The proliferation of sophisticated multi-modal misinformation necessitates detectors capable of perceiving both subtle manipulation traces and high-level semantic inconsistencies. However, a pivotal challenge remains: existing methods often project features into a unified latent space, leading to a “semantic crowding” effect where robust semantic signals drown out fragile, low-level forgery artifacts. To resolve this intrinsic dimensionality mismatch, we propose TSAD (Trace-Semantic Adaptive Disentanglement), a novel framework designed to detect and ground multi-modal media manipulation. At its core, TSAD introduces a Trace-Semantic Disentanglement (TSD) module that casts feature extraction as a dual-manifold projection problem, enabling explicit separation of heterogeneous representations. This mechanism orthogonally separates input data into a Structural Anomaly Space, aggregating local neighborhood pixel correlations to capture splicing boundaries, and a Semantic Fidelity Space that preserves global content identity. Furthermore, to handle the varying complexity of forgery patterns, we propose a Granularity-Adaptive Calibration (GAC) module that dynamically learns instance-specific gating weights to fuse these disentangled cues. Extensive experiments on the large-scale DGM4 benchmark validate the effectiveness and robustness of TSAD, showing clear advantages over existing state-of-the-art approaches in both binary and fine-grained evaluation settings.

Polynomial multiplication, a critical operation in lattice-based post-quantum cryptography, is highly vulnerable to side-channel secret key leak. Recent advancements in deep learning have demonstrated notable effectiveness in side-channel attacks. However, existing deep learning based approaches to attack polynomial multiplication are constrained by several limitations, including the substantial reliance on extensive traces from the target device and the superficial exploration of the effectiveness of diverse deep learning models. In this work, we propose a novel deep learning based side-channel attack on polynomial multiplication, achieving a significant reduction in the number of required traces by fixing the ciphertext and directly employing the key coefficient values as labels. We evaluate the effectiveness of our approach on three key encapsulation mechanisms (KEMs) submitted to the third round of the NIST Post-Quantum Cryptography Standardization Project: NTRU, Saber and Kyber. Each of these KEMs is implemented on an ARM Cortex-M4 embedded processor, utilizing various polynomial multiplication approaches, including schoolbook multiplication, Toom-Cook multiplication, and NTT-based multiplication. We systematically evaluate the performance of four prominent deep learning models: Multi-Layer Perceptron (MLP), Convolutional Neural Network (CNN), Long Short-Term Memory Network (LSTM), and Transformer. Our results indicate that, to fully recover the complete key, CNN and Transformer demonstrate superior performance for NTRU, requiring only 7 traces during the attack stage. For Saber, Transformer exhibits the best performance with 9 traces. For Kyber, MLP outperforms the others with 19 traces. Compared to two recent state-of-the-art side-channel attacks targeting polynomial multiplication, our approach significantly reduces the number of traces required from the target device, with reductions ranging from 62% to 95.5% across different implementations. These results underscore the potential of advanced deep learning techniques in enhancing the efficiency and effectiveness of side-channel attacks on post-quantum cryptographic systems.

The Internet lacking accountability suffers from IP address spoofing, prefix hijacking, and DDoS attacks. Global PKI-based accountable network involves harmful centralized authority abuse and complex certificate management. The inherently accountable network with self-certifying addresses is incompatible with the current Internet and faces the difficulty of revoking and updating keys. This study presents DIIA, a blockchain-based decentralized infrastructure to provide accountability for the current Internet. Specifically, DIIA designs a public-permissioned blockchain called TIPchain to act as a decentralized trust anchor, allowing cryptographic authentication of IP addresses without any global trusted authority. DIIA also proposes the revocable trustworthy IP address bound to the cryptographic key, which supports automatic key renewal and efficient key revocation and eliminates complexity certificate management. We present several security mechanisms based on DIIA to show how DIIA can help to enhance network layer security. We also implement a prototype system and experiment with real-world data. The results demonstrate the feasibility and suitability of our work in practice.

