Federated learning, as a distributed machine learning framework, enables participants to collaboratively train models by uploading only local gradients instead of exchanging local data. However, the malicious server might infer the participants' private data from the uploaded gradients or return incorrect aggregated results to participants. To tackle the above issues, numerous privacy-preserving and verifiable federated learning schemes have been developed. However, only a few of these schemes address collusion-resistant verification, and none considers the potential disputes between participants and server. In this paper, we put forward a privacy-preserving federated learning scheme with collusion-resistant verification and fair arbitration (PFLVA). In PFLVA, a novel verification method is designed, in which non-colluding participants can verify the correctness of aggregated gradient, even if up to$N-1$participants collude with the server, where$N$denotes the total number of online participants. We propose an efficient gradient encryption method to ensure participants' privacy while substantially reducing the computational overhead. We introduce a smart contract to locate the compromised entity when disputes arise and to achieve fair arbitration. Additionally, PFLVA allows participants to go offline without incurring additional computational or communication overheads for the online participants. We provide a comprehensive security analysis to demonstrate the correctness, verifiability, privacy protection, and collusion resistance of PFLVA. Experimental results demonstrate that PFLVA maintains high model accuracy while significantly reducing the computational and communication overhead for participants compared to related schemes.

In the Segment Routing over IPv6 (SRv6) network, a wide range of network events (e.g., attacks, intrusions, violations, malicious route announcements) may occur. Network management requires real-time monitoring of untrusted and unreliable environments (e.g., unsafe components and devices). Early localization of abnormal links causing violations in the SRv6 network helps minimize the compensation required for service unavailability. However, the overhead of the state-of-the-art methods does not scale efficiently to large-scale SRv6 networks and exhibit poor robustness to addressing various disturbances from unreliable networks. To cope with these challenges, we propose Glint, an in-band network telemetry framework to localize abnormal links in SRv6 networks. The key idea of Glint is sampling part of the information while the overall information is known. Glint provides probabilistic in-band collection to gather segment-level telemetry data, reducing overhead and improving efficiency. Glint also proposes distributed verification-based detection to enhance the trustworthiness of security assessments, further improving robustness against disturbances. In addition, we design selective telemetry that reduces telemetry reports while preserving security-relevant visibility. Our evaluations demonstrate that, compared to the state-of-the-art frameworks, Glint significantly reduces header bandwidth overhead by 75.6% and memory overhead by 48.7% while reducing false positives. We also implement Glint on the Intel Tofino switch, achieving over a 50% reduction in hardware resource consumption compared to existing methods.

The swift growth of e-commerce has led to an increase in fraudulent activities, which results in significant financial losses for both suppliers and consumers. Current research on detecting fraudulent activities within e-commerce platforms primarily focuses on analyzing individual user behavioral patterns over time or examining the spatial relationships among users. However, considering temporal or spatial contexts alone is not sufficient for fraud detection since they may not exist in real scenarios. Additionally, the issue caused by the imbalance of the data to be classified has not been solved in the field of fraud identification. To address these challenges, a novel scheme is proposed for fraudulent user detection in this work. The main contribution lies in the spatiotemporal fusion of user behavior and the layer-by-layer selective aggregation of graph models. Specifically, we utilize a long short-term memory model and a multi-layer perceptron model to extract the discriminant features from time-dependent and time-independent user behavior, respectively. This approach enhances the model’s ability to detect fraudulent users with different behavioral characteristics, including time-correlated and/or time-independent fraud behavior. Furthermore, a shared classifier is added to general graph neural network, it reclassifies the output of each layer of the graph model and reconstructs the spatial neighbor relationship. This little trick makes minority class samples select similar samples with a greater probability to build their spatial neighbor relationships, which can alleviate the issue of data imbalance. In the numerical experiments, three real datasets are used to validate the proposed scheme. Experiment results, including performance evaluation, comparison with existing benchmark approaches and ablation analysis, are presented and discussed.

Graph matching, as an important query technology, has been widely applied in various fields. With the increasing of graph data, users choose to encrypt a large number of graphs and store them in the cloud. Existing solutions to graph matching query over encrypted graphs require the user to execute a lot of time-consuming subgraph isomorphism (NP-complete problem) operations to extract the matched graphs, which inevitably brings heavy computational burden to the user. Therefore, how to reduce the number of subgraph isomorphisms is crucial for releasing the user from the heavy workload in a graph matching query scheme over encrypted graphs. In this paper, we propose a secure and efficient scheme for graph matching query over encrypted graphs. The main idea is to classify the query graph into frequent subgraph and infrequent subgraph, and adopt different strategies to perform the matching query. We design the novel secure index based on the frequent subgraphs and the edge labels to reduce the number of subgraph isomorphisms. When the query graph is a frequent subgraph, the proposed scheme can directly produce the exact result owing to this secure index. The user does not need to perform any subgraph isomorphism in this case. When the query graph is an infrequent subgraph, the proposed scheme can return a set of data graphs very close to the exact result. As a result, the proposed scheme reduces the number of subgraph isomorphisms substantially. Formal security proof is provided. Extensive experiments on real-world data sets show that the proposed scheme reduces nearly 90% subgraph isomorphism.

For security enhancement and privacy preservation, homomorphic encryption is deployed to facilitate computations among cipher texts. To transmit extra data over a cipher text without affecting its usage, lossless data hiding in encrypted domain (LDH-CT) has been developed by exploiting randomness introduced in homomorphic encryption such as Paillier, BGN and NTRU schemes. As data extraction without decrypting the cipher text has been accomplished with BGN, how to retrieve the hidden data after decryption remains unexplored. In this article, an LDH-CT scheme named random number replacement and partitioning (RNRP) is proposed to achieve the versatility of data embedding by designing two algorithms, namely the random number replacement algorithm to embed data to be extracted after decryption and the cipher value selection algorithm to embed data to be extracted without decryption. For the first time, confidential information to be extracted after decryption can be hidden into a cipher text by a third party without knowing its plain text. For convenience in performance evaluation, the proposed algorithms and the RNRP scheme are applied to a set of test images. Experimental results and comparisons with the state-of-the-art schemes demonstrate the better applicability of the proposed scheme, such as in saving bandwidth.

The adoption of symmetric searchable encryption (SSE) has become increasingly common. However, many current SSE schemes assume an honest-but-curious cloud service provider (CSP) or necessitate significant overhead to manage a malicious CSP. Furthermore, most of these schemes are tailored for static datasets. Our paper presents an efficient SSE scheme that aims to address these challenges. To the best of our knowledge, this is the first scheme that supports dynamic datasets with forward and backward privacy, integrity verification of non-empty and empty search results, efficient search, non-interactive, light client, and both forward and inverted indexes simultaneously. In this paper, we present two novel approaches, Hexie and Jianding. Hexie implements secret sharing to conceal index entries, enabling dynamic updates, non-interactive interactions, and lightweight clients. To enhance the reliability of search results and address the problem of empty, incomplete, or inaccurate outcomes, we introduce the Jianding scheme as an extension of Hexie. It combines a chained MAC structure with a secret sharing scheme, which enables a client to verify the data integrity of the search result efficiently. Moreover, we propose graph-based dictionary sharding to enhance search efficiency. Finally, we conduct comprehensive experiments to validate the effectiveness of the proposed schemes.

Community search on attributed graphs has gained significant attention in recent years for its ability to provide meaningful and personalized results. Given a query community, a similar community search aims to identify the communities that are similar in structural and attributed characteristics to the query community. As real-world networks continue to grow in complexity and size, outsourcing graph data and search tasks to cloud servers not only saves local storage space but also significantly enhances search efficiency. Nonetheless, this inevitably raises concerns about data privacy since cloud servers are not completely trustworthy. In this paper, we research on privacy-preserving similar community search on graphs. We propose a privacy-preserving closest similar community search scheme for attributed graphs that leverages cloud servers to enhance search efficiency while safeguarding the sensitive information in the graph. We consider packaging communities using center vertices to evaluate relationships across communities without accessing details within the communities. To achieve this, we design a centrality score function that integrates attribute contribution and closeness centrality to identify the center vertex of a community. To ensure the security of sensitive information in the attribute graph, we construct three secure indexes for the original graph utilizing diverse cryptographic primitives. By searching secure indexes, cloud servers can answer the closest similar community searches without possessing any sensitive information about the attribute graph. We employ Paillier homomorphic cryptosystem and related protocols to support efficient and secure evaluation of the distance and similarity between two communities on secure indexes. The security analysis confirms that the proposed scheme can be against adaptive chosen-query attacks so as to achieve CQA2-security and experimental results demonstrate the efficiency of the proposed scheme.

