This study investigates energy-efficient resource allocation for covert vehicular communications with age constraints, where vehicle-to-vehicle (V2V) links leverage spectrum sharing to conceal covert transmissions. Vehicle-to-infrastructure (V2I) links serve as friendly jammers, simultaneously disrupting detection and maintaining connectivity with the base station. To maximize V2V links’ covert energy efficiency (CEE) and V2I links’ throughput under quality of service (QoS), communication covertness, and freshness constraints, a novel matching-based resource allocation framework is proposed. Specifically, we derive the minimum error detection rate and the optimal detection threshold at warden. The transmit probability and power are jointly optimized using the successive convex approximation method. Jamming selection is then modeled as a stable marriage problem, solved via the Gale-Shapley algorithm for stable matching between V2V and V2I links. Additionally, we explore a coalition falsification strategy to further enhance the CEE of certain V2V links without hurting the performance of the rest. Extensive simulations validate the proposed approach, showing significant improvements over existing baselines.

Advanced metering infrastructure in smart grids faces critical security challenges from distributed denial of service (DDoS) attacks, while traditional traceback methods suffer from resource constraints that limit their mitigation effectiveness. To address this, we propose a reverse auction-driven fog resource allocation strategy that innovatively employs a reverse auction mechanism to coordinate distributed fog resources for collaborative DDoS attack mitigation. Specifically, the framework is formulated as a 0–1 integer programming model, for which we develop a second-price sealed-bid auction (SPSA) algorithm that reduces computational complexity from factorial to polynomial time while maintaining allocation optimality. Experimental results demonstrate that the SPSA algorithm outperforms existing baseline methods, significantly improving both the efficiency and security of DDoS defenses in smart grid environments.

With the frequent occurrence of information security incidents within the Internet of Things (IoT) landscape, there has been an increasing emphasis on anomaly detection in IoT traffic. Recently, supervised machine learning techniques have shown significant potential on this topic. However, the intricate nature of IoT network environments has posed a challenge in acquiring sufficient labeled samples of abnormal traffic. In comparison to supervised learning, unsupervised learning has more lenient sample requirements. Researchers have proposed various unsupervised detection methods, yet limitations persist. First, unsupervised learning, lacking guidance from labeled information, necessitates a more diverse range of traffic perspectives for comprehensive information coverage. Second, despite efforts to extract multiview traffic features from various perspectives, existing methods struggle to integrate these features effectively, limiting interpretability and introducing redundancy and noise. Lastly, conventional unsupervised methods often rely heavily on manually crafted features, potentially leading to biased and limited representations. In this article, we propose an unsupervised IoT traffic anomaly detection method based on multiview subspace learning. Specifically, we first construct a multiview traffic representation, including a protocol field view and a payload semantic view. Subsequently, a multiview subspace learning algorithm is designed to project the different views of traffic onto a unified and low-rank subspace, optimized using the augmented lagrangian multiplier with alternating direction minimization (ALM-ADM) strategy. Finally, spectral clustering is employed to accomplish IoT traffic anomaly detection. We benchmark the proposed method on multiple IoT traffic datasets and diverse computational platforms. The experimental results demonstrate that the method outperforms other state-of-the-art approaches in terms of accuracy and computational efficiency.

Accurately identifying malicious traffic in heterogeneous IoT environments is critical for network security. Although deep learning-based methods can effectively extract multi-dimensional features and achieve high accuracy, deploying complex models on resource-constrained IoT devices remains challenging. To balance performance and efficiency, we propose IoT-CVKD, a novel malicious IoT traffic identification framework leveraging cross-view knowledge distillation. IoT-CVKD consists of a multi-view teacher model and a lightweight single-view student model. The teacher model characterizes heterogeneous traffic from different perspectives by capturing flow-level global and packet-level spatio-temporal local burst information, and efficiently fuses these features using a cross-attention mechanism. The student model, composed of lightweight and computationally efficient modules, takes only packet-level features as input. Multi-view knowledge from the teacher is then implicitly distilled into the student through cross-view knowledge distillation during training, thereby significantly enhancing the student’s classification capability. Extensive evaluations demonstrate that IoT-CVKD achieves superior classification performance compared to state-of-the-art methods while substantially reducing computational complexity, making it highly suitable for resource-constrained IoT deployments.