In the communication environment of smart homes, personal data, control messages, and sensitive data are transmitted through wireless sensor networks (WSNs). Therefore, to prevent an invasion of privacy, communication has to be encrypted, and the data have to be stored securely. In this paper, we propose a new secure privacy-preserving authentication scheme for smart homes. We propose the concept of non-interactive chaotic zero-knowledge proof (NCZKP) and use it for our scheme to resist ephemeral secrets leakage (ESL) impersonation attack, which assures that the adversary can extract the sensitive information stored in gateway note, and use it to impersonate as a legal user. Also, the formal security analysis Random-or-real model is used to prove that our scheme is secure against different known attacks. In the end, according to the experiment, our scheme has low computation and communication costs compare with other related schemes.

In-network middleboxes are vital for the Internet-of-Things (IoT) system security, but the widely adopted transport layer security (TLS) protocol blinds application-level middleboxes due to the encryption of traffic data. To resolve this problem, many solutions have been proposed to date. Among them, SplitTLS is widely adopted in the industry by proxy manufacturers. It requires TLS client to install customized root certificates and incurs additional security flaws, e.g., disabling server authentication and using weak cipher suites. Another approach is to customize the TLS protocol where middleboxes are enabled via either performing handshake directly with TLS endpoints or receiving session key materials in an out-of-band manner. Overall, current solutions would either jeopardize the original TLS handshake procedure or incur additional overheads on the endpoints. In this article, we design a new middlebox-enhanced TLS (ME-TLS), which enables endpoints to introduce authenticated middleboxes into a TLS session while control middleboxes' access permission and processing order of traffic data. Particularly, in our proposed ME-TLS, the handshake structure of TLS keeps unchanged and middleboxes work in a passive manner. That is, middleboxes in the ME-TLS could recover session key materials by monitoring handshake messages passively instead of interacting with endpoints; secondary secure channels for key transmission are also not needed in our ME-TLS. We implement our ME-TLS based on the TLS 1.3 protocol and evaluate its performances. The experimental results demonstrate that our proposal is practical and deployable for real-world IoT scenarios.

Enabling end-to-end secure communication is essential for many Internet-of-Things (IoT) application scenarios. Transport-layer security (TLS) and datagram TLS (DTLS) are the de-facto protocols for communication security in the IP-based IoT. However, the current authentication approaches of TLS are confronted with the heavy overhead and security issues in the resource-constrained IoT scenario. On the other hand, the identity-based cryptography (IBC) becomes an attractive cryptographic solution for the IoT. Unfortunately, the current IBC-based proposals exist the problem of either high communication latency or low level of security. In this article, we propose the first lightweight secure transport protocol called iTLS, which delivers protected data in the first flight with perfect forward secrecy, and provides implicit mutual authentication without certificates. iTLS dynamically generates identity-based early keys before receiving a server response, allowing clients to send the encrypted data without additional round trips. Furthermore, it employs the ephemeral secret ticket to obtain an ephemeral server key in the previous connection. Therefore, the early key established afterward can provide full forward secrecy. Design and implementation in the form of extension make iTLS fully compatible with TLS 1.3 and easy to be converted to a DTLS version. Our evaluation shows that iTLS reduces the network traffic overhead by at least 61.2%, and handshake latency on an ideal network by at least 60% compared to the certificate-based TLS. The results demonstrate iTLS achieves strong adaptability on the low-power and lossy IoT networks.

Summary Hardware‐based middleboxes are ubiquitous in computer networks, which usually incur high deployment and management expenses. A recently arising trend aims to address those problems by outsourcing the functions of traditional hardware‐based middleboxes to high volume servers in a cloud. This technology is promising but still faces a few challenges from different aspects, including privacy concerns, middlebox functionality, and performance. In this paper, we propose two practical approaches to implementing a cloud‐based DPI middlebox. The outsourced DPI middlebox performs payload inspection over encrypted traffic while preserving the privacy of both communication data and inspection rules. Our first approach employs a modified reversible sketch structure, which is used for efficient error‐free membership testing, and our second approach extends the famous AC pattern matching algorithm to the cipher text domain. We utilize unkeyed one‐way hash functions instead of complex cryptographic protocols to achieve the privacy preservation requirements. Our system supports a wide range of real‐world inspection rules. We conduct evaluations on the ClamAV rule set, and the experiment results demonstrate the effectiveness of our proposals.

