In high-voltage devices, the voltage-blocking structure is composed of chip termination and packaging, which is a semiconductor with multilayer dielectrics stacked structure. However, existing TCAD (Technology Computer-Aided Design) software fails to consider the Maxwell-Wagner effect in multilayer dielectrics. To address this issue, a transient state electric field model considering the Maxwell-Wagner effect for dielectric materials is developed and integrated into the standard TCAD workflow with acceptable computational cost. By experimental verification, the proposed model corresponds well with the measurement results and it reveals the influence of the Maxwell-Wagner effect in the multilayer dielectrics on the electric field characteristics of semiconductor. Moreover, the maximum relative error between the simulation based on the proposed model and measurement is 2.3%, while it is 15.38% when using original model in existing TCAD software. In addition, the influence of mesh size and parameters of dielectrics are discussed. Overall, the proposed model yields more accurate simulation results and can be used for robust insulation design under transient state.

Bluetooth-low-energy (BLE)-based low-power cameras have expanded the applications of battery-powered low-power Internet of Things (IoT) vision systems. The adaptive tuning of connection and image encoding settings plays a vital role in optimizing the efficiency of wireless vision systems. This article introduces a framework for adaptive adjustment in BLE-based low-power vision systems. To reduce power consumption, we model BLE power usage and design a dynamic BLE parameters and resolution adjustment method for low-power IoT vision system. Additionally, we design an edge-end combined approach that delegates the task of key region prediction to the receiving device to achieve adaptive intraframe JPEG encoding. Our approach leverages commercially available BLE devices without requiring physical layer modifications, ensuring compatibility with standard devices. We design a wireless hardware prototype using off-the-shelf CMOS sensors and BLE Systems on a Chip to evaluate our framework. Extensive experiments demonstrate a 66.9% increase in energy efficiency compared to traditional fixed parameter methods.

In response to the escalating prevalence of inference attacks on network traffic, traffic shaping emerges as a highly effective strategy to curb the leakage of user privacy information. Although many traffic shaping mechanisms have been proposed, their privacy-preserving performance has mostly been evaluated empirically or by focusing solely on inter-event traffic shaping methods, thereby neglecting intra-event information. In this work, we develop a general framework considering intra-event characteristics for quantifying privacy leakage. The proposed evaluation framework provides quantitative assessments of privacy risks and can guide the design and improvement of traffic-shaping mechanisms. Our theoretical results identify the limitation of existing approaches, namely, the absence of a flexible trade-off between privacy-preserving effectiveness and cost. This trade-off is critical for IoT applications, as devices are highly heterogeneous in terms of resources (i.e., bandwidth) and need to meet service-level objectives (e.g., latency). To achieve this design goal, we model the trade-off problem as multi-armed bandits and propose an online traffic-shaping algorithm named DPShaping. DPShaping has a proven privacy-preserving guarantee and supports flexible trade-offs between effectiveness and communication cost. We compare our approach with three representative algorithms. Experimental results show that compared with state-of-the-art schemes, DPShaping achieves lower attack accuracy (only 16.8%) and reduces bandwidth and delay.

Magnetic resonant coupling (MRC) enabled wireless power transfer (WPT) systems have shown significant promise in efficiently charging multiple devices simultaneously through beamforming technology. The existing works propose various mechanisms for achieving better charging performance, but they still lack exploration of transmitter (TX) coil orientation adjustment and rarely consider the dynamic deployment of TXs. In this work, we propose the D istributed A daptive E xploration and E xploitation ( DAEE ) algorithm for orientation adjustment in MRC-WPT systems, which includes both hardware and software innovations. The hardware component features a servo motor-based mechanical device that adjusts the TX coil orientation. In the software aspect, we decompose the charging performance optimization problem and devise a distributed orientation control algorithm combining exploration and exploitation mechanisms. We develop a system prototype for the DAEE algorithm and conduct extensive experiments to validate its performance. Specifically, the TX orientation adjustment significantly enhances performance, achieving an average 103% improvement in power-delivered-to-load (PDL) compared to state-of-the-art frequency adjustment-based solutions that do not adjust orientation. Additionally, the combination of exploration and exploitation strategies in the DAEE algorithm proves effective, delivering a 24% performance improvement over the random beamforming (RB)-based exploration method.

In the ever-evolving digital landscape, the complexity of web technologies has significantly increased. This complexity highlights the limitations of traditional web defense mechanisms in offering complete protection. Web shells, especially, present a formidable challenge in the field of web security. Recognizing and addressing this challenge is of paramount importance. It necessitates innovative understandings/approaches that contribute to the collective knowledge in web security. To achieve this, our paper introduces a novel type of attack: the cross-file web shell. Alongside this, we propose a detection methodology utilizing Graph Neural Networks (GNNs). Our method leverages the Function Call Graph (FCG) to generate graph embedding, capturing both the structural and semantic nuances of code. By incorporating a variety of statistics features, our approach adeptly identifies the characteristic patterns of web shells. Utilizing deep learning, this technique allows for precise classification and detection. The efficacy of our method is demonstrated by its impressive performance in detecting cross-file web shells, achieving an accuracy of 96.65% and an F1-score of 96.63%. In addition, we simulate real-world cross-file web shell attack and successfully detecte them using our method. These results underscore the potential of our approach in significantly enhancing web security measures.

