Abstract Protocol reverse engineering is crucial in normative verification, and malware behavior analysis and vulnerability discovery. However, uncovering the structural features of binary protocols concealed within dense data representations remains a significant challenge. Accurately identifying keyword segments associated with message types is a prerequisite for meaningful semantic analysis and protocol state machine reduction. In this work, we introduce a novel approach for inferring keywords from binary protocols based on probabilistic statistics. Our method in terms of Byte employs heuristic rules to filter offset positions that are clearly unrelated to message types. We further filter candidate Byte-offsets utilizing constraint relations and provide the probabilistic ranking of each offset as the keyword segment. To enhance the reliability of keyword segment inference, we utilize the Monte Carlo algorithm to assess the difference between message clustering with candidate Byte-offset and random message clustering, and reorder candidate offsets according to the results. Then we can observe optimal values from both orderings and present the ultimate inference results. Experimental results demonstrate that our method excels in the accuracy of keyword segments identification compared with previous techniques.

Inferring protocol state machines from observable information presents a significant challenge in protocol reverse engineering (PRE), especially when passively collected traffic suffers from message loss, resulting in an incomplete protocol state space. This paper introduces an innovative method for actively inferring protocol state machines using the minimally adequate teacher (MAT) framework. By incorporating session completion and deterministic mutation techniques, this method broadens the range of protocol messages, thereby constructing a more comprehensive input space for the protocol state machine from an incomplete message domain. Additionally, the efficiency of active inference is improved through several optimizations for the L M + algorithm, including traffic deduplication, the construction of an expanded prefix tree acceptor (EPTA), query optimization based on responses, and random counterexample generation. Experiments on the real-time streaming protocol (RTSP) and simple mail transfer protocol (SMTP), which use Live555 and Exim implementations across multiple versions, demonstrate that this method yields more comprehensive protocol state machines with enhanced execution efficiency. Compared to the L M + algorithm implemented by AALpy, Act_Infer achieves an average reduction of approximately 40.7% in execution time and significantly reduces the number of connections and interactions by approximately 28.6% and 46.6%, respectively.

Abstract Since the traffic of novel attacks exceeds current knowledge, realistic traffic labeling methods are prone to mislabeling, which has a significant impact on machine learning-based intrusion detection systems. Data cleaning typically relies on the ability of supervised deep neural networks to learn correct knowledge. Under high noise conditions, noisy labels can affect a supervised network and render it ineffective. To clean traffic datasets under high noise conditions, we propose an unsupervised learning-based data cleaning framework (called ULDC) that does not rely on labels and powerful supervised networks, hence reducing the impact of noisy labels. ULDC evaluates the confidence of observed labels through the distribution and similarity of samples in low dimensions. Moreover, ULDC maximizes the retention of hard samples through adaptive intra-class threshold evaluation, preserving more hard samples for training and improving generalization. In evaluations of ULDC on the CIRA-CIC-DoHBrw-2020 dataset, the percentage of data correction reached more than 75% under high noise, which is better than that of the state-of-the-art methods. ULDC is applicable to traffic data cleaning in both traditional networks and novel networks such as the Internet of Things and mobile networks, and it has been validated on datasets including CIC-IDS-2017 and IoT-23.

Tunnel seismic prediction (TSP) plays a critical role in ensuring the safety of tunnel construction; however, traditional methodologies encounter challenges related to detection range, system deployment, and imaging complexity. In this correspondence, we introduce a novel prestack time migration approach for TSP, known as the surface observation-based prestack time migration method for TSP (SOPSTM-TSP). This method involves the extraction of the direct wave through analysis of seismic wavelet characteristics to derive the scattered wave field, which is subsequently utilized for imaging the mountain through prestack time migration. Through numerical experimentation, the efficacy of the SOPSTM-TSP method is demonstrated in the identification of 5-m scatterers, detection of 60° dip faults, and characterization of relative velocity disparities within various geological contexts. A field study conducted in Gansu, China has demonstrated the feasibility of this method. Engineering practice has confirmed that a 30-m-long rock fracture zone corresponds to the migration results. SOPSTM-TSP uses the amplitude of imaging results to indicate the strength of lithology, which can guide tunnel construction more conveniently and safely.