Nowadays, outsourcing data and machine learning tasks, e.g.,$k$-nearest neighbor (KNN) classification, to clouds has become a scalable and cost-effective way for large scale data storage, management, and processing. However, data security and privacy issue have been a serious concern in outsourcing data to clouds. In this article, we propose a privacy-preserving KNN classification scheme on cloud data in a twin-cloud model based on an additively homomorphic cryptosystem and secret sharing. Compared with existing works, we redesign a set of lightweight building blocks, such as secure square Euclidean distance, secure comparison, secure sorting, secure minimum, and maximum number finding, and secure frequency calculating, which achieve the same security level but with higher efficiency. In our scheme, data owners stay offline, which is different from secure-multiparty computation-based solutions which require data owners’ stay online during computation. In addition, query users do not interact with the cloud except sending query data and receiving the query results. Our security analysis shows that the scheme protects outsourced data security and query privacy, and hides access patterns. The experiments on real-world dataset indicate that our scheme is significantly more efficient than existing schemes.

Origin authentication is one of the most concentrated and advocated BGP security approach against IP prefix hijacking. However, the potential risk of centralized authority abuse and the fragile infrastructure may lead a sluggish deployment of such BGP security approach currently. We propose BGPCoin, a trustworthy blockchain-based Internet resource management solution which provides compliant resource allocations and revocations, and a reliable origin advertisement source. By means of a smart contract to perform and supervise resource assignments on the tamper-resistant Ethereum blockchain, BGPCoin yields significant benefits in the secure origin advertisement and the dependable infrastructure for object repository compared with RPKI. We demonstrate through an Ethereum prototype implementation that the deployment incentives and increased security are technically and economically viable.

Revocable Identity-Based Encryption (RIBE) allows feasible key revoke to enable dynamic user management in certificateless system. The existing RIBE schemes fail to keep receivers anonymity, or short parameters, or adaptive security. Hence, we overcome the drawbacks of previous schemes and contribute to an Anonymous RIBE (ARIBE) scheme with two advantages: (1) the provable full security under the adaptive-ID attack in the standard model and (2) the sufficient efficiency in optimal parameters-the secret subkey and the update subkey are one group element each and decryption only requires two pairings. To our best knowledge, our construction is the first IBE scheme that simultaneously achieves efficient revocability, anonymity and full security in the exponent-inversion IBE family.

Port address hopping (PAH) communication is a powerful network moving target defense (MTD) mechanism. It was inspired by frequency hopping in wireless communications. One of the critical and difficult issues with PAH is synchronization. Existing schemes usually provide hops for each session lasting only a few seconds/minutes, making them easily influenced by network events such as transmission delays, traffic jams, packet dropouts, reordering, and retransmission. To address these problems, in this paper we propose a novel self-synchronization scheme, called ‘keyed-hashing based self-synchronization (KHSS)’. The proposed method generates the message authentication code (MAC) based on the hash based MAC (HMAC), which is then further used as the synchronization information for port address encoding and decoding. Providing the PAH communication system with one-packet-one-hopping and invisible message authentication abilities enables both clients and servers to constantly change their identities as well as perform message authentication over unreliable communication mediums without synchronization and authentication information transmissions. Theoretical analysis and simulation and experiment results show that the proposed method is effective in defending against man-in-the-middle (MITM) attacks and network scanning. It significantly outperforms existing schemes in terms of both security and hopping efficiency.