Accurate attribution and tracing of cyber attacks require a comprehensive understanding of the resources employed by malicious actors. However, Indicators of Compromise (IoCs) can only reveal a portion of the attacker’s assets. To enhance the capability of clue expansion, this study introduces a novel approach to associating attack sources, facilitating the identification of additional IP addresses and subnets that may correspond to a single malicious actor. We focus on the scenario of compromised email accounts and utilize login logs as foundational data. We employ Gaussian Mixture Models (GMM) to construct a reference model that captures known malicious behaviors. Then, we utilize a genetic algorithm to filter and select candidate subnets that exhibit the attack patterns outlined by the reference model. Through evaluation on real-world data, we demonstrate the effectiveness of our proposed method in successfully attributing multiple attack sources to a single attacker, thereby providing valuable insights for manual investigations.

Low-power perception technologies, notable for their micro-watt-Ievel energy consumption, offer the capability for years of continuous data sensing and communication without the necessity for battery replacement. These characteristics make them extremely viable for large-scale deployment and position them as a pivotal trend in the future development of the Internet of Things. Low-power video transmission is a critical application. Low-power devices often have weaker signals, which can lead to consecutive packet loss, resulting in severe image defects at the receiver end. To address this, we propose a novel image transmission method at the transmitter side, which transmitting image blocks or rows using a specific sequence, significantly reducing the risk of consecutive block loss under severe channel interference or at low signal-to-noise ratio conditions, thereby en-hancing system stability under continuous packet loss conditions. Therefore, We adjust the deep learning model for real-world scenarios, achieving better image restoration in environments with high packet loss rates. We constructe a prototype based on backscatter communication cameras. Experiments conducte on this platform demonstrate that we can recover the majority of image information, even with a packet loss rate of 75%, by using traditional algorithms or deep learning approaches. This significantly enhances the visibility of low-power visual perception systems.

Abuse of code signing has garnered attention from security researchers, as evidenced by threat modeling efforts targeting the public key infrastructure trust infrastructure of code signing and empirical studies examining issues surrounding the revocation of code signing certificates. However, current research on code signing remains inadequate in bridging the gap between attack strategies and defensive measures. This shortfall is primarily due to the predominant focus on quantitative measurements in academic studies, often at the expense of a thorough analysis of the underlying code signing mechanisms. Moreover, the misalignment of some threat models and measurement outcomes with real-world attack scenarios further hampers efforts to enhance defenses against code signing abuse. To the best of our knowledge, this article represents the first comprehensive and in-depth analysis of code signing security from both offensive and defensive perspectives. Commencing with a profound understanding of code signing and its verification mechanisms, we constructed an integrated threat model encompassing eight typical attack patterns and distilled a set of critical security properties that directly influence the security of code signing. Proceeding from this foundation, we systematically reviewed and analyzed various defensive strategies associated with these security properties, meticulously discussing their strengths, limitations, and the specific attack types they effectively defend against or mitigate. Lastly, this article conducts a risk statistical analysis based on actual security incidents, with the related results directly impacting the prioritization of defensive mechanism deployments. This ensures, at a practical level, the effectiveness and relevance of the defense strategies implemented.

In recent years, receiver (RX) feedback communication has attracted increasing attention to enhance the charging performance for magnetic resonant coupling (MRC) based wireless power transfer (WPT) systems. People prefer to adopt the in-band implementation with minimal overhead costs. However, the influence of RX-RX coupling couldn’t be directly ignored like that in the RFID field, i.e., strong couplings and relay phenomenon. In order to solve these two critical issues, we propose a Robust layer-level in-band parallel communication protocol for MIMO MRC-WPT systems (called Roland). Technically, we first utilize the observed channel decomposability to construct group-level channel relationship graph for eliminating the interference caused by strong RX-RX couplings. Then, we generalize such method to deal with the RX dependency due to relay phenomenon. Finally, we conduct extensive experiments on a prototype testbed to evaluate the effectiveness of the proposed scheme. The results demonstrate that our Roland could provide ≥95% average decoding accuracy for concurrent feedback communication of 14 devices. Compared with the state-of-the-art solution, the proposed protocol Roland can achieve an average decoding accuracy improvement of 20.41%.

Amid escalating cyber threats, websites have emerged as predominant targets for attackers employing web shells to maintain extended control. Web shells, frequently used by Advanced Persistent Threat (APT) groups, often result in significant damage, despite the conspicuous lack of focused academic research on their detection. This paper illuminates the stealth variant of the web shell, covertly embedded within benign files, and addresses the unique detection challenges presented by their covert nature and the dearth of targeted datasets. In response to these challenges, we construct three datasets: small web shells, benign files, and stealth web shells, subsequently proposing an innovative triplet network detection model for the stealth web shell. This model excels in differentiating stealth web shells from benign files while simultaneously aligning them more closely with small web shells, thereby refining classification precision. Our methodology transforms samples into opcode sequences through a series of processing steps, and then integrates them into the specially designed triplet network. Benchmarked against a cutting-edge deep learning network model and recognized detection tools, our detection methodology yields superior performance, delivering a high accuracy of 92.56% and a robust F1-score of 89.17%. These results substantiate the potency of our approach in countering the mounting threat posed by stealth web shells.