Wireless Power Transfer (WPT) is a disruptive technology that allows wireless energy provisioning for energy-limited IoT devices, thus decreasing the over-reliance on batteries and wires. WPT could replace conventional energy provisioning (e.g., energy harvesting) and expand to be deployed in many of our daily-life applications, including but not limited to healthcare, transportation, automation, and smart cities. As a new rising technology, WPT has attracted many researchers from academia and industry about WPT technologies and wireless charging scheduling algorithms. Therefore, in this paper, we review the most recent studies related to WPT, including classifications, advantages, disadvantages, and main domains of application. Furthermore, we review the recently designed wireless charging scheduling algorithms (schemes) for wireless sensor networks. Our study provides a detailed survey of wireless charging scheduling schemes covering the main scheme classifications, evaluation metrics, application domains, advantages, and disadvantages of each charging scheme. We further summarize trends and opportunities for applying WPT at some intersections.

The Microgrid allows for more efficient and lower-cost power provisions, and is therefore more flexible than traditional power ecosystems. However, the increasingly integrated nature of these systems into network and internet-connected IT systems also potentially makes them susceptible to cyber-attack. This paper examined different challenges related to the cyber attacks threatening wireless microgrid systems from the experimental view. Wireless communication and transmission methods are widely used for secondary control of energy re-sources. However, there are risks of cyber attacks during the communication process, such as Denial-of-Service (DoS) attacks. This paper reports the investigation of potential cyber attacks on wireless communications of microgrid systems. Furthermore, this paper evaluates the practical impacts of cybersecurity breaches targeting microgrid systems, with special attention to those in Australia. In brief, the main goal of this paper is to enhance the mitigation countermeasures for cyber attacks linked to wireless microgrid systems, thus guaranteeing reliable wireless communications within these systems.

The space-air-ground integrated network (SAGIN) has a stringent demand on the efficiency of authentication protocols deployed in the devices that have been launched into the air and space. In this paper, we define the concept of the security model of conditional physical unclonable function (CPUF) that guarantees the security of the protocol while allowing the use of PUFs that can be modeled. We then propose a CPUF-based authentication and key agreement (AKA) scheme, named CPAKA, that addresses the challenges of device key leakage and inefficient authentication in resource-asymmetric environments. The CPAKA scheme embeds PUFs in weak nodes and deploys prediction models corresponding to the PUFs in strong nodes, eliminating the need to store challenge-response pairs or perform complex calculations. We formally prove the protocol's security under the decisional uniqueness assumption of CPUF and the universal composability framework, and we analyze its secrecy and authentication properties using the Tamarin prover. We also implement an Arbiter PUF on the ZYNQ-7020 FPGA, verify its accuracy through experiments, and show that CPAKA is secure, efficient, and suitable for SAGIN. Our CPAKA scheme greatly reduces computing and storage costs while improving authentication efficiency compared to traditional schemes.

With the property of helping users further enhance the anonymity of transactions, mixing services in blockchain have gained wide popularity in recent years. However, the strong untraceability offered by mixing services has led to the abuse of them by criminals for money laundering and committing fraud. These illegal actions pose significant threats to the blockchain ecosystem and financial order. In this paper, we focus on the problem of correlating the addresses of mixing transactions in Tornado Cash, a widely-used mixing service on Ethereum. We propose a graph neural network framework named MixBroker, which aims to break the anonymity of Tornado Cash by correlate mixing addresses from the perspective of node-pair link prediction. Specifically, we construct a Mixing Interaction Graph (MIG) using raw Ethereum mixing transaction data that can be used for subsequent analysis. To better represent the properties of mixing account nodes, we extract features from account nodes in the MIG from multiple perspectives. Furthermore, we design a GNN-based link prediction mechanism to serve as the backbone of MixBroker. This mechanism captures the interconnected nature of nodes within the MIG and calculates the probability of correlation between account nodes through node embeddings. In addition, to solve the problem of lacking ground-truth, we collect a large number of real mixing transactions of Ethereum in Tornado Cash and construct a ground-truth dataset by combining the principles of Ethereum Name Service (ENS). We conduct extensive experiments on the datasets, and the results demonstrate that MixBroker has a superior performance over other state-of-the-art methods on the address correlation problem in Ethereum mixing transactions.

Network managers configure networks to enforce various high-level policies, and to respond to the wide range of network events (e.g., attacks, intrusions, malicious route announcements from neighbors) that may occur. It is incredibly difficult to specify these high-level policies in terms of distributed low-level configuration. These high-level policies hold only if the distributed configurations are well equipped to react to unsafe and unreliable environments (e.g., malicious route announcements, unsafe components and devices). Therefore, it is important to proactively verify whether network policies hold across continually changing environments in terms of current network configurations. State-of-the-art policy verification techniques are limited because they can check only the Boolean policies (e.g., forwarding reachability, waypoint or blackhole-freeness). However, many policy violations express themselves in quantitative ways (e.g., a link becomes overloaded). In this paper, we propose quantitative network verification (QNV) analyzing the quantitative policies of networks across unsafe and unreliable environments. QNV translates network configurations into a symbolic simulation model that captures the stable states to which the network forwarding will converge as a result of interactions between routing protocols. It then generates a logical formula matrix that describes network forwarding in the event of failures and verifies quantitative policies based on the formula matrix. We implement QNV and evaluate it on realistic and synthetic configurations. Our evaluation shows that QNV can precisely verify quantitative policies in only a few minutes, even in large networks.

The minimum community search is used to identify a minimum dense community that includes a specified vertex in a large network. It has gained significant attention because of its various applications in social-network analysis, e-commerce transactions, biological network modeling, and other areas. Nevertheless, how to realize privacy-preserving minimum community search remains unexplored up to now. In this paper, we initiate the first research on privacy-preserving approximate minimum community search. We propose an effective scheme that allows cloud servers to identify the smallest possible community while safeguarding the private information of the network. To ensure the privacy of sensitive information in the network, we employ obfuscation technology and graph encryption technology to construct two secure indexes instead of the original graph. To strike a balance between safeguarding private information and maintaining search efficiency, our scheme incorporates Bloom filters into the index and implements a two-step strategy on the secure indexes to achieve privacy-preserving approximate minimum community searches. Furthermore, to secure the privacy of the search result, we carefully design an array comparison protocol based on the BGN cryptosystem. This protocol enables cloud servers to perform privacy-preserving heuristic searches from the initial community without exposing any details about the approximate minimum community. The security analysis confirms that our scheme achieves CQA2-security for two non-colluding cloud servers. The experimental results based on real social networks show that the proposed scheme can efficiently handle approximate minimum community searches on large networks.

Existing fuzzy extractor and similar methods provide an effective way for extracting a secret key from a user’s biometric data, but are susceptible to impersonation attack: once a valid biometric sample is captured, the scheme is no longer secure. We propose a novel multi-factor fuzzy extractor that integrates both a user’s secret (e.g., a password) and a user’s biometrics in the generation and reconstruction process of a cryptographic key. We then employ this multi-factor fuzzy extractor to construct personal identity credentials, which can be used in a new multi-factor authenticated key exchange protocol that possesses multiple important features. First, the protocol provides mutual authentication. Second, the user and service provider can authenticate each other without the involvement of the identity authority. Third, the protocol can prevent user impersonation from a compromised identity authority. Finally, even when both a biometric sample and the secret are captured, the user can re-register to create a new credential using a new secret (renewable biometrics-based identity credentials). Most existing works on multi-factor authenticated key exchange only have a subset of these features. We formally prove that the proposed protocol is semantically secure. Our experiments carried out on the finger vein dataset SDUMLA achieved a low equal error rate (EER) of 0.04%, a reasonable computation time of 0.93 seconds for the user and service provider to authenticate and establish a shared session key, and a small communication overhead of 448 bytes.

EEG-based biometric systems verify the identity of a user by comparing the probe to a reference EEG template of the claimed user enrolled in the system, or by classifying the probe against a user verification model stored in the system. These approaches are often referred to as template-based and model-based methods, respectively. Compared with template-based methods, model-based methods, especially those based on deep learning models, tend to provide enhanced performance and more flexible applications. However, there is no public research report on the security and cancellability issue for model-based approaches. This becomes a critical issue considering the growing popularity of deep learning in EEG biometric applications. In this study, we investigate the security issue of deep learning model-based EEG biometric systems, and demonstrate that model inversion attacks post a threat for such model-based systems. That is to say, an adversary can produce synthetic data based on the output and parameters of the user verification model to gain unauthorized access by the system. We propose a cancellable deep learning framework to defend against such attacks and protect system security. The framework utilizes a generative adversarial network to approximate a non-invertible transformation whose parameters can be changed to produce different data distributions. A user verification model is then trained using output generated from the generator model, while information about the transformation is discarded. The proposed framework is able to revoke compromised models to defend against hill climbing attacks and model inversion attacks. Evaluation results show that the proposed method, while being cancellable, achieves better verification performance than the template-based methods and state-of-the-art non-cancellable deep learning methods.

