually defined rules are gradually replaced by automated approaches empowered by machine learning. This revolution is accelerated by huge datasets which support machine-learning models with outstanding performance. In the context of a data-driven paradigm, this article reviews recent analytic research on cyber traffic over social networks and the Internet by using a set of common concepts of similarity, correlation, and collective indication, and by sharing security goals for classifying network host or applications and users or Tweets. The ability to do so is not determined in isolation, but rather drawn for a wide use of many different network or social flows. Furthermore, the flows exhibit many characteristics, such as fixed sized and multiple messages between source and destination. This article demonstrates a new research methodology of data-driven cyber security (DDCS) and its application in social and Internet traffic analysis. The framework of the DDCS methodology consists of three components, that is, cyber security data processing, cyber security feature engineering, and cyber security modeling. Challenges and future directions in this field are also discussed.

Privacy protection in Content Based Image Retrieval (CBIR) is a new research topic in cyber security and privacy. The state-of-art CBIR systems usually adopt interactive mechanism, namely relevance feedback, to enhance the retrieval precision. How to protect the user's privacy in such Relevance Feedback based CBIR (RF-CBIR) is a challenge problem. In this paper, we investigate this problem and propose a new Private Relevance Feedback CBIR (PRF-CBIR) scheme. PRF-CBIR can leverage the performance gain of relevance feedback and preserve the user's search intention at the same time. The new PRF-CBIR consists of three stages: 1) private query; 2) private feedback; 3) local retrieval. Private query performs the initial query with a privacy controllable feature vector; private feedback constructs the feedback image set by introducing confusing classes following theK-anonymity principle; local retrieval finally re-ranks the images in the user side. Privacy analysis shows that PRF-CBIR fulfills the privacy requirements. The experiments carried out on the real-world image collection confirm the effectiveness of the proposed PRF-CBIR scheme.

Software vulnerability has long been an important but critical research issue in cybersecurity. Recently, the machine learning (ML)-based approach has attracted increasing interest in the research of software vulnerability detection. However, the detection performance of existing ML-based methods require further improvement. There are two challenges: one is code representation for ML and the other is class imbalance between vulnerable code and nonvulnerable code. To overcome these challenges, this article develops a DeepBalance system, which combines the new ideas of deep code representation learning and fuzzy-based class rebalancing. We design a deep neural network with bidirectional long short-term memory to learn invariant and discriminative code representations from labeled vulnerable and nonvulnerable code. Then, a new fuzzy oversampling method is employed to rebalance the training data by generating synthetic samples for the class of vulnerable code. To evaluate the performance of the new system, we carry out a series of experiments in a real-world ground-truth dataset that consists of the code from the projects of LibTIFF, LibPNG, and FFmpeg. The results show that the proposed new system can significantly improve the vulnerability detection performance. For example, the improvement is 15% in terms of F-measure.

Machine learning-based solutions have been successfully employed for the automatic detection of malware on Android. However, machine learning models lack robustness to adversarial examples, which are crafted by adding carefully chosen perturbations to the normal inputs. So far, the adversarial examples can only deceive detectors that rely on syntactic features (e.g., requested permissions, API calls,etc.), and the perturbations can only be implemented by simply modifying application’s manifest. While recent Android malware detectors rely more on semantic features from Dalvik bytecode rather than manifest, existing attacking/defending methods are no longer effective. In this paper, we introduce a new attacking method that generates adversarial examples of Android malware and evades being detected by the current models. To this end, we propose a method of applying optimal perturbations onto Android APK that can successfully deceive the machine learning detectors. We develop an automated tool to generate the adversarial examples without human intervention. In contrast to existing works, the adversarial examples crafted by our method can also deceive recent machine learning-based detectors that rely on semantic features such as control-flow-graph. The perturbations can also be implemented directly onto APK’s Dalvik bytecode rather than Android manifest to evade from recent detectors. We demonstrate our attack on two state-of-the-art Android malware detection schemes, MaMaDroid and Drebin. Our results show that the malware detection rates decreased from 96% to 0% in MaMaDroid, and from 97% to 0% in Drebin, with just a small number of codes to be inserted into the APK.

Internet of Things (IoT) integrates a variety of software (e.g., autonomous vehicles and military systems) in order to enable the advanced and intelligent services. These software increase the potential of cyber-attacks because an adversary can launch an attack using system vulnerabilities. Existing software vulnerability analysis methods used to be relying on human experts crafted features, which usually miss many vulnerabilities. It is important to develop an automatic vulnerability analysis system to improve the countermeasures. However, source code is not always available (e.g., most IoT related industry software are closed source). Therefore, vulnerability detection on binary code is a demanding task. This article addresses the automatic binary-level software vulnerability detection problem by proposing a deep learning-based approach. The proposed approach consists of two phases: binary function extraction, and model building. First, we extract binary functions from the cleaned binary instructions obtained by using IDA Pro. Then, we employ the attention mechanism on top of a bidirectional long short-term memory for building the predictive model. To show the effectiveness of the proposed approach, we have collected datasets from several different sources. We have compared our proposed approach with a series of baselines including source code-based techniques and binary code-based techniques. We have also applied the proposed approach to real-world IoT related software such as VLC media player and LibTIFF project that used on Autonomous Vehicles. Experimental results show that our proposed approach betters the baselines and is able to detect more vulnerabilities.

Industrial Internet of Things (IIoT) is significant of building powerful industrial systems and applications. Deep learning has provided a promising opportunity to extract useful knowledge by utilizing vast amounts of data in IIoT. However, lacking of massive public datasets will lead to low performance and overfitting of the learned model. Therefore, the federated deep learning over distributed datasets has been proposed. Whereas, it inevitably introduces some new security challenges, i.e., disclosing participant's data privacy. However, existing methods cannot guarantee each participant's data privacy in a learning group. In this article, we propose two privacy-preserving asynchronous deep learning schemes [privacy-preserving and asynchronous deep learning via re-encryption (DeepPAR) and dynamic privacy-preserving and asynchronous deep learning (DeepDPA)]. Compared to the state-of-the-art work, DeepPAR protects each participant's input privacy while preserving dynamic update secrecy inherently. Meanwhile, DeepDPA enables to guarantee backward secrecy of group participants in a lightweight manner. Security analysis and performance evaluations on real dataset show that our proposed schemes are secure, efficient and effective.

Encryption alone is not enough to protect data privacy, because access pattern leaks some sensitive information. Oblivious RAM (ORAM), the solution to this problem, is still far from practical deployment for heavy storage and communication/computation overhead. To reduce them, an insightful idea was proposed to utilize non-colluding clouds to shift client computation and client-cloud communication to the clouds. The proposed multi-cloud ORAM achieved O(1) client-cloud bandwidth cost and removed most of client computation. In this paper, we exploit “disconnected ORAMoperation” and design “two-layerencryption” to further reduce these overheads. Experiments show that our proposed scheme, NewMCOS, significantly reduces evict cache size from GB/MB to KB level with about 2-3 times lower response time and 20 percent savings in bandwidth for clouds, compared to other schemes. Theoretically speaking, we reduce evict cache size from O(√N) to O(ZK), where N is the number of real data blocks, K is the number of clouds (2 <; K <; <; √N ), and Z is the number of real blocks uploaded from the client for eviction. By employing “lazy eviction operation”, the write frequency is reduced by O(Z), the shuffling bandwidth cost is reduced by Ω(Z log Z). Meanwhile, NewMCOS is proved to be secure.

Motivated by privacy preservation requirements for outsourced data, keyword searches over encrypted cloud data have become a hot topic. Compared to single-keyword exact searches, multi-keyword fuzzy search schemes attract more attention because of their improvements in search accuracy, typo tolerance, and user experience in general. However, existing multi-keyword fuzzy search solutions are not sufficiently efficient when the file set in the cloud is large. To address this, we propose an Efficient Leakage-resilient Multi-keyword Fuzzy Search (EliMFS) framework over encrypted cloud data. In this framework, a novel two-stage index structure is exploited to ensure that search time is independent of file set size. The multi-keyword fuzzy search function is achieved through a delicate design based on the Gram Counting Order, the Bloom filter, and the Locality-Sensitive Hashing. Furthermore, considering the leakages caused by the two-stage index structure, we propose two specific schemes to resist these potential attacks in different threat models. Extensive analysis and experiments show that our schemes are highly efficient and leakage-resilient.

With the rapid development of cloud services, the resources-constrained enterprises and individuals can outsource the huge sensitive data into the Cloud Service Providers (CSPs) who fully control the data physically. Since CSPs are not fully trusted, it is essential to protect the integrity and confidentiality of users' data. Plenty of researchers have devoted considerable attention to solve this issue in the last decade such as various PDP and POR schemes. In this paper, we propose an algebraic signature-based data integrity auditing scheme that ensures the cloud data integrity and confidentiality with batch auditing. Moreover, one advantage of the scheme is that it can also support data dynamics by using only one cloud server. The security analysis shows that our construction can achieve the desired security properties. We also provide the simulation results of the dynamic operations on different numbers of data blocks and sub-blocks, which show that our scheme is efficient for real-world applications.

Fuzzing is a promising technique for detecting security vulnerabilities. Newly developed fuzzers are typically evaluated in terms of the number of bugs found on vulnerable programs/binaries. However, existing corpora usually do not capture the features that prevent fuzzers from finding bugs, leading to ambiguous conclusions on the pros and cons of the fuzzers evaluated. In this paper, we propose to address the above problem by generating corpora based on search-hampering features. As a proof-of-concept, we designed FEData, a prototype corpus that currently focuses on three search-hampering features to generate vulnerable programs for fuzz testing. Unlike existing corpora that can only answer "how", FEData can also further answer "why" by exposing (or understanding) the reasons for the identified weaknesses in a fuzzer. The "why" information serves as the key to the improvement of fuzzers. Based on the "why" information, our FEData programs enabled us to identify the weakness of AFLFast, called cycle explosion, behind. We further developed an improved version of AFLFast, called AFLFast+, which has overcome the cycle explosion problem. AFLFast+ retains the efficiency of AFLFast in path search while maintaining or even surpassing the bug-finding capability of AFL for the corpus evaluated.

The characteristics of wireless transmission make the smart homes become vulnerable to kinds of malicious attacks, such as eavesdropping. To ensure the security of home area networks, cryptographic keys need to be established for smart home devices. Specifically, the lightweight physical layer key extraction schemes can be implemented. In practice, however, the key generation rate of the state-of-the-art schemes is low. To improve the rate, in this paper we propose an adaptive secret key establishment scheme for smart homes using the Received Signal Strength (RSS) measurements. Two smart home devices can adaptively quantize the collected RSS measurements and obtain the secret key. To illustrate the practicality of our scheme, we experimentally implement it using the Ralink WiFi cards based on the RT2870 chipset. In addition, we evaluate the randomness of the generated key by conducting the NIST randomness test experiment.

Demand response (DR) is a vital means of electricity market in maintaining power grid reliability, sustainability and stability. DR can enable consumers (e.g. data centers) to reduce their electricity consumption when the supply of electricity is a shortage. The consumers will be rewarded if they reduce or shift some of their energy usage during peak hours. Aiming at solving the efficiency of DR, in this paper, we present MEDR, a mechanism on emergency DR in colocation data center. First, we formalize the MEDR problem and propose a dynamic programming to solve the optimization version of the problem. We then design a deterministic mechanism to solve the MEDR. We prove that our mechanism is truthful and it is an FPTAS, i.e., it can be approximated within 1 + ε for any given ε > 0, while the running time of our mechanism is polynomial in the number of tenants n and 1/ε. Furthermore, we also give an auction system covering the efficient FPTAS algorithm as bidding decision program for DR. Finally, we choose a real dataset to build a large number of simulation datasets in performance evaluation. The results show that our mechanism outperforms near-optimal and high utility demonstrate the effectiveness of our work.

Abstract Information flow control (IFC) regulates where information is permitted to travel within information systems. To enforce IFC, access control encryption (ACE) was proposed to support both the no read-up rule and the no write-down rule. There are some problems in existing schemes. First, the communication cost is linear with the number of receivers. Second, senders are not authenticated, namely an unauthorized sender can send a message to a receiver. To reduce communication cost and implement sender authentication, we propose an attribute-based IFC (ABIFC) scheme by introducing attribute-based systems into IFC. Our ABIFC scheme captures the following features: (i) flexible IFC policies are defined over a universal set of descriptive attributes; (ii) both the no read-up rule and the no write-down rule are supported; (iii) the communication cost is linear with the number of required attributes, instead of receivers; (iv) receivers can outsource heavy computation to a server without compromising data confidentiality; (v) authorized senders can control release their attributes when sending messages to receivers. To the best of our knowledge, it is the first IFC scheme where flexible policies are defined over descriptive attributes and outsourced computation is supported.

Social computing and cloud computing are the major trends of technology development in recent years. With the unparalleled popularity, social networks and cloud platforms have become part of our daily lives. Users have produced big data that are beyond the ability of commonly used computer software and hardware tools to capture, manage, and process within a tolerable elapsed time. It has been widely recognized that security and privacy are the key challenges for social network and cloud services due to their scale, complexity, and heterogeneity. The goal of this special issue is to promote research on security, privacy, and social networks. Eleven papers were carefully selected from open submissions and invited from the best original presentations at the 13th International Conference on Information Security Practice and Experience (ISPEC 2017) and the Third International Symposium on Security and Privacy in Social Networks and Big Data (SocialSec 2017). These research papers address the state-of-the-art technologies related to security, privacy, and social networks. The papers are organized under the following topics: security and privacy in social network and web, big data and information security, hardware and software security, and network security. Social media has greater and greater influence on society in recent years. Hu et al1 present an interesting study on the influence of negative opinions spreading in social media during election period. Unlike existing approaches that rely on sentiment analysis and emotional words, the authors take advantage of nouns with emotional context to determine the election preference of each user more accurately. Protecting social networks from security threats and preserving user privacy are the key challenges in social network security. To protect social network users against cross-site scripting worms, Gupta et al2 propose a client-server JavaScript code rewriting-based framework. A Java-based prototype has been developed by the authors, and the authors test its malicious script alleviation capability on several web applications. Yang et al3 propose a novel privacy-preserving authentication protocol for anonymous web browsing, which help users avoid being monitored by the web server on the basis of the identity. In particular, the proposed protocol makes use of a pseudoidentity mechanism and an identity-based elliptic-curve cryptography algorithm. In the area of big data and cloud computing, secure nearest neighbor query over encrypted data is an important issue. Zhu et al4 put forward an efficient attack against the CloudBI-II scheme that is designed for resisting the collusion of cloud server and query users. Accordingly, the authors present an enhanced scheme that can resist the collusion attack. Outsourcing heavy computational tasks to cloud service providers has become popular in the cloud era. As commercial cloud service providers are not trusted, preserving the integrity of computational results becomes an important challenge. Yang et al5 propose a verifiable computation scheme that can protect the output privacy. Ciphertext-policy attribute-based encryption (CP-ABE) is widely used for data access control in cloud storage, which gives data owners direct and flexible control on access policies. Zhang et al6 present a multiauthority attribute-based encryption scheme with constant-size ciphertexts and user revocation for threshold access policy, which addresses the practical challenges in CP-ABE. The security and reliability of information transmission in vehicular ad hoc networks have attracted a lot of research efforts in recent years. Wang et al7 propose a neighborhood trustworthiness-based vehicle-to-vehicle authentication scheme, which uses cloud computing to evaluate the trustworthiness of vehicles for emergent information delivery. The security of ARM embedded devices is important as they are becoming increasingly ubiquitous. Chang et al8 propose a hardware-assisted memory isolation protection mechanism using the B method, and present an implementation of the proposed system on an ARM-based platform. Function-call graph matching is useful in binary code analysis for software security purposes. Huang et al9 propose a function-call graph matching method based on the Hungarian algorithm. The proposed method solves the maximum weight matching problem in polynomial time, which allows matching between graphs of large scale. This special issue would not be complete without covering network security. Yang et al10 use software-defined network techniques to build a moving target defense model that maps physical network elements to a considerably large address space and creates different times of validity randomly to generate mapping addresses. The proposed model helps make it more difficult for attackers to find the targets in a network. Shan et al11 propose a node importance scheme to a community-based caching scheme with network coding for information centric networking. Experimental results indicate that the proposed scheme can improve network performance including average download time, cache hit rate, and instantaneous hop reduction rate. The articles presented in this special issue report recent advances in some areas of security, privacy, and social networks, including security and privacy in social network and web, big data and information security, hardware and software security, and network security. We hope the readers can benefit from the insights of these works and make further contributions to these important and rapidly growing fields. We are grateful to the authors who submitted papers to this special issue. We would also like to thank the reviewers for their hard work and their valuable feedback to the authors. Finally, we would like to express our sincere gratitude to Professor Geoffrey Fox, the Editor in Chief, for providing the opportunity and assistance to edit this special issue in the international journal of Concurrency and Computation: Practice and Experience.

Internet of Things (IoT) devices have brought much efficiency and convenience to our daily life. However, the devices may collect a myriad of data from people without their consent. Controlling the large amount of data generated from the devices from being misused is critical to mitigate privacy risks. Therefore, privacy protection on personal data has become an important factor in the development of the IoT. Historically, privacy enhancing technologies (PETs) can effectively enhance the privacy and protect users' personally identifiable information. To date, many researchers have stressed the importance of PETs and proposed solutions relevant to different application fields of the IoT. However, to the best of our knowledge, none of the research has analyzed the PETs in IoT from the aspects of privacy threat issues and privacy legislation. As a result, this paper surveys on the solutions of PETs in the field of IoT, which has filtered down from the large number of published academic papers to the 120 primary studies published between 2014 and 2017. After collecting the papers, we categorized them based on the functions and the coverage of privacy protection, and analyzed them from different aspects, ranging from high-level principles of general data protection regulations and ISO/IEC 29100:2011 requirements to the actual resolution of privacy threats in IoT. Thus, we aim to identify the current state of development of the PETs in various fields and examine whether the existing PETs comply with the latest legal principles and privacy standards and reduce the threats to privacy. Finally, recommendations for future research are given based on the results.

The emergence of the mobile Internet of Things (IoT) has made our lives smarter, relying on its various mobile IoT devices and services provided. However, with the explosively emerging mobile IoT services, malicious attackers can access them in an unauthorized way. In this paper, we designed an Efficient Anonymous User Authentication (E-AUA) protocol between the users and servers based on multiserver architectures, which contain multiple servers to address the problem of network congestion in mobile IoT. Furthermore, the E-AUA protocol was designed with a dual messages mechanism with strong anti-attack ability, lower communication and computation costs. Comparing with the state of the art protocols, our E-AUA protocol reduced both communication and computation costs. We also provided a security analysis to demonstrate that our E-AUA protocol is secure and meets a variety of security requirements in a motivated mobile IoT scenario.