Magnetic resonant coupling (MRC) enabled wireless power transfer (WPT) systems can charge multiple devices concurrently and efficiently via beamforming technology. The existing work proposes various mechanisms for achieving better charging performance, but still lacks the exploration about transmitter (TX) coil direction adjustment, and rarely considers the dynamic deployment of TXs. Thus, in this paper, we propose a Distributed Probability-adaptive Direction Adjustment algorithm for MRC-WPT systems (called DPDA). On the one hand, we design and implement a servo motor-based mechanical device to realize the ability of TX coil direction adjustment. On the other hand, we decompose the charging performance optimization problem, and then devise a distributed direction control algorithm based on random beamforming. We implement the system prototype for DPDA, and conduct extensive experiments on it. The experimental results demonstrate the effectiveness of the proposed algorithm, e.g., in case of large TX-RX horizontal misalignment, DPDA can achieve an average 1.98X improvement of power-delivered-to-load (PDL) as compared with the state-of the-art frequency adjustment-based solution.

Abstract The illegal use of compromised email accounts by adversaries can have severe consequences for enterprises and society. Detecting compromised email accounts is more challenging than in the social network field, where email accounts have only a few interaction events (sending and receiving). To address the issue of insufficient features, we propose a novel approach to detecting compromised accounts by combining time zone differences and alternate logins to identify abnormal behavior. Based on this approach, we propose a compromised email account detection framework that relies on widely available and less sensitive login logs and does not require labels. Our framework characterizes login behaviors to identify logins that do not belong to the account owner and outputs a list of account-subnet pairs ranked by their likelihood of having abnormal login relationships. This approach reduces the number of account-subnet pairs that need to be investigated and provides a reference for investigation priority. Our evaluation demonstrates that our method can detect most email accounts that have been accessed by disclosed malicious IP addresses and outperforms similar research. Additionally, our framework has the capability to uncover undisclosed malicious IP addresses.

Magnetic resonant coupling wireless power transfer (MRC-WPT) enables convenient device-charging. When MIMO MRC-WPT system incorporated with multiple relay components, both relayOn-Offstate (i.e.,power routing) and TX current (i.e.,current scheduling) could be adjusted for improving charging efficiency and distance. Previous approaches need the collaboration and feedback from the energy receiver (RX), achieved using side-channels, e.g., Bluetooth, which is time/energy-consuming. In this work we propose, design, and implement a multi-relay MIMO MRC-WPT system, and design an almost optimum joint optimization ofPowerROuting andCurrentScheduling method namedPROCS, without relying on any feedback from RX. We carefully decompose the joint optimization problem into two subproblems without affecting the overall optimality of the combined solution. For current scheduling subproblem, we propose an almost-optimum RX-feedback independent solution. For power routing subproblem, we first design a greedy algorithm with$\frac{1}{2}$approximation ratio, and then design a DQN based method to further improve its effectiveness. We prototype our system and evaluate it with extensive experiments. Our results demonstrate the effectiveness of the proposed algorithms. The achieved power transfer efficiency (PTE) on average is$3.2X$,$1.43X$,$1.34X$, and$7.3X$over the other four strategies: Without relay, with non-adjustable relays, greed based, and shortest-path based ones.

Recently, multiple-input multiple-output (MIMO) technology has been introduced into magnetic resonant coupling (MRC) enabled wireless power transfer (WPT) systems for concurrent charging of multiple devices. However, impedance mismatching phenomena caused by strong TX-RX, TX-TX, or RX-RX coupling greatly affect the power delivered to load (PDL) in practical charging systems. To solve this issue, we propose an effective scheduling algorithm for Impedance Matching–enhanced PDL optimization in MIMO MRC-WPT systems (called IMeP ), which integrates the transmitter scheduling together with the impedance matching techniques, i.e., adjusting TX coils for tuning TX-RX/TX-TX coupling and grouping RXs to separate strongly coupled RX pairs. We formulate this as a joint optimization problem and decouple it into three sub-problems, i.e., current scheduling, coil adjustment, and RX grouping. We then solve them through alternating direction method of multipliers–based, randomized beamforming–based, and graph clique cover–based algorithms, respectively. Extensive experiments are performed on a prototype testbed, and the results demonstrate the effectiveness of our solution. Compared with the state-of-the-art power transfer efficiency maximization solution, the proposed algorithm IMeP achieves a 74.7× performance improvement of PDL on average.