Lossless data hiding in ciphertexts (LDH-CT) is to perform data embedding without changing their plaintexts, which can be used to transmit extra data in the applications of homomorphic encryption at little cost. In this paper, two LDH-CT algorithms named Polynomial Encoding (PE) and Polynomial Modulation (PM) are proposed for the “N-th Degree Truncated Polynomial Ring Unit” (NTRU) scheme, respectively. In the PE algorithm, a polynomial is encoded according to a string of bit values and further used to encrypt a plain-text polynomial. After decrypting the ciphertext, the encoded polynomial can be retrieved so that dozens of bit values can be extracted from it. Moreover, the PE algorithm can be combined with a polynomial partitioning strategy to achieve data extraction before decryption as well. In applying the PM algorithm, no parameter setting of an NTRU cryptosystem is changed while a cipher-text polynomial is generated by selectively sampling a polynomial to match the to-be-hidden value. Furthermore, the data hidden with the PM algorithm can be pre-chosen to be extracted without decryption or after decryption, and in each case up to 10 bit values can be hidden into one cipher-text polynomial. The proposed algorithms and schemes are implemented and compared with several schemes developed for NTRU, BGN, LWE and Paillier encryption. Experimental results and performance evaluations demonstrate the efficacy and superiority of the proposed algorithms and schemes.

Cloud service models intrinsically cater to multiple tenants. In current multi-tenancy model, cloud service providers isolate data within a single tenant boundary with no or minimum cross-tenant interaction. With the booming of cloud applications, allowing a user to search across tenants is crucial to utilize stored data more effectively. However, conducting such a search operation is inherently risky, primarily due to privacy concerns. Moreover, existing schemes typically focus on a single tenant and are not well suited to extend support to a multi-tenancy cloud, where each tenant operates independently. In this article, to address the above issue, we provide a privacy-preserving, verifiable, accountable, and parallelizable solution for “privacy-preserving keyword search problem" among multiple independent data owners. We consider a scenario in which each tenant is a data owner and a user’s goal is to efficiently search for granted documents that contain the target keyword among all the data owners. We first propose a verifiable yet accountable keyword searchable encryption (VAKSE) scheme through symmetric bilinear mapping. For verifiability, a message authentication code (MAC) is computed for each associated piece of data. To maintain a consistent size of MAC, the computed MACs undergo an exclusive OR operation. For accountability, we propose a keyword-based accountable token mechanism where the client’s identity is seamlessly embedded without compromising privacy. Furthermore, we introduce the parallel VAKSE scheme, in which the inverted index is partitioned into small segments and all of them can be processed synchronously. We also conduct formal security analysis and comprehensive experiments to demonstrate the data privacy preservation and efficiency of the proposed schemes, respectively.

This paper proposes a novel uncertainty-adjusted label transition (UALT) method for weakly supervised solar panel mapping (WS-SPM) in aerial Images. In weakly supervised learning (WSL), the noisy nature of pseudo labels (PLs) often leads to poor model performance. To address this problem, we formulate the task as a label-noise learning problem and build a statistically consistent mapping model by estimating the instance-dependent transition matrix (IDTM). We propose to estimate the IDTM with a parameterized label transition network describing the relationship between the latent clean labels and noisy PLs. A trace regularizer is employed to impose constraints on the form of IDTM for its stability. To further reduce the estimation difficulty of IDTM, we incorporate uncertainty estimation to first improve the accuracy of noisy dataset distillation and then mitigate the negative impacts of falsely distilled examples with an uncertainty-adjusted re-weighting strategy. Extensive experiments and ablation studies on two challenging aerial data sets support the validity of the proposed UALT.

With the continuous advancement of edge intelligence, edge servers undertake more and more intelligent computing tasks. Nowadays, there are a large number of IoT devices in the network in idle state. For instance, the mining process for consensus of miners in blockchain such as Bitcoin causes a waste of computing resources and energy. A natural question arises: can we couple the idle computing resources of network devices to continuously and credibly share the burden of edge intelligent computing tasks in a secure manner? The answer of this paper is yes. We propose a blockchain-based IoT resource monitoring and scheduling framework that supports resource management and trusted edge computing. We analyze the security threats in all phases of distributed edge computing, and utilize the trusted computing and public verifiability features of blockchain to ensure reliability and fairness in the trusted measurement of device computing power, the decomposition of intelligent computing tasks, the matching of task and computing power, and the verification of computing result. Finally, we implement a simulation on the edge network by performing distributed machine learning task for weather prediction, and the simulation results demonstrate the availability of our scheme.

Wearable devices-based biometrics has become mainstream in the biometric domain, especially in mobile computing, due to its convenience, flexibility, and potentially high user acceptance. Among various modalities, wearable devices-based gait recognition has been recognized as an effective user authentication method and employed in various applications, such as automated entry systems for home, school, work, vehicles, and automated ticket payment/validation for public transport. However, how secure wearable gait remains an open research question. In this study, we conduct a comprehensive security analysis of the wearable gait. Then, we demonstrate that gait itself is not robust against some attacking methods, such as spoofing or forgery. Therefore, we argue that an anti-spoofing mechanism is important for enhancing the security of wearable gait biometric systems. To this end, we proposed a novel authentication protocol called$Pistis$that embedded gait biometrics and a liveness detection mechanism that is aiming to detect various attacks of gait authentication systems. Our extensive experiments based on 50 subjects demonstrate that$Pistis$is effective in liveness detection and authentication performance enhancement, providing 100% accuracy for human and nonhuman detection, and 99.53% accuracy for user authentication. Pistis can be used as a liveness detection method for wearable devices-based biometrics, significantly for wearable gait.

Fingerprint authentication techniques have been employed in various Internet of Things (IoT) applications for access control to protect private data, but raw fingerprint template leakage in unprotected IoT applications may render the authentication system insecure. Cancelable fingerprint templates can effectively prevent privacy breaches and provide strong protection to the original templates. However, to suit resource-constrained IoT devices, oversimplified templates would compromise authentication performance significantly. In addition, the length of existing cancelable fingerprint templates is usually fixed, making them difficult to be deployed in various memory-limited IoT devices. To address these issues, we propose a novel length-flexible lightweight cancelable fingerprint template for privacy-preserving authentication systems in various resource-constrained IoT applications. The proposed cancelable template design primarily consists of two components: 1) length-flexible partial-cancelable feature generation based on the designed reindexing scheme and 2) lightweight cancelable feature generation based on the designed encoding nested difference XOR scheme. Comprehensive experimental results on public databases FVC2002 DB1–DB4 and FVC2004 DB1–DB4 demonstrate that the proposed cancelable fingerprint template achieves equivalent authentication performance to state-of-the-art methods in IoT environments, but our design substantially reduces template storage space and computational cost. More importantly, the proposed length-flexible lightweight cancelable template is suitable for a variety of commercial smart cards (e.g., C5-M.O.S.T. Card Contact Microprocessor Smart Cards CLXSU064KC5). To the best of our knowledge, the proposed method is the first length-flexible lightweight, high-performing cancelable fingerprint template design for resource-constrained IoT applications.

Latent fingerprint enhancement is an essential preprocessing step for latent fingerprint identification. Most latent fingerprint enhancement methods try to restore corrupted gray ridges/valleys. In this paper, we propose a new method that formulates latent fingerprint enhancement as a constrained fingerprint generation problem within a generative adversarial network (GAN) framework. We name the proposed network FingerGAN. It can enforce its generated fingerprint (i.e, enhanced latent fingerprint) indistinguishable from the corresponding ground truth instance in terms of the fingerprint skeleton map weighted by minutia locations and the orientation field regularized by the FOMFE model. Because minutia is the primary feature for fingerprint recognition and minutia can be retrieved directly from the fingerprint skeleton map, we offer a holistic framework that can perform latent fingerprint enhancement in the context of directly optimizing minutia information. This will help improve latent fingerprint identification performance significantly. Experimental results on two public latent fingerprint databases demonstrate that our method outperforms the state of the arts significantly. The codes will be available for non-commercial purposes from https://github.com/HubYZ/LatentEnhancement.

Reversible data hiding in ciphertext has potential applications for privacy protection and transmitting extra data in a cloud environment. For instance, an original plain-text image can be recovered from the encrypted image generated after data embedding, while the embedded data can be extracted before or after decryption. However, homomorphic processing can hardly be applied to an encrypted image with hidden data to generate the desired image. This is partly due to that the image content may be changed by preprocessing or/and data embedding. Even if the corresponding plain-text pixel values are kept unchanged by lossless data hiding, the hidden data will be destroyed by outer processing. To address this issue, a lossless data hiding method called random element substitution (RES) is proposed for the Paillier cryptosystem by substituting the to-be-hidden bits for the random element of a cipher value. Moreover, the RES method is combined with another preprocessing-free algorithm to generate two schemes for lossless data hiding in encrypted images. With either scheme, a processed image will be obtained after the encrypted image undergoes processing in the homomorphic encrypted domain. Besides retrieving a part of the hidden data without image decryption, the data hidden with the RES method can be extracted after decryption, even after some processing has been conducted on encrypted images. The experimental results show the efficacy and superior performance of the proposed schemes.