To secure the communications of home area networks, cryptographic keys need to be established between smart home devices. Though many key agreement schemes have been proposed, they cannot be directly implemented, due to the reason that in some applications, smart home devices have no access to the online trusted third party. Moreover, in certain scenarios, the smart home devices are manufactured by different factories. As a result, it is a challenge to securely establish the communication keys using the secrets preloaded by different factories. A few key agreement schemes are designed without using the online trusted third party and the preloaded secrets. However, there are some problems in these schemes. In this article, we improve these schemes and design a key agreement scheme for smart homes such that the devices can automatically and securely establish the communication key. Specifically, our scheme is designed by making use of the secret mismatch problem (exists in the physical layer secret extraction schemes). We prove the security of the proposed scheme and present a prototype implementation. Additionally, we analyze the performance of our scheme and compare it with that of other related works. The comparison shows that our key agreement scheme can fix the problems in the related works, however, it introduces some extra communication consumptions.

Network traffic classification plays a significant role in cyber security applications and management scenarios. Conventional statistical classification techniques rely on the assumption that clean labelled samples are available for building classification models. However, in the big data era, mislabelled training data commonly exist due to the introduction of new applications and lack of knowledge. Existing statistical traffic classification techniques do not address the problem of mislabelled training data, so their performance become poor in the presence of mislabelled training data. To meet this challenge, in this paper, we propose a new scheme, Noise-resistant Statistical Traffic Classification (NSTC), which incorporates the techniques of noise elimination and reliability estimation into traffic classification. NSTC estimates the reliability of the remaining training data before it builds a robust traffic classifier. Through a number of traffic classification experiments on two real-world traffic data sets, the results show that the new NSTC scheme can effectively address the problem of mislabelled training data. Compared with the state of the art methods, NSTC can significantly improve the classification performance in the context of big unclean data.

Android users are increasingly concerned with the privacy of their data and security of their devices. To improve the security awareness of users, recent automatic techniques produce security-centric descriptions by performing program analysis. However, the generated text does not always address users’ concerns as they are generally too technical to be understood by ordinary users. Moreover, different users have varied linguistic preferences that do not match the text. Motivated by this challenge, we develop an innovative scheme to help users avoid malware and privacy-breaching apps by generating security descriptions that explain the privacy and security related aspects of an Android app in clear and understandable terms. We implement a prototype system, PERSCRIPTION, to generate personalised security-centric descriptions that automatically learn users’ security concerns and linguistic preferences to produce user-oriented descriptions. We evaluate our scheme through experiments and user studies. The results clearly demonstrate the improvement on readability and users’ security awareness of PERSCRIPTION’s descriptions compared to existing description generators.

Data sharing in cloud computing enables multiple participants to freely share the group data, which improves the efficiency of work in cooperative environments and has widespread potential applications. However, how to ensure the security of data sharing within a group and how to efficiently share the outsourced data in a group manner are formidable challenges. Note that key agreement protocols have played a very important role in secure and efficient group data sharing in cloud computing. In this paper, by taking advantage of the symmetric balanced incomplete block design (SBIBD), we present a novel block design-based key agreement protocol that supports multiple participants, which can flexibly extend the number of participants in a cloud environment according to the structure of the block design. Based on the proposed group data sharing model, we present general formulas for generating the common conference key IC for multiple participants. Note that by benefiting from the (v, k + 1, 1)-block design, the computational complexity of the proposed protocol linearly increases with the number of participants and the communication complexity is greatly reduced. In addition, the fault tolerance property of our protocol enables the group data sharing in cloud computing to withstand different key attacks, which is similar to Yi's protocol.

As more and more people rely on social networks for business and life, social worms constitute one of the major security threats to our society. Modern social worms exhibit two new features,message notificationandthe temporal characteristic of human mobility. Message notification indicates a user will get a reminder once a new message comes to a social account. The temporal characteristic of human mobility indicates a user can operate corresponding computer in different locations with different resting time. Previous scholars have proposed some analytical models for the propagation dynamics of social worms. However, they did not consider the above two features and there is one critical problem unrealized, which isstructural imperfection of network topology. Previous models have not taken into account the hierarchical topology structure, which results from a many-to-many relationship between users and hosts. To address these problems, we model propagation dynamics of social worms oriented hierarchical networks in this paper, and the proposed model accurately describes the propagation behavior of social worms. We conduct both a theoretical analyses and extensive simulations to show our model can overcome inaccuracy in the number of infected nodes and provide a stronger approximation for the worm propagation. The results show that our model presented in this paper achieves a greater accuracy in characterizing the propagation of modern social worms.

Special Issue on Intelligent Edge Computing for Cyber Physical and Cloud SystemsCyber Physical Systems (CPS) and Cloud Computing have received tremendous research interest and efforts from both academia and industry.Cloud computing extends the computing and storage ability of CPS and leads to a new paradigm-Cyber Physical and Cloud Systems (CPCS), which is a product of combining CPS and Cloud Computing together.It enables a new breed of applications and services, such as industrial process control, video surveillance, structural health monitoring, and intelligent agriculture, and can fundamentally change the way that people interact with the physical world.However, CPCS face many important challenges.First, the Cloud can neither manage CPS devices directly nor satisfy requirements of real-time.Second, communication bottleneck exists between CPS and the Cloud.Third, new security challenges need to be overcome to accelerate the development of these integrated applications.In particular, edge computing, acting as a new computing scheme, is a promising technology to address these challenges.It extends the Cloud Computing paradigm to the edge of the network.For example, edge computing devices, which are capable of intelligent computing, can reduce the network latency by enabling computation and storage capacity at the edge network.These so-called edge devices can bridge the gap between CPS and Cloud.The intelligent computing and storage on edge devices offer the potential to solve the communication problem, real-time problem, and security problem.The accepted papers represent the urgent needs to be considered in developing an intelligent computing for edge devices and to fill the gap between CPS and Cloud.Moreover, the outcome of this special section exhibits the latest research achievements and state-of-art research results to solve intelligent computing issues for CPCS. INTELLIGENT COMPUTING FOR EDGE DEVICES IN CYBER PHYSICAL AND CLOUD SYSTEMSThrough a peer-review process, we have accepted 10 submissions, and each selected article has received at least two rounds of rigorous reviews.The accepted articles represent activities in areas around the world and propose various theoretical research results and applications on applying Intelligent Edge Computing for Cyber Physical and Cloud Systems in industrial informatics.A brief introduction is provided to each of the articles as follows:The first three articles introduce intelligent computing for edge devices in Cyber Physical and Cloud Systems.In "Deep Reinforcement Learning for Vehicular Edge Computing: An Intelligent Offloading System," Zhaolong Ning et al. construct an intelligent offloading system for vehicular edge computing in the development of smart vehicles, bringing a comfortable and safe environment to drivers and passengers.In this research, the author has investigated two-sided matching scheme and a deep reinforcement learning to solve sub-optimization problems.Numerical results demonstrate that the matching algorithm in the first module can reach 95% of the exhaustive algorithm in different network scenarios and decrease the execution time by more than 90%.For the

Crowdsourcing systems which utilize the human intelligence to solve complex tasks have gained considerable interest and adoption in recent years. However, the majority of existing crowdsourcing systems rely on central servers, which are subject to the weaknesses of traditional trust-based model, such as single point of failure. They are also vulnerable to distributed denial of service (DDoS) and Sybil attacks due to malicious users involvement. In addition, high service fees from the crowdsourcing platform may hinder the development of crowdsourcing. How to address these potential issues has both research and substantial value. In this paper, we conceptualize a blockchain-based decentralized framework for crowdsourcing named CrowdBC, in which a requester's task can be solved by a crowd of workers without relying on any third trusted institution, users' privacy can be guaranteed and only low transaction fees are required. In particular, we introduce the architecture of our proposed framework, based on which we give a concrete scheme. We further implement a software prototype on Ethereum public test network with real-world dataset. Experiment results show the feasibility, usability, and scalability of our proposed crowdsourcing system.

Large-scale smart computing is generally more vulnerable to cyber attacks since their system devices are normally distributed as networked platforms and each device could be a target and get compromised. Due to resource constraints (i.e., Sustainable Computing demand) and cost-efficiency issues (i.e., Green Computing demand), we usually monitor only a few devices (i.e., partial observation) to ensure all operations across different platforms are under a secure environment. This leads to a critical problem for detecting compromised devices that are out of surveillance. To the best of our knowledge, this problem has not been solved so far. In this paper, we propose an unsupervised classifier based on source-tracing technique (STC in short) to expose hidden compromised devices with partial observation on the networked sustainable green smart computing platforms. STC mainly focuses on the cyber threats that can spread in the platform and compromise various system devices. To expose hidden compromised devices that are out-of-surveillance, STC first captures the spreading source by the reverse dissemination technique, and then relies on microscopic propagation modelling to probabilistically identify the most probable compromised devices. We carried out a series of experiments to validate the performance of our proposed method. The evaluations are based on three real networked platforms: Air Traffic Control system, AS-level Internet platform, and US Power Grid. The experiment results demonstrated that STC can accurately expose the hidden compromised devices in terms of following aspects: 1) Source-tracing (more than 80 percent runs got exact real source and 95 percent within two hops of real source); 2) Modelling (very close to the simulation results); 3) Exposing accuracy (almost all > 90 percent); and 4) Comparison to baseline (superiority to three supervised and two unsupervised classifiers).

Machine learning (ML) is commonly used in multiple disciplines and real-world applications, such as information retrieval, financial systems, health, biometrics and online social networks. However, their security profiles against deliberate attacks have not often been considered. Sophisticated adversaries can exploit specific vulnerabilities exposed by classical ML algorithms to deceive intelligent systems. It is emerging to perform a thorough security evaluation as well as potential attacks against the machine learning techniques before developing novel methods to guarantee that machine learning can be securely applied in adversarial setting. In this paper, an effective attack strategy for crafting foreign support vectors in order to attack a classic ML algorithm, the Support Vector Machine (SVM) has been proposed with mathematical proof. The new attack can minimize the margin around the decision boundary and maximize the hinge loss simultaneously. We evaluate the new attack in different real-world applications including social spam detection, Internet traffic classification and image recognition. Experimental results highlight that the security of classifiers can be worsened by poisoning a small group of support vectors.

Network inference has been extensively studied to better understand the information diffusion in online social networks. In this field, state-of- art widely adopted a priori knowledge related to users' infection timestamps. Researchers also assume that the smaller the time difference between two nodes, the higher the likelihood of an edge between the pair of users. However, according to our technical analyses and empirical studies, existing methods have two critical problems 1) alternative spreading paths; 2) users' delivery delay, which leads to the inaccuracy of previous methods. In this paper, we developed an innovative method to address the inference inaccuracy caused by the exposed two problems. This method determined the existence of an edge between a pair of users according to part of the users' features. The experiment results suggested that our method achieved around 70% accuracy in inferring network structures while existing methods failed in the same tasks.

Summary With the large volume of network traffic flow, it is necessary to preprocess raw data before classification to gain the accurate results speedily. Feature selection is an essential approach in preprocessing phase. The principal component analysis (PCA) is recognized as an effective and efficient method. In this paper, we classify network traffic flows by using the PCA technique together with 6 machine learning algorithms—Naive Bayes, decision tree, 1‐nearest neighbor, random forest, support vector machine, andH2O. We analyzed the impact of PCA on the classification results by applying each algorithm with and without PCA onto the data set. Experiments were set out by varying the size of input data sets, and the performances were measured from 2 aspects, including average overall accuracy and F‐measure. The computational time was also considered in analyzing the performance. Our results showed that random forest and 1‐nearest neighbor were the top 2 algorithms among all the 6 regarding the 2 metrics mentioned above. Then we continued the study of PCA impact on per class level with these 2 algorithms as examples. And the positive correlation between overall impact and the number of class with significant impact was revealed. Lastly, the visualization was used in exploring the reasons of the impacts caused by PCA. Two factors are considered in PCA's impact on per class level: benefit for classes grouped by PCA and mislabeled error interfered by nearby groups.

The concept of the Social Internet of Things (SIoT) can be viewed as the integration of prevailing social networking and the Internet of Things, which is making inroads into the daily operation of many industries. Smart grids, which are cost-effective and environmentally friendly applications, are a promising field of the SIoT. However, security and privacy concerns are the dark aspects of smart grids. The goal of this paper is to address the security and privacy issues in the vehicle-togrid (V2G) networks with the intention of promoting a more extensive deployment of V2G networks for smart grids. Driven by this motivation, in this paper, we propose a robust key agreement protocol that can achieve mutual authentication without exposing the real identities of users. Efficiency is also a major concern in resource-constrained environments. By leveraging only hash functions and bitwise exclusive-OR operations, the proposed protocol is highly efficient compared with pairing-based protocols. In addition, we define a formal security model for our privacy-preserving key agreement protocol for V2G networks. Using this model, a formal security analysis shows that the proposed protocol is secure. Moreover, an informal security analysis demonstrates that our protocol can withstand different types of attacks.

With the advance of database-as-a-service (DaaS) and cloud computing, increasingly more data owners are motivated to outsource their data to cloud database for great convenience and economic savings. Many encryption schemes have been proposed to process SQL queries over encrypted data in the database. In order to obtain the desired data, the SQL queries contain some statements to describe the requirement, e.g., arithmetic and comparison operators ( + , - , × , < , > , and = ). However, to support different operators ( + , - , × , < , > , and = ) in SQL queries over encrypted data, multiple encryption schemes need to be combined and adjusted to work together. Moreover, repeated encryptions will reduce the efficiency of execution. This paper presents a practical and secure homomorphic order-preserving encryption (FHOPE) scheme, which allows cloud server to perform complex SQL queries that contain different operators (such as addition, multiplication, order comparison, and equality checks) over encrypted data without repeated encryption. These operators are data interoperable, so they can be combined to formulate complex SQL queries. We conduct security analysis and efficiency evaluation of the proposed scheme FHOPE. The experiment results show that, compared with the existing approaches, the FHOPE scheme incurs less overhead on computation and communication. It is suitable for large batch complex SQL queries over encrypted data in cloud environment.

Non peer reviewed

Identifying rumor sources in social networks plays a critical role in limiting the damage caused by them through the timely quarantine of the sources. However, the temporal variation in the topology of social networks and the ongoing dynamic processes challenge our traditional source identification techniques that are considered in static networks. In this paper, we borrow an idea from criminology and propose a novel method to overcome the challenges. First, we reduce the time-varying networks to a series of static networks by introducing a time-integrating window. Second, instead of inspecting every individual in traditional techniques, we adopt a reverse dissemination strategy to specify a set of suspects of the real rumor source. This process addresses the scalability issue of source identification problems, and therefore dramatically promotes the efficiency of rumor source identification. Third, to determine the real source from the suspects, we employ a novel microscopic rumor spreading model to calculate the maximum likelihood (ML) for each suspect. The one who can provide the largest ML estimate is considered as the real source. The evaluations are carried out on real social networks with time-varying topology. The experiment results show that our method can reduce 60 - 90 percent of the source seeking area in various time-varying social networks. The results further indicate that our method can accurately identify the real source, or an individual who is very close to the real source. To the best of our knowledge, the proposed method is the first that can be used to identify rumor sources in time-varying social networks.

The nine papers included in this special section focus on cyber security methods to protect social network services. The emerging paradigm of social network provides an enormous number of novel approaches to implementing advanced networking communications and data analysis schemes efficiently using existing datasets, networks, and infrastructure. Social networks have had a great impact on people’s daily life and global businesses, as has been addressed by recent research. However, the security issue is also a critical concern when adopting social network technologies in practice. Considering the uniqueness of social networks, the mechanism is now facing a variety of security challenges from multiple dimensions, such as mobile apps, wireless communication, cloud systems, big data, and security operations. Compared with traditional security issues, the applications of social networks are operated in a dynamic circumstance involving different internal and external inputs and factors, which requires new security mechanisms in distinct operational environments. The complexity of the technical implementations may result in unexpected consequences when adopting social network technologies. It is therefore important for current researchers and practitioners to address the security issues and seek out efficient ways to handle different hazards. For the purpose of preventing social network-based solutions from the threats of social networks, a variety of cyber security approaches or mechanism have been proposed.

Machine learning is now widely used to detect security vulnerabilities in the software, even before the software is released. But its potential is often severely compromised at the early stage of a software project when we face a shortage of high-quality training data and have to rely on overly generic hand-crafted features. This paper addresses this cold-start problem of machine learning, by learning rich features that generalize across similar projects. To reach an optimal balance between feature-richness and generalizability, we devise a data-driven method including the following innovative ideas. First, the code semantics are revealed through serialized abstract syntax trees (ASTs), with tokens encoded by Continuous Bag-of-Words neural embeddings. Next, the serialized ASTs are fed to a sequential deep learning classifier (Bi-LSTM) to obtain a representation indicative of software vulnerability. Finally, the neural representation obtained from existing software projects is then transferred to the new project to enable early vulnerability detection even with a small set of training labels. To validate this vulnerability detection approach, we manually labeled 457 vulnerable functions and collected 30 000+ nonvulnerable functions from six open-source projects. The empirical results confirmed that the trained model is capable of generating representations that are indicative of program vulnerability and is adaptable across multiple projects. Compared with the traditional code metrics, our transfer-learned representations are more effective for predicting vulnerable functions, both within a project and across multiple projects.

Location-based service (LBS) has gained increasing popularity recently, but protecting users' privacy in LBS remains challenging. Depending on whether a trusted third party (TTP) is used, existing solutions can be classified into: TTP-based and TTP-free. The former relies on a TTP for user privacy protection, which creates a single-point-failure and is thus impractical in reality. The latter does not require any TTP, but usually introduces redundant point-of-interest (POI) records in query result and thus incurs significant computation and communication costs on the user side, making them unsuitable for resource-constrained mobile devices. In this paper, we propose a novel framework to protect user privacy while ensuring efficiency. Our framework also uses redundant POI records to protect privacy against LBS provider but employs a semi-trusted third party, called proxy, to filter out redundant POI records. To protect privacy against proxy, we design a novel filtering protocol, Blind filter, to allow the proxy to filter out redundant encrypted POI records in a blind way. In comparison with existing solutions, our framework is not only resilient to dual identity attack, but also incurs lower communication and computation overhead. Comprehensive analysis and experiments show that our framework is secure and highly efficient in mobile environments.