Summary Because of the rapid increasing of malware attacks on the Internet of Things in recent years, it is critical for resource‐constrained devices to guard against potential risks. The traditional host‐based security solution becomes puffy and inapplicable with the development of malware attacks. Moreover, it is hard for the cloud‐based security solution to achieve both the high performance detection and the data privacy protection simultaneously. This paper proposes a cloud‐based anti‐malware system, called CloudEyes, which provides efficient and trusted security services for resource‐constrained devices. For the cloud server, CloudEyes presents suspicious bucket cross‐filtering, a novel signature detection mechanism based on the reversible sketch structure, which provides retrospective and accurate orientations of malicious signature fragments. For the client, CloudEyes implements a lightweight scanning agent which utilizes the digest of signature fragments to dramatically reduce the range of accurate matching. Furthermore, by transmitting sketch coordinates and the modular hashing, CloudEyes guarantees both the data privacy and low‐cost communications. Finally, we evaluate the performance of CloudEyes by utilizing both the campus suspicious traffic and normal files. The results demonstrate that the mechanisms in CloudEyes are effective and practical, and our system can outperform other existing systems with less time and communication consumption. Copyright © 2016 John Wiley & Sons, Ltd.

Abstract People‐centric sensing (PCS), which collects information closely related to human activity and interactions in societies, is stepping into a flourishing time. Along with its great benefits, PCS poses new security challenges such as data integrity and participant privacy. Hierarchical identity‐based signature (HIBS) scheme can efficiently provide high‐integrity messaging, secure communication, and privacy protection to PCS. However, key escrow problem and low computation efficiency primarily hinder the adoption of HIBS scheme. In this paper, we propose an escrow‐free online/offline HIBS scheme for securing PCS. By utilizing user‐selected‐secret signing algorithm and splitting the signing phase into online and offline procedures, our scheme solves the key escrow problem and achieves high scheme performance. Copyright © 2016 John Wiley & Sons, Ltd.

For Securing BGP Protocol, this paper proposes an identity-based private key infrastructure (iPKI) for managing self-attested IP (sIP) addresses. An sIP address endows the current IP address self-attested characteristic, which does not rely on any credential based PKI. Based on the sIP address, we design the In-Band Self Origin Verification (IBSOV) protocol and self Route Origin Authorization (sROA) to provide a lightweight origin verification for the BGP protocol, which has a much lower overhead than the existing works.