Machine learning (ML) based Malware classification provides excellent performance and has been deployed in various real-world applications. Training for malware classification often relies on crowdsourced threat feeds, which exposes a natural attack injection point. Considering a real-world threat model for backdoor poisoning attacks on a malware dataset, because attackers are generally considered to have no control over the sample-labeling process, they conduct a clean-label attack, a more realistic scenario, by generating backdoored benign binaries that will be disseminated through threat intelligence platforms and poison the datasets for downstream malware classifiers. To avoid the threat of backdoor poisoned datasets, we propose an explanation-powered defense methodology called make data reliable (MDR), which is a general and effective mitigation to ensure the reliability of datasets by removing backdoored samples. We use a surrogate model and explanation tool Shapley Additive exPlanations (SHAP) to filter suspicious samples, then perform watermark identification based on the filtered suspicious samples, and finally remove samples with the identified watermark to construct a reliable dataset. We conduct extensive experiments on two typical datasets that were manually poisoned using different attack strategies. Experimental results show that the MDR achieves backdoored samples removal rate greater than 99.0% for different datasets and attack conditions, while maintaining an extremely low false positive rate of less than 0.1%. Furthermore, to confirm the generality of MDR, we use different models to perform a model-agnostic evaluation. The results show that, MDR is a general methodology that does not rely on any specific model.

Magnetic resonant coupling (MRC) wireless power transfer (WPT) is a convenient and potential power supply solution for smart devices. The scheduling problem in the multiple-input multiple-output (MIMO) scenarios is essential to concentrate energy at the receiver (RX) side. Meanwhile, strong TX-RX coupling could ensure better power transfer efficiency (PTE), but may cause lower power delivered to load (PDL) when transmitter voltages are bounded. In this paper, we propose the frequency adjustment based PDL maximization scheme for MIMO MRC-WPT systems. We formulate such joint optimization problem and decouple it into two sub-problems, i.e., high-level frequency adjustment and low-level voltage adaptation. We solve these two sub-problems with gradient descent based and alternating direction method of multipliers (ADMM) based algorithms, respectively. We further design an energy-voltage transform matrix algebra based estimation mechanism to reduce context measurement overhead. We prototype the proposed system, and conduct extensive experiments to evaluate its performance. As compared with the PTE maximization solutions, our system trades smaller efficiency for larger energy, i.e., 361% PDL improvement with respect to 26% PTE losses when TX-RX distance is 10cm.

DNS-based data exfiltration has become increasingly popular among advanced persistent threat (APT) attackers owing to the ubiquity and penetrability of the DNS protocol. AI-powered methods solve the defect that attackers can easily bypass because of the fixed threshold and weight in rule matching while still suffer from several issues. Such as the lack of malware samples for training, the amplified impact of even low FPR present enormous obstacles to applying the model in real-world detection.We present a method to generate malicious traffic covering an extensive sample space based on Tactics, Techniques, and Procedures (TTPs). We then propose a sticky mechanism, which transforms certain decision-making into dynamic human-computer interaction decision-making, to verify the suspicious hosts recognized by the AI model. The experimental results demonstrate the superiority of our model by identifying eight kinds of real attacks precisely. The good performance on real-world traffic shows our method is a solid foothold for applying AI-powered detection to practical applications.

DNS (Domain Name System) plays an important role in network communication and it is rarely blocked by firewalls and intrusion detection systems (IDS). It is a suitable way for attackers to build DCC (DNS Covert Channel), which is used for data exfiltration. In recent years, some DCC detection methods have been proposed based on deep learning and there is no need for manual feature extraction. However, some expert knowledge is helpful to express the DNS characteristic. In this paper, we propose a FC-LSTM (Features Concatenation-based LSTM) model to detect DCC. The statistical features are concatenated with the output features of the LSTM model. This method makes the expression of DNS domain names more abundant. The experimental results have shown that the DCC traffic can be identified from normal traffic via this model, and the recognition rate is significantly improved compared with the traditional LSTM model and CNN model. In addition, we implement multi-classification in terms of the DCC tools (some of them are used in APT32). We also add generalization DNS packets (simulating APT34 traffic using DCC for stealing and attacking) to verify the robustness of our model. The FC-LSTM model has a good detection performance as well.

With the increasing complexity of software composition, code defects have become a long-term problem in software security. Traditional static analysis techniques cannot exhaustively enumerate all unsafe modes, and problems such as low path coverage rate brought by dynamic detection techniques make software security vulnerability detection inefficient. Methods based on Natural Language Processing have promoted the research of code defect detection tasks; however, there are problems of insufficient code semantic learning and limited data processing by pre-trained models. To solve these problems, from the perspective of enriching model input semantics and improving the model’s ability to process data, based on the Transformer model, we propose a hierarchical compression encoder model CPGBERT to detect whether the target function has defects. By using the regularity of the program context and structure, the program code is sliced for the input-output variables related to the objective function and dependencies on the codes’ propagation paths. Extract multiple code property graph information on rich semantics from the sliced program code for graph fusion, and embed the fused code property graph into the model by grouping. During the learning process, the independent hidden layer features are compressed and aggregated to make the model focus on the deep semantic learning of the objective function. The experiment uses the CodeXGLUE benchmark dataset and compares 6 kinds of code defect detection models having better performance to perform defect detection and effect evaluation on actual engineering code. The results show that the accuracy of the CPGBERT detection model is 67.97%, which is 5.89% higher than the CodeBERT model proposed by Microsoft and 1.35% higher than the state-of-the-art model CoTexT.