In cybersecurity, vulnerability discovery in source code is a fundamental problem. To automate vulnerability discovery, Machine learning (ML) based techniques has attracted tremendous attention. However, existing ML-based techniques focus on the component or file level detection, and thus considerable human effort is still required to pinpoint the vulnerable code fragments. Using source code files also limit the generalisability of the ML models across projects. To address such challenges, this paper targets at the function-level vulnerability discovery in the cross-project scenario. A function representation learning method is proposed to obtain the high-level and generalizable function representations from the abstract syntax tree (AST). First, the serialized ASTs are used to learn project independence features. Then, a customized bi-directional LSTM neural network is devised to learn the sequential AST representations from the large number of raw features. The new function-level representation demonstrated promising performance gain, using a unique dataset where we manually labeled 6000+ functions from three open-source projects. The results confirm that the huge potential of the new AST-based function representation learning.

People are suffering from a range of risks in the ubiquitous networks of current world, such as rumours spreading in social networks, computer viruses propagating throughout the Internet and unexpected failures happened in Smart grids. We usually monitor only a few users of detecting various risks due to the resource constraints and privacy protection. This leads to a critical problem to detect compromised users who are out of surveillance. In this paper, we propose a risk assessment method to address this problem. The aim is to assess the security status of unmonitored users according to the limited information collected from monitored users in networks. There are two innovative techniques developed: First, we identify the source of risk propagation by inversely disseminating risks from the influenced (by rumours) or infected (by viruses) monitored users. We show a new finding that the ones who synchronously receive the risk copies from all monitored users are most likely to be the sources. Second, we propose a microscopic mathematical model to present the risk propagation from the exposed sources. This model forms a discriminant to classify the compromised users from others. For evaluations, we collect three real networks on which we launch simulated risk propagation and then sample the status of monitored users. The experiment results show that our method is effective and the result of risk assessment well matches the real status of the unmonitored users.

Summary With the advantages of extremely high access speed, low energy consumption, nonvolatility, and byte addressability, nonvolatile memory (NVM) device has already been setting off a revolution in storage field. Conventional storage architecture needs to be optimized or even redesigned from scratch to fully explore the performance potential of NVM device. However, most previous NVM‐related works only explore its low access latency and low energy consumption. Few works have been done to explore the appropriate way to use NVM device for improving virtual machine's storage performance. In this paper, we comprehensively evaluate and analyze conventional virtual machine's storage architecture. We find that, even with cutting‐edge optimization technologies, virtual machine can only achieve 30% of NVM device's original performance. Based on this observation, we propose a memory bus–based storage architecture, which we named MBSA. Memory bus–based storage architecture can greatly shorten the length of virtual machine's storage input/output stack and improve NVM device's use flexibility. In addition, an efficient wear‐leveling algorithm is proposed to prolong NVM device's lifespan. To evaluate the new architecture, we implement it as well as the wear‐leveling algorithm on real hardware and software platform. Experimental results show that MBSA can provide a big performance improvement, about 2.55X, and the wear‐leveling algorithm can efficiently balance write operations on NVM device with a negligible performance overhead (no more than 3%).

Summary Scale‐free networks are often used to model a wide range of real‐world networks, such as social, technological, and biological networks. Understanding the structure of scale‐free networks evolves into a big data problem for business, management, and protein function prediction. In the past decade, there has been a surge of interest in exploring the properties of scale‐free networks. Two interesting properties have attracted much attention: the assortative mixing and community structure. However, these two properties have been studied separately in either theoretical models or real‐world networks. In this paper, we show that the structural features of communities are highly related with the assortative mixing in scale‐free networks. According to the value of assortativity coefficient, scale‐free networks can be categorized into assortative, disassortative, and neutral networks, respectively. We systematically analyze the community structure in these three types of scale‐free networks through six metrics: node embeddedness, link density, hub dominance, community compactness, the distribution of community sizes, and the presence of hierarchical communities. We find that the three types of scale‐free networks exhibit significant differences in these six metrics of community structures. First, assortative networks present high embeddedness, meaning that many links lying within communities but few links lying between communities. This leads to the high link density of communities. Second, disassortative networks exhibit great hubs in communities, which results in the high compactness of communities that nodes can reach each other via short paths. Third, in neutral networks, a big portion of links act as community bridges, so they display sparse and less compact communities. In addition, we find that (dis)assortative networks show hierarchical community structure with power‐law‐distributed community sizes, while neutral networks present no hierarchy. Understanding the structure of communities from the angle of assortative mixing patterns of nodes can provide insights into the network structure and guide us in modeling information propagation in different categories of scale‐free networks. Copyright © 2016 John Wiley & Sons, Ltd.

Summary Twitter spam has long been a critical but difficult problem to be addressed. So far, researchers have developed a series of machine learning–based methods and blacklisting techniques to detect spamming activities on Twitter. According to our investigation, current methods and techniques have achieved the accuracy of around 87%. However, because of the problems of spam drift and information fabrication, these machine learning–based methods cannot efficiently detect spam activities in real‐life scenarios. Meanwhile, the blacklisting method also cannot catch up with the variations of spamming activities, as manually inspecting suspicious URLs is extremely timeconsuming. In this paper, we proposed a novel technique based on deep‐learning technique to address the above challenges. The syntax of each tweet will be learned through WordVector and trained by deep learning. We then constructed a binary classifier to differentiate spam and regular tweets. In experiments, we collected and labeled a 10‐day real tweet dataset as ground truth to evaluate our proposed method. We first went for empirical analysis with a series of comparisons to other methods: (1) performance of different classifiers, (2) other existing text‐based methods, and (3) nontext‐based detection techniques. According to the experiment results, our proposed method largely outperformed previous methods. We further conducted principle component analysis on typical methods to theoretically justify the outperformance of our method. We extracted all kinds of features via dimensionality reduction. It was found that our features were most distinct among all the detection methods. This well demonstrated the outperformance of our method.

This special issue collates a selection of representative research articles that were primarily presented at the 9th International Conference on Network and System Security. This annual conference brings together researchers and practitioners from both academia and industry who are working on security and privacy in computer systems and social networks, in order to promote an exchange of ideas, discuss future collaborations, and develop new research directions.

In today's world of the internet, billions of computer systems are connected to one another in a global network. The internet provides an unsecured channel in which hundreds of terabytes of data is being transmitted daily. Computer and software systems rely on encryption algorithms such as block ciphers to ensure that sensitive data remains confidential and secure. However, adversaries can leverage the statistical behavior of underlying ciphers to recover encryption keys. Accurate evaluation of the security margins of these encryption algorithms remains to be a big challenge. In this paper, we tackle this issue by introducing several searching strategies based on differential cryptanalysis. By clustering differential paths, the searching algorithm derives more accurate distinguishers as compared to examining individual paths, which in turn provides a more accurate estimation of cipher security margins. We verify the effectiveness of this technique on ciphers with the generalized Feistel and SPN structures, whereby the best distinguishers for each of the investigated ciphers were obtained by discovering clusters with thousands of paths. With the KATAN block cipher family as a test case, we also show how to apply the searching algorithm alongside other cryptanalysis techniques such as the boomerang attack and related-key model to obtain the best cryptanalytic results. This also depicts the flexibility of the proposed searching scheme, which can be tailored to improve upon other differential attack variants. In short, the proposed searching strategy realizes an automated security evaluation tool with higher accuracy compared to previous techniques. In addition, it is applicable to a wide range of encryption schemes which makes it a flexible tool for both academic research and industrial purposes.

Privacy becomes one of the major concerns of cloud-based multimedia applications such as cloud video surveillance. Privacy protection of surveillance videos aims to protect privacy information without hampering normal processing tasks of the cloud. Privacy Region Protection only protects the privacy region while keeping the non-privacy region visually intact to facilitate processing in the cloud. However, full reversibility, i.e. the complete recovery of the original video which is critical to digital investigation and law enforcement has not been properly addressed in privacy region protection. In this paper, we introduce fully reversible privacy region protection into cloud video surveillance and propose a novel fully reversible privacy protection method for H.264/AVC compressed video. All the operations are performed in the compressed domain and avoid lossy re-encoding, so the original H.264/AVC compressed video can be fully recovered. To our best knowledge, the proposed scheme is the first fully reversible one for privacy region protection. Experimental results and performance comparison demonstrate the effectiveness and efficiency of the proposed approach.

With the popularity of cloud computing, there have been increasing concerns about its security and privacy. Since the cloud computing environment is distributed and untrusted, data owners have to encrypt outsourced data to enforce confidentiality. Therefore, how to achieve practicable access control of encrypted data in an untrusted environment is an urgent issue that needs to be solved. Attribute-based encryption (ABE) is a promising scheme suitable for access control in cloud storage systems. This paper proposes a hierarchical attribute-based access control scheme with constant-size ciphertext. The scheme is efficient because the length of ciphertext and the number of bilinear pairing evaluations to a constant are fixed. Its computation cost in encryption and decryption algorithms is low. Moreover, the hierarchical authorization structure of our scheme reduces the burden and risk of a single authority scenario. We prove the scheme is of CCA2 security under the decisional q-Bilinear Diffie-Hellman Exponent assumption. In addition, we implement our scheme and analyse its performance. The analysis results show the proposed scheme is efficient, scalable, and fine-grained in dealing with access control for outsourced data in cloud computing.

While the increasing digitalization of our society and amalgamation of embedded devices into the ever-increasing facets of our daily life (e.g., in smart and intelligent vehicles, smart cities and smart nations, and critical infrastructure sectors) have resulted in improved productivity and quality of life, the trend has also resulted in a trend of increasing frequency and sophistication of cyber exploitation and cyber threats. Hence, there is a need for coordinated efforts from the research community to address resulting concerns using both cryptographic and non-cryptographic solutions, such as those presented in this special section.

Class imbalance and missing values are two critical problems in pattern classification. Researchers have proposed a number of techniques to address each of the problems. However, no single technique can solve the two problems. Moreover, the simple combination approach cannot accurately classify the imbalanced data with missing values. This paper develops a fuzzy-based information decomposition (FID) method to simultaneously address these two problems. In the new FID method, the two different problems are treated as the same missing data estimation problem. In particular, FID rebalances the training data by creating synthetic samples for the minority class. The proposed scheme has two steps: weighting and recovery. In the weighting step, the weights produced by the fuzzy membership functions are used to quantify the contribution of the observed data to the missing estimation. In the recovery step, missing values will be estimated by taking into account different contribution of the observed data. To evaluate the performance of the new FID method, a large number of classification experiments have been carried out on 27 well-known datasets. The results show that the FID method significantly outperforms other ten state-of-the-art individual methods and eight combination methods when missing values and imbalanced data present at the same time.

Twitter spam has become a critical problem nowadays. Recent works focus on applying machine learning techniques for Twitter spam detection, which make use of the statistical features of tweets. In our labeled tweets data set, however, we observe that the statistical properties of spam tweets vary over time, and thus, the performance of existing machine learning-based classifiers decreases. This issue is referred to as “Twitter Spam Drift”. In order to tackle this problem, we first carry out a deep analysis on the statistical features of one million spam tweets and one million non-spam tweets, and then propose a novel Lfun scheme. The proposed scheme can discover “changed” spam tweets from unlabeled tweets and incorporate them into classifier's training process. A number of experiments are performed to evaluate the proposed scheme. The results show that our proposed Lfun scheme can significantly improve the spam detection accuracy in real-world scenarios.

Due to the critical security threats imposed by social worms, such as Twitter and Facebook, modeling and simulation study of the propagation dynamics of social worms is essential to predict their potential for damage and to understand the propagation characteristics. Modern social worms exhibit one new feature,reinfection-notification. It indicates that malicious messages are sent by neighbors whenever any susceptible or infected recipients open the malicious attachments, and a user will get reminders when new messages come to a social account. Meanwhile, there are two critical problems:dynamic host usageandtemporal message processing. First, from aspatialperspective, previous models have not taken into account that public hosts in different locations are shared by several users arising from human mobility, namely,dynamic host usage. Second, from atemporalperspective, the problem of temporal message processing results from the improper assumption that during this period of message checking, unread messages all are read by default, or under the condition that some parts of messages have been read, but the rest of unread messages are no longer processed afterward. To address these problems, we present a novel social worm simulation model in this paper, which adopts “social network-based sharing” and “sorting and attenuation” methods. We perform comprehensive theoretical analyses and experimental evaluation to validate our simulation model. The results show that our model is more suitable for modeling the complicated propagation behaviors of modern social worms in hierarchical networks.

Vehicular ad-hoc networks (VANETs) have drawn much attention of researchers. The vehicles in VANETs frequently join and leave the networks, and therefore restructure the network dynamically and automatically. Forwarded messages in vehicular ad-hoc networks are primarily multimedia data, including structured data, plain text, sound, and video, which require access control with efficient privacy preservation. Ciphertext-policy attribute-based encryption (CP-ABE) is adopted to meet the requirements. However, solutions based on traditional CP-ABE suffer from challenges of the limited computational resources on-board units equipped in the vehicles, especially for the complex policies of encryption and decryption. In this paper, we propose a CP-ABE delegation scheme, which allows road side units (RSUs) to perform most of the computation, for the purpose of improving the decryption efficiency of the vehicles. By using decision tree to jointly optimize multiple factors, such as the distance from RSU, the communication and computational cost, the CP-ABE delegation scheme is adaptively activated based on the estimation of various vehicles decryption overhead. Experimental results thoroughly demonstrate that our scheme is effective and efficient for multimedia data forwarding in vehicular ad-hoc networks with privacy preservation.

As we enter the era of many-core, providing the shared memory abstraction through cache coherence has become progressively difficult. The standard directory-based coherence does not scale well with increasing core count. Timestamp-based hardware coherence protocols introduced recently offer an attractive alternative solution. This paper proposes a timestamp-based coherence protocol, called TC-Release++, that efficiently supports cache coherence in large-scale systems. Our approach is inspired by TC-Weak, a recently proposed timestamp-based coherence protocol targeting GPU architectures. We first design TC-Release in an attempt to straightforwardly port TC-Weak to general-purpose many-cores. But re-purposing TC-Weak for general-purpose many-core architectures is challenging due to significant differences both in architecture and the programming model. Indeed the performance of TC-Release turns out to be worse than conventional directory protocols. We overcome the limitations and overheads of TC-Release by exploiting simple hardware support to eliminate frequent memory stalls, and an optimized lifetime prediction mechanism to improve cache performance. The resulting optimized coherence protocol TC-Release++is highly scalable (storage scales logarithmically with core count) and shows better performance (3.0 percent) and comparable network traffic (within 1.3 percent) relative to the baseline MESI directory protocol. We use Murphi to formally verify that TC-Release++is error-free and imposes small verification cost.

Spam has become a critical problem in online social networks. This paper focuses on Twitter spam detection. Recent research works focus on applying machine learning techniques for Twitter spam detection, which make use of the statistical features of tweets. We observe existing machine learning based detection methods suffer from the problem of Twitter spam drift, i.e., the statistical properties of spam tweets vary over time. To avoid this problem, an effective solution is to train one twitter spam classifier every day. However, it faces a challenge of the small number of imbalanced training data because labelling spam samples is time-consuming. This paper proposes a new method to address this challenge. The new method employs two new techniques, fuzzy-based redistribution and asymmetric sampling. We develop a fuzzy-based information decomposition technique to re-distribute the spam class and generate more spam samples. Moreover, an asymmetric sampling technique is proposed to re-balance the sizes of spam samples and non-spam samples in the training data. Finally, we apply the ensemble technique to combine the spam classifiers over two different training sets. A number of experiments are performed on a real-world 10-day ground-truth dataset to evaluate the new method. Experiments results show that the new method can significantly improve the detection performance for drifting Twitter spam.

The goal of this special issue is to collate a selection of representative research articles that were primarily presented at the 8th International Conference on Network and System Security (NSS 2014). This annual conference brings together researchers and practitioners in the world from both academia and industry who are working on network and system security, in order to foster interaction between researchers and developers, promote an exchange of ideas, discuss future collaborations, and develop new research directions.

The purpose of this special issue is to collate a selection of representative research articles that were primarily presented at the 12th IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom 2013). This annual conference brings together researchers and practitioners in the world from both academia and industry who are working on trusted computing and communications in computer systems and networks, in order to promote an exchange of ideas, discuss future collaborations, and develop new research directions.

Anomaly detection as a kind of intrusion detection is good at detecting the unknown attacks or new attacks, and it has attracted much attention during recent years. In this paper, a new hierarchy anomaly intrusion detection model that combines the fuzzy c-means (FCM) based on genetic algorithm and SVM is proposed. During the process of detecting intrusion, the membership function and the fuzzy interval are applied to it, and the process is extended to soft classification from the previous hard classification. Then a fuzzy error correction sub interval is introduced, so when the detection result of a data instance belongs to this range, the data will be re-detected in order to improve the effectiveness of intrusion detection. Experimental results show that the proposed model can effectively detect the vast majority of network attack types, which provides a feasible solution for solving the problems of false alarm rate and detection rate in anomaly intrusion detection model. Copyright © 2016 John Wiley & Sons, Ltd.

Privacy preserving in cloud computing environment

In this paper, we propose a two-factor data security protection mechanism with factor revocability for cloud storage system. Our system allows a sender to send an encrypted message to a receiver through a cloud storage server. The sender only needs to know the identity of the receiver but no other information (such as its public key or its certificate). The receiver needs to possess two things in order to decrypt the ciphertext. The first thing is his/her secret key stored in the computer. The second thing is a unique personal security device which connects to the computer. It is impossible to decrypt the ciphertext without either piece. More importantly, once the security device is stolen or lost, this device is revoked. It cannot be used to decrypt any ciphertext. This can be done by the cloud server which will immediately execute some algorithms to change the existing ciphertext to be un-decryptable by this device. This process is completely transparent to the sender. Furthermore, the cloud server cannot decrypt any ciphertext at any time. The security and efficiency analysis show that our system is not only secure but also practical.

Access control is an indispensable security component of cloud computing, and hierarchical access control is of particular interest since in practice one is entitled to different access privileges. This paper presents a hierarchical key assignment scheme based on linear-geometry as the solution of flexible and fine-grained hierarchical access control in cloud computing. In our scheme, the encryption key of each class in the hierarchy is associated with a private vector and a public vector, and the inner product of the private vector of an ancestor class and the public vector of its descendant class can be used to derive the encryption key of that descendant class. The proposed scheme belongs to direct access schemes on hierarchical access control, namely each class at a higher level in the hierarchy can directly derive the encryption key of its descendant class without the need of iterative computation. In addition to this basic hierarchical key derivation, we also give a dynamic key management mechanism to efficiently address potential changes in the hierarchy. Our scheme only needs light computations over finite field and provides strong key indistinguishability under the assumption of pseudorandom functions. Furthermore, the simulation shows that our scheme has an optimized trade-off between computation consumption and storage space.

