Abstract Although packers are useful tools for protecting applications, they can also be used to protect malware. This makes packer identification technology increasingly important for malware analysis. Most existing packer identification methods based on static analysis extract a large number of features from the binary code of an executable. However, these binary code-related features are sensitive to small changes in the executable’s binary code, and it is difficult to understand how these features influence the decision-making processes of machine learning models. To address the shortcomings of existing static analysis-based packer identification methods, we explore extraction of a small number of easily extractable and discriminative features for efficient and accurate packer identification. Specifically, we analyze the packing process and notice that the structures of the packed PEs differ according to the different packing patterns used by the packer. Based on this, a section-entropy plot is proposed, which is generated by a small number of easily extractable and discriminative features that can reflect the overall structure of a PE file. By using GoogLeNet to identify the packer characterized by the section-entropy plot, a p acker i dentification method based on the s ection- e ntropy p lot (PISEP) is constructed, which does not require PE file disassembly and complex feature engineering. The experimental results show that PISEP achieves 99.08% accuracy for identifying seen and unseen types of packers and requires only 0.165 s on average to identify the packer class of a test sample, and thus could be a highly competitive candidate for packer identification.

Abstract In response to the increasing threat posed by the exponential growth of malware in cybersecurity, researchers have developed a number of malware classification methods based on malware images and deep learning in recent years. Newly proposed methods of this type tend to focus on generating malware images by extracting multiple types of information from a PE file, as well as on using complex convolutional neural network (CNN) models, to achieve high classification accuracy. Methods that involve extracting multiple types of information, especially those that require file disassembly for acquisition and the subsequent use of complex CNN models, result in a lengthy process for generating malware images and significantly increase model training durations. To alleviate this problem, we adopt the idea of using only a small part of the content that can be easily extracted from a PE file to efficiently generate a malware image, and implement malware classification without relying on complex CNN models. As a key component of a PE file, the PE header and the section table (we call them PE metadata) are characterized by a relatively low byte count and are likely to be useful for malware classification according to the similarities observed in the PE metadata between malware from both the same family and different families. Therefore, in this work, we explore the feasibility of using PE metadata alone to generate an image for malware classification and propose an Image of PE metadata (IPM) generated from PE metadata to represent malware. Based on the proposed IPM, we then construct a shallow CNN model and combine it with a support vector machine classifier to introduce a novel malware classification method called MCPDS ( M alware c lassification method using P E metadata, d eep learning and s upport vector machine). The experimental results show that the MCPDS not only achieves high accuracy in terms of classifying malware on two malware datasets but also exhibits high efficiency in terms of image generation and good robustness against adversarial samples.

Probing the configurations of the Software-Defined Networking (SDN) switches is the essential preliminary for attacking SDN. This study points out a critical bottleneck in detecting probing attack: the dynamically changing character of different kinds of probing attacks makes the existing detection methods fail to detect probing attack. In this paper, we propose Tide, a probing attack detection method based on a Dynamic Flow-Packet graph (DFP-Graph), along with an intra-and inter-timeslot enhanced node embedding strategy. Tide constructs a (FP-Graph) across multiple timeslots, thereby modeling the intra-timeslot DFP-Graph consisting of multiple static Flow-Packet Graphs correlations that include the flow to flow, packet to packet, flow to packet, and packet to flow relationships while representing the inter-timeslot correlation of flows. Furthermore, Tide proposes an intra-timeslot node embedding module, an inter-timeslot node embedding module, and a probing attack flow detection module. The intra-timeslot node embedding module is designed to update the node representations based on the intra-timeslot correlation among different flows, while the inter-timeslot node embedding module is proposed to track the time-varying characters of a single flow. Finally, the probing attack flow detection module is employed to integrate the flow nodes’ representations in each timeslot and identify the probing attack flows. The experimental results demonstrate that Tide can effectively detect probing attack. It achieves the average detection accuracy at 87.51%, which outperforms the state-of-the-art methods.