Magnetic wireless power transfer (WPT) has received widespread attention from both academia and industry, and magnetic resonance coupling (MRC) based WPT systems have a longer charging distance to support the scenarios with multiple transmitters (TXs) and multiple receivers (RXs). In such systems, an in-band reliable TX-RX communication protocol is essential to guarantee to charge performance. In this paper, we devise Onion, a dependency-aware in-band communication protocol for MIMO MRC-WPT systems. Technically, we extend the well-known EPCglobal C1G2 protocol in Radio Frequency Identification (RFID) fielded and make it suitable for mutual inductance based communication links in MRC-WPT systems. Furthermore, we craft an innovative onion-style layer-dependency based communication mechanism to utilize the positive impact of the relay phenomenon. We design and implement the Onion prototype and conduct extensive experiments to evaluate it. The experiment results demonstrate the effectiveness of the proposed protocol, which increases the communication success ratio by an average of 40% as compared to the dependency-unaware scheme.

Delivering malware covertly and evasively is critical to advanced malware campaigns. In this paper, we present a new method to covertly and evasively deliver malware through a neural network model. Neural network models are poorly explainable and have a good generalization ability. By embedding malware in neurons, the malware can be delivered covertly, with minor or no impact on the performance of neural network. Meanwhile, because the structure of the neural network model remains unchanged, it can pass the security scan of anti-virus engines. Experiments show that 36.9MB of malware can be embedded in a 178MB-AlexNet model within 1% accuracy loss, and no suspicion is raised by anti-virus engines in VirusTotal, which verifies the feasibility of this method. With the widespread application of artificial intelligence, utilizing neural networks for attacks becomes a forwarding trend. We hope this work can provide a reference scenario for the defense on neural network-assisted attacks.

Recently, multiple-input multiple-output (MIMO) technology has been introduced into magnetic resonant coupling (MRC) enabled wireless power transfer (WPT) systems for concurrent charging of multiple devices. However, impedance mismatching phenomena caused by strong TX-RX or RX-RX coupling greatly affect the power delivered to load (PDL) in practical charging systems. To solve this issue, we propose an effective scheduling algorithm for Impedance Matching enhanced PDL optimization in MIMO MRC-WPT systems (called IMP), which integrates the transmitter scheduling together with the impedance matching techniques, i.e., adjusting TX coils for tuning TX-RX coupling and grouping RXs to separate strongly coupled RX pairs. We formulate this as a joint optimization problem and decouple it into three sub-problems, i.e., current scheduling, coil adjustment, and RX grouping, and solve them through alternating direction method of multipliers (ADMM) based, tabu search (TS) based, and graph clique cover based algorithms, respectively. Extensive experiments are performed on a prototype testbed, and the results demonstrate the effectiveness of our solution. Compared with the state-of-the-art power transfer efficiency (PTE) maximization solution, the proposed algorithm IMP achieves a 74.7X performance improvement of PDL on average.

Machine learning(ML)-based botnet detection methods have become mainstream in corporate practice. However, researchers have found that ML models are vulnerable to adversarial attacks, which can mislead the models by adding subtle perturbations to the sample. Due to the complexity of traffic samples and the special constraints that to keep malicious functions, no substantial research of adversarial ML has been conducted in the botnet detection field, where the evasion attacks caused by carefully crafted adversarial examples may directly make ML-based detectors unavailable and cause significant property damage. In this paper, we propose a reinforcement learning(RL) method for bypassing ML-based botnet detectors. Specifically, we train an RL agent as a functionality-preserving botnet flow modifier through a series of interactions with the detector in a black-box scenario. This enables the attacker to evade detection without modifying the botnet source code or affecting the botnet utility. Experiments on 14 botnet families prove that our method has considerable evasion performance and time performance.

Magnetic resonant coupling wireless power transfer (MRC-WPT) enables convenient device-charging. When MIMO MRC-WPT system incorporated with multiple relay components, both relay On-Off state (i.e., power routing) and TX current (i.e., current scheduling) could be adjusted for improving charging efficiency and distance. Previous approaches need the collaboration and feedback from the energy receiver (RX), achieved using side-channels, e.g., Bluetooth, which is time/energy-consuming. In this work we propose, design, and implement a multi-relay MIMO MRC-WPT system, and design an almost optimum joint optimization of power routing and current scheduling method, without relying on any feedback from RX. We carefully decompose the joint optimization problem into two subproblems without affecting the overall optimality of the combined solution. For current scheduling subproblem, we propose an almost-optimum RX-feedback independent solution. For power routing subproblem, we first design a greedy algorithm with ½ approximation ratio, and then design a DQN based method to further improve its effectiveness. We prototype our system and evaluate it with extensive experiments. Our results demonstrate the effectiveness of the proposed algorithms. The achieved power transfer efficiency (PTE) on average is 3.2X, 1.43X, 1.34X, and 7.3X over the other four strategies: without relay, with non-adjustable relays, greed based, and shortest-path based ones.