Identifying the nature of data flows can help improve network service and security. Most existing solutions usually simplify the traffic classification to protocol and application identification based on some uniqueness assumptions. However, in the real world these assumptions aren’t always reasonable due to the abuse of multiplexing techniques. In this work, a new scheme is proposed from a different perspective that aims to directly identify the content inside a data flow without considering the external protocols and applications. We use wavelet to obtain the time-scale signals of each data flow and develop a new hidden Markov tree (HMT) with an embedding deep neural network (DNN) to model these signals. Each hidden state of the HMT represents a specific signal generation pattern. Transition of hidden states describes the time-scale context of the signal patterns. DNN is used to describe the probabilistic relationship between the implicit patterns and the observed time-scale signals. We derive new algorithms for the model and create an instance for each type of traffic, which projects the data flows into a multi-dimensional decision space and achieves their content identification through a classifier. Numerical experiments using real datasets are presented to validate the proposed scheme. Performance-related issues and comparisons with related works are discussed.

The key exposure is a serious threat for the security of data integrity auditing. Once the user's private key for auditing is exposed, most of the existing data integrity auditing schemes would inevitably become unable to work. To deal with this problem, we construct a novel and efficient identity-based data integrity auditing scheme with key-exposure resilience for cloud storage. This is achieved by designing a novel key update technique, which is fully compatible with BLS signature used in identity-based data integrity auditing. In our design, the Third Party Auditor (TPA) is responsible for generating update information. The user can update his private key based on the private key in one previous time period and the update information from the TPA. Furthermore, the proposed scheme supports real lazy update, which greatly improves the efficiency and the feasibility of key update. Meanwhile, the proposed scheme relies on identity-based cryptography, which makes certificate management easy. The security proof and the performance analysis demonstrate that the proposed scheme achieves desirable security and efficiency.

With the appearance of electric energy market deregulation, there exists a growing concern over the potential privacy leakage of commercial data among competing power companies where data sharing is essential in the applications such as smart grid state estimation. Most of the existing solutions are either perturbation-based or conventional cryptography-based where a trusted central 3rd party would often be required. This paper proposes privacy-preserving state estimation protocols for DC and AC models. The proposed idea is to distribute the overall task of the system state estimation into sub-tasks which can be performed by local sub-grid operators with their private data. A masking method is designed inside a homomorphic encryption scheme which is then used to ensure both the input and output data privacy during the collaboration process among individual sub-task players. Security is achieved via the computationally indistinguishable post-quantum security guaranteed by a levelled homomorphic encryption scheme over real numbers and the differential privacy of the output estimated states provided by the Laplace mechanism perturbation integrated into the masking linear transformation. Simulation results are presented to demonstrate the validity of our proposed privacy-preserving system state estimation protocols.

Recent findings confirm that biometric templates derived from electroencephalography (EEG) signals contain sensitive information about registered users, such as age, gender, cognitive ability, mental status and health information. Existing privacy-preserving methods such as hash function and fuzzy commitment are not cancelable, where raw biometric features are vulnerable to hill-climbing attacks. To address this issue, we propose the PolyCosGraph, a system based onPolynomial transformation embeddingCosine functions withGraphfeatures of EEG signals, which is a privacy-preserving and cancelable template design that protects EEG features and system security against multiple attacks. In addition, a template corrupting process is designed to further enhance the security of the system, and a corresponding matching algorithm is developed. Even when the transformed template is compromised, attackers cannot retrieve raw EEG features and the compromised template can be revoked. The proposed system achieves the authentication performance of 1.49% EER with a resting state protocol, 0.68% EER with a motor imagery task, and 0.46% EER under a watching movie condition, which is equivalent to that in the non-encrypted domain. Security analysis demonstrates that our system is resistant to attacks via record multiplicity, preimage attacks, hill-climbing attacks, second attacks and brute force attacks.

Federated Learning is a prominent machine learning paradigm which helps tackle data privacy issues by allowing clients to store their raw data locally and transfer only their local model parameters to an aggregator server to collaboratively train a shared global model. However, federated learning is vulnerable to inference attacks from dishonest aggregators who can infer information about clients’ training data from their model parameters. To deal with this issue, most of the proposed schemes in literature either require a non-colluded server setting, a trusted third-party to compute master secret keys or a secure multiparty computation protocol which is still inefficient over multiple iterations of computing an aggregation model. In this work, we propose an efficient cross-silo federated learning scheme with strong privacy preservation. By designing a double-layer encryption scheme which has no requirement to compute discrete logarithm, utilizing secret sharing only at the establishment phase and in the iterations when parties rejoin, and accelerating the computation performance via parallel computing, we achieve an efficient privacy-preserving federated learning protocol, which also allows clients to dropout and rejoin during the training process. The proposed scheme is demonstrated theoretically and empirically to provide provable privacy against an honest-but-curious aggregator server and simultaneously achieve desirable model utilities. The scheme is applied to false data injection attack detection (FDIA) in smart grids. This is a more secure cross-silo FDIA federated learning resilient to the local private data inference attacks than the existing works.

Software Defined Network (SDN) has been widely used in modern network architecture. The SD-WAN is considered as a technology that has a potential to revolutionize the WAN service usage by utilizing the SDN philosophy. Attacking SDN router and controller can affect the network and block the entire services. In this paper, we propose a machine learning based anomalous traffic detection framework named OADSD over SD-WAN that can achieve task independent and has the ability of adapting to the environment. The OADSD adopts Distributed Dynamic Feature Extraction (DDFE) to extract representative features directly from the raw traffic, and proposes the On-demand Evolving Isolation Forest (OEIF) to make the system adapt to an environment. We provide a theoretical analysis of the performance of the OADSD. We also conduct comprehensive experiments to evaluate the performance of the OADSD with real world public datasets as well as a small real testbed. Our experiments under real world public datasets show that, the OADSD can accurately detect various kinds of attacks with a high performance. Compared with the state-of-the-art systems, the OADSD can achieve up to 60% accuracy improvement.

Weakly supervised solar panel mapping has shown its advantages in automatically detecting solar panels from remote sensing images with low annotation costs. Considering the noisy nature of pseudo labels (PLs), which are frequently employed in weakly supervised methods, we propose to introduce uncertainty measure to guide the estimation of noise levels in PLs and develop a novel method based on uncertainty-aware label transition (UALT). The proposed method consists of three parts: uncertainty estimation network, uncertainty-aware label transition network, and target mapping network with forward correction. We first generate heteroscedastic uncertainty by learning an estimator under Bayes formalism. Then, with the uncertainty as guidance, a label transition network is trained to learn the mapping between clean labels, and Bayes optimal labels and predict the instance-dependent transition matrix. Finally, the transition matrix is employed in the forward correction process, where the target mapping network produces clean predictions for solar panels. Comparative experiments with six state-of-the-art weakly supervised methods on an aerial image data set show the superiority of the proposed UALT, especially in mapping accuracy and dis-covering small-scale objects.

Previous works on expressive speech synthesis focus on modelling the mono-scale style embedding from the current sentence or context, but the multi-scale nature of speaking style in human speech is neglected.In this paper, we propose a multiscale speaking style modelling method to capture and predict multi-scale speaking style for improving the naturalness and expressiveness of synthetic speech.A multi-scale extractor is proposed to extract speaking style embeddings at three different levels from the ground-truth speech, and explicitly guide the training of a multi-scale style predictor based on hierarchical context information.Both objective and subjective evaluations on a Mandarin audiobooks dataset demonstrate that our proposed method can significantly improve the naturalness and expressiveness of the synthesized speech 1 .

As the human hand makes direct physical contact with smartphones, significant efforts have recently been made to study the behavioral information of hand gripping of smartphones for user authentication purposes. Most existing methods leverage hand gripping behavior (e.g., gripping gesture, gripping position, gripping strength) of smartphones as biometrics to identify users. However, behavioral-based biometric authentication approaches may suffer from two problems: authentication performance (accuracy) degradation due to high-intra class variations arising from changes in user behavior over time, and vulnerability under spoofing attacks. To address these issues, we propose HoldPass, which is a behavior-independent in-hand user authentication method using vibration. HoldPass is able to adapt to the changes of hand gripping behavior of smartphones by extracting unique and stable physical features of human hands and eliminating the behavior-related prior information. Specifically, in HoldPass, we propose an adversarial neural network to achieve authentication based on unique physical features. Experiments with 10 users show that HoldPass can authenticate users with 97.39% accuracy while keeping False Accepted Rates (FAR) at a minimum of 2.1%.

