Network covert channels in the Internet of Things (IoT) can conceal device communication behaviors, thereby protecting user privacy and ensuring secure transmission of sensitive data. However, existing active covert channels in IoT are constrained by the low computational power and limited storage of IoT terminal devices, making them unsuitable for complex steganographic algorithms. Moreover, the active covert channel is more vulnerable to targeted detection and blocking by traffic analysis. To address these challenges, this study proposes a passive network storage covert channel (PNSCC) that leverages intermediate IoT nodes. We also present solutions for synchronization and reversible data hiding within the PNSCC. A covert channel kernel module was designed and deployed on smart routers running the OpenWrt system, followed by experimental testing. The results indicate that the PNSCC achieves a relatively high capacity, with a covert data transmission rate of approximately 88.97 bps in real-world network environments. Additionally, it has minimal impact on actual network performance and exhibits resilience against traffic analysis.

LLMs can exhibit age biases, resulting in unequal treatment of individuals across age groups. While much research has addressed racial and gender biases, age bias remains little explored. The scarcity of instruction-tuning and preference datasets for age bias hampers its detection and measurement, and existing fine-tuning methods seldom address age-related fairness. In this paper, we construct age bias preference datasets and instruction-tuning datasets for RLHF. We introduce AGR, an age fairness reward to reduce differences in the response quality of LLMs across different age groups. Extensive experiments demonstrate that this reward significantly improves response accuracy and reduces performance disparities across age groups. Our source code and datasets are available at the anonymous link.

Audio can disclose PII, particularly when combined with related text data. Therefore, it is essential to develop tools to detect privacy leakage in Contrastive Language-Audio Pretraining(CLAP). Existing MIAs need audio as input, risking exposure of voiceprint and requiring costly shadow models. We first propose PRMID, a membership inference detector based probability ranking given by CLAP, which does not require training shadow models but still requires both audio and text of the individual as input. To address these limitations, we then propose USMID, a textual unimodal speaker-level membership inference detector, querying the target model using only text data. We randomly generate textual gibberish that are clearly not in training dataset. Then we extract feature vectors from these texts using the CLAP model and train a set of anomaly detectors on them. During inference, the feature vector of each test text is input into the anomaly detector to determine if the speaker is in the training set (anomalous) or not (normal). If available, USMID can further enhance detection by integrating real audio of the tested speaker. Extensive experiments on various CLAP model architectures and datasets demonstrate that USMID outperforms baseline methods using only text data.

The results of federated learning contain certain private information and still have the risk of privacy leakage. Therefore, this paper proposes a Federated Learning Scheme with Adaptive Hierarchical Protection and Multiple Aggregation (ADDFed). The scheme trains models and generates updates using local datasets at the client side. Based on comparisons between client contributions and two thresholds, it chooses homomorphic encryption, adaptive differential privacy, or data discarding methods to protect the data. The first aggregation model and the second aggregation model are obtained by classification aggregation at the server side. Finally, the client decrypts and aggregates to get the global model. Experimental results demonstrate that ADDFed consumes a privacy budget of 3624.47, involves 562,219,358 bytes of communication, and requires 11,603 seconds of training time, achieving a model accuracy of 87.4%, thus showing significant advantages.

With the continuous breakthroughs in deep learning within the field of computer vision, an increasing number of researchers have begun exploring image-based Android malware detection. For example, recent years have seen widespread application of Vision Transformer (ViT) models in Android malware detection, which have demonstrated significant effectiveness. However, ViT-based Android malware detection methods still face challenges, such as the loss of local features and insufficient capture of edge information and texture features, which limit their detection capabilities. To address these challenges, this paper proposes an Android malware detection method based on multi-feature fusion RGB images and the SC-ViT model. The SC-ViT model consists of two branches: the SC (Swin-Transformer CBAM) branch is responsible for extracting global information and capturing long-range dependencies, while the SPP (Spatial Pyramid Pooling Net, SPP-net) branch focuses on extracting multi-scale spatial features. These features are subsequently fused using an IAFF(Iterative Attentional Feature Fusion) module. Experimental results show that the proposed model achieves a detection accuracy of 99.50% and a detection precision of 99.23%, significantly surpassing the 96.82% accuracy achieved by the baseline ViT model, demonstrating its superiority and innovation in Android malware detection tasks.