In the Internet of vehicles, using jammers to assist covert communication can protect the security of vehicular communication in some sensitive or special scenarios. However, the issue of three-party spectrum resource allocation involving multiple coexisting transmitters, receivers, and jammers has rarely been studied. This paper investigates jammer selection and power control in vehicular covert communication. To maximize the utility of spectrum resources, a vehicular covert communication auction model (VCCAM) is established and formulated as a 0-1 integer programming problem. We derive the optimal detection threshold for minimum average detection error probability and corresponding optimal transmit power based on the slow fading statistical channel state information (CSI) of mobile links. We then propose a reverse Vickrey-Clarke-Groves (VCG) auction algorithm that ensures incentive compatibility and individual rationality. However, it lacks computational efficiency. To address this, we introduce the reverse second-price sealed-bid algorithm (SPSA), which reduces the VCG auction’s factorial complexity to polynomial complexity, offering a computationally efficient, suboptimal solution. Extensive simulations verify the effectiveness, communication covertness, computational efficiency, incentive compatibility, and individual rationality of the proposed algorithms, showing that our algorithm significantly outperforms other baselines.

Network covert channels transmit secret messages by manipulating network traffic, including packet headers, timing intervals, and communication patterns. The growth of network services has spurred interest in exploring these channels. Yet, the practical application of these channels faces challenges in transmission rate and reliability due to unpredictable network interference. QUIC-based websites offer promising opportunities for covert communication, given their inherent dynamic nature from web resource updates and network interferences. Repeated visits or refresh actions on the same website generate substantial statistical redundancy. Furthermore, widely used proxy tools introduce additional traffic morphology changes. This paper presentsQuicCourier, a covert channel leveraging web traffic's dynamic characteristics and proxy service encapsulation to hide messages in QUIC packets from the service node to the client. Guided by a generative model for web resource patterns,QuicCourierensures that covert traffic closely resembles legitimate traffic, employing three packet-wise meta operations. The altered QUIC flows are then encased in proxy protocols, complicating the detection of embedded information. The covert receiver is incorporated into the proxy client. The efficacy ofQuicCourieris evaluated using a dataset of over 30,000 web browsing traffic samples, demonstrating its exceptional undetectability against state-of-the-art traffic classification tools and a high covert transmission rate.

Deep learning-based website fingerprinting (WF) attacks dominate website traffic classification. In the real world, the main challenges limiting their effectiveness are, on the one hand, the difficulty in countering the effect of content updates on the basis of accurate descriptions of page features in traffic representations. On the other hand, the model’s accuracy relies on training numerous samples, requiring constant manual labeling. The key to solving the problem is to find a website traffic representation that can stably and accurately display page features, as well as to perform self-supervised learning that is not reliant on manual labeling. This study introduces the multi-level resource-coherented graph convolutional neural network (MRCGCN), a self-supervised learning-based WF attack. It analyzes website traffic using resources as the basic unit, which are coarser than packets, ensuring the page’s unique resource layout while improving the robustness of the representations. Then, we utilized an echelon-ordered graph kernel function to extract the graph topology as the label for website traffic. Finally, a two-channel graph convolutional neural network is designed for constructing a self-supervised learning-based traffic classifier. We evaluated the WF attacks using real data in both closed- and open-world scenarios. The results demonstrate that the proposed WF attack has superior and more comprehensive performance compared to state-of-the-art methods.

Despite the end-to-end encryption capabilities provided by network protocols such as QUIC in HTTP/3 and the additional tunneling functions offered by proxy tools like virtual private networks (VPNs) and the onion router (Tor), website fingerprinting (WF) techniques can still identify specific network services by exploiting the spatio-temporal characteristics of network traffic. Therefore, defending against WF attacks is crucial for ensuring comprehensive privacy protection for network services. Existing WF defenses typically rely on proxy-based solutions that require coordinated packet manipulations between the client and the proxy node to counteract WF attacks. These symmetric architectures cannot protect network traffic between proxy nodes and web servers from WF attacks. Furthermore, the ability to counter more powerful traffic analysis tools remains a challenging issue. In this paper, we propose WF-A2D, an asymmetric adversarial defense method against website fingerprinting for HTTP/3. WF-A2D employs a two-stage cascading adversarial learning strategy, leveraging packet direction and length patterns to enhance defense performance. Position-based perturbation vectors representing packet operations are generated for packet-by-packet manipulations to achieve real-time WF defense. Experimental results on a real-world HTTP/3-QUIC website browsing traffic dataset demonstrate that WF-A2D can achieve a defense success rate of 97.10% on average against seven state-of-the-art traffic analysis tools, while incurring less than 2% bandwidth overhead. More importantly, WF-A2D can operate independently on the client side and ensure end-to-end protection to web servers.