Summary The evolution of the traditional power system toward the modern smart grid has posed many new cybersecurity challenges to this critical infrastructure. One of the most dangerous cybersecurity threats is the false data injection (FDI) attack, especially when it is capable of completely bypassing the widely deployed bad data detector of state estimation (SE) and interrupting the normal operation of the power system. Most of the simulated FDI attacks are designed using a simplified linearized DC model, while most of the industry‐standard SE systems are based on the nonlinear AC model. In this article, a comprehensive FDI attack scheme is presented based on the nonlinear AC model. A case study of the nine‐bus Western System Coordinated Council (WSCC)'s power system is provided, using an industry‐standard package to assess the outcomes of the proposed design scheme. A public FDI dataset is generated as a test set for the community to develop and evaluate new detection algorithms, which are lacking in the field. The FDI's stealthy quality of the dataset is assessed and proven through a preliminary analysis based on both physical power law and statistical analysis.

Smart electricity meters as a prominent instance of the Internet of Things (IoT) have driven more efficient energy services in smart grids but also created growing concerns of consumer privacy. Homomorphic encryption of consumption data is a conventional solution for privacy protection, but it incurs a high computational burden to the resource-restrained smart meters (SMs) due to the encryption of high-frequency consumption readings. Perturbation is another major approach in providing the privacy protection of SM readings which is highly efficient. However, most existing perturbation-based works inadequately balance the tradeoff between the need of hiding individual consumption profiles and the need of retaining utility’s quality. This article proposes a hybrid privacy-preserving electricity consumption data publishing scheme without a trusted third party which utilizes the desirable properties of both perturbation and cryptography for better privacy-utility tradeoff and efficiency. The proposed scheme for fine-grained SM consumption data consists of two phases, which are noise generation and noise distribution. In the first phase, a distributed perturbation method is designed to provide differential privacy protection for high-frequency consumption while retaining the accuracy of energy services like regional load forecasting. In the second phase, a private noise distribution protocol,$nn$-PND, securely distributes$n$noise elements generated by an energy distribution operator to$n$SMs in a semihonest adversarial model. Formal proofs of correctness and privacy of the scheme are provided. Experiments of regional short-term electricity consumption forecast using real-world data sets demonstrate the preservation of the utility over the masked data of this scheme.

In mobile crowdsensing (MCS), sensing data uploaded by dishonest workers may be false or even malicious. Thus, a reputation management system is often set up by using workers’ historical behaviors to indicate the quality of sensing data. As existing management schemes usually protect the reputation update process, reputation scores are generally stored in plaintext, which may destroy the fair bidding property of an MCS system. To address this issue, we propose an anonymous reputation management system based on the dual blockchain architecture, where reputation scores are masked. More precisely, one chain is used to store and update reputation scores, and another chain is responsible for publishing tasks and storing task-related data. To anonymously update and verify the reputation scores without affecting their usages in data sensing process, a kind of ring signature and Pedersen commitment is employed in smart contracts. In addition, a Schnorr signature is generated to make the reputation scores verifiable in the MCS system. We implement a prototype system on Hyperledger Fabric, and simulation results are provided for comparisons with two existing schemes.

Identity authentication has become an essential component for access control in the Internet of Things (IoT) environment. To overcome the inherent weakness of password-based authentication, many present IoT devices (e.g., commercial banking smart cards) are equipped with the fingerprint authentication mechanism. However, due to the resource constraints of IoT devices, oversimplified authentication schemes are deployed, which compromise system performance significantly. Moreover, fingerprint templates in these existing schemes are unprotected. To address these issues, we propose an IoT-oriented privacy-preserving fingerprint authentication system. The proposed system is composed of four main components: 1) minutiae extraction; 2) the minutia cylinder-code (MCC)-based cancelable binary template, generated by the proposed normalized random projection; 3) the lightweight, privacy-preserving template, built by novel pairwise Boolean operations; and 4) fingerprint matching. Our system can effectively mitigate preimage and hill-climbing attacks. A prototype of the proposed system is developed using a popular open-source platform (i.e., Open Virtual Platforms). Comprehensive experimental results on eight benchmark data sets validate the effectiveness of the proposed IoT-oriented fingerprint authentication system. Our system also achieves equivalent authentication accuracy to that of the unprotected fingerprint authentication systems deployed in the resource-rich, non-IoT environment. More importantly, our system prototype is deployable to commercially available low-cost smart cards, such as Atmel AT24C256C Memory Smart Card 256K Bits. To the best of our knowledge, the proposed system is the first privacy-preserving, cancelable fingerprint authentication system developed in such a resource-constrained IoT setting.

Solar panel mapping from high-resolution aerial images is becoming increasingly crucial to grid planning and operation, where weakly supervised approach has been explored. To cope with the noisy nature of pseudo-labels (PLs) generated by weakly supervised object localization, we propose an effective uncertainty-aware forward correction (UA-FC) method to learn clean predictions from the noisy PLs. The proposed method consists of two steps: heteroscedastic uncertainty estimation and forward correction procedure. The purpose of the first step is to produce uncertainty as an indicator for the instance-dependent noise. The second step includes a target mapping network to produce clean predictions and a transition function to model the relationship between clean predictions and noisy PLs. As estimating every probability of one class flipped into another is difficult and time-consuming, we introduce heteroscedastic uncertainty as a measurement and propose an uncertainty-based transformation function to map clean predictions into noisy ones. By minimizing the errors between the noisy predictions and noisy labels, the target mapping network is able to offer clean predictions close to the actual objects. Extensive experiments on an aerial dataset reveal that the proposed method outperforms other state-of-the-art methods by a large margin, especially in recovering the boundary of the objects.

With satellite platforms gazing at a target territory, the captured satellite videos exhibit local misalignment and local intensity variation on some stationary objects that can be mistakenly extracted as moving objects and increase false alarm rates. Typical approaches for mitigating the effect of moving cameras in moving object detection (MOD) follow domain transformation technique, where the misalignment between consecutive frames is restricted to the image planar. However, such technique cannot properly handle satellite videos, as the local misalignment on them is caused by the varying projections from the 3D objects on the Earth's surface to 2D image planar. In order to suppress the effect of moving satellite platform in MOD, we propose a Moving-Confidence-Assisted Matrix Decomposition (MCMD) model, where foreground regularization is designed to promote real moving objects and ignore system movements with the assistance of a moving-confidence score estimated from dense optical flows. For solving the convex optimization problem in MCMD, both batch processing and online solutions are developed in this study, by adopting the alternating direction method and the stochastic optimization strategy, respectively. Experimental results on the videos captured by SkySat and Jilin-1 show that MCMD outperforms the state-of-the-art techniques with improved precision by suppressing effect of nonstationary satellite platforms.

Electronic health record (EHR) is a system that collects patients' digital health information and shares it with other healthcare providers in the cloud. Since EHR contains a large amount of significant and sensitive information about patients, it is required that the system ensures response correctness and storage integrity. Meanwhile, with the rise of IoT, more low-performance terminals are deployed for receiving and uploading patient data to the server, which increases the computational and communication burden of the EHR systems. The verifiable database (VDB), where a user outsources his large database to a cloud server and makes queries once he needs certain data, is proposed as an efficient updatable cloud storage model for resource-constrained users. To improve efficiency, most existing VDB schemes utilize proof reuse and proof updating technique to prove correctness of the query results. However, it ignores the “real-time” of proof generation, which results in an overhead that the user has to perform extra process (e.g., auditing schemes) to check storage integrity. In this article, we propose a publicly verifiable shared updatable EHR database scheme that supports privacy-preserving and batch integrity checking with minimum user communication cost. We modify the existing functional commitment (FC) scheme for the VDB design and construct a concrete FC under the computationall-BDHE assumption. In addition, the use of an efficient verifier-local revocation group signature scheme makes our scheme support dynamic group member operations, and gives nice features, such as traceability and non-frameability.

Distributed threat-events are one of the main challenges faced in computer networks. Although a lot of research has been conducted for these issues, the situation has not been significantly improved. Different from existing victim-centric approaches, in this article we propose a new network-centric approach for the detection of distributed threat-events. The distributed network is treated as a holistic system that consists of spatially interconnected network elements. Network events are detected by the dynamic behavior analysis of the distributed networks. We develop a model consisting of two-layer random fields to describe the time-varying traffic forwarding behavior of the distributed networks. The bottom layer describes the interaction and influence of the network elements under the action of network events. Markovianity is adopted to characterize the spatiotemporal context of each network element’s behavior patterns. The top layer describes each network element’s traffic features driven by the underlying behavior patterns. A Gaussian mixture model is used to capture the statistical features of the network traffic for each behavior pattern. We derive algorithms for parameter estimation and event detection. Numerical experiments using real datasets and different network scenarios are presented to validate the proposed approach. Performance-related issues and comparison with related works are discussed.