By using traffic analysis attacks, attackers track users’ network traffic and analyze user behaviors, such as visited websites and online activities. Users’ personal privacy is at risk. Traffic obfuscation is a new way to protect privacy. Traffic obfuscation is commonly used in censory-circumvention systems to help Internet users bypass online censorship, but recent work has used it to disguise user traffic to evade adversary attacks. However, the current traffic obfuscation methods and rules are relatively simple, can not dynamically adapt to the network environment, and lack of uniform traffic feature similarity evaluation index. In this paper, we propose a generative adversarial network(GAN) model based on temporal convolutional network(TCN). TCN-GAN learns traffic features to achieve the purpose of disguising specific traffic as target traffic. At the same time, we provide the Measurement of Indiscernibility(MoI) for evaluating the difference between generated traffic features and real traffic features. Compared with the existing work, our experimental results show that in machine learning-based traffic analysis attacks, TCN-GAN has better performance on sample quality and mimicry effect, and MoI can be used as an effective index to evaluate the model generation effect.

Near-field communication (NFC) is a set of communication protocols that enable two electronic devices. Its security and reliability are welcomed by mobile terminal manufactures, banks, telecom operators, and third-party payment platforms. Simultaneously, it has also drawn more and more attention from hackers and attackers, and NFC-enabled devices are facing increasing threats. To improve the security of the NFC technology, the paper studied the technology of discovering security vulnerabilities of NFC Data Exchange Format (NDEF), the most important data transmission protocol. In the paper, we proposed an algorithm, GTCT (General Test Case Construction and Test), based on fuzzing to construct test cases and test the NDEF protocol. GTCT adopts four strategies to construct test cases, manual, generation, mutation, and “reverse analysis,” which can detect logic vulnerabilities that fuzzing cannot find and improve the detection rate. Based on GTCT, we designed an NDEF vulnerability discovering framework and developed a tool named “GNFCVulFinder” (General NFC Vulnerability Finder). By testing 33 NFC system services and applications on Android and Windows Phones, we found eight vulnerabilities, including DoS vulnerabilities of NFC service, logic vulnerabilities about opening Bluetooth/Wi-Fi/torch, design flaws about the black screen, and DoS of NFC applications. Finally, we give some security suggestions for the developer to enhance the security of NFC.

With the development of Internet technology, network security is under diverse threats. In particular, attackers can spread malicious uniform resource locators (URL) to carry out attacks such as phishing and spam. The research on malicious URL detection is significant for defending against these attacks. However, there are still some problems in the current research. For instance, malicious features cannot be extracted efficiently. Some existing detection methods are easy to evade by attackers. We design a malicious URL detection model based on a dynamic convolutional neural network (DCNN) to solve these problems. A new folding layer is added to the original multilayer convolution network. It replaces the pooling layer with the k-max-pooling layer. In the dynamic convolution algorithm, the width of feature mapping in the middle layer depends on the vector input dimension. Moreover, the pooling layer parameters are dynamically adjusted according to the length of the URL input and the depth of the current convolution layer, which is beneficial to extracting more in-depth features in a wider range. In this paper, we propose a new embedding method in which word embedding based on character embedding is leveraged to learn the vector representation of a URL. Meanwhile, we conduct two groups of comparative experiments. First, we conduct three contrast experiments, which adopt the same network structure and different embedding methods. The results prove that word embedding based on character embedding can achieve higher accuracy. We then conduct the other three experiences, which use the same embedding method proposed in this paper and use different network structures to determine which network is most suitable for our model. We verify that the model designed in this paper has the highest accuracy (98%) in detecting malicious URL through these experiences.

DICOM is an international standard for medical images and related information, and is a medical image format that can be used for data exchange. The agreement is widely used in medical fields such as radiology and cardiovascular imaging. However, since DICOM libraries have less security considerations in protocol implementation, they have a large number of security risks. Aiming at the security issue of DICOM libraries, the paper conducts research on vulnerability mining technology for DICOM open source libraries, proposes a vulnerability mining framework based on Fuzzing technology, and implements a prototype system named DICOM-Fuzzer, which includes initialization, test case generation, automatic test, exception monitoring and other modules. Finally, the open source library DCMTK was selected for testing, and it was found that data overflow would occur when the content of the received file was greater than 7080 lines. Found that there is a vulnerability that causes the PACS system to refuse service. In conclusion, the DICOM protocol does have risks, and its information security needs to be further improved.

Diagnostic Imaging System like X-Ray and CT are widely used in hospitals. And for the reason that health data of patients is stored and transferred digitally, security and privacy on diagnostic imaging systems are of great significance to both patients and hospitals. Although many works on diagnostic imaging system have been studied currently, it's hard to find a detailed analysis on current research progress or a thorough survey on the security controls that should be implemented on diagnostic imaging system. In this paper, we evaluate medical devices from different vendors by the model above. Finally, we conclude the evaluation and analysed the future research directions. The survey of results shows that most of diagnostic imaging systems are under risk and their information security should be further improved.