Presents correcttions to the paper, “A performance evaluation of machine learning-based streaming spam tweets detection,” (Chen ], C.; et al) , IEEE Trans. Comput. Social Syst., vol. 2, no. 3, pp. 65–76, Sep. 2015.

Sensor networks are a branch of distributed ad hoc networks with a broad range of applications in surveillance and environment monitoring. In these networks, message exchanges are carried out in a multi-hop manner. Due to resource constraints, security professionals often use lightweight protocols, which do not provide adequate security. Even in the absence of constraints, designing a foolproof set of protocols and codes is almost impossible. This leaves the door open to the worms that take advantage of the vulnerabilities to propagate via exploiting the multi-hop message exchange mechanism. This issue has drawn the attention of security researchers recently. In this paper, we investigate the propagation pattern of information in wireless sensor networks based on an extended theory of epidemiology. We develop a geographical susceptible-infective model for this purpose and analytically derive the dynamics of information propagation. Compared with the previous models, ours is more realistic and is distinguished by two key factors that had been neglected before: 1) the proposed model does not purely rely on epidemic theory but rather binds it with geometrical and spatial constraints of real-world sensor networks and 2) it extends to also model the spread dynamics of conflicting information (e.g., a worm and its patch). We do extensive simulations to show the accuracy of our model and compare it with the previous ones. The findings show the common intuition that the infection source is the best location to start patching from, which is not necessarily right. We show that this depends on many factors, including the time it takes for the patch to be developed, worm/patch characteristics as well as the shape of the network.

Two-party password-authenticated key exchange (2PAKE) protocols provide a natural mechanism for secret key establishment in distributed applications, and they have been extensively studied in past decades. However, only a few efforts have been made so far to design password-authenticated group key exchange (GPAKE) protocols. In a 2PAKE or GPAKE protocol, it is assumed that short passwords are preshared among users. This assumption, however, would be impractical in certain applications. Motivated by this observation, this article presents a GPAKE protocol without the password sharing assumption. To obtain the passwords, wireless devices, such as smart phones, tablets, and laptops, are used to extract short secrets at the physical layer. Using the extracted secrets, users in our protocol can establish a group key at higher layers with light computation consumptions. Thus, our GPAKE protocol is a cross-layer design. Additionally, our protocol is a compiler, that is, our protocol can transform any provably secure 2PAKE protocol into a GPAKE protocol with only one more round of communications. Besides, the proposed protocol is proved secure in the standard model.

Collaborative Anomaly Detection CAD is an emerging field of network security in both academia and industry. It has attracted a lot of attention, due to the limitations of traditional fortress-style defense modes. Even though a number of pioneer studies have been conducted in this area, few of them concern about the universality issue. This work focuses on two aspects of it. First, a unified collaborative detection framework is developed based on network virtualization technology. Its purpose is to provide a generic approach that can be applied to designing specific schemes for various application scenarios and objectives. Second, a general behavior perception model is proposed for the unified framework based on hidden Markov random field. Spatial Markovianity is introduced to model the spatial context of distributed network behavior and stochastic interaction among interconnected nodes. Algorithms are derived for parameter estimation, forward prediction, backward smooth, and the normality evaluation of both global network situation and local behavior. Numerical experiments using extensive simulations and several real datasets are presented to validate the proposed solution. Performance-related issues and comparison with related works are discussed.

Twitter has changed the way of communication and getting news for people's daily life in recent years. Meanwhile, due to the popularity of Twitter, it also becomes a main target for spamming activities. In order to stop spammers, Twitter is using Google SafeBrowsing to detect and block spam links. Despite that blacklists can block malicious URLs embedded in tweets, their lagging time hinders the ability to protect users in real-time. Thus, researchers begin to apply different machine learning algorithms to detect Twitter spam. However, there is no comprehensive evaluation on each algorithms' performance for real-time Twitter spam detection due to the lack of large groundtruth. To carry out a thorough evaluation, we collected a large dataset of over 600 million public tweets. We further labelled around 6.5 million spam tweets and extracted 12 light-weight features, which can be used for online detection. In addition, we have conducted a number of experiments on six machine learning algorithms under various conditions to better understand their effectiveness and weakness for timely Twitter spam detection. We will make our labelled dataset for researchers who are interested in validating or extending our work.

The past decade has seen a lot of research on statistics-based network protocol identification using machine learning techniques. Prior studies have shown promising results in terms of high accuracy and fast classification speed. However, most works have embodied an implicit assumption that all protocols are known in advance and presented in the training data, which is unrealistic since real-world networks constantly witness emerging traffic patterns as well as unknown protocols in the wild. In this paper, we revisit the problem by proposing a learning scheme with unknown pattern extraction for statistical protocol identification. The scheme is designed with a more realistic setting, where the training dataset contains labeled samples from a limited number of protocols, and the goal is to tell these known protocols apart from each other and from potential unknown ones. Preliminary results derived from real-world traffic are presented to show the effectiveness of the scheme.

Summary Hybrid storage systems that consist of flash‐based solid state drives (SSDs) and traditional disks are now widely used. In hybrid storage systems, there exists a two‐level cache hierarchy that regard dynamic random access memory (DRAM) as the first level cache and SSD as the second level cache for disk storage. However, this two‐level cache hierarchy typically uses independent cache replacement policies for each level, which makes cache resource management inefficient and reduces system performance. In this paper, we propose a novel adaptive multi‐level cache (AMC) replacement algorithm in hybrid storage systems. The AMC algorithm adaptively adjusts cache blocks between DRAM and SSD cache levels using an integrated solution. AMC uses combined selective promote and demote operations to dynamically determine the level in which the blocks are to be cached. In this manner, the AMC algorithm achieves multi‐level cache exclusiveness and makes cache resource management more efficient. By using real‐life storage traces, our evaluation shows the proposed algorithm improves hybrid multi‐level cache performance and also increases the SSD lifetime compared with traditional multi‐level cache replacement algorithms. Copyright © 2015 John Wiley & Sons, Ltd.

The increasing complexity of computer systems and communication networks induces tremendous requirements for trust and security. This special issue includes topics on trusted computing, risk and reputation management, network security and survivable computer systems/networks. These issues have evolved into an active and important area of research and development. The past decade has witnessed a proliferation of concurrency and computation systems for practice of highly trust, security and privacy, which has become a key subject in determining future research and development activities in many academic and industrial branches. This special issue aims to present and discuss advances of current research and development in all aspects of trusted computing and network security. In addition, this special issue provides snapshots of contemporary academia work in the field of network trusted computing. We prepared and organized this special issue to record state-of-the-art research, novel development and trends for future insight in this domain. In this special issue, 14 papers have been accepted for publication, which demonstrate novel and original work in this field. A detailed overview of the selected works is given below.

Availability, resilience, and fault tolerance of internet and distributed computing systemsThe emergence of Web as a ubiquitous platform for innovations has laid the foundation for the rapid growth of the Internet.Side-by-side, the use of mobile and wireless devices such as PDAs, laptops, and cell phones for accessing the Internet has paved the ways for related technologies to flourish through recent developments.However, development of these technologies and systems adds complexity due to the performance, fault tolerance, and availability requirements.These issues are required to be explored for the effective design and implementation of high-performance modern computing systems.In this special issue, we are delighted to present ten technical papers on resilient, highly available, and fault-tolerant Internet and distributed systems, with a particular focus on the practical experiences with the design and implementation of related technologies as well as their theoretical perspectives.These papers were selected out of 80 submissions from 17 countries in the 6th International Conference on Internet and Distributed Computing Systems (IDCS 2013).The selection has been very rigorous, and only the best papers in the conference were selected.Performance and dependability evaluation plays a key role in the design of a broad range of systems, especially when strict requirements need to be met.In the first paper, 'Variable Operating Conditions in Distributed Systems: Modeling and Evaluation' [1], Longo et al. present an analytical method that allows the study of a class of systems where different operating conditions alternate changing the stochastic behavior of the system components but still preserving the continuity of the performance and dependability quantities to investigate.In the second paper, 'Supporting Personal Security Using Participatory Sensing' [2], Carreno et al. propose a mobile collaborative application, named Personal Guardian, which used by civilians while walking in urban areas.The application is focused on crime prevention, and it implements participatory sensing to help people be aware of the risks that appear to exist in a certain place.This is an interesting application on information feeding process and the unattended delivery of awareness information about personal security.In the third paper, 'Self-healing Wireless Sensor Networks' [3], A. Miyaji and K. Omote propose three self-healing schemes to provide availability in wireless sensor networks.This is very important for long-term use of wireless sensor networks.These self-healing schemes are effective and efficient according to the evaluations done by the authors.Smooth data streaming in wireless sensor networks is a challenging problem.In the fourth paper, 'A Slot Demand based Path Reservation Approach for the Timely and Reliable Delivery of Bursty Traffic in WSNs' [4], P. V. Vinh and H. Oh propose an efficient approach to deliver bursty data reliably by reserving time slots to transmit the required packets on all the paths from the selected multimedia nodes to the server.The nodes that are not on the selected paths are put into sleep mode to conserve energy during the transmission.In the fifth paper, 'SCRRM: A Stability-Aware Cooperative Routing Scheme for Reliable High-Speed Data Transmission in Multi-Rate Mobile Ad-hoc Wireless Networks' [5], L. T. Dung and B. An present a stability-aware cooperative routing scheme for reliable high-speed data transmission in multi-rate mobile ad-hoc wireless networks, called SCRRM, to provide high data transmission with stable and reliable routes.The performance evaluation shows that this scheme can adaptively select optimal data rate and outperforms single rate routing protocol in terms of packet delivery ratio, network throughput, and average end-to-end delay in all settings of node density and node mobility.

Abstract Locating the real source of the Internet attacks has long been an important but difficult problem to be addressed. In the real world, attackers can easily hide their identities and evade punishment by relaying their attacks through a series of compromised systems or devices called stepping stones. Currently, researchers mainly use similar features from the network traffic, such as packet timestamps and frequencies, to detect stepping stones. However, these features can be easily destroyed by attackers using evasive techniques. In addition, it is also difficult to implement an appropriate threshold of similarity that can help justify the stepping stones. In order to counter these problems, in this paper, we introduce the consistent causality probability to detect the stepping stones. We formulate the ranges of abnormal causality probabilities according to the different network conditions, and on the basis of it, we further implement to self‐adaptive methods to capture stepping stones. To evaluate our proposed detection methods, we adopt theoretic analysis and empirical studies, which demonstrate accuracy of the abnormal causality probability. Moreover, we compare our proposed methods with previous works. The result shows that our methods in this paper significantly outperform previous works in the accuracy of detection malicious stepping stones, even when evasive techniques are adopted by attackers. Copyright © 2014 John Wiley & Sons, Ltd.

Abstract With the widespread use of smartphones, the loss of a device is a critical problem, which results both in disrupting daily communications and losing valuable property. As a result, tracking systems have been developed to track mobile devices. Previous tracking systems focus on recovering the device's locations after it goes missing, with security methods implemented on the clients. However, users' locations are stored in untrusted third‐party services, which may be attacked or eavesdropped. In this paper, we propose a system, named Android Cloud Tracker, to provide a privacy‐preserving tracking client and safe storing of user's locations. We use cloud storage controlled by users themselves as storage facilities, and they do not need to worry about any untrusted third party. We implement Android Cloud Tracker prototype on Android phones, and the evaluation shows that it is both practical and lightweight: it generates a small amount of data flow and its distributed architecture provides strong guarantees of location privacy while preserving the ability to efficiently track missing devices. Copyright © 2014 John Wiley & Sons, Ltd.

Mobile virtualization has emerged fairly recently and is considered a valuable way to mitigate security risks on Android devices. However, major challenges in mobile virtualization include runtime, hardware, resource overhead, and compatibility. In this paper, we propose a lightweight Android virtualization solution named Condroid, which is based on container technology. Condroid utilizes resource isolation based on namespaces feature and resource control based on cgroups feature. By leveraging them, Condroid can host multiple independent Android virtual machines on a single kernel to support mutilple Android containers. Furthermore, our implementation presents both a system service sharing mechanism to reduce memory utilization and a filesystem sharing mechanism to reduce storage usage. The evaluation results on Google Nexus 5 demonstrate that Condroid is feasible in terms of runtime, hardware resource overhead, and compatibility. Therefore, we find that Condroid has a higher performance than other virtualization solutions.

In many network applications, the nature of traffic is of burst type. Often, the transient response of network to such traffics is the result of a series of interdependant events whose occurrence prediction is not a trivial task. The previous efforts in IEEE 802.15.4 networks often followed top-down approaches to model those sequences of events, i.e., through making top-view models of the whole network, they tried to track the transient response of network to burst packet arrivals. The problem with such approaches was that they were unable to give station-level views of network response and were usually complex. In this paper, we propose a non-stationary analytical model for the IEEE 802.15.4 slotted CSMA/CA medium access control (MAC) protocol under burst traffic arrival assumption and without the optional acknowledgements. We develop a station-level stochastic time-domain method from which the network-level metrics are extracted. Our bottom-up approach makes finding station-level details such as delay, collision and failure distributions possible. Moreover, network-level metrics like the average packet loss or transmission success rate can be extracted from the model. Compared to the previous models, our model is proven to be of lower memory and computational complexity order and also supports contention window sizes of greater than one. We have carried out extensive and comparative simulations to show the high accuracy of our model.

Data sharing has never been easier with the advances of cloud computing, and an accurate analysis on the shared data provides an array of benefits to both the society and individuals. Data sharing with a large number of participants must take into account several issues, including efficiency, data integrity and privacy of data owner. Ring signature is a promising candidate to construct an anonymous and authentic data sharing system. It allows a data owner to anonymously authenticate his data which can be put into the cloud for storage or analysis purpose. Yet the costly certificate verification in the traditional public key infrastructure (PKI) setting becomes a bottleneck for this solution to be scalable. Identity-based (ID-based) ring signature, which eliminates the process of certificate verification, can be used instead. In this paper, we further enhance the security of ID-based ring signature by providing forward security: If a secret key of any user has been compromised, all previous generated signatures that include this user still remain valid. This property is especially important to any large scale data sharing system, as it is impossible to ask all data owners to re-authenticate their data even if a secret key of one single user has been compromised. We provide a concrete and efficient instantiation of our scheme, prove its security and provide an implementation to show its practicality.

Data deduplication is a technique for eliminating duplicate copies of data, and has been widely used in cloud storage to reduce storage space and upload bandwidth. However, there is only one copy for each file stored in cloud even if such a file is owned by a huge number of users. As a result, deduplication system improves storage utilization while reducing reliability. Furthermore, the challenge of privacy for sensitive data also arises when they are outsourced by users to cloud. Aiming to address the above security challenges, this paper makes the first attempt to formalize the notion of distributed reliable deduplication system. We propose new distributed deduplication systems with higher reliability in which the data chunks are distributed across multiple cloud servers. The security requirements of data confidentiality and tag consistency are also achieved by introducing a deterministic secret sharing scheme in distributed storage systems, instead of using convergent encryption as in previous deduplication systems. Security analysis demonstrates that our deduplication systems are secure in terms of the definitions specified in the proposed security model. As a proof of concept, we implement the proposed systems and demonstrate that the incurred overhead is very limited in realistic environments.

As clouds have been deployed widely in various fields, the reliability and availability of clouds become the major concern of cloud service providers and users. Thereby, fault tolerance in clouds receives a great deal of attention in both industry and academia, especially for real-time applications due to their safety critical nature. Large amounts of researches have been conducted to realize fault tolerance in distributed systems, among which fault-tolerant scheduling plays a significant role. However, few researches on the fault-tolerant scheduling study the virtualization and the elasticity, two key features of clouds, sufficiently. To address this issue, this paper presents a fault-tolerant mechanism which extends the primary-backup model to incorporate the features of clouds. Meanwhile, for the first time, we propose an elastic resource provisioning mechanism in the fault-tolerant context to improve the resource utilization. On the basis of the fault-tolerant mechanism and the elastic resource provisioning mechanism, we design novel fault-tolerant elastic scheduling algorithms for real-time tasks in clouds named FESTAL, aiming at achieving both fault tolerance and high resource utilization in clouds. Extensive experiments injecting with random synthetic workloads as well as the workload from the latest version of the Google cloud tracelogs are conducted by CloudSim to compare FESTAL with three baseline algorithms, i.e., Non-M igration-FESTAL (NMFESTAL), Non-Overlapping-FESTAL (NOFESTAL), and Elastic First Fit (EFF). The experimental results demonstrate that FESTAL is able to effectively enhance the performance of virtualized clouds.

The notion of database outsourcing enables the data owner to delegate the database management to a cloud service provider (CSP) that provides various database services to different users. Recently, plenty of research work has been done on the primitive of outsourced database. However, it seems that no existing solutions can perfectly support the properties of both correctness and completeness for the query results, especially in the case when the dishonest CSP intentionally returns an empty set for the query request of the user. In this paper, we propose a new verifiable auditing scheme for outsourced database, which can simultaneously achieve the correctness and completeness of search results even if the dishonest CSP purposely returns an empty set. Furthermore, we can prove that our construction can achieve the desired security properties even in the encrypted outsourced database. Besides, the proposed scheme can be extended to support the dynamic database setting by incorporating the notion of verifiable database with updates.

Online social networks (OSN) have become one of the major platforms for people to exchange information. Both positive information (e.g., ideas, news and opinions) and negative information (e.g., rumors and gossips) spreading in social media can greatly influence our lives. Previously, researchers have proposed models to understand their propagation dynamics. However, those were merely simulations in nature and only focused on the spread of one type of information. Due to the human-related factors involved, simultaneous spread of negative and positive information cannot be thought of the superposition of two independent propagations. In order to fix these deficiencies, we propose an analytical model which is built stochastically from a node level up. It can present the temporal dynamics of spread such as the time people check newly arrived messages or forward them. Moreover, it is capable of capturing people’s behavioral differences in preferring what to believe or disbelieve. We studied the social parameters impact on propagation using this model. We found that some factors such as people’s preference and the injection time of the opposing information are critical to the propagation but some others such as the hearsay forwarding intention have little impact on it. The extensive simulations conducted on the real topologies confirm the high accuracy of our model.