Workflow scheduling in cloud data centers faces challenges such as task dependencies, resource heterogeneity, and dynamic workloads. Heuristic and meta-heuristic algorithms lack environment awareness and fail to meet real-time scheduling requirements. Existing deep reinforcement learning algorithms exhibit specific environment-aware capabilities; however, their feature modeling capabilities are insufficient, making it challenging to effectively model the nonlinear relationships between tasks and resources. To address these issues, we design a dynamic priority-aware mechanism that computes task priority factors in real time to adjust scheduling strategies adaptively. In low-load scenarios, dependency release is accelerated based on the priority rule of the successor node quantity to improve resource utilization; in high-load scenarios, bottleneck subtasks are prioritized based on the priority rule of the weighted critical path to shorten overall task completion times. We propose a Dynamic Priority-Aware Transformer-based Advantage ActorCritic (DPA-TA2C) scheduling method. The proposed method models the task topology, resource states, and priority factors as a sequence of features via a Transformer encoder. It collaboratively optimizes scheduling decisions using the policy and value functions of the A2C network to achieve end-to-end scheduling. Experimental results show that DPA-TA2C improves resource utilization by 49.5 % on average in low-load scenarios and reduces makespan by 51.6 % in high-load scenarios, demonstrating the efficiency and robustness of the proposed method for scheduling in complex cloud environments.

ABSTRACT A recent research work pointed out that the reversible data hiding algorithms proposed for gray‐scale images can be implemented on the reconstructed palette images to improve embedding capacity and visual quality by reordering the color table. However, the reordering effect has a significant impact on performance improvement. Therefore, we propose a clustering‐based color reordering method for reversible data hiding in palette images to improve the reordering effect and further enhance the performance. In this method, we first design a centroid initialization method to select the initial centroids and then exploit the K‐means algorithm to generate clusters for the colors in the original color table. In the following, our proposed method, respectively, reorders the colors of these clusters by a greedy strategy and concatenates them into the reordered color table. Based on the relationship between the original and the reordered color tables, a novel index matrix can be reconstructed. Finally, state‐of‐the‐art reversible data hiding algorithms can be implemented on the reconstructed index matrix for performance improvement. Since our proposed method improves the reordering effect, enhances the correlation of the reconstructed index matrix, and reduces the length of the encoded location map, the maximal embedding capacities and the visual quality under the fixed embedding capacities are improved. We conducted experiments on two image datasets and six standard images to verify that the performance improvement of our proposed reordering method is better than that of the state‐of‐the‐art methods.

As a new network structure, the decoupling of the control plane and forwarding plane makes Software-Defined Networking (SDN) widely used in large-scale network scenarios. However, the decoupling network architecture also brings new vulnerabilities. The flow table overflow attack is an attack strategy that can overwhelm SDN switches. Nevertheless, the existing flow table overflow attacks may fail in probing timeouts and match fields of flow entries, due to link failure, measurement of the round-trip time (RTT) of different packets, interference of hard-timeout and idle-timeout. Meanwhile, the stealthiness of the existing attacks may also reduce, as these attacks use fixed attack rate. To improve the timeout probing accuracy and the stealthiness of attack, a new flow table overflow attack strategy, DUDFTO, is proposed to accurately probe timeout settings and match fields, then stealthily overflow SDN flow tables. Firstly, it probes the match fields by measuring the one-sided transmission delay of the packets. After that, DUDFTO designs a down-to-up feedback-based timeout probing algorithm to eliminate the issues caused by high RTT, link failure, interference between hard-timeout and idle-timeout. Then, DUDFTO designs a dynamic attack packets sending algorithm to improve its stealthiness. Finally, DUDFTO probes the flow table state to stop sending new attack packets. The evaluation results demonstrate that DUDFTO outperforms the existing attacks in terms of match fields probing ability, timeout probing relative error, number of packet_in and flow_mod messages generated by the attack, rate distribution of packet_in and flow_mod messages generated during the attack, and number of detected attack packets.

Computation offloading technology plays an important role in Mobile Edge Computing (MEC). Most mainstream Deep Reinforcement Learning (DRL)-based computation offloading methods employ random experience replay to train networks. This training method does not take into account the value differences between experiences, resulting in the decrease of training speeds and the increase of task completion delay, energy consumption, and task drop rate. Prioritized Experience Replay (PER) alleviates this issue to some extent. However, using Temporal Difference (TD) error as the criterion for the importance of experiences does not allow for the selection of experiences that are more "concerned" by the Actor network under the Actor-Critic framework. This limitation restricts the performance of the algorithm. To address these issues, this paper focuses on the computation offloading problem in scenarios with multiple mobile devices (MDs) and multiple MEC servers. A near-far area experience replay algorithm-based computation offloading method named NFAERCOM is proposed. NFAERCOM additionally considers the queuing delay at the MEC server and introduces a new near-far area experience replay algorithm. Evaluation results demonstrate that NFAERCOM effectively reduces the task completion delay, energy consumption, and task drop rate of tasks.