The rapid growth of distributed and networking technologies has made our information system more vulnerable to attack threats, malicious behaviors, and unpredictable failures. As the emergence of botnets and advanced persistent threat attacks, the traditional defense technology cannot cope well with the new large-scale and obfuscated malwares. In distributed and virtualized environments, the trust risk of applications has been increased considerably, which made it vital to propose new trust access control technologies. In addition, the complicated system usually comprises a large number of components that are susceptible to unpredictable failures. We need new designs of resilient infrastructure and dependable services. The papers in this special issue focus on the security, trust, and resilience management for distributed and networking computing paradigms, such as wireless sensor network, P2P network, ad hoc networks, virtualized network, and software-defined network. The contributions of these papers are outlined next. To locate the real source of the Internet attacks, existing work is easy to be evaded by attackers and difficult to justify the stepping stones. Sheng Wen et al. introduce the consistent causality probability to detect the stepping stones. They formulate the ranges of abnormal causality probabilities according to the different network conditions and further implement self-adaptive methods to capture stepping stones. To extract signatures for malwares, most existing string-based signatures extracting methods have the problem of inaccuracy and time consuming. Sun Hao et al. present a system for automatically extracting signatures from large-scale malwares, named AutoMal. The system can extract both byte signatures and hashed signatures from the malware network flows with high accuracy. Multi-interface multi-channel can reduce the channel interference and improve the network capacity for multi-hop wireless ad hoc networks. Tong Zhao et al. design a dynamic channel assignment algorithm that can dynamically switch the channels to the less busy ones by monitoring the channel usages. Moreover, the algorithm is designed in a fully distributed way with low overhead For the task allocation in wireless sensor networks (WSNs), traditional solutions for high-performance computing cannot be directly used in WSNs because of limitations of resource availability and shared communication medium. Wenzhong Guo et al. design a discrete particle swarm optimization to generate a structure of the parallel coalitions, and then introduce the game theory and redesigned fitness function to find the Nash equilibrium point for the purpose of improving the effectiveness of scheduling and the reliability of the network. Clustering approach has been considered one of the most effective measures for wireless sensor networks. Xiao-Hui Kuang et al. propose a novel energy-efficient clustering approach based on convergence degree chain, which is named ECACD. ECACD can improve the stability of topology, reduce the energy consumption, and decrease the communication cost. The distributed hash table (DHT) technology is widely used, which needs to take into account the real-time response and dynamic network maintenance for distributed communication systems. Kai Shuang et al. propose a hierarchical DHT lookup service named Comb, which is organized as a two-layered architecture; workload is distributed evenly among nodes, and most queries can be routed in no more than two hops. Few access control models have been proposed for security issues of multi-domain and virtualized network management. Yang Luo et al. enhance the classic role-based access control model through two concepts: domain and virtual machine. They define the virtualized role based access control (VRBAC) model in which authorized users can migrate or copy virtual machines from one domain to another without causing a conflict. In software-defined networks, network operating systems (NOSes) are required to share or exchange reachability and topological information. Pingping Lin et al. proposes a west–east bridge mechanism for distributed heterogeneous NOSes to cooperate in enterprise/data center/intra-autonomous system networks. Monitoring Border Gateway Protocol (BGP) is an effective way to improve the security of inter-domain routing. Ning Hu et al. present a cooperative BGP monitoring method called the cooperative information sharing model (CoISM). CoISM can provide a more comprehensive information view by introducing information diffuse reflection based on initiative inquiry and making use of the relativity of monitoring information. Securing mobile devices such as smart phones is inherently difficult. René Mayrhofer et al. review recent research results, systematically analyze the technical issues of securing mobile device platforms against different threats, and suggest potential approaches to create human-verifiable secure communication with components or services within partially untrusted devices. We would like to thank the editor-in-chief, Professor Hsiao-Hwa Chen, and co-editor-in-chief, Professor Hamid R. Sharif, for providing us the opportunity to host this special issue. We thank Prof. Guojun Wang for his great help in the organization of the special issue. We also thank all the authors who contributed their papers. Last but not least, we appreciate the work of many reviewers for this special issue.

In this demo, we propose the self-trustworthy and secure Internet protocol (T-IP) for authenticated and encrypted network layer communications. T-IP has the following advantages: 1) Self-Trustworthy IP address. 2) Low connection latency and transmission overhead. 3) Reserving to be stateless (an important merit of IP). 4) Compatible with the existing TCP/IP architecture. We have implemented the protocol and deployed it in our campus network. Compared with IPsec, the evaluation shows that T-IP has a much lower transmission overhead and connection latency.

Flooding based Distributed Denial of Service (DDoS) attacks can cause very serious security problem by exhausting computing and bandwidth resources of victims. To mitigate these destructive attacks, it is crucially important to detect the occurrence of DDoS attacks and identify their targets as early as possible. In this paper, we propose a collaborative DDoS detection system, called VicSifter, which can detect ongoing DDoS attacks and identify victims at an early stage with good scalability and low overhead. VicSifter is deployed over multiple nodes with two kinds of functions: local anomaly detection and collaborative victim identification. The anomaly detection method is performed locally and is lightweight to save computation by measuring passing packets in a sketch. The collaborative victim identification is triggered only when a local anomaly is detected by employing our distinctive elimination mechanism. The mechanism can significantly reduce the number of packets to be processed by each node, making our system scalable for high-speed network links. We evaluate the performance of VicSifter by using real-world data traffic, mixing the real DDoS attack traces with captured campus gateway traffic. The results show that our system has high accuracy in the early detection of DDoS attacks and timely identification of targeted victims. Our system can outperform other existing methods with less space requirement, and thus achieving good system scalability.

