Oblivious Random Access Machine (ORAM) is a kind of cryptographic primitive that allows a client to access its private data from the server without disclosing the access pattern. To deal with consecutive requested blocks at a time efficiently, range ORAM (rORAM) is presented. In the previous rORAM scheme, the locality, namely, the number of discontinuous seeks to complete a request, is reduced to O(log2 N), nevertheless, the bandwidth cost is increased to the poly-logarithmic level. Hence, there exists an open question, that is, whether rORAM can be constructed with the same bandwidth efficiency as a regular ORAM, that is, O(log N)-block? In this paper, we propose a new rORAM scheme, called L2-rORAM. In our scheme, a compatible superblock technique is proposed, and it is combined together with an eviction technique for range blocks, so that it avoids duplication of multiple copies and extra dummy access. As a result, it obtains O(log N)-block bandwidth cost, which affirmatively answers the above open question. Meanwhile, the data locality is reduced to O(log N). In addition, the client storage is maintained at the small level of O(log N)-block, and the server storage is maintained at the unexpanded level of O(N)-block. Finally, experimental results show that the average response time of our L2-rORAM is reduced by one order of magnitude over the state-of-the-art rORAM scheme.

With the trend of digital transformation of enterprises, the use of Internet of Things (IoT) devices is increasing. IoT devices that are not protected by security measures have gradually become targets of attackers. Attackers use weak passwords and software vulnerabilities in the device to invade the device and control it to become a node of the botnet. The Mozi botnet was discovered in December 2019, and its attention has increased day by day, and its influence once exceeded Mirai. After a preliminary reverse analysis of the Mozi samples, we have continued to track the development and changes of the Mozi botnet since February 2021. First, through the in-depth analysis of the communication principles of the Mozi botnet and the distributed sloppy hash table protocol, we have proposed an in-depth analysis of the Mozi botnet. The active detection method of Mozi, through daily and continuous tracking of the number of Mozi nodes, is infinitely close to the boundary of the Mozi network. On the basis of the collected detection data, we give our conclusions on Mozi's node size, global geographic distribution, 24-hour global activity, equipment composition, and Mozi botnet countermeasures. Through this study, we found that the security of IoT devices around the world is not optimistic, and there is an urgent need to increase the security protection of IoT devices. At the same time, we also hope that this study can further promote more research on future botnets.

Graph neural networks (GNN) have been widely used in many machine learning tasks, such as text classification, sequence labeling, protein interface prediction, and knowledge graph. With increasing security concerns, GNN have been proved to be vulnerable and unreliable. Recent years, inspired by adversarial model in computer vision, various attacks on graph data begin to emerge. However, the exist attacks mostly focus on security violation and attack specificity, and very few attacks concern error specificity. In this paper, we focus on dealing with this kind of attack on one node of the graph by slightly manipulating the graph structure. Our goal is to change the label of the node to what we want after attack. We formulate this case as label specificity attack problem. The biggest challenge in solving this problem is the lack of theoretical guidance to perform this attack. For this, we reinterpret structural entropy and define differential structural entropy (DS-entropy) to guide the manipulation. Based on DS-entropy, we propose the target-label principle and max-degree principle to execute our attack, and then design the corresponding algorithm DSEM. We compare our algorithm DSEM with two benchmarks on three classical graph data sets. Results show that our algorithm is effective in performing label specificity attacks.

Dynamic searchable encryption (SE) aims at achieving varied search function over encrypted database in dynamic setting, which is a trade-off in efficiency, security, and functionality. Recent work proposes a file-injection attack which can successfully attack by utilizing some information leaked in the update process. To mitigate this attack, some SE schemes with forward privacy are proposed. However, these schemes are designed to achieve single keyword or conjunctive keyword search, which cannot support multikeyword search. Moreover, these schemes do not consider the function of results ranking. In this paper, we propose a forward privacy multikeyword ranked search scheme over encrypted database. We design a forward privacy multikeyword search scheme based on the classic MRSE scheme. Our scheme makes the cloud cannot obtain the actual match results of the past query with the newly updated files by adding the well-chosen dummy elements to the original index and query vectors. We rank the search results based on the matched keyword number and the T F × I D F $TF\times IDF$ rule in the dynamic setting. Our scheme uses only the symmetric encryption primitive. We implement our scheme for COVID-19 data set and the experimental evaluation results show that the proposed scheme is secure and efficient.