Web services, as the most ubiquitous form of online services, have consistently attracted research attention due to privacy concerns. Although VPNs and anonymous communication methods can partially protect users’ online privacy, advancements in website fingerprinting (WF) attacks still exploit the spatio-temporal characteristics of Web resource transmission to identify Web services. The challenge lies in defending against WF attacks efficiently, with limited bandwidth costs. Server-side WF defenses, deployed on Web servers, can achieve end-to-end obfuscation across both clients and servers. However, existing defenses often consume significant bandwidth and require additional removal operations on the client side. Given the growing use of QUIC with HTTP/3 and the need for robust privacy protections, this paper introduces an asymmetric server-side WF defense scheme using State-Transition Adversarial Perturbations (STAP). STAP introduces the concept of latent resource-state transitions, which represent hidden patterns in resource transmission. Utilizing perturbation models containing these transitions, STAP subtly alters traffic through packet padding and insertion, with inherent transport layer encryption enhancing the concealment. STAP can operate independently, removing the necessity for user involvement. Experimental results demonstrate that STAP outperforms other schemes, achieving reductions in True Positive Rate (TPR) by up to 22% and reductions in bandwidth overhead by up to 30%.

Anonymous network tracing is a significant research subject in the field of network security, and flow correlation technology serves as a fundamental technique for deanonymizing network traffic. Existing flow correlation techniques are considered ineffective and unreliable when applied on a large scale because they exhibit high false‐positive rates or require impractically long periods of traffic observation to achieve reliable correlations. To address this issue, this paper proposed an innovative flow correlation approach for the typical and most widely used Tor anonymous network by combining graph convolutional neural networks with triplet networks. Our proposed method involves extracting features such as packet intervals, packet lengths, and directions from Tor network traffic and encoding each flow into a graph representation. The integration of triplet networks enhances the internode relationships, which can effectively fuse flow representations with node associations. The graph convolutional neural network extracts features from the input graph topology, mapping them to distinct representations in the embedding space, thus effectively distinguishing different Tor flows. Experimental results demonstrate that with a false‐positive rate as low as 0.1%, the correlation accuracy reaches 86.4%, showcasing a 5.1% accuracy improvement compared to the existing state‐of‐the‐art methods.

Unmanned aerial vehicles (UAVs) are viewed as a key component of 5G, 6G and beyond wireless networks to receive, store and forward information. Benefiting from swift deployment, low cost and high mobility, it has become a promising trend to leverage the UAVs to assist the covert communicator (Alice) against the detector’s (Willie’s) detection in a covert communication network. Nevertheless, once Willie notices the covert transmission process, the covert information is exposed to the risk of being cracked. In this paper, we propose a UAV-assisted covert communication asymmetric information game model (UCCAIG) that focuses on the covert communication countermeasure process based on information asymmetry. We introduce the UAV into covert communication relay assistant Alice and interference assistant Willie respectively, analyze the interaction between Alice and Willie, and derive the optimal strategies for both sides. We further prove the existence of a Bayesian Nash equilibrium (BNE) in the UCCAIG. In addition, we evaluate our proposals on a covert communication testbed with software radio, and the numerical results show that our proposed strategy increases the payoffs of Alice, reduces the payoffs of Willie in a variety of scenarios, and improves the covert communication rate compared with UAV-relayed game (URG).

Abstract The evergrowing diversity of encrypted and anonymous network traffic makes network management more formidable to manage the network traffic. An intelligent system is essential to analyse and identify network traffic accurately. Network management needs such techniques to improve the Quality of Service and ensure the flow of secure network traffic. However, due to the usage of non‐standard ports and encryption of data payloads, the classical port‐based and payload‐based classification techniques fail to classify the secured network traffic. To solve the above‐mentioned problems, this paper proposed an effective deep learning‐based framework employed with flow‐time‐based features to predict heterogeneous secure network traffic best. The state‐of‐the‐art machine learning strategies (C4.5, random forest, and K‐nearest neighbour) are investigated for comparison. The proposed 1D‐CNN model achieved higher accuracy in classifying the heterogeneous secure network traffic. In the next step, the proposed deep learning model characterises the major categories (virtual private network traffic, the onion router network traffic, and plain encrypted network traffic) into several application types. The experimental results show the effectiveness and feasibility of the proposed deep learning framework, which yields improved predictive power compared to the state‐of‐the‐art machine learning techniques employed for secure network traffic analysis.