Due to the limitations of the existing annotation methods, the prevalence of label noise can be caused in realistic malicious traffic datasets, which has a significant impact on the training and evaluation of deep learning-based intrusion detection models. Recently, various methods have been proposed to deal with noise-containing labeled datasets, and they can be roughly divided into two categories: data cleaning and robust training. However, the different processing ideas lead these two types of methods to ignore the information in different components of the dataset, resulting in a cliff-like drop in performance under high noise conditions. To this end, this study proposes a unified framework for handling noise malicious traffic based on the multidimensional constrained representations named MCRe, which unifies data cleaning and robust training into an ideal representation function approximation. According to the properties of the ideal representation function, information integrity constraints, cluster separability constraints and core proximity constraints are defined to drive MCRe to approximate the ideal representation during iteration. These constraints led MCRe to learn the individual, intra-class, and global levels of distributed knowledge, thus avoiding irrational domain knowledge extraction and ensuring strong label noise robustness of the representation network. We validated MCRe on a dataset that includes 22 types of realistic malicious traffic. Experimental results show that MCRe can outperform the state-of-the-art methods in both data cleaning and robust training downstream tasks, achieving 85% pure sample rate and 82% classification accuracy even under the condition of up to 90% noise labels. In addition, the generalizability of MCRe was verified on several public datasets. Finally, MCRe was also well-extended to enhance other data cleaning and robust training approaches.

Website Fingerprinting (WF) enables a local passive attacker to infer which website a user is visiting over an encrypted connection. Classifiers utilizing deep neural networks (DNNs) automatically extract reliable features and have achieved up to 98% accuracy even against Tor. Since DNNs are known to be vulnerable to adversarial examples, several recent studies have exploited adversarial perturbations to defeat WF attacks. These defenses, however, require a high bandwidth overhead that typically exceeds 20% of the original traffic, prohibiting them from real-world deployment. Moreover, many studies on WF defense have been criticized for unrealistic assumptions such as full access to the target model and operating on the entire website trace. In this paper, we leverage adversarial patches—a special type of adversarial example that perturbs only local parts of the input—to control the overhead and enable black-box perturbation. In particular, we propose a new WF defense calledMinipatchthat injects extremely few dummy packets in real-time traffic to evade the attacker’s classifier. Experimental results demonstrate thatMinipatchprovides over 97% protection success rate with less than 5% bandwidth overhead, much lower than existing defenses. Moreover, we show that our adversarial patches remain effective in challenging settings, e.g., where dummy packets are injected only on the client-side and where perturbations are applied almost two months later. Finally, we also analyze several potential countermeasures and suggest ways to preserve perturbation effectiveness during deployment.

Attacks against blockchain networks have proliferated in recent years. Due to its immense economic value, Bitcoin has been subject to numerous malicious theft activities through the exchange platforms. This poses a severe threat to the credibility of the entire Bitcoin ecosystem. Therefore, it is necessary to provide detection and prediction services of malicious events for Bitcoin Exchanges to prevent them in a precise and timely manner. Meanwhile, preserving the privacy of transaction data to prevent de-anonymization attacks during the detection process is also of great importance. In this paper, we present a general framework for privacy-preserving anomaly detection in blockchain networks. Based on this framework, we propose ADaaS, an anomaly detection service scheme that adopts a supervised machine learning model and achieves privacy preservation by using vector homomorphic encryption and matrix perturbation strategies. We also analyze the security, communication and computation costs of ADaaS. Experimental results demonstrate that ADaaS can achieve high detection effectiveness while providing privacy guarantees and is applicable in real scenarios of detecting Bitcoin transactions due to its reasonable efficiency.