Software-defined networking for IoT (SD-IoT), as an emerging architecture, is suffering from numerous security issues. Saturation attacks against the SDN switches and controllers are major security concerns in SD-IoT. When using the Dempster–Shafer evidence theory (DSE) to detect various saturation attacks, the simple mutual information calculation may cause information loss problem, leading to the decrease of detection accuracy. Therefore, how to avoid information loss problem to improve the detection performance is a key issue. Aiming to solve the above-mentioned issues, we propose KIND, a novel image mutual information-based decision fusion method for saturation attack detection in SD-IoT. The main idea of KIND is that it converts the probability matrix of binary classifiers to images and detects the saturation attacks by fusing these images. More specifically, when executing the evidence fusion, each evidence is converted to an image by a nonlinear transformation method. Each image is converted from the related probability-supported matrix. Then, the evidence can be fixed by comparing structural similarities among different images. After that, all evidence can be utilized to obtain the final detection results using the conducted combination rule. The evaluation results demonstrate that KIND can achieve high detection performance, which outperforms other state-of-the-art methods, in terms of TPR, TNR, FPR, FNR, accuracy, precision, recall, F-score, confusion matrix, ROC curves, PR curves, Chi-square test, correlation coefficient, and the quantitative strategy test. In conclusion, KIND can detect saturation attacks with high precision while causing acceptable storage overload.

As one of the next generation of network architectures, Software-Defined Networking (SDN) decouples the forwarding and control function of the traditional network device. However, it also faces new threats from network attacks, such as the Low-rate Distributed Denial of Service (L-DDoS) attack. To resist L-DDoS attack in SDN, this work proposes METER, an enseMble discrEte wavelet Transform-based method for idEntifying low-Rate DDoS attack in SDN. The rationale for METER is to identify L-DDoS attacks based on a new metric referred to as the Ensemble Wavelet Energy Entropy set (EWEEs), which is calculated by a novel ensemble DWT method. Firstly, the ensemble wavelet coefficients matrix is attained by METER using the ensemble DWT method. After that, METER combines the related entropy values with wavelet energy of the ensemble wavelet coefficients matrix to obtain EWEEs. Furthermore, to increase the precision of the L-DDoS detection method, machine learning methods are used to mine the correlation between EWEEs and L-DDoS attacks for identifying L-DDoS. The experiments were implemented on the RYU controller and Mininet, which demonstrates that METER outperforms the baseline method, in terms of precision, accuracy, F -score, recall, ROC curve, and P-R curve.

With the increasing complexity of network attacks, an active defense based on intelligence sharing becomes crucial. There is an important issue in intelligence analysis that automatically extracts threat actions from cyber threat intelligence (CTI) reports. To address this problem, we propose EX-Action, a framework for extracting threat actions from CTI reports. EX-Action finds threat actions by employing the natural language processing (NLP) technology and identifies actions by a multimodal learning algorithm. At the same time, a metric is used to evaluate the information completeness of the extracted action obtained by EX-Action. By the experiment on the CTI reports that consisted of sentences with complex structure, the experimental result indicates that EX-Action can achieve better performance than two state-of-the-art action extraction methods in terms of accuracy, recall, precision, and F1-score.

In data‐driven big data security analysis, knowledge graph‐based multisource heterogeneous threat data organization, association mining, and inference analysis attach increasinginterest in the field of cybersecurity. Although the construction of knowledge graph based on deep learning has achieved great success, the construction of a largescale, high‐quality, and domain‐specific knowledge graph needs a manual annotation of large corpora, which means it is very difficult. To tackle this problem, we present a straightforward active learning strategy for cybersecurity entity recognition utilizing deep learning technology. BERT pre‐trained model and residual dilation convolutional neural networks (RDCNN) are introduced to learn entity context features, and the conditional random field (CRF) layer is employed as a tag decoder. Then, taking advantages of the output results and distribution of cybersecurity entities, we propose an active learning strategy named TPCL that considers the uncertainty, confidence, and diversity. We evaluated TPCL on the general domain datasets and cybersecurity datasets, respectively. The experimental results show that TPCL performs better than the traditional strategies in terms of accuracy and F1. Moreover, compared with the general field, it has better performance in the cybersecurity field and is more suitable for the Chinese entity recognition task in this field.