This work investigates the phase gain of intelligent reflecting surface (IRS) covert communication over complex-valued additive white Gaussian noise (AWGN) channels. The transmitter Alice intends to transmit covert messages to the legitimate receiver Bob via reflecting the broadcast signals from a radio frequency (RF) source, while rendering the adversary Willie’s detector arbitrarily close to ineffective. Our analyses show that, compared to the covert capacity for classical AWGN channels, we can achieve a covertness gain of value 2 by leveraging Willie’s uncertainty of phase angles. This covertness gain is achieved when the number of possible phase angle pairsN= 2. More interestingly, our results show that the covertness gain will not further increase withNas long asN≥ 2, even if it approaches infinity.

Software-defined networking (SDN) has become a promising trend for managing the Industrial Internet of Things (IIoT) devices. As the core of sensitive data storage and business interaction, the SDN is vulnerable to advanced persistent threats (APTs) attacks, while honeypots have shown great promise against APT attacks. In this article, we propose a new SDN-based dynamic bounded rational honeypot-APT game model in IIoT. Specifically, the defender maximizes the utility by chossing the period strategy of honeypot collecting and analyzing the data, while the attacker maximizes utility by choosing the period strategy of its latency and attack. To describe the bounded rationality, we model the simultaneous dynamic attack and defense process through the prospect theory, in which the Prelec function and the value function are both introduced. Experiment results show that bounded rationality affects strategy selection and reduces defender and attacker’s utilities. Furthermore, our strategy outperforms the existing work in defensive performance.

Mobile malware poses a great challenge to mobile devices and mobile communication. With the explosive growth of mobile networks, it is significant to detect mobile malware for mobile security. Since most mobile malware relies on the networks to coordinate operations, steal information, or launch attacks, evading network monitor is difficult for the mobile malware. In this paper, we present an N-gram, semantic-based neural modeling method to detect the network traffic generated by the mobile malware. In the proposed scheme, we segment the network traffic into flows and extract the application layer payload from each packet. Then, the generated flow payload data are converted into the text form as the input of the proposed model. Each flow text consists of several domains with 20 words. The proposed scheme models the domain representation using convolutional neural network with multiwidth kernels from each domain. Afterward, relationships of domains are adaptively encoded in flow representation using gated recurrent network and then the classification result is obtained from an attention layer. A series of experiments have been conducted to verify the effectiveness of our proposed scheme. In addition, to compare with the state-of-the-art methods, several comparative experiments also are conducted. The experiment results depict that our proposed scheme is better in terms of accuracy.

With the development of detection algorithms on malicious dynamic domain names, domain generation algorithms have developed to be more stealthy. The use of multiple elements for generating domains will lead to higher detection difficulty. To effectively improve the detection accuracy of algorithmically generated domain names based on multiple elements, a domain name syntax model is proposed, which analyzes the multiple elements in domain names and their syntactic relationship, and an adaptive embedding method is proposed to achieve effective element parsing of domain names. A parallel convolutional model based on the feature selection module combined with an improved dynamic loss function based on curriculum learning is proposed, which can achieve effective detection on multielement malicious domain names. A series of experiments are designed and the proposed model is compared with five previous algorithms. The experimental results denote that the detection accuracy of the proposed model for multiple-element malicious domain names is significantly higher than that of the comparison algorithms and also has good adaptability to other types of malicious domain names.

Wireless covert channel is an emerging covert communication technique which conceals the very existence of secret information in wireless signal including GSM, CDMA, and LTE. The secret message bits are always modulated into artificial noise superposed with cover signal, which is then demodulated with the shared codebook at the receiver. In this paper, we first extend the traditional KS test and regularity test in covert timing channel detection into wireless covert channel, which can be used to reveal the very existence of secret data in wireless covert channel from the aspect of multiorder statistics. In order to improve the undetectability, a wireless covert channel for OFDM-based communication system based on constellation shaping modulation is proposed, which generates additional constellation points around the standard points in normal constellations. The carrier signal is then modulated with the dirty constellation and the secret message bits are represented by the selection mode of the additional constellation points; shaping modulation is employed to keep the distribution of constellation errors unchanged. Experimental results show that the proposed wireless covert channel scheme can resist various statistical detections. The communication reliability under typical interference is also proved.