Automatic weed monitoring and classification are critical for effective site-specific weed management. With the increasing availability of different sensors, it is possible for weed management to be achieved by processing a wide range of images captured from various remote sensing platforms. A deep learning-based convolutional neural network (CNN) can learn the sophisticated spectral, spatial, and structural features to discriminate weed species. The challenge is to train a CNN architecture for each dataset with limited training samples. In this study, we develop a partial transferable CNN to cope with a new dataset with a different spatial resolution, a different number of bands, and variation in the signal-to-noise ratio. The goal is to make the training for each new dataset less demanding. We conducted a series of experiments on simulated image datasets from two sensors. This study reveals that the dropout layers between the convolutional layers have a significant impact for partial transferable CNN. Even-numbered subset layers from source CNN has a stronger impact on dealing with a task of different spatial resolution. For a different number of bands in source and target datasets, except for the first convolutional layer, the remaining layers are used for the analysis. Results show that network transfer is possible when the numbers of bands of the two datasets are not very different. For the variation in signal-to-noise ratio, it is found that the performance of transfer learning is acceptable when the noise level is not high. Based on these findings, experiments were conducted on two real datasets from two sensors, which includes all the variations. The comparison results using different state-of-the-art models show that partial CNN transfer with even-numbered layers provides better mapping accuracy for the target dataset with a limited number of training samples.

With the rapid development of the solar distribution, solar panel mapping is becoming increasingly valuable to decision-makers. Weakly supervised methods have been developed to reduce the cost in training sample collection, and the most successful ones follow the alternative training scheme, which first generates coarse object localizations as pseudo labels (PLs) and then utilizes these PLs to train an end-to-end network for object extraction. As remote sensing images are typically characterized by multiple occurrences of objects and complicated backgrounds, the alternative training scheme suffers from low mapping accuracy and deficient boundary maintenance due to the varying quality of PLs. In this article, we focus on addressing these problems by adaptively adjusting the contributions of quality-varying PLs and propose a novel self-paced residual aggregated network (SP-RAN) for solar panel mapping. Specifically, with the initial PLs generated by gradient-weighted class activation mapping, a residual aggregated network is designed for target mapping with special consideration for the capability in producing complete and well-shaped mapping results. Considering the inconsistent quality of PLs, an effective confidence-aware (CA) loss is developed to emphasize the contribution of high-quality PLs and alleviate the negative impacts brought by the bad-quality ones in the training phase. Moreover, to concentrate on boundary maintenance, a novel self-paced label correction (SP-LC) strategy is proposed to selectively update PLs by considering their reliability. Extensive experimental comparisons with state-of-the-art methods and ablation study on two aerial datasets and a remote sensing dataset demonstrate the superiority of the proposed method.

As a promising candidate to complement traditional biometric modalities, brain biometrics using electroencephalography (EEG) data has received a widespread attention in recent years. However, compared with existing biometrics such as fingerprints and face recognition, research on EEG biometrics is still in its infant stage. Most of the studies focus on either designing signal elicitation protocols from the perspective of neuroscience or developing feature extraction and classification algorithms from the viewpoint of machine learning. These studies have laid the ground for the feasibility of using EEG as a biometric verification modality, but they have also raised security and privacy concerns as EEG data contains sensitive information. Existing research has used hash functions and cryptographic schemes to protect EEG data, but they do not provide functions for revoking compromised templates as in cancellable template design. This paper proposes the first cancellable EEG template design for privacy-preserving EEG-based verification systems, which can protect raw EEG signals containing sensitive privacy information (e.g., identity, health and cognitive status). A novel cancellable EEG template is developed based on EEG features extracted by a deep learning model and a non-invertible transform. The proposed transformation provides cancellable templates, while taking advantage of EEG elicitation protocol fusion to enhance biometric performance. The proposed verification system offers superior performance than the state-of-the-art, while protecting raw EEG data. Furthermore, we analyze the system’s capacity for resisting multiple attacks, and discuss some overlooked but critical issues and possible pitfalls involving hill-climbing attacks, second attacks, and classification-based verification systems.

False data injection attacks (FDIAs) have recently become a major threat to smart grids. Most of the existing FDIA detection methods have focused on modeling the temporal relationship of time-series measurement data but have paid less attention to the spatial relationship between bus/line measurement data and have failed to consider the relationship between subgrids. To address these issues, in this article, we propose a subgrid-oriented microservice framework by integrating a well-designed spatial–temporal neural network for FDIA detection in ac-model power systems. First, a well-designed neural network is developed to model the spatial–temporal relationship of bus/line measurements for subgrids. A microservice-based supervising network is then proposed for integrating the representation features obtained from subgrids for the collaborative detection of FDIAs. To evaluate the proposed framework, three types of FDIA datasets are generated based on a public benchmark power grid. Case studies on the FDIA datasets show that our method outperforms state-of-the-art methods for FDIA detection in these datasets.

With the rapid development of solar distribution, mapping the locations and sizes of solar panels is becoming increasingly valuable. Weakly supervised methods have been proposed to reduce the reliance on expensive pixel-wise annotations by adopting weak labels, but inevitably suffer from low mapping accuracy and poor boundary maintenance. To solve these problems, a novel weakly supervised residual aggregated network (WS-RAN) is presented in this paper. In the WS-RAN, pixel-wise labels are automatically generated from image-level labels by a classification network. Then, the produced pixel-wise labels are used to train the residual aggregated network (RAN) for target mapping, which is designed to cope the variations in size and shapes of individual solar panel layout. Particularly, for better boundary maintenance, the residual aggregated block is developed as the basic module in the bottom-up path of the RAN. Experiment results reveal that the proposed WS-RAN significantly outperforms four state-of-the-art weakly supervised methods with 76.0% F1score and 61.3% IoU score.

In speech interaction scenarios, speech emphasis is essential for expressing the underlying intention and attitude. Recently, end-to-end emphatic speech synthesis greatly improves the naturalness of synthetic speech, but also brings new problems: 1) lack of interpretability for how emphatic codes affect the model; 2) no separate control of emphasis on duration and on intonation and energy. We propose a novel way to build an interpretable and controllable emphatic speech synthesis framework based on forward attention. Firstly, we explicitly model the local variation of speaking rate for emphasized words and neutral words with modified forward attention to manifest emphasized words in terms of duration. The 2-layers LSTM in decoder is further divided into attention-RNN and decoder-RNN to disentangle the influence of emphasis on duration and on intonation and energy. The emphasis information is injected into decoder-RNN for highlighting emphasized words in the aspects of intonation and energy. Experimental results have shown that our model can not only provide separate control of emphasis on duration and on intonation and energy, but also generate more robust and prominent emphatic speech with high quality and naturalness.

The advent of smart power grid, which plays a vital role in the upcoming smart city era, is accompanied with the implementation of a monitoring tool, called state estimation (SE). For the case of the unbalanced residential distribution grid, the state-estimating operation, which is conducted at a regional scale, is considered as an application of the edge computing-based Internet of Things (IoT). While the outcome of the SE is important to the subsequent control activities, its accuracy heavily depends on the data integrity of the information collected from the scattered measurement devices. This fact exposes the vulnerability of the SE module under the effect of data-driven attacks. Among these, the false data-injection (FDI) attack is attracting much attention due to its capability to interfere with the normal operation of the network without being detected. This article presents an attack design scheme based on a nonlinear physical-constraint model that is able to produce an FDI attack with theoretically stealthy characteristic. To demonstrate the effectiveness of the proposed design scheme, simulations with the IEEE 13-node test feeder and the WSCC 9-bus system are conducted. The experimental results indicate that not only the false-positive rate of the bad data detection mechanism is 100% but the physical consequence of the attack is severe. These results pose a serious challenge for the operators in maintaining the integrity of measurement data.

With the rapid development of web-based applications, clicking on hyperlinks has become a general means for accessing various network services. Understanding the visiting behavior of web users not only helps improve the personalized service quality and user experience, but also plays an important role in network management and early threat detection. Click-stream identification is a fundamental issue for user behavior analysis. However, most existing approaches are designed for non-encrypted HTTP requests and only focus on server-side scenarios, which makes them inapplicable to the increasingly popular HTTPS and network-side management. In this work, we propose an encryption-independent scheme from a network-side perspective that adopts the web traffic collected at the network boundary to identify the HTTP(S) requests generated by the click actions of web users. The proposed scheme employs hidden Markov models (HMMs) to describe the time-varying behavior of click and non-click web traffic. A deep neural network (DNN) is integrated into the HMMs to capture the context of web traffic, which eliminates the limitations caused by the independence hypothesis of the traditional HMMs. Finally, a DNN-based rear classifier is proposed to determine the type of HTTP(S) requests according to the fitting degree between the HTTP(S) requests and the HMM-based behavior models. We derive the algorithms for model learning and click identification. Experiments are conducted to validate the proposed approach. Performance-related issues and comparisons are discussed. Results show that both the average precision and recall rate of the proposed approach exceed 92%, which is better than most existing benchmark methods in terms of performance and stability.