Opportunistic wireless channel access granted to non-licensed users through auctions represents a promising approach for effectively distributing and utilizing the scarce wireless spectrum. A limitation of existing spectrum auction designs lies in the over-simplifying assumption that every non-licensed secondary user is a single node or single-hop network. For the first time in the literature, we propose to model non-licensed users as secondary networks (SNs), each of which comprises of a multihop network with end-to-end routing demands. We use simple examples to show that such auctions among SNs differ drastically from simple auctions among single-hop users, and previous solutions suffer from local, per-hop decision making. We first design a simple, heuristic auction that takes inter-SN interference into consideration and is truthful. We then design a randomized auction framework based on primal-dual linear optimization, which is automatically truthful and achieves a social welfare approximation ratio that matches one achieved by cooperative optimization assuming truthful bids for free. The framework relieves a spectrum auction designer from worrying about truthfulness of the auction, so that he or she can focus on social welfare maximization while assuming truthful bids for free.

A novel adaptive steganographic scheme for spatial image is proposed. A noisy function is used to measure texture complexity of 2 × 2 pixel blocks, which keeps monotonic increasing after ±1 modifications. Therefore, the message is embedded into the noisiest areas and the recipient can identify the embedding region. The ‘double-layered embedding’ is exploited to reduce the number of ±1 modifications, in which the fast matrix embedding and wet paper codes are applied to the least significant bit (LSB) plane and the second LSB plane, respectively. The experiments on resisting three steganalyzers show that the proposed method performs better than four typical steganographic schemes. Moreover, comparing with the extended highly undetectable steGO having parameter T = 255, the novel method achieves the competitive ability of resisting detection and faster embedding speed.

In a secondary spectrum market, the utility of a secondary user often depends on not only whether it wins, but also which channels it wins. Combinatorial auctions are a natural fit here to allow secondary users to bid for combinations of channels. In this context, the VCG mechanism constitutes a generic auction that uniquely guarantees both truthfulness and efficiency. There also exists related auction design that relaxes efficiency due to perceived complexity issues, and focuses on truthfulness. Starting with new empirical evidences on the complexity issue, we propose to design core-selecting auctions instead, which resolve VCG's vulnerability to collusion and shill bidding, and improve seller revenue. While the VCG type of auctions are unique in guaranteeing both efficiency and truthfulness, we prove that our core-selecting auctions are unique in guaranteeing both efficiency and shill-proofness, and always outperform VCG auctions in terms of seller revenue generated. Employing linear programming and quadratic programming techniques, we design two payment rules for minimizing the incentives of bidders to deviate from truth telling.

In a secondary spectrum market, the utility of a secondary user often depends on not only whether it wins, but also which channels it wins. Combinatorial auctions are a natural fit here to allow secondary users to bid for combinations of channels. In this context, the VCG mechanism constitutes a generic auction that uniquely guarantees both truthfulness and efficiency, but it is vulnerable to shill bidding and generates low revenue. In this paper, without compromising efficiency, we propose to design core-selecting auctions instead, which resolves VCG's vulnerability and improves seller revenue. We prove that in a secondary spectrum market, the revenue gleaned from a core-selecting auction is at least that of the VCG mechanism, and shills are not profitable to bidders. Employing linear programming and quadratic programming techniques, we design two payment rules suitable for our core-selecting auction, which aim to minimize the incentives of bidders to deviate from truthful-telling. Our extensive simulation results show that the revenues can be largely increased due to spectrum sharing.

Dynamic spectrum access by non-licensed users has emerged as a promising solution to address the bandwidth scarcity challenge. In a secondary spectrum market, primary users lease chunks of unused spectrum to secondary users. Auctions perform as one of the natural mechanisms for allocating the spectrum, generating an economic incentive for the licensed user to relinquish channels. Existing spectrum auction designs, while taking externality introduced by interference into account, fail to consider the potential mobility of secondary users, which leads to another dimension of externality: mobile communication motivates a secondary user to exclusively occupy a channel, i.e., forbidding channel reuse in its mobility region. In this work, we design two expressive auctions for mobility support, by introducing two-dimensional bids that reject a secondary user's willingness to pay for exclusive and non-exclusive channel usage, for the single-channel and multiple-channel scenarios, respectively. In the outcome of our 2D auctions, a channel is either monopolized or simultaneously reused without interference, whereas a secondary user can be mobile or is regulated to be static. We prove the existence of desirable equilibria in both auctions, where 1/10 and c/7(1+c) of optimal social welfare are guaranteed to be recoverable, respectively (c is the number of channels).