The success of cloud computing makes an increasing number of real-time applications such as signal processing and weather forecasting run in the cloud. Meanwhile, scheduling for real-time tasks is playing an essential role for a cloud provider to maintain its quality of service and enhance the system's performance. In this paper, we devise a novel agent-based scheduling mechanism in cloud computing environment to allocate real-time tasks and dynamically provision resources. In contrast to traditional contract net protocols, we employ a bidirectional announcement-bidding mechanism and the collaborative process consists of three phases, i.e., basic matching phase, forward announcement-bidding phase and backward announcement-bidding phase. Moreover, the elasticity is sufficiently considered while scheduling by dynamically adding virtual machines to improve schedulability. Furthermore, we design calculation rules of the bidding values in both forward and backward announcement-bidding phases and two heuristics for selecting contractors. On the basis of the bidirectional announcement-bidding mechanism, we propose an agent-based dynamic scheduling algorithm named ANGEL for real-time, independent and aperiodic tasks in clouds. Extensive experiments are conducted on CloudSim platform by injecting random synthetic workloads and the workloads from the last version of the Google cloud tracelogs to evaluate the performance of our ANGEL. The experimental results indicate that ANGEL can efficiently solve the real-time task scheduling problem in virtualized clouds.

Smart grid is a technological innovation that improves efficiency, reliability, economics, and sustainability of electricity services. It plays a crucial role in modern energy infrastructure. The main challenges of smart grids, however, are how to manage different types of front-end intelligent devices such as power assets and smart meters efficiently; and how to process a huge amount of data received from these devices. Cloud computing, a technology that provides computational resources on demands, is a good candidate to address these challenges since it has several good properties such as energy saving, cost saving, agility, scalability, and flexibility. In this paper, we propose a secure cloud computing based framework for big data information management in smart grids, which we call “Smart-Frame.” The main idea of our framework is to build a hierarchical structure of cloud computing centers to provide different types of computing services for information management and big data analysis. In addition to this structural framework, we present a security solution based on identity-based encryption, signature and proxy re-encryption to address critical security issues of the proposed framework.

The popularity of Twitter attracts more and more spammers. Spammers send unwanted tweets to Twitter users to promote websites or services, which are harmful to normal users. In order to stop spammers, researchers have proposed a number of mechanisms. The focus of recent works is on the application of machine learning techniques into Twitter spam detection. However, tweets are retrieved in a streaming way, and Twitter provides the Streaming API for developers and researchers to access public tweets in real time. There lacks a performance evaluation of existing machine learning-based streaming spam detection methods. In this paper, we bridged the gap by carrying out a performance evaluation, which was from three different aspects of data, feature, and model. A big ground-truth of over 600 million public tweets was created by using a commercial URL-based security tool. For real-time spam detection, we further extracted 12 lightweight features for tweet representation. Spam detection was then transformed to a binary classification problem in the feature space and can be solved by conventional machine learning algorithms. We evaluated the impact of different factors to the spam detection performance, which included spam to nonspam ratio, feature discretization, training data size, data sampling, time-related data, and machine learning algorithms. The results show the streaming spam tweet detection is still a big challenge and a robust detection technique should take into account the three aspects of data, feature, and model.

The global diffusion of epidemics, computer viruses, and rumors causes great damage to our society. It is critical to identify the diffusion sources and timely quarantine them. However, most methods proposed so far are unsuitable for diffusion with multiple sources because of the high computational cost and the complex spatiotemporal diffusion processes. In this paper, based on the knowledge of infected nodes and their connections, we propose a novel method to identify multiple diffusion sources, which can address three main issues in this area: 1) how many sources are there? 2) where did the diffusion emerge? and 3) when did the diffusion break out? We first derive an optimization formulation for multi-source identification problem. This is based on altering the original network into a new network concerning two key elements: 1) propagation probability and 2) the number of hops between nodes. Experiments demonstrate that the altered network can accurately reflect the complex diffusion processes with multiple sources. Second, we derive a fast method to optimize the formulation. It has been proved that the proposed method is convergent and the computational complexity is O(mn logα), where α = α(m, n) is the slowly growing inverse-Ackermann function, n is the number of infected nodes, and m is the number of edges connecting them. Finally, we introduce an efficient algorithm to estimate the spreading time and the number of diffusion sources. To evaluate the proposed method, we compare the proposed method with many competing methods in various real-world network topologies. Our method shows significant advantages in the estimation of multiple sources and the prediction of spreading time.

As a fundamental tool for network management and security, traffic classification has attracted increasing attention in recent years. A significant challenge to the robustness of classification performance comes from zero-day applications previously unknown in traffic classification systems. In this paper, we propose a new scheme of Robust statistical Traffic Classification (RTC) by combining supervised and unsupervised machine learning techniques to meet this challenge. The proposed RTC scheme has the capability of identifying the traffic of zero-day applications as well as accurately discriminating predefined application classes. In addition, we develop a new method for automating the RTC scheme parameters optimization process. The empirical study on real-world traffic data confirms the effectiveness of the proposed scheme. When zero-day applications are present, the classification performance of the new scheme is significantly better than four state-of-the-art methods: random forest, correlation-based classification, semi-supervised clustering, and one-class SVM.

Wireless mesh networks are widely applied in many fields such as industrial controlling, environmental monitoring, and military operations. Network coding is promising technology that can improve the performance of wireless mesh networks. In particular, network coding is suitable for wireless mesh networks as the fixed backbone of wireless mesh is usually unlimited energy. However, coding collision is a severe problem affecting network performance. To avoid this, routing should be effectively designed with an optimum combination of coding opportunity and coding validity. In this paper, we propose a Connected Dominating Set (CDS)-based and Flow-oriented Coding-aware Routing (CFCR) mechanism to actively increase potential coding opportunities. Our work provides two major contributions. First, it effectively deals with the coding collision problem of flows by introducing the information conformation process, which effectively decreases the failure rate of decoding. Secondly, our routing process considers the benefit of CDS and flow coding simultaneously. Through formalized analysis of the routing parameters, CFCR can choose optimized routing with reliable transmission and small cost. Our evaluation shows CFCR has a lower packet loss ratio and higher throughput than existing methods, such as Adaptive Control of Packet Overhead in XOR Network Coding (ACPO), or Distributed Coding-Aware Routing (DCAR).

This paper presents a novel adaptive safe-band for quantization based audio watermarking methods, aiming to improve robustness. Considerable number of audio watermarking methods have been developed using quantization based techniques. These techniques are generally vulnerable to signal processing attacks. For these conventional quantization based techniques, robustness can be marginally improved by choosing larger step sizes at the cost of significant perceptual quality degradation. We first introduce fixed size safe-band between two quantization steps to improve robustness. This safe-band will act as a buffer to withstand certain types of attacks. Then we further improve the robustness by adaptively changing the size of the safe-band based on the audio signal feature used for watermarking. Compared with conventional quantization based method and the fixed size safe-band based method, the proposed adaptive safe-band based quantization method is more robust to attacks. The effectiveness of the proposed technique is demonstrated by simulation results.

The goal of email classification is to classify user emails into spam and legitimate ones. Many supervised learning algorithms have been invented in this domain to accomplish the task, and these algorithms require a large number of labeled training data. However, data labeling is a labor intensive task and requires in-depth domain knowledge. Thus, only a very small proportion of the data can be labeled in practice. This bottleneck greatly degrades the effectiveness of supervised email classification systems. In order to address this problem, in this work, we first identify some critical issues regarding supervised machine learning-based email classification. Then we propose an effective classification model based on multi-view disagreement-based semi-supervised learning. The motivation behind the attempt of using multi-view and semi-supervised learning is that multi-view can provide richer information for classification, which is often ignored by literature, and semi-supervised learning supplies with the capability of coping with labeled and unlabeled data. In the evaluation, we demonstrate that the multi-view data can improve the email classification than using a single view data, and that the proposed model working with our algorithm can achieve better performance as compared to the existing similar algorithms.

In the past few years, cloud computing has emerged as one of the most influential paradigms in the IT industry. As promising as it is, this paradigm brings forth many new challenges for data security because users have to outsource sensitive data on untrusted cloud servers for sharing. In this paper, to guarantee the confidentiality and security of data sharing in cloud environment, we propose a Flexible and Efficient Access Control Scheme (FEACS) based on Attribute-Based Encryption, which is suitable for fine-grained access control. Compared with existing state-of-the-art schemes, FEACS is more practical by following functions. First of all, considering the factor that the user membership may change frequently in cloud environment, FEACS has the capability of coping with dynamic membership efficiently. Secondly, full logic expression is supported to make the access policy described accurately and efficiently. Besides, we prove in the standard model that FEACS is secure based on the Decisional Bilinear Diffie-Hellman assumption. To evaluate the practicality of FEACS, we provide a detailed theoretical performance analysis and a simulation comparison with existing schemes. Both the theoretical analysis and the experimental results prove that our scheme is efficient and effective for cloud environment.

Wireless Sensor Networks are vulnerable to node replication attacks due to deployment in unattended environments and the lack of physical tamper-resistance. An adversary can easily capture and compromise sensor nodes and after replicating them, he inserts arbitrary number of replicas into the network to mount a wide variety of internal attacks. In this paper we propose a novel distributed solution (RAND) for the detection of node replication attack in static WSNs which combines random walks with network division and works in two phases. In the first phase called network configuration phase, the entire network is divided into different areas. In the second phase called replica detection phase, the clone is detected by following a claimer-reporter-witness framework and a random walk is employed within each area for the selection of witness nodes. Simulation results show that our scheme outperforms the existing witness node based strategies with moderate communication and memory overhead.

Static detection of malware variants plays an important role in system security and control flow has been shown as an effective characteristic that represents polymorphic malware. In our research, we propose a similarity search of malware to detect these variants using novel distance metrics. We describe a malware signature by the set of control flowgraphs the malware contains. We use a distance metric based on the distance between feature vectors of string-based signatures. The feature vector is a decomposition of the set of graphs into either fixed size k-subgraphs, or q-gram strings of the high-level source after decompilation. We use this distance metric to perform pre-filtering. We also propose a more effective but less computationally efficient distance metric based on the minimum matching distance. The minimum matching distance uses the string edit distances between programs' decompiled flowgraphs, and the linear sum assignment problem to construct a minimum sum weight matching between two sets of graphs. We implement the distance metrics in a complete malware variant detection system. The evaluation shows that our approach is highly effective in terms of a limited false positive rate and our system detects more malware variants when compared to the detection rates of other algorithms.

Due to the critical security threats imposed by email-based malware in recent years, modeling the propagation dynamics of email malware becomes a fundamental technique for predicting its potential damages and developing effective countermeasures. Compared to earlier versions of email malware, modern email malware exhibits two new features, reinfection and self-start. Reinfection refers to the malware behavior that modern email malware sends out malware copies whenever any healthy or infected recipients open the malicious attachment. Self-start refers to the behavior that malware starts to spread whenever compromised computers restart or certain files are visited. In the literature, several models are proposed for email malware propagation, but they did not take into account the above two features and cannot accurately model the propagation dynamics of modern email malware. To address this problem, we derive a novel difference equation based analytical model by introducing a new concept of virtual infected user. The proposed model can precisely present the repetitious spreading process caused by reinfection and self-start and effectively overcome the associated computational challenges. We perform comprehensive empirical and theoretical study to validate the proposed analytical model. The results show our model greatly outperforms previous models in terms of estimation accuracy.

The articles in this special section focus on trust, network security, and privacy deployed in parallel and distributed systems.

Attribute-based signature (ABS) enables users to sign messages over attributes without revealing any information other than the fact that they have attested to the messages. However, heavy computational cost is required during signing in existing work of ABS, which grows linearly with the size of the predicate formula. As a result, this presents a significant challenge for resource-constrained devices (such as mobile devices or RFID tags) to perform such heavy computations independently. Aiming at tackling the challenge above, we first propose and formalize a new paradigm called Outsourced ABS, i.e., OABS, in which the computational overhead at user side is greatly reduced through outsourcing intensive computations to an untrusted signing-cloud service provider (S-CSP). Furthermore, we apply this novel paradigm to existing ABS schemes to reduce the complexity. As a result, we present two concrete OABS schemes: i) in the first OABS scheme, the number of exponentiations involving in signing is reduced from O(d) to O(1) (nearly three), where d is the upper bound of threshold value defined in the predicate; ii) our second scheme is built on Herranz et al.'s construction with constant-size signatures. The number of exponentiations in signing is reduced from O(d2) to O(d) and the communication overhead is O(1). Security analysis demonstrates that both OABS schemes are secure in terms of the unforgeability and attribute-signer privacy definitions specified in the proposed security model. Finally, to allow for high efficiency and flexibility, we discuss extensions of OABS and show how to achieve accountability as well.

Many services and applications in vehicular ad-hoc networks (VANETs) require preserving and secure data communications. To improve driving safety and comfort, the traffic-related status information will be broadcasted regularly and shared among drivers. Without the security and privacy guarantees, attackers could track their interested vehicles by collecting and analyzing their traffic messages. Hence, anonymous message authentication is an essential requirement of VANETs. On the other hand, when a vehicle is involved in a dispute event of warning message, the certificate authority should be able to recover the real identity of this vehicle. To deal with this issue, we propose a new privacy-preserving authentication protocol with authority traceability using elliptic curve based chameleon hashing. Compared with existing schemes, our approach possesses the following features: 1) mutual and anonymous authentication for both vehicle-to-vehicle and vehicle-to-roadside communications, 2) vehicle unlinkability, 3) authority tracking capability, and 4) high computational efficiency. We also demonstrate the merits of our proposed scheme through security analysis and extensive performance evaluation.

This paper initiates the study of two specific security threats on smart-card-based password authentication in distributed systems. Smart-card-based password authentication is one of the most commonly used security mechanisms to determine the identity of a remote client, who must hold a valid smart card and the corresponding password to carry out a successful authentication with the server. The authentication is usually integrated with a key establishment protocol and yields smart-card-based password-authenticated key agreement. Using two recently proposed protocols as case studies, we demonstrate two new types of adversaries with smart card: 1) adversaries with pre-computed data stored in the smart card, and 2) adversaries with different data (with respect to different time slots) stored in the smart card. These threats, though realistic in distributed systems, have never been studied in the literature. In addition to point out the vulnerabilities, we propose the countermeasures to thwart the security threats and secure the protocols.

Attribute-Based Encryption (ABE) is a promising cryptographic primitive which significantly enhances the versatility of access control mechanisms. Due to the high expressiveness of ABE policies, the computational complexities of ABE key-issuing and decryption are getting prohibitively high. Despite that the existing Outsourced ABE solutions are able to offload some intensive computing tasks to a third party, the verifiability of results returned from the third party has yet to be addressed. Aiming at tackling the challenge above, we propose a new Secure Outsourced ABE system, which supports both secure outsourced key-issuing and decryption. Our new method offloads all access policy and attribute related operations in the key-issuing process or decryption to a Key Generation Service Provider (KGSP) and a Decryption Service Provider (DSP), respectively, leaving only a constant number of simple operations for the attribute authority and eligible users to perform locally. In addition, for the first time, we propose an outsourced ABE construction which provides checkability of the outsourced computation results in an efficient way. Extensive security and performance analysis show that the proposed schemes are proven secure and practical.

Statistics-based Internet traffic classification using machine learning techniques has attracted extensive research interest lately, because of the increasing ineffectiveness of traditional port-based and payload-based approaches. In particular, unsupervised learning, that is, traffic clustering, is very important in real-life applications, where labeled training data are difficult to obtain and new patterns keep emerging. Although previous studies have applied some classic clustering algorithms such as K-Means and EM for the task, the quality of resultant traffic clusters was far from satisfactory. In order to improve the accuracy of traffic clustering, we propose a constrained clustering scheme that makes decisions with consideration of some background information in addition to the observed traffic statistics. Specifically, we make use of equivalence set constraints indicating that particular sets of flows are using the same application layer protocols, which can be efficiently inferred from packet headers according to the background knowledge of TCP/IP networking. We model the observed data and constraints using Gaussian mixture density and adapt an approximate algorithm for the maximum likelihood estimation of model parameters. Moreover, we study the effects of unsupervised feature discretization on traffic clustering by using a fundamental binning method. A number of real-world Internet traffic traces have been used in our evaluation, and the results show that the proposed approach not only improves the quality of traffic clusters in terms of overall accuracy and per-class metrics, but also speeds up the convergence.

Restraining the spread of rumors in online social networks (OSNs) has long been an important but difficult problem to be addressed. Currently, there are mainly two types of methods 1) blocking rumors at the most influential users or community bridges, or 2) spreading truths to clarify the rumors. Each method claims the better performance among all the others according to their own considerations and environments. However, there must be one standing out of the rest. In this paper, we focus on this part of work. The difficulty is that there does not exist a universal standard to evaluate them. In order to address this problem, we carry out a series of empirical and theoretical analysis on the basis of the introduced mathematical model. Based on this mathematical platform, each method will be evaluated by using real OSN data. We have done three types of analysis in this work. First, we compare all the measures of locating important users. The results suggest that the degree and betweenness measures outperform all the others in the Facebook network. Second, we analyze the method of the truth clarification method, and find that this method has a long-term performance while the degree measure performs well only in the early stage. Third, in order to leverage these two methods, we further explore the strategy of different methods working together and their equivalence. Given a fixed budget in the real world, our analysis provides a potential solution to find out a better strategy by integrating both types of methods together. From both the academic and technical perspective, the work in this paper is an important step towards the most practical and optimal strategies of restraining rumors in OSNs.

Traffic classification is a fundamental component in advanced network management and security. Recent research has achieved certain success in the application of machine learning techniques into flow statistical feature based approach. However, most of flow statistical feature based methods classify traffic based on the assumption that all traffic flows are generated by the known applications. Considering the pervasive unknown applications in the real world environment, this assumption does not hold. In this paper, we cast unknown applications as a specific classification problem with insufficient negative training data and address it by proposing a binary classifier based framework. An iterative method is proposed to extract unknown information from a set of unlabelled traffic flows, which combines asymmetric bagging and flow correlation to guarantee the purity of extracted negatives. A binary classifier is used as an application signature which can operate on a bag of correlated flows instead of individual flows to further improve its effectiveness. We carry out a series of experiments in a real-world network traffic dataset to evaluate the proposed methods. The results show that the proposed method significantly outperforms the-state-of-art traffic classification methods under the situation of unknown applications present.