An automated fingerprint recognition system (AFRS) for 3D fingerprints is essential and highly promising for biometric security. Despite the progress in developing 3D AFRSs, achieving high-quality real-time reconstruction and high-accuracy recognition of 3D fingerprints remain two challenging issues. To address them, we propose a robust 3D AFRS based on ridge-valley (RV)-guided 3D fingerprint reconstruction and 3D topology polymer (TTP) feature extraction. The former considers the unique fingerprint characteristics of the RV and achieves real-time reconstruction. Unlike traditional triangulation-based methods that establish correspondences between points by cross-correlation-based searching, we propose to establish RV correspondences (RVCs) between ridges/valleys by defining and calculating a RVC matrix based on the topology of RV curves. To enhance depth reconstruction, curve-based smoothing is proposed to refine our novel RV disparity map. The TTP feature codes the 3D topology by projecting the 3D minutiae onto multiple planes and extracting their corresponding 2D topologies and has proven to be effective and efficient for 3D fingerprint recognition. Comprehensive experimental results demonstrate that our method outperforms the state-of-the-art methods in terms of both reconstruction and recognition accuracy. Also, due to its very short running time, it is appropriate for practical applications.

Contrast enhancement (CE) of magnetic resonance (MR) brain images is an important technique to bring out the tissue details for clinical diagnosis. Recently, a new form of image enhancement has been proposed to complete the task without any information loss. Specifically, information required to restore the original image is reversibly hidden into the enhanced image. Moreover, several image segmentation based algorithms have been proposed so that the region of interest can be exclusively enhanced. However, with the reversible algorithms, it is hard to properly enhance the tissues in MR brain images when they are relatively small or connected with each other. To address this issue, a hierarchical CE scheme is proposed for MR brain images with reversibility in this letter. Firstly, a deep convolutional neural network is used to segment multiple tissue classes automatically. Then, the segmented tissues are individually utilized to guide the CE procedure so that individual-tissue-enhanced images are generated. Compared with using the background information to guide the CE procedure, better tissue enhancement effects and visual quality are both obtained by our proposed hierarchical scheme. The evaluation results obtained over MR brain test images demonstrate the reversibility and adaptability of the proposed scheme for the enhancement of interested tissues.

Searching the identity of an unknown fingerprint over large databases is very challenging. Minutia Cylinder-Code (MCC) has been proved to be very effective in mapping a minutiae-based representation (positions and directions only) into a set of fixed-length transformation-invariant binary vectors. Based on MCC, a Locality-Sensitive Hashing (LSH) scheme has been designed to index fingerprint in large databases, which uses a numerical approximation for the similarity between MCC vectors. However, the LSH scheme is not robust enough when there is certain distortion between template and searched samples, such as fingerprints captured by multi-sensors. In this paper, we propose a finer hash bit selection method based on LSH. Besides, we take into consideration another feature - the single maximum collision for indexing and fuse the candidate lists produced by both indexing methods to produce the final candidate list. Experimentations carried out on our collected multi-sensor database (2D and 3D databases) show that the proposed indexing approach greatly improves the performance of fingerprint indexing. Extensive evaluation was also conducted on some public benchmark databases for fingerprint indexing, and the results demonstrated that the new approach outperforms existing ones in almost all the cases.

Using cloud storage services, users can store their data in the cloud to avoid the expenditure of local data storage and maintenance. To ensure the integrity of the data stored in the cloud, many data integrity auditing schemes have been proposed. In most, if not all, of the existing schemes, a user needs to employ his private key to generate the data authenticators for realizing the data integrity auditing. Thus, the user has to possess a hardware token (e.g., USB token, smart card) to store his private key and memorize a password to activate this private key. If this hardware token is lost or this password is forgotten, most of the current data integrity auditing schemes would be unable to work. In order to overcome this problem, we propose a new paradigm called data integrity auditing without private key storage and design such a scheme. In this scheme, we use biometric data (e.g., iris scan, fingerprint) as the user’s fuzzy private key to avoid using the hardware token. Meanwhile, the scheme can still effectively complete the data integrity auditing. We utilize a linear sketch with coding and error correction processes to confirm the identity of the user. In addition, we design a new signature scheme which not only supports blockless verifiability, but also is compatible with the linear sketch. The security proof and the performance analysis show that our proposed scheme achieves desirable security and efficiency.

IoT (Internet of things) devices often collect data and store the data in the cloud for sharing and further processing; This collection, sharing, and processing will inevitably encounter secure access and authentication issues. Attribute based signature (ABS), which utilizes the signer’s attributes to generate private keys, plays a competent role in data authentication and identity privacy preservation. In ABS, there are multiple authorities that issue different private keys for signers based on their various attributes, and a central authority is usually established to manage all these attribute authorities. However, one security concern is that if the central authority is compromised, the whole system will be broken. In this paper, we present an outsourced decentralized multi-authority attribute based signature (ODMA-ABS) scheme. The proposed ODMA-ABS achieves attribute privacy and stronger authority-corruption resistance than existing multi-authority attribute based signature schemes can achieve. In addition, the overhead to generate a signature is further reduced by outsourcing expensive computation to a signing cloud server. We present extensive security analysis and experimental simulation of the proposed scheme. We also propose an access control scheme that is based on ODMA-ABS.

Cloud technology has brought great convenience to enterprises as well as customers. System logs record notable events and are becoming valuable resources to track and investigate system status. Detecting anomaly from logs as fast as possible can improve the quality of service significantly. Although many machine learning algorithms (e.g., SVM, Logistic Regression) have high detection accuracy, we find that they assume data are clean and might have high training time. Facing these challenges, in this paper, we propose Robust Online Evolving Anomaly Detection (ROEAD) framework which adopts Robust Feature Extractor (RFE) to remove the effects of noise and Online Evolving Anomaly Detection (OEAD) to dynamic update parameters. We propose Online Evolving SVM (OES) algorithm as the example of online anomaly detection methods. We analyze the performance of OES in theory and prove the performance difference between OES and the best hypothesis tends to zero as time goes infinity. We compare the performance of ROEAD against state-of-the-art anomaly detection algorithms using public log datasets. The results demonstrate that ROEAD is able to remove the effects of noise and OES can improve the detection accuracy by more than 40%.

Encrypted web traffic can reveal sensitive information of users, such as their browsing behaviors. Existing studies on encrypted traffic analysis focus on website fingerprinting. We claim that fine-grained webpage fingerprinting, which speculates specific webpages on a same website visited by a victim, allows exploiting more user private information, e.g., shopping interests in an online shopping mall. Since webpages from the same website usually have very similar traffic traces that make them indistinguishable, existing solutions may end up with low accuracy. In this paper, we propose FineWP, a novel fine-grained webpage fingerprinting method. We make an observation that the length information of packets in bidirectional client-server interactions can be distinctive features for webpage fingerprinting. The extracted features are then fed into traditional machine learning models to train classifiers, which achieve both high accuracy and low training overhead. We collect two real-world traffic datasets and construct closed- and open-world evaluations to verify the effectiveness of FineWP. The experimental results demonstrate that FineWP is superior to the state-of-the-art methods in terms of accuracy, time complexity and stability.

Deep neural networks (DNNs) have been increasingly used in face recognition (FR) systems. Recent studies, however, show that DNNs are vulnerable to adversarial examples, which potentially mislead DNN-based FR systems in the physical world. Existing attacks either generate perturbations working merely in the digital world, or rely on customized equipment to generate perturbations that are not robust in the ever-changing physical environment. In this paper, we propose FaceAdv, a physical-world attack that crafts adversarial stickers to deceive FR systems. It mainly consists of a sticker generator and a convertor, where the former can craft several stickers with different shapes while the latter aims to digitally attach stickers to human faces and provide feedback to the generator to improve the effectiveness. We conduct extensive experiments to evaluate the effectiveness of FaceAdv on attacking three typical FR systems (i.e., ArcFace, CosFace and FaceNet). The results show that compared with a state-of-the-art attack, FaceAdv can significantly improve the success rates of both dodging and impersonating attacks. We also conduct comprehensive evaluations to demonstrate the robustness of FaceAdv.