Botnets are one of predominant threats to Internet security. To date, machine learning technology has wide application in botnet detection because that it is able to summarize the features of existing attacks and generalize to never-before-seen botnet families. However, recent works in adversarial machine learning have shown that attackers are able to bypass the detection model by constructing specific samples, which due to many algorithms are vulnerable to almost imperceptible perturbations of their inputs. According to the degree of adversaries' knowledge about the model, adversarial attacks can be classified into several groups, such as gradient- and score-based attacks. In this paper, we propose a more general framework based on deep reinforcement learning (DRL), which effectively generates adversarial traffic flows to deceive the detection model by automatically adding perturbations to samples. Throughout the process, the target detector will be regarded as a black box and more close to realistic attack circumstance. A reinforcement learning agent is equipped for updating the adversarial samples by combining the feedback from the target model (i.e. benign or malicious) and the sequence of actions, which is able to change the temporal and spatial features of the traffic flows while maintaining the original functionality and executability. The experiment results show that the evasion rates of adversarial botnet flows are significantly improved. Furthermore, with the perspective of defense, this research can help the detection model spot its defect and thus enhance the robustness.

Receiver (RX) feedback and power transfer channel estimation are essential for enhancing the context-aware ability for magnetic resonant coupling (MRC) enabled wireless power transfer (WPT) systems. Solutions are not highly efficient and immature in MIMO scenarios. In this work, we investigate the concurrent feedback communications for multiple RXs equipped with oscillating circuits. We discover an interesting clustering phenomenon, where the TX currents form clusters in corresponding to the combined RX "Open-Short" states. Based on this, we propose a parallel multi-stage decoding scheme by identifying the combined state for each cluster. In symbol clustering stage, we introduce two-layer clustering mechanism to tackle the "dominant RXs" challenge which causes inaccurate classification results. In cluster identification stage, we solve the "ambiguous identification candidates" challenge by calibration based on power transfer channel condition estimation. We have implemented the prototype testbed using off-the-shelf components. Our experiment results demonstrate the effectiveness of the proposed scheme. Our system supports communication within valid charging area even under significant interference from other RX. The simulation results further suggest the scalability of the proposed scheme, and the accuracy for power transfer channel estimation.

While various ransomware defense systems have been proposed to deal with traditional randomly‐spread ransomware attacks (based on their unique high‐noisy behaviors at hosts and on networks), none of them considered ransomware attacks precisely aiming at specific hosts, e.g., using the common Remote Desktop Protocol (RDP). To address this problem, we propose a systematic method to fight such specifically targeted ransomware by trapping attackers via a network deception environment and then using traceback techniques to identify attack sources. In particular, we developed various monitors in the proposed deception environment to gather traceable clues about attackers, and we further design an analysis system that automatically extracts and analyze the collected clues. Our evaluations show that the proposed method can trap the adversary in the deception environment and significantly improve the efficiency of clue analysis. Furthermore, it also helps us trace back RDP‐based ransomware attackers and ransomware makers in the practical applications.

Many time-dependent problems like molecular dynamics of protein folding require a large number of time steps. The latencies and overheads of common-purpose clusters with accelerators are too big for high-frequency iteration. We introduce an algorithmic model called Samsara Parallel (or SP) which, unlike BSP, relies on asynchronous communications and can repeatedly return to earlier time steps to refine the precision of computation. This also extends a line of research called Parallel-in-Time in computational chemistry and physics.

This paper describes the use of array notation called Parray in refinement of parallel programs concerning array type that separates the physical data layout and logical structure of multi-dimensional data, and the control flow diversion of heterogeneous processor units. A case study on matrix multiplication demonstrates refinement of Parray programs: the code evolves from a simple single CPU-thread code to a multi-thread code on CPU/MIC and then a GPU code by modifying the array types in only a few lines of code. A GPU-based SGEMM is implemented in Parray and achieves almost the same Gflops of CUBLAS 4.0 when testing on a single node of Tian-1A system. Because the code operates directly on the logical structure of array, the same SGEMM code can work on different physical array data layouts.

Robotic rehabilitation devices are attractive to physical therapists. Various leg exoskeletons have been developed during the past decade and have been used in gait training. Traditional exoskeletons usually have a complex structure and add extra inertia to the wearer's leg, which may change their natural gait. In this paper, we present the design of a cable-driven active leg exoskeleton (C-ALEX) for human gait training. The advantages of cable-driven designs are that they have a simpler structure, add minimal inertia to the human limbs, and do not require precise joint alignment. C-ALEX employs the “assist-as-needed” control strategy to help the ankle center move along a prescribed path. An experiment with 6 healthy subjects was conducted who walked with C-ALEX on a treadmill. The results showed that C-ALEX is capable of helping the subjects better track a prescribed ankle path.

This paper studies the essence of heterogeneity from the perspective of language mechanism design. The proposed mechanism, called tiles, is a program construct that bridges two relative levels of computation: an outer level of source data in larger, slower or more distributed memory and an inner level of data blocks in smaller, faster or more localized memory.