Reputation-based trust systems provide important capability in open and service-oriented computing environments. Most existing trust models fail to assess the variance of a reputation prediction. Moreover, the summation method, widely used for reputation feedback aggregation, is vulnerable to malicious feedbacks. This paper presents a general trust model, called RLM, for a more comprehensive and robust reputation evaluation. Concretely, we define a comprehensive reputation evaluation method based on two attributes: reputation value and reputation prediction variance. The reputation predication variance serves as a quality measure of the reputation value computed based on aggregation of feedbacks. For feedback aggregation, we propose the novel Kalman aggregation method, which can inherently support robust trust evaluation. To defend against malicious and coordinated feedbacks, we design the Expectation Maximization algorithm to autonomously mitigate the influence of a malicious feedback, and further apply the hypothesis test method to resist malicious feedbacks precisely. Through theoretical analysis, we demonstrate the robustness of the RLM design against adulating and defaming attacks, two popular types of feedback attacks. Our experiments show that the RLM model can effectively capture the reputation's evolution and outperform the popular summation-based trust models in terms of both accuracy and attack resilience. Concretely, under the attack of collusive malicious feedbacks, RLM offers higher robustness for the reputation prediction and a lower false positive rate for the malicious feedback detection.

Nowadays, web servers are suffering from flash crowds and application layer DDoS attacks that can severely degrade the availability of services. It is difficult to prevent them because they comply with the communication protocol. Peer-to-peer (P2P) networks have been exploited to amplify DDoS attacks, but we believe their available resource, such as distributed storage and network bandwidth, can be used to mitigate both flash crowds and DDoS attacks. In this paper, we propose a server initiated approach to employ deployed P2P networks as distributed web caches, so that the workload directed to web servers can be reduced. In experiments, we use Kad as the particular P2P network for the realization of a large-scale distributed web cache. We performed comprehensive evaluation on the feasibility, efficiency and robustness of our scheme, through experiments and simulations on the prototype we implemented. The evaluation results show that our scheme can increase the capacity of the protected web servers at least 10 times at the same cost of connection and bandwidth consumption. The web contents cached in Kad remain reachable even under churn of peers and targeted DoS attack, and the access latency is comparable to normal direct access to web servers. It also achieves good load balancing under the heavy-tailed distribution of object popularity.

For an application in public-resource computing environments, providing reliable scheduling based on resource reliability evaluation is becoming increasingly important. Most existing reputation models used for reliability evaluation ignore the time influence. And very few works use a robust genetic algorithm to optimize both time and reliability for a workflow application. Hence, in this paper, we propose the reliability-driven (RD) reputation, which is time dependent and can be used to evaluate a taskpsilas reliability directly using the exponential failure model. Based on the RD reputation, we also propose knowledge-based genetic algorithm (KBGA) to optimize both time and reliability for a workflow application. KBGA uses heuristics to accelerate the evolution process without giving invalid solutions. Our experiments show that the RD reputation can improve the reliability of a workflow application with more accurate reputation, while the KBGA can evolve to better scheduling solutions more quickly than traditional genetic algorithms.

To optimize makespan and reliability for workflow applications, most existing works use list heuristics rather than genetic algorithms (GAs) which can usually give better solutions. In addition, most existing GAs evolve a scheduling solution randomly, which may give invalid solutions or lead to slow convergence of the algorithm. In this paper, we define three heuristics for GAs to decide the priorities for a resource and a task dynamically. We propose look-ahead genetic algorithm (LAGA) to optimize both makespan and reliability for workflow applications. It uses a novel evolution and evaluation mechanism: the genetic operators evolve the task-resource mapping for a scheduling solution, while the solutionpsilas task order is determined in the evaluation step using our new max-min strategy, which is specifically proposed for GAs. Our experiments show that LAGA can provide better solutions than existing list heuristics and evolve to better solutions more quickly than a traditional genetic algorithm.