The recent years have seen extensive work on statistics-based network traffic classification using machine learning (ML) techniques. In the particular scenario of learning from unlabeled traffic data, some classic unsupervised clustering algorithms (e.g. K-Means and EM) have been applied but the reported results are unsatisfactory in terms of low accuracy. This paper presents a novel approach for the task, which performs clustering based on Random Forest (RF) proximities instead of Euclidean distances. The approach consists of two steps. In the first step, we derive a proximity measure for each pair of data points by performing a RF classification on the original data and a set of synthetic data. In the next step, we perform a K-Medoids clustering to partition the data points into K groups based on the proximity matrix. Evaluations have been conducted on real-world Internet traffic traces and the experimental results indicate that the proposed approach is more accurate than the previous methods.

Due to the nature of wireless transmission, communication in wireless mesh networks (WMNs) is vulnerable to many adversarial activities including eavesdropping. Pair-wise key establishment is one of the fundamental issues in securing WMNs. This paper presents a new matrix-based pairwise key establishment scheme for mesh clients. Our design is motivated by the fact that in WMNs, mesh routers are more powerful than mesh clients, both in computation and communication. By exploiting this heterogeneity, expensive operations can be delegated to mesh routers, which help alleviate the overhead of mesh clients during key establishment. The new scheme possesses two desirable features: (1) Neighbor mesh clients can directly establish pairwise keys; and (2) Communication and storage costs at mesh clients are significantly reduced.

Some safety applications in vehicular ad-hoc networks (VANETs) require the dissemination of safety information to all nearby vehicles in a broadcast fashion. Each vehicle should periodically broadcast its state information up to a safety range around itself to avoid likely collisions. This causes a congested channel in dense areas especially in multi-lane roads and leads to significant performance reduction. In this paper, using a Markov model, we analytically derive the percentage of channel utilization as well as the packet transmission rate based on the contention window size, carrier sense range, density of vehicles and packet generation rate. Unlike the previous models, the devised Markov model enables us to derive the probability of packet obsolescence before broadcasting from the probability mass function of service delay. Also, we can evaluate the performance of tracking applications for large and small contention window sizes. The extensive simulations carried out confirm the accuracy of our model.

SUMMARY Due to its advantages of cost‐effectiveness, on‐demand provisioning and easy for sharing, cloud computing has grown in popularity with the research community for deploying scientific applications such as workflows. Although such interests continue growing and scientific workflows are widely deployed in collaborative cloud environments that consist of a number of data centers, there is an urgent need for exploiting strategies which can place application datasets across globally distributed data centers and schedule tasks according to the data layout to reduce both latency and makespan for workflow execution. In this paper, by utilizing dependencies among datasets and tasks, we propose an efficient data and task coscheduling strategy that can place input datasets in a load balance way and meanwhile, group the mostly related datasets and tasks together. Moreover, data staging is used to overlap task execution with data transmission in order to shorten the start time of tasks. We build a simulation environment on Tianhe supercomputer for evaluating the proposed strategy and run simulations by random and realistic workflows. The results demonstrate that the proposed strategy can effectively improve scheduling performance while reducing the total volume of data transfer across data centers. Concurrency and Computation: Practice and Experience, 2013.© 2013 Wiley Periodicals, Inc.

Advances in parallel, distributed, embedded, and ubiquitous systems Computing systems are now invading in every aspect of our daily life and promise to revolutionize our life. The emergence of the related technology is a natural outcome of research and technological advances in a variety of areas including parallel computing, distributed computing, embedded systems, pervasive computing and communications, wireless networks, mobile computing, and agent technologies. These new and exciting paradigms provide computing and communication services to the end users all the time and everywhere. This special issue focuses on the recent advances in the new generation computing systems such as parallel, distributed, embedded, and ubiquitous systems.

Signature-based malware detection systems have been a much used response to the pervasive problem of malware. Identification of malware variants is essential to a detection system and is made possible by identifying invariant characteristics in related samples. To classify the packed and polymorphic malware, this paper proposes a novel system, named Malwise, for malware classification using a fast application-level emulator to reverse the code packing transformation, and two flowgraph matching algorithms to perform classification. An exact flowgraph matching algorithm is employed that uses string-based signatures, and is able to detect malware with near real-time performance. Additionally, a more effective approximate flowgraph matching algorithm is proposed that uses the decompilation technique of structuring to generate string-based signatures amenable to the string edit distance. We use real and synthetic malware to demonstrate the effectiveness and efficiency of Malwise. Using more than 15,000 real malware, collected from honeypots, the effectiveness is validated by showing that there is an 88 percent probability that new malware is detected as a variant of existing malware. The efficiency is demonstrated from a smaller sample set of malware where 86 percent of the samples can be classified in under 1.3 seconds.

This paper presents a novel traffic classification scheme to improve classification performance when few training data are available. In the proposed scheme, traffic flows are described using the discretized statistical features and flow correlation information is modeled by bag-of-flow (BoF). We solve the BoF-based traffic classification in a classifier combination framework and theoretically analyze the performance benefit. Furthermore, a new BoF-based traffic classification method is proposed to aggregate the naive Bayes (NB) predictions of the correlated flows. We also present an analysis on prediction error sensitivity of the aggregation strategies. Finally, a large number of experiments are carried out on two large-scale real-world traffic datasets to evaluate the proposed scheme. The experimental results show that the proposed scheme can achieve much better classification performance than existing state-of-the-art traffic classification methods.

In this paper, we address the problem of blind separation of spatially correlated signals, which is encountered in some emerging applications, e.g., distributed wireless sensor networks and wireless surveillance systems. We preprocess the source signals in transmitters prior to transmission. Specifically, the source signals are first filtered by a set of properly designed precoders and then the coded signals are transmitted. On the receiving side, the Z-domain features of the precoders are exploited to separate the coded signals, from which the source signals are recovered. Based on the proposed precoders, a closed-form algorithm is derived to estimate the coded signals and the source signals. Unlike traditional blind source separation approaches, the proposed method does not require the source signals to be uncorrelated, sparse, or nonnegative. Compared with the existing precoder-based approach, the new method uses precoders with much lower order, which reduces the delay in data transmission and is easier to implement in practice.

Traffic classification technique is an essential tool for network and system security in the complex environments such as cloud computing based environment. The state-of-the-art traffic classification methods aim to take the advantages of flow statistical features and machine learning techniques, however the classification performance is severely affected by limited supervised information and unknown applications. To achieve effective network traffic classification, we propose a new method to tackle the problem of unknown applications in the crucial situation of a small supervised training set. The proposed method possesses the superior capability of detecting unknown flows generated by unknown applications and utilizing the correlation information among real-world network traffic to boost the classification performance. A theoretical analysis is provided to confirm performance benefit of the proposed method. Moreover, the comprehensive performance evaluation conducted on two real-world network traffic datasets shows that the proposed scheme outperforms the existing methods in the critical network environment.

Social network worms, such as email worms and facebook worms, pose a critical security threat to the Internet. Modeling their propagation dynamics is essential to predict their potential damages and develop countermeasures. Although several analytical models have been proposed for modeling propagation dynamics of social network worms, there are two critical problems unsolved: temporal dynamics and spatial dependence. First, previous models have not taken into account the different time periods of Internet users checking emails or social messages, namely, temporal dynamics. Second, the problem of spatial dependence results from the improper assumption that the states of neighboring nodes are independent. These two problems seriously affect the accuracy of the previous analytical models. To address these two problems, we propose a novel analytical model. This model implements a spatial-temporal synchronization process, which is able to capture the temporal dynamics. Additionally, we find the essence of spatial dependence is the spreading cycles. By eliminating the effect of these cycles, our model overcomes the computational challenge of spatial dependence and provides a stronger approximation to the propagation dynamics. To evaluate our susceptible-infectious-immunized (SII) model, we conduct both theoretical analysis and extensive simulations. Compared with previous epidemic models and the spatial-temporal model, the experimental results show our SII model achieves a greater accuracy. We also compare our model with the susceptible-infectious-susceptible and susceptible-infectious- recovered models. The results show that our model is more suitable for modeling the propagation of social network worms.

Network traffic modeling is a fundamental problem in communication. A traffic model should be able to capture and reproduce various properties of a real trace. Despite the widespread success of most numerical models in various applications, few actually focus on the oscillation behavior proven to be one of the basic properties in network traffic. In this paper, a new mathematical method is proposed to model and synthesize stationary and nonstationary oscillatory processes of network traffic. The proposed model is based on the structure of the hierarchical hidden Markov model, which includes two nested hidden Markov chains and one observable process. The first-layer hidden Markov chain with variable state-duration controls the time-varying oscillatory process. Conditional on the first-layer Markov chain, the local fluctuation process is modeled by the second-layer hidden Markov chain. Algorithms are derived for inference of model parameters and traffic synthesis. The proposed approach is compared with four classical models for performance evaluation. The selected performance criterion includes time structure, statistical properties, self-similarity, queuing behavior and multiscale properties. The flexibility and accuracy of the proposed model results in a close fit to the real traces.

A novel server-side defense scheme is proposed to resist the Web proxy-based distributed denial of service attack. The approach utilizes the temporal and spatial locality to extract the behavior features of the proxy-to-server traffic, which makes the scheme independent of the traffic intensity and frequently varying Web contents. A nonlinear mapping function is introduced to protect weak signals from the interference of infrequent large values. Then, a new hidden semi-Markov model parameterized by Gaussian-mixture and Gamma distributions is proposed to describe the time-varying traffic behavior of Web proxies. The new method reduces the number of parameters to be estimated, and can characterize the dynamic evolution of the proxy-to-server traffic rather than the static statistics. Two diagnosis approaches at different scales are introduced to meet the requirement of both fine-grained and coarse-grained detection. Soft control is a novel attack response method proposed in this work. It converts a suspicious traffic into a relatively normal one by behavior reshaping rather than rudely discarding. This measure can protect the quality of services of legitimate users. The experiments confirm the effectiveness of the proposed scheme.

Traffic classification has wide applications in network management, from security monitoring to quality of service measurements. Recent research tends to apply machine learning techniques to flow statistical feature based classification methods. The nearest neighbor (NN)-based method has exhibited superior classification performance. It also has several important advantages, such as no requirements of training procedure, no risk of overfitting of parameters, and naturally being able to handle a huge number of classes. However, the performance of NN classifier can be severely affected if the size of training data is small. In this paper, we propose a novel nonparametric approach for traffic classification, which can improve the classification performance effectively by incorporating correlated information into the classification process. We analyze the new classification approach and its performance benefit from both theoretical and empirical perspectives. A large number of experiments are carried out on two real-world traffic data sets to validate the proposed approach. The results show the traffic classification performance can be improved significantly even under the extreme difficult circumstance of very few training samples.

Due to the limitations of the traditional port-based and payload-based traffic classification approaches, the past decade has seen extensive work on utilizing machine learning techniques to classify network traffic based on packet and flow level features. In particular, previous studies have shown that the unsupervised clustering approach is both accurate and capable of discovering previously unknown application classes. In this paper, we explore the utility of side information in the process of traffic clustering. Specifically, we focus on the flow correlation information that can be efficiently extracted from packet headers and expressed as instance-level constraints, which indicate that particular sets of flows are using the same application and thus should be put into the same cluster. To incorporate the constraints, we propose a modified constrained K-Means algorithm. A variety of real-world traffic traces are used to show that the constraints are widely available. The experimental results indicate that the constrained approach not only improves the quality of the resulted clusters, but also speeds up the convergence of the clustering process.

Wire is a intermediate language to enable static program analysis on low level objects such as native executables. It has practical benefit in analysing the structure and semantics of malware, or for identifying software defects in closed source software. In this paper we describe how an executable program is disassembled and translated to the Wire intermediate language. We define the formal syntax and operational semantics of Wire and discuss our justifications for its language features. We use Wire in our previous work Malwise, a malware variant detection system. We also examine applications for when a formally defined intermediate language is given. Our results include showing the semantic equivalence between obfuscated and non obfuscated code samples. These examples stem from the obfuscations commonly used by malware.

A critical problem for Internet traffic classification is how to obtain a high-performance statistical feature based classifier using a small set of training data. The solutions to this problem are essential to deal with the encrypted applications and the new emerging applications. In this paper, we propose a new Naive Bayes (NB) based classification scheme to tackle this problem, which utilizes two recent research findings, feature discretization and flow correlation. A new bag-of-flow (BoF) model is firstly introduced to describe the correlated flows and it leads to a new BoF-based traffic classification problem. We cast the BoF-based traffic classification as a specific classifier combination problem and theoretically analyze the classification benefit from flow aggregation. A number of combination methods are also formulated and used to aggregate the NB predictions of the correlated flows. Finally, we carry out a number of experiments on a large scale real-world network dataset. The experimental results show that the proposed scheme can achieve significantly higher classification accuracy and much faster classification speed with comparison to the state-of-the-art traffic classification methods.

Email worms propagate across networks by taking advantage of email relationships. Modeling the propagation of email worms can help predict their potential damages and develop countermeasures. We propose a novel analytical model on the propagation process of modern reinfection email worms. It relies on probabilistic analysis, and thus can provide a steady and reliable assessment on the propagation dynamics. Additionally, by introducing virtual users to represent the repetitious spreading process, the proposed model overcomes the computational challenge caused by reinfection processes. To demonstrate the benefits of our model, we conduct a series of experimental evaluation. The results show that our novel approach achieves a greater accuracy and is more suitable for modeling modern email worms than previous models.

Jiankun Hu, Yang Xiang, Wanlei Zhou; Advances in Network and System Security: Editorial Statement, The Computer Journal, Volume 55, Issue 4, 1 April 2012, Pages

SUMMARY The accuracy of feedback presentation, the sensitivity, and the robustness of reputation evaluation are critical issues to be addressed in a reputation system under the grid environment. This paper proposes a QoS‐based fine‐grained grid reputation system, where economic elements are considered to make the reputation system more sensitive in the commercial grid environments. A novel fine‐grained feedback presentation model based on aggregation of objective QoS attributes and subjective opinions of evaluators is proposed to enable a semi‐automatic, personalized and accurate feedback presentation. Through the introduction of a punishment factor and the adaptive reference of a previous trust value, the proposed reputation system effectively improves the sensitivity of the reputation evaluation. Moreover, the weighted combination of interorganizational trust, direct trust and recommended trust makes the reputation system more robust against collusion attacks. Simulation results show that the proposed reputation system can practically predict feedback and effectively resist malicious attacks such as fake transaction attacks and badmouthing attacks. This provides a clear advantage in the applications of grid service selection. Copyright © 2011 John Wiley & Sons, Ltd.

SUMMARY In this paper, we present some practical experiences on implementing an alert fusion mechanism from our project. After investigation on most of the existing alert fusion systems, we found the current body of work alternatively weighed down in the mire of insecure design or rarely deployed because of their complexity. As confirmed by our experimental analysis, unsuitable mechanisms could easily be submerged by an abundance of useless alerts. Even with the use of methods that achieve a high fusion rate and low false positives, attack is also possible. To find the solution, we carried out analysis on a series of alerts generated by well‐known datasets as well as realistic alerts from the Australian Honey‐Pot. One important finding is that one alert has more than an 85% chance of being fused in the following five alerts. Of particular importance is our design of a novel lightweight Cache‐based Alert Fusion Scheme, called CAFS. CAFS has the capacity to not only reduce the quantity of useless alerts generated by intrusion detection system, but also enhance the accuracy of alerts, therefore greatly reducing the cost of fusion processing. We also present reasonable and practical specifications for the target‐oriented fusion policy that provides a quality guarantee on alert fusion, and as a result seamlessly satisfies the process of successive correlation. Our experiments compared CAFS with traditional centralized fusion. The results showed that the CAFS easily attained the desired level of simple, counter‐escapable alert fusion design. Furthermore, as a lightweight scheme, CAFS can easily be deployed and excel in a large amount of alert fusions, which go towards improving the usability of system resources. To the best of our knowledge, our work is a practical exploration in addressing problems from the academic point of view. Copyright © 2011 John Wiley & Sons, Ltd.

Current computer networks and systems are facing serious threats from cyber terrorism andcrime, which cause huge financial loss and potential life hazard. Although these attack systems have become more easy-to-use, sophisticated, and powerful, interest has greatly increased in the field of building more effective, intelligent, adaptive, active, and high performance networks and systems. This special issue focuses on issues related to Network and System Security, such as authentication, access control, availability, integrity, privacy, confidentiality, dependability and sustainability of computer networks and systems. We are pleased to present to you eight technical papers dealing with cutting-edge research and technology related to this topic. These papers were selected out of the significantly extended versions of the 131 submissions from 44 countries in the 4th International Conference on Network and System Security (NSS 2010) and a large number of open submissions. The selection has been very rigorous and only the best papers were selected. In the first paper, ‘DHTrust: A robust and distributed reputation system for trusted peer-to-peer Networks’ 1, Xue et al. propose a robust and distributed reputation system, DHTrust, which takes full advantage of the distributed hash table to distribute local reputation to trade off the damage of fake reputation information by genuine reputation information. This system can effectively distinguish and evaluate the fundamental behaviors of peers in peer-to-peer networks and thus to provide service and issue reputation scores. In the second paper, ‘Breaking Tor anonymity with game theory and data mining’ 2, Wagner et al. propose a mechanism to break Tor anonymity with one rogue exit node. The attack is composed of two elements: an active tag injection scheme and an inference attack that leverages a semi-supervised learning algorithm to reconstruct browsing sessions. A prototype is implemented and its performance is evaluated on the Tor network. The article also describes several countermeasures and interesting advanced attacks. In the third paper, ‘Mobile device access control: an improved correlation based face authentication scheme and its Java ME application’ 3, Xi et al. investigate face authentication based access control solutions for camera-equipped mobile devices. They propose a new hierarchical correlation based face authentication scheme by analyzing the relationship between each cross-correlation output peak generated from selected subregions of a face, in conjunction with conventional direct cross-correlation methods. The proposed algorithm is implementable on mobile devices with shortened processing time and reduced resource demand. In the fourth paper, ‘Energy efficient authentication strategies for network coding’ 4, Apavatjrut et al. investigate different strategies based on message authentication codes algorithms to deal with the attacks against network coding schemes. In wireless sensor networks, the node resources are limited in energy and in computational power. The authors develop new strategies to defend against pollution attacks on wireless sensor networks. In the fifth paper, ‘On the identity anonymization of high dimensional rating data’ 5, Sun et al. study the challenges of protecting privacy of individuals in the large public survey rating data, which is prone to attacks that can potentially identify user information. The authors propose a greedy approach to anonymize survey rating data that scales almost linearly with the input size. They apply the method to two real-life data sets to demonstrate their efficiency and practical utility. Intrusion detection systems (IDS) have been widely deployed in practice for detecting malicious behaviors. In the sixth paper, ‘An alert correlation platform for memory-supported techniques’ 6, Roschke et al. present a new way to enhance the detection process of intrusion detection systems by correlation and clustering of alerts. The proposed platform can be distributed over multiple processing units to share memory and processing power. The efficiency and the effectiveness of the platform is tested by practical experiments with several alert storage approaches, multiple algorithms, as well as a local and a distributed deployment. In the seventh paper, ‘CAFS: A novel lightweight cache-based scheme for large-scale intrusion alert fusion’ 7, Wen et al. propose a lightweight cache-based alert fusion scheme that is capable of reducing the quantity of useless alerts generated by an intrusion detection system and enhance the accuracy of alerts, therefore greatly reducing the cost of fusion processing. The authors also present reasonable and practical specifications for the target-oriented fusion policy that provides a quality guarantee on alert fusion. In the last paper, ‘A purpose based access control in native XML databases’ 8, Sun and Wang propose a model for privacy preserving access control based on the notion of purpose. In this model, purpose information associated with given data elements in an XML document specifies the intended use of the data elements. A new approach is proposed to represent purpose information to support access control based on purpose information. This method relies on usage access control models and the components, which are based on the notions of the purpose information used in subjects and objects. We sincerely hope that you will enjoy reading these papers and find them interesting. We thank all the international reviewers for their professional services. We deeply thank Professor Geoffrey Fox, the Editor-in-Chief, for providing this opportunity to publish this special issue. With his continuous support, encouragement and guidance throughout this publishing project, this special issue has been very successful.