As the arms race between botmasters and defenders becomes increasingly common, the emerging advanced botnets have evolved to be more resilient to traditional mitigation strategies. For security-conscious Internet users, the host-based security software i.e., antivirus and firewall could provide effective protection against the botnet attacks; however, the remaining security-unconscious users will suffer from the botnet attacks and will be compromised easily. Consequently, how to protect both security-conscious and security-unconscious users against advanced botnets without any command and control vulnerability has posed a great challenge to this day. In this paper, we propose the idea of botnet spoofing that aims at addressing the aforementioned challenge to some degree. Botnet spoofing exploits the essential property of a persistent bot that it MUST obtain its file path before subsequent autostart registration or self-propagation to spoof a specific bot and trick the specific bot to propagate BotSpoofer instead of propagating itself, consequently making the victim not only avoid an originally successful attack but also achieve extra protection provided by BotSpoofer. Thus, botnet spoofing is independent of the vulnerability, protocol, and structure of botnet command and control. To prove the feasibility of botnet spoofing, we create a prototype named ConSpoofer-targeting Conficker. The results show that ConSpoofer could be passively delivered to other victims, which are located by Conficker, through Conficker's three propagation methods in an automatic, simple, accurate, and scalable manner. The goal of our work is to provide a new mitigation strategy that will promote the development of more efficient countermeasures against advanced botnets. Copyright © 2013 John Wiley & Sons, Ltd.

The ability of the HTTP protocol to bypass Firewalls and IDSs has resulted in it becoming the most popular command and control (C&C) protocol adopted for use by most current botnets. To date, most botnet detection approaches either operate at packet-level or flow-level by identifying signatures or flow patterns. In addition, some detection technologies correlate both flow and malicious behaviors to detect botnets. However, most of these approaches relay on obvious behavior characteristics of botnets and cannot simultaneously detect and characterize unknown bots in the early stages subsequent to an infection. In an effort to rectify this situation, we studied the distribution pattern of relevant packets and determined that, in general, the first request packet from bots and the first response packet from C&C servers contain the most valuable information. Consequently, we propose a technique that automatically detects unknown HTTP botnets and generates the signatures of C&C activities on the basis of this knowledge. The results of preliminary experiments conducted indicate that our proposed approach can accurately detect unknown HTTP botnets (such as SpyEye and ZeuS) with low false positive rates and generate their signatures automatically.

Security issues of software plugins are seldom studied in existing researches. The plugin mechanism provides a convenient way to extend an application's functionality. However, it may also introduce susceptibility to new security issues. For example, attackers can create a malicious plugin to accomplish intended goals stealthily. In this poster, we propose a Software Plugin-based Malware (SPM) model and implement SPM prototypes for Microsoft Office, Adobe Reader and mainstream browsers, with the aim to study the development feasibility of such malware and illustrate their potential threats.

This paper proposes a replication cost model and two greedy algorithms, named GS QoS and GS QoS C1, for replication placements in cloud-based storage systems. The model aims to minimize replication cost with full consideration of quality of user access to storage nodes. Our two algorithms employ a utility measurement to guide placement procedures. Our final experimental results show that 1) GS QoS outperforms GS QoS C1, 2) both algorithms have more economical results than those from existing greedy replica placement algorithm.

A low-cost and easy-to-customize Cable-driven Wrist Robotic Rehabilitor (CDWRR) has been developed for forearm and wrist motion training. This device can be potentially applied to rehabilitation of stroke patients for three degree-of-freedom (3-DOF) arm motion, including forearm supination/pronation, wrist flexion/extension and ulnar/radial deviation. The CDWRR can be customized for patients with different motor impairments of the wrist. With the cable-driven parallel structure, it has properties such as low-cost, low-weight, and easy-to-reconfigure. In this paper, the structural design, kinematic analysis, workspace calculations, and parameter identification algorithms are presented. Computer simulations of the identification algorithms are performed to validate the results. Finally, preliminary experiments on a healthy subject are carried out to demonstrate the feasibility of the proposed robot to provide assistance to the human wrist and forearm during movement training.

The Web Proxy Auto-Discovery (WPAD) protocol is always used to locate a URL of a configuration file through DHCP, DNS or some other discovery methods. WPAD is a very convenience way for the management of network administrator. However, in the meantime, it may lead to a potential compromise to our LANs. In this poster, we propose a novel attack method based on WPAD protocol which can be used by attacker to intercept traffic, sniff and propagate malwares in LAN.

Nowadays, most of research on botnet survivability only focuses on the advanced design of downstream (from botmasters to bots, used to deliver commands) command and control (C&C) channel. However, the upstream (from bots to botmasters, used to upload the collected data on victims) C&C channel remains vulnerable and low-efficiency in most of botnets to this day. To address the problem, we propose a C&C channel division scheme and then establish a Botnet Triple-Channel Model (BTM). BTM divides a traditional C&C channel into three independent sub-channels, denoting as Command Download Channel (CDC), Registration Channel (RC) and Data Upload Channel (DUC), respectively. To illuminate the feasibility and advantages, we implement a BTM botnet prototype which exploits URL Flux for CDC, Domain-flux for RC, and introduces a new approach (Cloud-based File Hosting and URL Shortening Services) for DUC. Compared with current botnets, the proposed BTM botnet will promise to be as robust as P2P botnets and as efficient as centralized botnets. The ultimate goal of our work is to increase the understanding of advanced botnets which will promote the development of more efficient countermeasures.