Opportunistic wireless channel access by non-licensed users has emerged as a promising solution for addressing the bandwidth scarcity challenge. Auctions represent a natural mechanism for allocating the spectrum, generating an economic incentive for the licensed user to relinquish channels. A severe limitation of existing spectrum auction designs lies in the over-simplifying assumption that every non-licensed user is a single-node or single-link secondary user. While such an assumption makes the auction design easier, it does not capture practical scenarios where users have multihop routing demands. For the first time in the literature, we propose to model non-licensed users as secondary networks (SNs), each of which comprises of a multihop network with end-to-end routing demands. We aim to design truthful auctions for allocating channels to SNs in a coordinated fashion that maximizes social welfare of the system. We use simple examples to show that such auctions among SNs differ drastically from simple auctions among single-hop users, and previous solutions suffer severely from local, per-hop decision making. We first design a simple, heuristic auction that takes inter-SN interference into consideration, and is truthful. We then design a randomized auction based on primal-dual linear optimization, with a proven performance guarantee for approaching optimal social welfare. A key technique in our solution is to decompose a linear program (LP) solution for channel assignment into a set of integer program (IP) solutions, then applying a pair of tailored primal and dual LPs for computing probabilities of choosing each IP solution. We prove the truthfulness and performance bound of our solution, and verify its effectiveness through simulation studies.

Abstract In this paper, we mainly investigate anonymous user authentication scheme using smart card. We first demonstrate security weaknesses still exist in two such schemes recently propose by Wanget al. and Tsaiet al., respectively according to Wanget al.'s criteria. Thereafter, we propose an enhanced smart‐card‐based authentication scheme with user anonymity for providing all the admired requirements at the same time. Compared with the previous schemes, our scheme is yet efficient both in computation and communication cost. Moreover, we can prove the security of the proposed scheme in the random oracle model. Copyright © 2011 John Wiley & Sons, Ltd.

This paper studies the scaling law of the data gathering capacity of large-scale wireless sensor networks. Many previous researches on data gathering capacity focus on a many-to-one scheme, but we study the capacity in a multi-session data gathering paradigm, where some of the nodes in the network act as sinks and each sink has a set of source nodes to collect data. The analysis of this paradigm is meaningful in that it may be more commonplace in wireless sensor networks, because in real world, we often hope different sinks to get different kinds of data from sensors deployed in the same region. In the multicast scenario, a source node just sends the same data to all of its destinations, while in multi-session data gathering, the sink node has to receive different data from all its sensor nodes, which makes the last hop to the sink become a capacity bottleneck. We use compressive sensing (CS), a newly introduced sampling theory, to simplify the analysis of data gathering capacity into a similar way as the situation of multicast. Meanwhile, compressive sensing can achieve a capacity gain of $k/M$ for each data gathering session.

With the broad application of UNIX and its descendants in recent years, heterogeneous network environment is a must to maximize the enterprise's freedom of choice. However, because of different accounts formats and authentication mechanisms of various operating system (OS), heterogeneous network environment also increases difficulties for system management and security implementation. Facing the situation, this paper proposes a HSMD (heterogeneous system management domain) domain to embody both Windows and UNIX. The domain is based on lightweight directory access protocol (LDAP) to solve the conflict in account storing modes of different OS and realizes interoperation between Microsoft extended Kerberos protocol and standard Kerberos protocol. At last, the paper states that the scheme proposed has advantages of security, reliability, flexibility and adaptability.

In this paper, we formulate and realize a definition of security for three-party key distribution within the universally composable (UC) framework. That is, an appropriate ideal functionality that captures the basic security requirements of three-party key distribution is formulated. We show that UC definition of security for three-party key distribution protocol is strictly more stringent than a previous definition of security which is termed AKE-security. Finally, we present a real-life protocol that securely realizes the formulated ideal functionality with respect to non-adaptive adversaries