Binary signatures have been widely used to detect malicious software on the current Internet. However, this approach is unable to achieve the accurate identification of polymorphic malware variants, which can be easily generated by the malware authors using code generation engines. Code generation engines randomly produce varying code sequences but perform the same desired malicious functions. Previous research used flow graph and signature tree to identify polymorphic malware families. The key difficulty of previous research is the generation of precisely defined state machine models from polymorphic variants. This paper proposes a novel approach, using Hierarchical Hidden Markov Model (HHMM), to provide accurate inductive inference of the malware family. This model can capture the features of self-similar and hierarchical structure of polymorphic malware family signature sequences. To demonstrate the effectiveness and efficiency of this approach, we evaluate it with real malware samples. Using more than 15,000 real malware, we find our approach can achieve high true positives, low false positives, and low computational cost.

There are the two common means for propagating worms: scanning vulnerable computers in the network and sending out malicious email attachments. Modeling the propagation of worms can help us understand how worms spread and devise effective defence strategies. Most traditional models simulate the overall scale of infected network in each time tick, making them invalid for examining deep inside the propagation procedure among individual nodes. For this reason, this paper proposes a novel probability matrix to model the propagation mechanism of the two main classes of worms (scanning and email worms) by concentrating on the propagation probability. The objective of this paper is to access the spreading and work out an effective scheme against the worms. In order to evaluate the effects of each major component in our probability model, we implement a series of experiments for both worms. From the results, the network administrators can make decision on how to reduce the number of vulnerable nodes to a certain threshold for scanning worms, and how to immunize the highly-connected node for preventing worm's propagation for email worms.

Network traffic classification is an essential component for network management and security systems. To address the limitations of traditional port-based and payload-based methods, recent studies have been focusing on alternative approaches. One promising direction is applying machine learning techniques to classify traffic flows based on packet and flow level statistics. In particular, previous papers have illustrated that clustering can achieve high accuracy and discover unknown application classes. In this work, we present a novel semi-supervised learning method using constrained clustering algorithms. The motivation is that in network domain a lot of background information is available in addition to the data instances themselves. For example, we might know that flow f1and f2are using the same application protocol because they are visiting the same host address at the same port simultaneously. In this case, f1and f2shall be grouped into the same cluster ideally. Therefore, we describe these correlations in the form of pair-wise must-link constraints and incorporate them in the process of clustering. We have applied three constrained variants of the K-Means algorithm, which perform hard or soft constraint satisfaction and metric learning from constraints. A number of real-world traffic traces have been used to show the availability of constraints and to test the proposed approach. The experimental results indicate that by incorporating constraints in the course of clustering, the overall accuracy and cluster purity can be significantly improved.

While cloud computing (CC) is a scalable model of shared infrastructure and on-demand computing, it lacks a transparent trust and security mechanism. A data owner (DO) loses control over the data outsourced to a machine in the cloud controlled and operated by a cloud service provider (CSP). This machine is at a location unknown to a data owner. This loss of control over data is further intensified with the lack of managing users' access to the data from practical cloud computing perspectives. In this paper, we introduce a new mechanism of ensuring trust and security in Software as a Service (SaaS) CC. Trust Ticket, with the supporting protocols, is our mechanism that helps a data owner in establishing a link between a CSP and a registered user. In our mechanism, a user first gets registered with a DO before receiving a Trust Ticket and a secret key from that DO. Each Trust Ticket is unique and encrypted. On completing the registration of each user, the DO apprises the CSP of the Trust Ticket. Trust Ticket and secret key are respectively for the registered user's getting accepted to the CSP and having a view of the data owner's data upon a successful verification by the CSP. We have done our experiment in Java network programming by creating an emulated cloud computing framework under the VMware ESXi 4.1 hypervisor based platform. Using the framework, we have evaluated our algorithmic protocol for Trust Ticket. We have also compared our work with prior work. Overall performance of our work is better. We argue that our proposed algorithmic protocol for Trust Ticket deployment establishes a data owner's trust. This trust is established through a data owner's control over data and a registered user; because a registered user is linked with a CSP by a data owner through Trust Ticket.

Static detection of polymorphic malware variants plays an important role to improve system security. Control flow has shown to be an effective characteristic that represents polymorphic malware instances. In our research, we propose a similarity search of malware using novel distance metrics of malware signatures. We describe a malware signature by the set of control flow graphs the malware contains. We propose two approaches and use the first to perform pre-filtering. Firstly, we use a distance metric based on the distance between feature vectors. The feature vector is a decomposition of the set of graphs into either fixed size k-subgraphs, or q-gram strings of the high-level source after decompilation. We also propose a more effective but less computationally efficient distance metric based on the minimum matching distance. The minimum matching distance uses the string edit distances between programs' decompiled flow graphs, and the linear sum assignment problem to construct a minimum sum weight matching between two sets of graphs. We implement the distance metrics in a complete malware variant detection system. The evaluation shows that our approach is highly effective in terms of a limited false positive rate and our system detects more malware variants when compared to the detection rates of other algorithms.

Ubiquitous computing is an exciting paradigm shift where technology becomes virtually invisible in our lives. In the increasingly interconnected world, threats to our daily lives can come from unexpected sources and universal directions. Criminals and terrorists have recognized the value of leveraging the ubiquitous computing environments to facilitate the commission of crimes. The cybercriminals typically launch different forms of large-scale and coordinated attacks, causing huge financial loss and potential life hazard. In this talk, we report two innovative approaches to defend against large-scale and coordinated attacks in the ubiquitous environments: 1) Inferring the cybercrime's intent through network traffic classification to enable the early warning of potential attacks; and 2) Profiling the large-scale and coordinated cyber attacks through both microscopic and macroscopic modeling to provide better control of such attacks. These approaches are effective in finding weak symptoms caused by the attacks thus can successfully defend against the large-scale and coordinated attacks at their early stages.

Each year, large amounts of money and labor are spent on patching the vulnerabilities in operating systems and various popular software to prevent exploitation by worms. Modeling the propagation process can help us to devise effective strategies against those worms’ spreading. This paper presents a microcosmic analysis of worm propagation procedures. Our proposed model is different from traditional methods and examines deep inside the propagation procedure among nodes in the network by concentrating on the propagation probability and time delay described by a complex matrix. Moreover, since the analysis gives a microcosmic insight into a worm's propagation, the proposed model can avoid errors that are usually concealed in the traditional macroscopic analytical models. The objectives of this paper are to address three practical aspects of preventing worm propagation: (i) where do we patch? (ii) how many nodes do we need to patch? (iii) when do we patch? We implement a series of experiments to evaluate the effects of each major component in our microcosmic model. Based on the results drawn from the experiments, for high-risk vulnerabilities, it is critical that networks reduce the number of vulnerable nodes to below 80%. We believe our microcosmic model can benefit the security industry by allowing them to save significant money in the deployment of their security patching schemes.

As an interesting application on cloud computing, content-based image retrieval (CBIR) has attracted a lot of attention, but the focus of previous research work was mainly on improving the retrieval performance rather than addressing security issues such as copyrights and user privacy. With an increase of security attacks in the computer networks, these security issues become critical for CBIR systems. In this paper, we propose a novel two-party watermarking protocol that can resolve the issues regarding user rights and privacy. Unlike the previously published protocols, our protocol does not require the existence of a trusted party. It exhibits three useful features: security against partial watermark removal, security in watermark verification and non-repudiation. In addition, we report an empirical research of CBIR with the security mechanism. The experimental results show that the proposed protocol is practicable and the retrieval performance will not be affected by watermarking query images.

\n\t\t\t\t\tWith decades of progress toward ubiquitous networks and systems, distributed computing systems have played an increasingly important role in the industry and society. However, not many distributed networks and systems are secure and reliable in the sense of defending against different attacks and tolerating failures automatically, thus guaranteeing properties such as performance, and offering security against intentional threats. This special issue focuses on securing distributed networks and systems.\n\t\t\t\t

Abstract In resource‐constrained wireless sensor networks, data aggregation is a key technique for power‐efficient information acquisition. Consequently, the intermediate sensor nodes performing aggregation tasks known as aggregators are valuable and attractive targets for attackers. We address the problem of defending against malicious adversaries who intend to stealthily change some aggregates to entice the base station to accept deceiving results. A secure and efficient aggregation scheme is proposed, in which the base station composes a secret configuration matrix and each sensor node is pre‐loaded with a limited part of the matrix known as a secret share containing certain local instructions. For each aggregation session, a set of scrambled aggregates are constructed in such a manner that there exists a secret yet unrevealed relationship between these values. The base station, aware of the relationship derived from the configuration matrix, can both extract the intended result from the received aggregates and verify it on its own. Our scheme avoids the interactive verification phase which existent protocols typically take to ensure the aggregation integrity, and thus observably lowers the communication overhead. The proposed scheme also features protection of data confidentiality, and analysis shows that it can detect stealthy alteration attacks with a significant probability. Copyright © 2010 John Wiley & Sons, Ltd.

Optimistic fair exchange (OFE) allows two parties to exchange their digital items in a fair way. As one of the fundamental problems in secure electronic business and digital rights management, OFE has been studied intensively since its introduction. This paper introduces and defines a new property for OFE: Strong Resolution-Ambiguity. We show that many existing OFE protocols have the new property, but its formal investigation has been missing in those protocols. We prove that in the certified-key model, an OFE protocol is secure in the multi-user setting if it is secure in the single-user setting and has the property of strong resolution-ambiguity. Our result not only simplifies the security analysis of OFE protocols in the multi-user setting but also provides a new approach for the design of multi-user secure OFE protocols. Following this approach, a new OFE protocol with strong resolution-ambiguity is proposed. Our analysis shows that the protocol is setup-free, stand-alone and multi-user secure without random oracles.

A low-rate distributed denial of service (DDoS) attack has significant ability of concealing its traffic because it is very much like normal traffic. It has the capacity to elude the current anomaly-based detection schemes. An information metric can quantify the differences of network traffic with various probability distributions. In this paper, we innovatively propose using two new information metrics such as the generalized entropy metric and the information distance metric to detect low-rate DDoS attacks by measuring the difference between legitimate traffic and attack traffic. The proposed generalized entropy metric can detect attacks several hops earlier (three hops earlier while the order α = 10 ) than the traditional Shannon metric. The proposed information distance metric outperforms (six hops earlier while the order α = 10) the popular Kullback-Leibler divergence approach as it can clearly enlarge the adjudication distance and then obtain the optimal detection sensitivity. The experimental results show that the proposed information metrics can effectively detect low-rate DDoS attacks and clearly reduce the false positive rate. Furthermore, the proposed IP traceback algorithm can find all attacks as well as attackers from their own local area networks (LANs) and discard attack traffic.

As part of the security within distributed systems, various services and resources need protection from unauthorized use. Remote authentication is the most commonly used method to determine the identity of a remote client. This paper investigates a systematic approach for authenticating clients by three factors, namely password, smart card, and biometrics. A generic and secure framework is proposed to upgrade two-factor authentication to three-factor authentication. The conversion not only significantly improves the information assurance at low cost but also protects client privacy in distributed systems. In addition, our framework retains several practice-friendly properties of the underlying two-factor authentication, which we believe is of independent interest.

Identifying malicious software provides great benefit for distributed and networked systems. Traditional real-time malware detection has relied on using signatures and string matching. However, string signatures ineffectively deal with polymorphic malware variants. Control flow has been proposed as an alternative signature that can be identified across such variants. This paper proposes a novel classification system to detect polymorphic variants using flowgraphs. We propose using an existing heuristic flowgraph matching algorithm to estimate graph isomorphisms. Moreover, we can determine similarity between programs by identifying the underlying isomorphic flowgraphs. A high similarity between the query program and known malware identifies a variant. To demonstrate the effectiveness and efficiency of our flowgraph based classification, we compare it to alternate algorithms, and evaluate the system using real and synthetic malware. The evaluation shows our system accurately detects real malware, performs efficiently, and is scalable. These performance characteristics enable real-time use on an intermediary node such as an Email gateway, or on the endhost.

Propagation of Peer-to-Peer (P2P) worms in the Internet is posing a serious challenge to network security because of P2P worms' increasing complexity and sophistication, significant damages their propagation can cause, and recent popularity of P2P networks with increasing number of users. No existing work has solved the problem of propagation modeling of P2P worms due to its complexity. This paper presents a study on propagation modeling of P2P worms. It also presents our applications of the proposed approach in worm propagation research. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms, and demonstrate the approach's ease of employment through the simulation experiments; and secondly, we find the impacts of the network-related characteristics on a P2P worm's attack performance in structured P2P networks, and a critical value of vulnerability rate. The proposed discrete-time deterministic propagation model of a P2P worm is written in a difference equation of logic matrix. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation research in particular. The proposed approach's ease of employment makes it an attractive instrument to conduct worm propagation research.

Identifying applications and classifying network traffic flows according to their source applications are critical for a broad range of network activities. Such classifications can be based on information derived from packet header fields and payload content, or statistical characteristics of flows and communication patterns of hosts. However, most of present methods rely on some forms of priori knowledge. In this paper, an application signature based traffic classification system with a novel approach to fully automate the process of deriving signatures from unknown traffic is proposed. The key idea is to combine traffic clustering based on statistical flow properties in order to generate clusters dominated by a single application on the one hand, and application signature construction solely based on payload content from each cluster on the other hand. Evaluation using real-world traffic traces indicate that the proposed approach is highly effective.

While the nascent Cloud Computing paradigm supported by virtualization has the upward new notion of edges, it lacks proper security and trust mechanisms. Edges are like on demand scalability and infinite resource provisioning as per the `pay-as-you-go' manner in favour of a single information owner (abbreviated as INO from now onwards) to multiple corporate INOs. While outsourcing information to a cloud storage controlled by a cloud service provider (abbreviated as CSP from now onwards) relives an information owner of tackling instantaneous oversight and management needs, a significant issue of retaining the control of that information to the information owner still needs to be solved. This paper perspicaciously delves into the facts of the Cloud Computing security issues and aims to explore and establish a secure channel for the INO to communicate with the CSP while maintaining trust and confidentiality. The objective of the paper is served by analyzing different protocols and proposing the one in commensurate with the requirement of the security property like information or data confidentiality along the line of security in Cloud Computing Environment (CCE). To the best of our knowledge, we are the first to derive a secure protocol by successively eliminating the dangling pitfalls that remain dormant and thereby hamper confidentiality and integrity of information that is worth exchanging between the INO and the CSP. Besides, conceptually, our derived protocol is compared with the SSL from the perspectives of work flow related activities along the line of secure trusted path for information confidentiality.

In this paper, we present some practical experience on implementing an alert fusion mechanism from our project. After investigation on most of the existing alert fusion systems, we found the current body of work alternatively weighed down in the mire of insecure design or rarely deployed because of their complexity. As confirmed by our experimental analysis, unsuitable mechanisms could easily be submerged by an abundance of useless alerts. Even with the use of methods that achieve a high fusion rate and low false positives, attack is also possible. To find the solution, we carried out analysis on a series of alerts generated by well-known datasets as well as realistic alerts from the Australian Honey-Pot. One important finding is that one alert has more than an 85% chance of being fused in the following 5 alerts. Of particular importance is our design of a novel lightweight Cache-based Alert Fusion Scheme, called CAFS. CAFS has the capacity to not only reduce the quantity of useless alerts generated by IDS (Intrusion Detection System), but also enhance the accuracy of alerts, therefore greatly reducing the cost of fusion processing. We also present reasonable and practical specifications for the target-oriented fusion policy that provides a quality guarantee on alert fusion, and as a result seamlessly satisfies the process of successive correlation. Our experimental results showed that the CAFS easily attained the desired level of survivable, inescapable alert fusion design. Furthermore, as a lightweight scheme, CAFS can easily be deployed and excel in a large amount of alert fusions, which go towards improving the usability of system resources. To the best of our knowledge, our work is a novel exploration in addressing these problems from a survivable, inescapable and deployable point of view.

In the existing studies on fault-tolerant scheduling, the active replication schema makes use of ε + 1 replicas for each task to tolerate E failures. However, in this paper, we show that it does not always lead to a higher reliability with more replicas. Besides, the more replicas implies more resource consumption and higher economic cost. To address this problem, with the target to satisfy the user's reliability requirement with minimum resources, this paper proposes a new fault tolerant scheduling algorithm: MaxRe. In the algorithm, we incorporate the reliability analysis into the active replication schema, and exploit a dynamic number of replicas for different tasks. Both the theoretical analysis and experiments prove that the MaxRe algorithm's schedule can certainly satisfy user's reliability requirements. And the MaxRe scheduling algorithm can achieve the corresponding reliability with at most 70% fewer resources than the FTSA algorithm.

