Container escape detection is a critical research topic in the field of cloud security. Among the challenges faced in modern cloud security, the issue of container escape poses a significant threat due to its direct impact on the security of the host machine. Although recent research has proposed various methods to address such issue, they have shortcomings in terms of real-time capabilities and deployment in multinode environments. Meanwhile, container network interface (CNI) plugins provide network functionality for container management systems such as Kubernetes, offering ease of use and scalability. Therefore, we propose CPCED, a real-time container escape detection system running on a generic CNI plugin, and implement the prototype. The system defines the container namespace event that is used to detect insecure interactions by monitoring its changes in the permissions of the process namespace. To detect the events, an algorithm is proposed to extract suspicious process paths and command context in Kubernetes and Docker environments. The experimental results show that this system detects nine container escape vulnerabilities successfully. Compared to PACED, one of the real-time container escape attack detection systems, the memory usage of CPCED is reduced by 7.6% on average, and the average detection time of single vulnerability is 18.6% of PACED’s.

Certificateless public key cryptography (CL-PKC) has garnered significant attention in recent years due to its ability to address the complex certificate management requirements inherent in public key infrastructure (PKI) systems and the key escrow issue associated with identity-based cryptography (IBC). However, the efficient revocation of illegitimate users in authentication schemes based on CL-PKC remains a challenge. Moreover, certain schemes still exhibit security vulnerabilities, such as susceptibility to key replacement attacks, and also require performance enhancements. In this article, we propose a novel certificateless signature scheme that incorporates the RSA accumulator. By leveraging the witness in the RSA accumulator to produce the public keys of users, the authenticity of the public key can be efficiently verified, thereby eliminating key replacement attacks. Additionally, by removing specific elements from the RSA accumulator and broadcasting the update credential to legitimate users via a public channel, our proposed scheme allows the effective revocation of malicious users. Security analysis and performance evaluations indicate that our scheme provides comprehensive security and achieves high performance in terms of computational and communication costs in both signingverification and revocation processes.

Abstract Bitcoin is a decentralized P2P cryptocurrency. It supports users to use pseudonyms instead of network addresses to send and receive transactions at the data layer, hiding users’ real network identities. Traditional transaction tracing attack cuts through the network layer to directly associate each transaction with the network address that issued it, thus revealing the sender’s network identity. But this attack can be mitigated by Bitcoin’s network layer privacy protections. Since Bitcoin protects the unlinkability of Bitcoin addresses and there may be a many-to-one relationship between addresses and nodes, transactions sent from the same node via different addresses are seen as coming from different nodes because attackers can only use addresses as node identifiers. In this paper, we proposed the evicting and filling attack to expose the correlations between addresses and cluster transactions sent from different addresses of the same node. The attack exploited the unisolation of Bitcoin’s incoming connection processing mechanism. In particular, an attacker can utilize the shared connection pool and deterministic connection eviction strategy to infer the correlation between incoming and evicting connections, as well as the correlation between releasing and filling connections. Based on inferred results, different addresses of the same node with these connections can be linked together, whether they are of the same or different network types. We designed a multi-step attack procedure, and set reasonable attack parameters through analyzing the factors that affect the attack efficiency and accuracy. We mounted this attack on both our self-run nodes and multi-address nodes in real Bitcoin network, achieving an average accuracy of 96.9% and 82%, respectively. Furthermore, we found that the attack is also applicable to Zcash, Litecoin, Dogecoin, Bitcoin Cash, and Dash. We analyzed the cost of network-wide attacks, the application scenario, and proposed countermeasures of this attack.

Location-based service recommendations usually need to collect and analyze the location information of trajectories generated by users with smart phones or wearable devices. It is easy to cause the location privacy leaks. The current location privacy protection methods usually confuse the adversary by adding fake locations into real trajectories to achieve the goal of privacy protection. However, these methods fail to consider the utility of user trajectories in service recommendations. In this paper, we propose a privacy-preserving trajectory generation algorithm based on service semantic similarity. To improve the utility of privacy-preserving trajectories for service recommendations, the algorithm constructs a series of service semantic grid maps and generates fake individuals with privacy-preserving trajectories considering both utility and privacy. Simulation results show that the proposed algorithm can effectively hide the locations in real trajectories of individuals and obtain higher effectiveness for service recommendations.

As a novel network architecture, softwaredefined networking (SDN) decouples control and data planes, which brings a lot of flexibility to the network. But the separation arises some problems, such as controller placement problem(CPP). Controller placement problem is an important task especially in wide area networks, which would directly affect latency and performance of entire network. In this paper, we propose a method based on modified density peaks clustering(MDPC) algorithm to solve controller placement problem, aiming to minimize the average propagation latency between switches and controllers. The entire network is divided into several sub-networks, each of sub-networks is managed by a controller. We conduct the experiments on the Internet2 OS3E topology to evaluate the performance of our method. The experimental results show that our controller placement strategy can significantly reduce latency. Specifically, the average latency can be reduced by 35% compared to K-means and 10% compared to optimized Kmeans.

Since Cyber-Physical System (CPS) is defined as integrations of computation, communication and control to physical processes, the communication plays an important role in such system. Compared with the traditional control system, the control in CPS is very difficult because the communication networks inevitably introduce variable time delays and possible lost of samples. In Networked Control System (NCS), there are some related works to discuss the problem of time delay. However it still needs to evaluate and improve those existing schemes in CPS. In this paper, a novel dynamic timeout scheme and actuator compensation by using a hidden Markov model for the time delay to reduce the influence of random time delays has been proposed. Simulation results on TrueTime 2.0 demonstrate the feasibility and effectiveness of this networked real-time control strategy.

Mobile ad hoc network (MANET) is a self-configuring network that is formed automatically via wireless links by a collection of mobile nodes without the help of a fixed infrastructure or centralized management. The mobile nodes forward packets for each other, allowing communication among nodes outside wireless transmission range hop by hop. Due to dynamic infrastructure-less nature and lack of centralized monitoring points, the ad hoc networks are vulnerable to attacks. Attacks on ad hoc network routing protocols disrupt network performance and reliability. This paper attempts to provide a comprehensive overview of attacks and secure routing. It first analyzes the reason that ad hoc network is vulnerable to attacks. Then it presents the well known attacks and the popular secure protocols.