This paper introduces a programming interface called PARRAY (or Parallelizing ARRAYs) that supports system-level succinct programming for heterogeneous parallel systems like GPU clusters. The current practice of software development requires combining several low-level libraries like Pthread, OpenMP, CUDA and MPI. Achieving productivity and portability is hard with different numbers and models of GPUs. PARRAY extends mainstream C programming with novel array types of distinct features: 1) the dimensions of an array type are nested in a tree, conceptually reflecting the memory hierarchy; 2) the definition of an array type may contain references to other array types, allowing sophisticated array types to be created for parallelization; 3) threads also form arrays that allow programming in a Single-Program-Multiple-Codeblock (SPMC) style to unify various sophisticated communication patterns. This leads to shorter, more portable and maintainable parallel codes, while the programmer still has control over performance-related features necessary for deep manual optimization. Although the source-to-source code generator only faithfully generates low-level library calls according to the type information, higher-level programming and automatic performance optimization are still possible through building libraries of sub-programs on top of PARRAY. The case study on cluster FFT illustrates a simple 30-line code that 2x outperforms Intel Cluster MKL on the Tianhe-1A system with 7168 Fermi GPUs and 14336 CPUs.

With the rapid development of social networking services and the diversification of social engineering attacks, new high-infection botnet (called SE-botnet by us), which exploits social engineering attacks to spread bots in social networks, has become an underlying threat. Predicting the threat of SE-botnet can help defenders mitigate it effectively. In this paper, we focus on SE-botnet's infection and defense, presenting a propagation model for it. We take full account of social networks' characteristics and human dynamics, and abstract the general process of social engineering attacks used by SE-botnet. Our preliminary simulation results demonstrate that the SE-botnet can capture tens of thousands of bots in one day with a great infection capacity. our propagation model can accurately predict this process with less than 5% deviation.

In this paper we discuss about our experiences in improving the performance of GEMM (both single and double precision) on Fermi architecture using CUDA, and how the new features of Fermi such as cache affect performance. It is found that the addition of cache in GPU on one hand helps the processers take advantage of data locality occurred in runtime but on the other hand renders the dependency of performance on algorithmic parameters less predictable. Auto tuning then becomes a useful technique to address this issue. Our auto-tuned SGEMM and DGEMM reach 563 GFlops and 253 GFlops respectively on Tesla C2050. The design and implementation entirely use CUDA and C and have not benefited from tuning at the level of binary code.

A GPU cluster is a cluster equipped with GPU devices. Excellent acceleration is achievable for computation-intensive tasks (e. g. matrix multiplication and LINPACK) and bandwidth-intensive tasks with data locality (e. g. finite-difference simulation). Bandwidth-intensive tasks such as large-scale FFTs without data locality are harder to accelerate, as the bottleneck often lies with the PCI between main memory and GPU device memory or the communication network between workstation nodes. That means optimizing the performance of FFT for a single GPU device will not improve the overall performance. This paper uses large-scale FFT as an example to show how to achieve substantial speedups for these more challenging tasks on a GPU cluster. Three GPU-related factors lead to better performance: firstly the use of GPU devices improves the sustained memory bandwidth for processing large-size data; secondly GPU device memory allows larger subtasks to be processed in whole and hence reduces repeated data transfers between memory and processors; and finally some costly main-memory operations such as matrix transposition can be significantly sped up by GPUs if necessary data adjustment is performed during data transfers. This technique of manipulating array dimensions during data transfer is the main technical contribution of this paper. These factors (as well as the improved communication library in our implementation) attribute to 24.3x speedup with respect to FFTW and 7x speedup with respect to Intel MKL for 4096 3D single-precision FFT on a 16-node cluster with 32 GPUs. Around 5x speedup with respect to both standard libraries are achieved for double precision.

In this paper we discuss about our experiences in improving the performance of two key algorithms: the single-precision matrix-matrix multiplication subprogram (SGEMM of BLAS) and single-precision FFT using CUDA. The former is computation-intensive, while the latter is memory bandwidth or communication-intensive. A peak performance of 393 Gflops is achieved on NVIDIA GeForce GTX280 for the former, about 5% faster than the CUBLAS 2.0 library. Better FFT performance results are obtained for a range of dimensions. Some common principles are discussed for the design and implementation of many-core algorithms.

Classification of network vulnerability is critical to detection and risk analysis of network vulnerability. A broad range of classification methods have been proposed in literature. This paper reviews a total of 25 selected approaches and identifies the differences and relations among them. It also points out some open issues for research in this field.

The paper presents several new protocol classes for mobile wireless ad-hoc networks that rely on specific mobility patterns of router nodes in order to guarantee tight upper bounds on communication delays. We introduce a generic formal model of a heterogeneous network in which regular nodes exchange messages through a subnetwork of dedicated router nodes, and use it to identify desirable properties of router mobility patterns. In particular, the analysis focusses on protocols that periodically cover ('sweep') the entire communication zone. We define specific classes of sweep protocols and prove the upper bounds on router contact delays and on end-to-end message delivery times that they guarantee to stationary or mobile populations of regular nodes. The results of simulation experiments show that a translatory chain sweep protocol outperforms the runners protocol with respect to end-to-end message delivery times for both stationary and mobile regular nodes.