Peer-to-Peer (P2P) worms have become a serious problem on the Internet because of its adaptive propagation features. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of P2P worms, especially when quarantine of peers is enforced. This paper presents a study on modeling the propagation of P2P worms under quarantine. We strive to find a quarantine tactic which is able to protect the majority of the peers by quarantining only the minority of them. Our major contributions in this paper are firstly, we propose a novel logic matrix approach to modeling the propagation of P2P worms; and secondly, we find the impacts of the two different quarantine tactics on the propagation characteristics of P2P worms. Motivated by our aspiration to invent an easy-to-employ instrument for worm propagation research, the proposed approach models the propagation processes of P2P worms by difference equations of logic matrix, which are essentially discrete-time deterministic propagation models of P2P worms. To the best of our knowledge, we are the first using logic matrix in network security research in general and worm propagation modeling in particular.

Abstract Identifying applications and classifying network traffic flows according to their source applications are critical for a broad range of network activities. Such a decision can be based on packet header fields, packet payload content, statistical characteristics of traffic and communication patterns of network hosts. However, most present techniques rely on some sort ofa prioriknowledge, which means they require labor‐intensive preprocessing before running and cannot deal with previously unknown applications. In this paper, we propose a traffic classification system based on application signatures, with a novel approach to fully automate the process of deriving signatures from unidentified traffic. The key idea is to integrate statistics‐based flow clustering with payload‐based signature matching method, so as to eliminate the requirement of pre‐labeled training data sets. We evaluate the efficiency of our approach using real‐world traffic trace, and the results indicate that signature classifiers built from clustered data and pre‐labeled data are able to achieve similar high accuracy better than 99%. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract Modeling network traffic has been a critical task in the development of Internet. Attacks and defense are prevalent in the current Internet. Traditional network models such as Poisson‐related models do not consider the competition behaviors between the attack and defense parties. In this paper, we present a microscopic competition model to analyze the dynamics among the nodes, benign or malicious, connected to a router, which compete for the bandwidth. The dynamics analysis demonstrates that the model can well describe the competition behavior among normal users and attackers. Based on this model, an anomaly attack detection method is presented. The method is based on the adaptive resonance theory, which is used to learn the model by normal traffic data. The evaluation shows that it can effectively detect the network attacks. Copyright © 2009 John Wiley & Sons, Ltd.

In the past decades, the evolution of wireless technologies has brought significant changes in modern communication networks through its wireless extension of wired networks. Wireless communications offer organizations and users many benefits such as portability and flexibility, increased productivity, and lower installation costs. However, risks are inherent in any wireless network. As the technologies of next generation wireless networks are emerging, security has become a primary concern in order to provide dependable and secure communication between the wireless nodes in a hostile environment. The next generation wireless networks face many unique challenges in security such as open network architecture, shared wireless medium, limited resource constraints, and highly dynamic network topology. This special issue in Security and Communication Networks presents current research focusing on the standard or protocol related security, attacks and defense applications, security architecture and frameworks, and theories and methodologies in security in next generation wireless networks. In view of this, we selected eight papers on security in next generation wireless networks to this special issue. The papers are either selected from open submissions or the best paper in 2008 International Workshop on Network and System Security (NSS 2008), held on 18–19 October 2008, in Shanghai, China. All the papers were selected on the basis of their originality, technical quality, and significance. Each paper was under rigorous technical review by at least three international reviewers. The selected papers are summarized below. Routing security contexts via an IP network imposes new challenging requirements of secure cross-handover services and security context management. In the first paper, Kim and Shin present a context router that manages security contexts in an all-IP network, providing seamless and secure handover services for the mobile users that carry multimedia-access devices. The proposed predictive routing mechanism improves seamless and secure cross-handover services. Trust establishment and management are essential for any security framework of MANETs. In the second paper, Dahshan and Irvine propose a robust self-organized, public key management for MANETs. The proposed scheme relies on establishing a small number of trust relations between neighboring nodes during the network initialization phase. Simulation results show that the proposed scheme is robust and efficient in the mobility environment of MANET and against malicious node attacks. A mobile node in a MANET must be assigned a free IP address before it may participate in unicast communications. This is a fundamental and difficult problem in the practical application of any MANET. In the third paper, Zhou, Mutka, and Ni propose a secure autoconfiguration algorithm, namely secure prophet address allocation, to perform prophet address allocation while considering the requirements of communication overhead, latency, and scalability. It is demonstrated that the proposed approach is able to maintain uniqueness of address assignment in the presence of IP spoofing attacks, ‘state pollution’ attacks, and Sybil attacks. In the fourth paper, Babu and Venkataram present a security techniques selection scheme for mobile transactions, called the Transactions-Based Security Scheme (TBSS). The TBSS identifies a suitable level of security techniques from the repository, which consists of symmetric, and asymmetric types of security algorithms arranged in three complexity levels, covering various encryption/decryption techniques, digital signature schemes, and hashing techniques. Their results shows a considerable reduction in security cost compared to static schemes, which employ pre-fixed security techniques to secure the transactions data. Discriminating impersonating devices is an important problem in Wi-Fi networks. While legal and illegal nodes may have the same configuration, their locations are different, resulting in different RSSI measured by the sensors. In the fifth paper, Tao et al. proposed X-mode, a faster clustering algorithm, to process the data. X-mode differs from other clustering algorithms by dropping low RSSI values and treating data points with the same RSSI values as one point during computation. Many RFID authentication techniques require a form of synchronization between a tag and a reader. A de-synchronization could jeopardize security and privacy. In the sixth paper, Conti et al. proposed a hash-chain based scheme to resolve the de-synchronization problem in RFID systems. Their solution achieves mutual reader-tag authentication by utilizing hash traversal and Merkle tree techniques. Through extensive simulations, the authors show that the tag and the reader can easily recover from de-synchronization with negligible overhead. Improving wireless access security through various OSI PHY layer mechanisms is the focus of the seventh paper. Klein et al. investigated the exploitation of RF waveform features that are inherently unique to specific devices and could be use for reliable device classification. They introduce a Dual-Tree Complex Wavelet Transform (DT-CWT) denoising technique to augment and improve Variance Trajectory (VT) detection capability. Instantaneous amplitude responses from collected 802.11a signals are used to validate the efficacy of DT-CWT at varying SNR. Internet key exchange version 2(IKEv2) is the protocol used to set up a security association (SA) in the IPsec protocol suite. In the eighth paper, Faigl et al. evaluated the performance impacts of IKEv2 in the next-generation wireless networks. They conduct experiments on two different wireless authentication methods, pre-shared keys (PSK) and extensible authentication protocol (EAP). Their experimental results clearly demonstrate the practical costs involved for IKEv2 authentication. We sincerely hope that you will enjoy reading these eight papers and find them very useful. We thank all the international reviewers for their professional services. We deeply thank Professor Hsiao-Hwa Chen, the Editor-in-Chief, for providing this opportunity to publish this special issue. Without his continuous support, encouragement, and guidance throughout this publishing project, the success of this special issue is impossible. Hahnsang Kim and Kang Shin, On predictive routing of security contexts in an All-IP network. Hisham Dahshan and James Irvine, A robust self-organized public key management for mobile ad hoc networks. Hongbo Zhou, Matt W. Mutka, and Lionel M. Ni, Secure prophet address allocation for MANETs. Sathish Babu B. and Pallapa Venkataram, Random security scheme selection for mobile transactions. Tao et al., A data clustering approach to discriminating impersonating devices in Wi-Fi networks. Conti et al., eRIPP-FS: a novel authentication technique for RFID. Klein et al., Application of wavelet denoising to improve OFDM-based signal detection and classification. Faigl et al., Performance evaluation of IKEv2 authentication methods in next generation wireless networks.

This paper presents a study on modeling the propagation process of topology-aware worms. Topology-aware worms are more intelligent and adaptive to network topologies than other worms, thus are more difficult to control. Due to the complexity of the problem, no existing work has solved the problem of modeling the propagation of topology-aware worms. Our major contributions in this paper are firstly, we propose an innovative logic matrix formulation of the propagation process of topology-aware worms; and secondly, we find, from the applications of the formulation in our experiments, the impacts of two different topologies, namely the simple random graph topology and the pseudo power law topology, on a P2P worm's mean coverage rate in the P2P overlay network. The proposed innovative logic matrix formulation, which is a discrete time deterministic propagation model of topology-aware worms, can translate the propagation process of topology-aware worms into a sequence of logic matrix operations. Its effectiveness and efficiency are demonstrated by its applications in our experiments.

Abstract This paper presents an innovative fusion‐based multi‐classifier e‐mail classification on a ubiquitous multi‐core architecture. Many previous approaches used text‐based single classifiers to identify spam messages from a large e‐mail corpus with some amount of false positive tradeoffs. Researchers are trying to prevent false positive in their filtering methods, but so far none of the current research has claimed zero false positive results. In e‐mail classification false positive can potentially cause serious problems for the user. In this paper, we use fusion‐based multi‐classifier classification technique in a multi‐core framework. By running each classifier process in parallel within their dedicated core, we greatly improve the performance of our multi‐classifier‐based filtering system in terms of running time, false positive rate, and filtering accuracy. Our proposed architecture also provides a safeguard of user mailbox from different malicious attacks. Our experimental results show that we achieved an average of 30% speedup at an average cost of 1.4 ms. We also reduced the instances of false positives, which are one of the key challenges in a spam filtering system, and increases e‐mail classification accuracy substantially compared with single classification techniques. Copyright © 2009 John Wiley & Sons, Ltd.

Security and privacy have been the major concerns when people design computer networks and systems. In the recent years, there has been a significant increase in network and system attacks, such as frauds, distributed denial of service, viruses, worms, spyware, and malware, etc., causing huge economical and social damage. To deal with the rapidly evolving threats of today and the more intelligent and automatic threats in the future, we urgently need new security systems, at all times and in real-time, to protect the networks and systems, without causing performance penalty to normal operations. Multi-core processors represent a major evolution in computing hardware technology. Whereas two years ago most network processors and personal computer microprocessors had single core configuration, the majority of the current microprocessors contain dual or quad cores and the number of cores on die is expected to grow exponentially over time. Multi-core provides an application with more processing power from the hardware perspective. However, there are still significant software design challenges that must be overcome before the real-time defense system can be realized. The difficulty is not in building multi-core hardware, but in concurrently programming security systems in a way that lets them benefit from the continued growth in the CPU performance. How can we actually use multi-core to continue running security systems while keeping the overall system performance? How can we efficiently partition and distribute the workload of security systems between the different cores in the multi-core CPU? How can we split network data and solve the data dependency problem? How can we smartly utilize the memory so that it brings less memory access latencies? How can we synchronize and coordinate different threads of the security system when it is parallelized on multi-core? In view of this, we selected eight papers on multi-core supported network and system security for this special issue. The papers are either selected from open submissions or from the best papers in the 2008 International Workshop on Network and System Security (NSS 2008), held on 18–19 October 2008, in Shanghai, China. All the papers were selected on the basis of their originality, technical quality, and significance. Each paper was under rigorous technical review by at least two international reviewers. The selected papers broadly cover key research issues in multi-core supported network and system security as summarized below. Sommer et al. 1 present an architecture customized for parallel execution of network attack analysis. The network interface device dispatches packets to a set of threads that structure the processing as an event-based analysis model which is well suited to exploit many of the opportunities for concurrent execution. In this model, they capture event dependencies by scheduling related events to the same thread, serializing their execution without needing to resort to expensive inter-thread synchronization. The presented concurrent architecture shows how to transform the traditionally serial network security analysis pipeline into a highly parallelizable form that is able to take full advantage of the multi-core. Multi-core-based Network Processors (NPs) are promising components to build real-time and scalable security systems to protect the networks and systems. The parallel nature of the processing system makes it challenging for application developers to concurrently program high-performance security systems. Soewito and Weng 2 present an automatic programming methodology which considers application complexity, traffic variation, and attack signatures update. In particular, the proposed mapping algorithm concurrently takes advantage of parallelism in the level of tasks, applications, and packets to achieve optimal performance. The results show the effectiveness of the analysis, mapping, and the performance model methodology. Islam et al. 3 present an innovative fusion-based multi-classifier e-mail classification on a ubiquitous multi-core architecture. By running each classifier process in parallel within their dedicated core, they improve the performance of the multi-classifier-based filtering system in terms of running time, false positive rate, and filtering accuracy. This system substantially increases the e-mail classification accuracy compared with single classification techniques. This gives us a good example of application level parallelization. Parallel computing presents an opportunity to improve performance utilizing inherent parallel secure operations. Deitos and Kerschbaum 4 focus on practical approaches to privacy-preserving parallel protocols for collaborative linear programming. They theoretically compare the approaches of parallelizing a secure algorithm and securing a parallel algorithm. Different synchronization methods for the implementation are compared under different network conditions. They present and evaluate an adaptive scheduling algorithm for the dynamic selection of the number of threads, such that it is not necessary to statically and up-front determine the number for optimal speed-up. Gao et al. 5 present a simulation theorem for the online/off-line cases, where the security of an online/off-line threshold signature scheme is reduced to the security of a so-called divisible online/off-line signature scheme. This provides a theoretical basis for constructing an online/off-line threshold signature scheme through the simulation approach. Shen et al. 6 present an efficient and scalability key pre-distribution scheme for large-scale wireless sensor networks based on a three-tier hierarchical network architecture and a bivariate polynomial-key pre-distribution mechanism. Compared with existing key distribution protocols, it provides the best network resilience against node capture attack. The communication overhead of this scheme is minimized. In this scheme, each sensor node only needs to store one key and one polynomial in its memory regardless of the network size and density, which reduces the key storage overhead for tiny sensors. Agudo et al. 7 present a way for resolving the access control problem where several requests are performed concurrently. As trust is a paramount aspect when building distributed applications, the same applies in a lower scale on modern computers. The use of a trust graph keeps record of the trust relationships of the system and helps decide on concurrent access requests. This paper presents some preliminary research on concurrent access control for multi-user and multi-processor systems based on trust relationships. Liu et al. 8 propose a reverse interleaved pipelining scheduling strategy to decrease the total I/O execution time and balance the workloads of homogeneous processors. Theoretical analysis shows that this balancing strategy is fair. As for the heterogeneous processors' circumstance, a self-adaptive scheduling method is presented for selecting one of the most appropriate multi-core services for the expected I/O tasks. Simulation studies show that this scheduling strategy self-adapts well to applications and multi-core processors. We sincerely hope that you will enjoy reading these eight papers and find them very useful. We thank all the international reviewers for their professional services. We deeply thank Prof Geoffrey Fox, the Editor-in-Chief, for providing this opportunity to publish this special issue. Without his continuous support, encouragement, and guidance throughout this publishing project, the success of this special issue would have been impossible.

IP traceback is the enabling technology to control Internet crime. In this paper we present a novel and practical IP traceback system called Flexible Deterministic Packet Marking (FDPM) which provides a defense system with the ability to find out the real sources of attacking packets that traverse through the network. While a number of other traceback schemes exist, FDPM provides innovative features to trace the source of IP packets and can obtain better tracing capability than others. In particular, FDPM adopts a flexible mark length strategy to make it compatible to different network environments; it also adaptively changes its marking rate according to the load of the participating router by a flexible flow-based marking scheme. Evaluations on both simulation and real system implementation demonstrate that FDPM requires a moderately small number of packets to complete the traceback process; add little additional load to routers and can trace a large number of sources in one traceback process with low false positive rates. The built-in overload prevention mechanism makes this system capable of achieving a satisfactory traceback result even when the router is heavily loaded. It has been used to not only trace DDoS attacking packets but also enhance filtering attacking traffic.

Distributed Denial of Service attacks is one of the most challenging areas to deal with in Security. Not only do security managers have to deal with flood and vulnerability attacks. They also have to consider whether they are from legitimate or malicious attackers. In our previous work we developed a framework called bodyguard, which is to help security software developers from the current serialized paradigm, to a multi-core paradigm. In this paper, we update our research work by moving our bodyguard paradigm, into our new Ubiquitous Multi-Core Framework. From this shift, we show a marked improvement from our previous result of 20% to 110% speedup performance with an average cost of 1.5 ms. We also conducted a second series of experiments, which we trained up Neural Network, and tested it against actual DDoS attack traffic. From these experiments, we were able to achieve an average of 93.36%, of this attack traffic.

Over the last couple of months a large number of distributed denial of service (DDoS) attacks have occurred across the world, especially targeting those who provide Web services. IP traceback, a counter measure against DDoS, is the ability to trace IP packets back to the true source/s of the attack. In this paper, an IP traceback scheme using a machine learning technique called intelligent decision prototype (IDP), is proposed. IDP can be used on both probabilistic packet marking (PPM) and deterministic packet marking (DPM) traceback schemes to identify DDoS attacks. This will greatly reduce the packets that are marked and in effect make the system more efficient and effective at tracing the source of an attack compared with other methods. IDP can be applied to many security systems such as data mining, forensic analysis, intrusion detection systems (IDS) and DDoS defense systems.

Abstract One of the major challenges in wide use of Grid workflow systems is fault tolerance and avoidance. Checkpointing schemes provide a way of fault detection and recovery. In our research, we focus on the performance optimization of checkpointing schemes and dynamic voltage scaling (DVS) for Grid workflow systems. We propose offline checkpointing schemes with DVS and online adaptive checkpointing schemes that dynamically adjust the checkpointing intervals by using store checkpoints and compare checkpoints. When combined with DVS, offline adaptive checkpointing schemes not only are fault tolerant but also lead to reduce average execution time of tasks. These schemes can efficiently utilize comparison and storage operations and significantly improve the performance. Further, these schemes can calculate the optimal numbers of checkpoints by which the mean execution time can be minimized. We also expand the online adaptive checkpointing schemes from single‐task execution scenarios to multi‐task execution scenarios. Simulation results show that these online schemes outstandingly increase the likelihood of timely task completion when faults occur. Copyright © 2008 John Wiley & Sons, Ltd.

Currently distributed denial of service (DDoS) attacks have been identified as one of the most serious problems on the Internet. The aim of DDoS attacks is to prevent legitimate users from accessing desired resources, such as network bandwidth. Hence the immediate task of DDoS defense is to provide as much resources as possible to legitimate users when there is an attack. Unfortunately most current defense approaches can not efficiently detect and filter out attack traffic. Our approach is to find the network anomalies by using neural network, deploy the system at distributed routers, identify the attack packets, and then filter them. The marks in the IP header that are generated by a group of IP traceback schemes, deterministic packet marking (DPM)/flexible deterministic packet marking (FDPM), assist this process of identifying attack packets. The experimental results show that this approach can be used to defend against both intensive and subtle DDoS attacks, and can catch DDoS attacks' characteristic of starting from multiple sources to a single victim. According to results, we find the marks in IP headers can enhance the sensitivity and accuracy of detection, thus improve the legitimate traffic throughput and reduce attack traffic throughput. Therefore, it can perform well in filtering DDoS attack traffic precisely and effectively.