Network flow watermarking (NFW) is an emerging flow correlation technique to deanonymize an anonymous communication system or detect stepping stones, in which a watermark is encoded into a network flow by manipulating some flow characteristics, predominantly by altering timing information. Although interval-based NFWs that employ time intervals as carrier have proven to be capable of resisting moderate network interference, they are vulnerable to some statistic-based attacks, which may expose the very existence of watermark and enable attackers to damage or remove watermark from the observed flow. In this study, using insider swapping of time intervals and an adaptive centroid quantization framework, we design a highly invisible NFW scheme, which is undetectable by multi-flow attacks (MFA), Kullback-Leibler divergence (KLD) test, Kolmogorov-Smirnov (K-S) test, and spread spectrum flow watermark (SSFW) detection. Experimental results using real traffic and public dataset show that the proposed NFW scheme can outperform three typical NFW schemes on invisibility while maintaining a strong interference-resistance capability of network jitter, packet loss, and dummy packet insertion.

Abstract As the detection methods of covert channels can provide a better way to detect the existence of advanced persistent threat, it has become a hot research topic in the field of network security. Although the existing methods can achieve feasible performance for detecting the JitterBug covert timing channel, they are ineffective when the covert timing channels are implemented with sparse embedding, especially for low embedding probability. In this paper, a new method to detect JitterBug covert timing channel with sparse embedding is proposed, in which the timing intervals are first modeled in histogram statistics, and then the Kolmogorov–Smirnov statistic is used for detection. In addition, the diversifications of the references and the model updating scheme in practical usage are analyzed. The experimental results show that the proposed method is effective when the embedding probability is 0.3, while the existing methods can effective only when the embedding probability is larger than 0.6. Copyright © 2016 John Wiley & Sons, Ltd.

In existing model-based timing channels, the requirement for the target model to be shared between the sender and the receiver limits the sender's ability to adapt to changes in the inter-packet delay (IPD) distribution of the application traffic. In this paper, using analog fountain codes (AFCs) with a general model-fitting coding framework, we design timing channel schemes that allow the sender to change the target model without synchronizing with the receiver. We first propose analog fountain timing channels based on symbol transition when the application packet streams have IPD distribution that is shape similar to the distribution of AFC code symbol values. For more general packet streams, we then propose analog fountain timing channels based on symbol split in which the linearly mapped symbols are split using a symbol probability split matrix to mimic the IPD distribution of the application traffic. We use real VoIP and SSH traffic to compare the proposed schemes with model-based timing channels using LT codes and AFC. Experimental results show that both the proposed schemes are model-secure. The robustness of the two schemes is higher than the model-based timing channels using LT codes whereas not as good as those using AFC when the sender and receiver sides are synchronized with respect to the target model. Moreover, when the sender and the receiver are not synchronized with respect to the model, the robustness of the proposed schemes is significantly higher than model-based timing channels.

Abstract Matrix embedding schemes based on linear codes have been widely used in the field of steganography, which is an important branch of covert communication. Nevertheless, they appear weak for some conditions of high reliability demand or “active attack” because of the poor robustness. In this paper, with robustness analysis of matrix embedding based on Tanner graph, a general framework of damage‐resistance matrix embedding (DR‐ME) is described to take account of both robustness and embedding efficiency, which has a fair chance to recover the secret message when stego object is partly damaged. The approximated robustness–efficiency bound is derived to reveal the contradiction between robustness and embedding efficiency. Then, based on the parity‐check concatenation of systematic convolutional codes and syndrome‐trellis codes (STCs), we propose the practical damage‐resistance STCs (DR‐STCs). Experimental results show that DR‐STCs are near‐optimal DR‐ME schemes, which can approach the derived upper bound. Copyright © 2014 John Wiley & Sons, Ltd.

Quantization-embedder (QE) is the basic embedding manner, which is composed of partition function, quantization function, conversion function and encoding function. For achieving statistical security, a steganographcial method based on combination of QEs is proposed to preserve the distribution of stego signal toward that of cover signal, and a practical algorithm is implemented in prediction-error domain. Experimental results show that the proposed method has high preservation ability to keep statistical security.

A novel steganographic method based on non-uniform generalized LSB is proposed. Different from the traditional distortion measure MSE and PSNR, the structural-similarity based image quality assessment is used to measure the distortion caused by the data hiding. With the given maximum allowable distortion, dynamic programming is performed to find the optimum substitution depth vector to achieve the maximum capacity. Experiments show the proposed method can achieve higher embedding payload while keeping smaller distortion.