Industrial control systems (ICS) involve many key industries, which once attacked will cause heavy losses. However, traditional passive defense methods of cybersecurity have difficulty effectively dealing with increasingly complex threats; a knowledge graph is a new idea to analyze and process data in cybersecurity analysis. We propose a novel overall framework of data-driven industrial control network security defense, which integrated fragmented multisource threat data with an industrial network layout by a cybersecurity knowledge graph. In order to better correlate data to construct a knowledge graph, we propose a distant supervised relation extraction model ResPCNN-ATT; it is based on a deep residual convolutional neural network and attention mechanism, reduces the influence of noisy data in distant supervision, and better extracts deep semantic features in sentences by using deep residuals. We empirically demonstrate the performance of the proposed method in the field of general cybersecurity by using dataset CSER; the model proposed in this paper achieves higher accuracy than other models. And then, the dataset ICSER was used to construct a cybersecurity knowledge graph (CSKG) on the basis of analyzing specific industrial control scenarios, visualizing the knowledge graph for further security analysis to the industrial control system.

By network security threat intelligence analysis based on a security knowledge graph (SKG), multi-source threat intelligence data can be analyzed in a fine-grained manner. This has received extensive attention. It is difficult for traditional named entity recognition methods to identify mixed security entities in Chinese and English in the field of network security, and there are difficulties in accurately identifying network security entities because of insufficient features extracted. In this paper, we propose a novel FT-CNN-BiLSTM-CRF security entity recognition method based on a neural network CNN-BiLSTM-CRF model combined with a feature template (FT). The feature template is used to extract local context features, and a neural network model is used to automatically extract character features and text global features. Experimental results showed that our method can achieve an F-score of 86% on a large-scale network security dataset and outperforms other methods.

Ambiguity function (AF) provides an effective way for analysis of the resolving performance of a radar system. With the development of ultra-wideband (UWB) and multiple-input-multiple-output (MIMO) radio techniques, recently, the combination of them-the concept of UWB MIMO radar has been proposed and received much attention. For a UWB MIMO radar, first, the signal waveform with an exponential expression which is widely adopted in narrowband cases is not appropriate anymore. Second, the MIMO radar sensors are typically organized in a certain spatial topology, which greatly impacts the performance of the MIMO system. In addition, for a typical MIMO radar application scenario, generally, there are relative motions existing between the radar sensors and the targets. The presence of the relative motions would further complicate the performance analysis of the system. In fact, for a MIMO radar, the overall performance of the system is jointly determined by the parameters, such as the signal waveform, the topology, and the relative motions. Each of the parameters impacts the resolving performance in a particular way. In order to evaluate the contribution of each individual parameter of interest, in this paper, a UWB MIMO AF is developed and factorized into several factors. By this means, each individual parameter can be evaluated via the corresponding factor to examine a certain specific characteristic of the system, instead of via the complicated whole MIMO AFs.

This paper discusses basic requirements for passive ultra-wideband (UWB) localization systems that aim at home-entertainment applications such as smart audio systems, which can adapt the sound according to the user location, providing an optimum listening experience to the user. We have analyzed over hundred thousand channel impulse responses measured by a real-time UWB channel sounder in different scenarios. Our analyses show that passive localization systems must possess a large real-time dynamic range in order to be capable of detecting a listener. We assume that the listener does not carry any tag and is detected and localized just by electro-magnetic (EM) waves reflected from his body. Such passive localization is demonstrated by a measurement example.

Ultra-wideband (UWB) techniques are recently targeted as a broadband short range solution for in-flight-entertainment (IFE) systems. Despite the in-cabin channel can be considered as an indoor channel, under the current aviation regulations, and due to the usual metal cabins and cylindrical shapes, these scenarios are particular for wireless applications. In this paper is presented an experimental characterization of the UWB channel within an Airbus 319 aircraft cabin based on a real-time multiple-input-multiple-output (MIMO) UWB channel sounder. Here, the delay spread and coherent bandwidth have been calculated for different antennas configurations and distances. Besides, the in-cabin path-loss exponent has been calculated based on an extensively amount of data. Moreover, dynamic range metrics have been introduced for channel analysis and performance comparisons along the cabin.