Despite the ubiquity in the use of biometrics due to its many advantages against traditional methods such as password or token, the emerging cancelable biometric methods, which are designed to protect the biometrics are still exposed to certain threats. Attack via Record Multiplicity (ARM) is one of those. In this paper, we propose a novel framework that possesses two layers of authentication to improve the matching performance of a fingerprint authentication system in the cancelable template setting. In addition, a multi-filter fingerprint matching scheme is devised to deal more effectively with low-quality fingerprint images. Two techniques that are capable of defending against the heinous ARM are also introduced. Security analysis on the system's capability against the hill-climb attack and pre-image attack is also provided. The proposed scheme has been evaluated over public datasets FVC2002-DB1, FVC2002-DB2, FVC2002-DB3, and FVC2004-DB2. It has achieved the best result compared with the state-of-art methods. The source code for this framework is available on demand.

Protecting Cyber-physical Systems (CPSs) is highly important for preserving sensitive information and detecting cyber threats. Developing a robust privacy-preserving anomaly detection method requires physical and network data about the systems, such as Supervisory Control and Data Acquisition (SCADA), for protecting original data and recognising cyber-attacks. In this paper, a new privacy-preserving anomaly detection framework, so-called PPAD-CPS, is proposed for protecting confidential information and discovering malicious observations in power systems and their network traffic. The framework involves two main modules. First, a data pre-processing module is suggested for filtering and transforming original data into a new format that achieves the target of privacy preservation. Second, an anomaly detection module is suggested using a Gaussian Mixture Model (GMM) and Kalman Filter (KF) for precisely estimating the posterior probabilities of legitimate and anomalous events. The performance of the PPAD-CPS framework is assessed using two public datasets, namely the Power System and UNSW-NB15 dataset. The experimental results show that the framework is more effective than four recent techniques for obtaining high privacy levels. Moreover, the framework outperforms seven peer anomaly detection techniques in terms of detection rate, false positive rate, and computational time.

Detecting moving objects from ground-based videos is commonly achieved by using background subtraction (BS) techniques. Low-rank matrix decomposition inspires a set of state-of-the-art approaches for this task. It is integrated with structured sparsity regularization to achieve BS in the developed method of low-rank and structured sparse decomposition (LSD). However, when this method is applied to satellite videos where spatial resolution is poor and targets' contrast to the background is low, its performance is limited as the data no longer fit adequately either the foreground structure or the background model. In this article, we handle these unexplained data explicitly and address the moving target detection from space as one of the pioneering studies. We propose a new technique by extending the decomposition formulation with bounded errors, named Extended LSD (E-LSD). This formulation integrates low-rank background, structured sparse foreground, as well as their residuals in a matrix decomposition problem. Solving this optimization problem is challenging. We provide an effective solution by introducing an alternative treatment and adopting the direct extension of alternating direction method of multipliers (ADMM). The proposed E-LSD was validated on two satellite videos, and the experimental results demonstrate the improvement in background modeling with boosted moving object detection precision over state-of-the-art methods.

Inspired by the recent developments in computer vision, low-rank and structured sparse matrix decomposition can be potentially be used for extract moving objects in satellite videos. This set of approaches seeks for rank minimization on the background that typically requires batch-based optimization over a sequence of frames, which causes delays in processing and limits their applications. To remedy this delay, we propose an online low-rank and structured sparse decomposition (O-LSD). O-LSD reformulates the batch-based low-rank matrix decomposition with the structured sparse penalty to its equivalent framewise separable counterpart, which then defines a stochastic optimization problem for online subspace basis estimation. In order to promote online processing, O-LSD conducts the foreground and background separations and the subspace basis update alternatingly for every frame in a video. We also show the convergence of O-LSD theoretically. Experimental results on two satellite videos demonstrate the performance of O-LSD in terms of accuracy, and the time consumption is comparable with the batch-based approaches with significantly reduced delay in processing.

Contactless fingerprint recognition is highly promising and an essential component in the automatic fingerprint identification system. However, due to the inherent characteristic of perspective distortions of contactless fingerprints, achieving a highly accurate contactless fingerprint recognition system is very challenging. In this paper, we propose a robust contactless fingerprint recognition method based on global minutia topology and loose genetic algorithm. In order to avoid the inaccurate minutiae alignment problem suffered in conventional transformation-based methods, the minutiae correspondence is established by optimizing an energy function of the similarity matrix. We define an innovative similarity matrix based on both minutiae and minutia-pairs, which takes the global minutia topology into account. By adopting a distortion-free feature of ridge count to define the similarity, the problem of perspective distortions is effectively overcome. To solve the optimization, we propose a new genetic algorithm (GA) named loose GA with new mutation and crossover operators. We also propose a strict minutia-pair expanding algorithm to enhance the reliability of the minutiae correspondence. For recognition, a metric for measuring comparison scores which takes advantage of both the global topological similarity and the number of corresponding minutiae is proposed. We evaluate our method using two contactless fingerprint benchmark databases and achieve competitive performances in comparison with the state-of-the-art methods.

Weed detection and classification are one of the important and crucial steps for area-specific weed control. This reduces the overall cost and the negative impact of using unnecessary herbicides on human health and crops. As the spectral similarity between weeds and crops is high, patch-based classification approaches are adopted in this letter. Convolutional neural network (CNN) and histogram of oriented gradients (HoG) methods are evaluated and compared. With the advancement in the remote sensing technologies, a large number of sensors are available which provide different number of bands with different spatial resolutions. The effect of these variations on weed identification is investigated. Experimental results show that CNN method extracts more discriminative and powerful features that lead to an accurate classification of different weeds compared to the HoG method. Analysis of the two important parameters provides guidance in choosing correct patch size, spatial resolution, and the number of bands to use when CNN is applied for accurate and efficient weed classification.

Anomaly detection for cloud servers is important for detecting zero-day attacks. However, it is very challenging due to the large amount of accumulated data. In this paper, a new mathematical model for modeling dynamic usage behavior and detecting anomalies is proposed. It is constructed using state summarization and a novel nested-arc hidden semi-Markov model (NAHSMM). State summarization is designed to extract usage behavior reflective states from a raw sequence. The NAHSMM is comprised of exterior and interior hidden Markov chains. The exterior controls the propagation of raw sequences of system calls and, conditional on it, the interior one controls the summarized observation process from the transition less usage behavior reflective states. An anomaly detection algorithm is derived by integrating state summarization and NAHSMM. During training the algorithm is assisted by a forensic module to tune the behavioral threshold. Experimental data is collected using IXIA Perfect Storm in conjunction with the commercial security-test hardware platform cyber range. To evaluate the reliability of the proposed model, first, its accuracy and training costs are compared with those of existing machine-learning models and then its scalability and resistance capabilities are tested. The results indicate that this model could be used as a method for detecting anomalies in cloud servers.

With cloud storage services, users can remotely store their data to the cloud and realize the data sharing with others. Remote data integrity auditing is proposed to guarantee the integrity of the data stored in the cloud. In some common cloud storage systems such as the electronic health records system, the cloud file might contain some sensitive information. The sensitive information should not be exposed to others when the cloud file is shared. Encrypting the whole shared file can realize the sensitive information hiding, but will make this shared file unable to be used by others. How to realize data sharing with sensitive information hiding in remote data integrity auditing still has not been explored up to now. In order to address this problem, we propose a remote data integrity auditing scheme that realizes data sharing with sensitive information hiding in this paper. In this scheme, a sanitizer is used to sanitize the data blocks corresponding to the sensitive information of the file and transforms these data blocks' signatures into valid ones for the sanitized file. These signatures are used to verify the integrity of the sanitized file in the phase of integrity auditing. As a result, our scheme makes the file stored in the cloud able to be shared and used by others on the condition that the sensitive information is hidden, while the remote data integrity auditing is still able to be efficiently executed. Meanwhile, the proposed scheme is based on identity-based cryptography, which simplifies the complicated certificate management. The security analysis and the performance evaluation show that the proposed scheme is secure and efficient.

Highly secure access control requires Swiss-cheese-type multi-layer security protocols. The use of electroencephalogram (EEG) to provide cognitive indicators for human workload and fatigue has created environments where the EEG data are well-integrated into systems, making it readily available for more forms of innovative uses including biometrics. However, most of the existing studies on EEG biometrics rely on resting state signals or require specific and repetitive sensory stimulation, limiting their uses in naturalistic settings. Moreover, the limited discriminatory power of uni-variate measures denies an opportunity to use dependences information inherent in brain regions to design more robust biometric identifiers. In this paper, we proposed a novel model for ongoing EEG biometric identification using EEG collected during a diverse set of tasks. The novelty lies in representing EEG signals as a graph based on within-frequency and cross-frequency functional connectivity estimates, and the use of graph convolutional neural network (GCNN) to automatically capture deep intrinsic structural representations from the EEG graphs for person identification. An extensive investigation was carried out to assess the robustness of the method against diverse human states, including resting states under eye-open and eye-closed conditions and active states drawn during the performance of four different tasks. We compared our method with the state-of-the-art EEG features, classifiers, and models of EEG biometrics. Results show that the representation drawn from EEG functional connectivity graphs demonstrates more robust biometric traits than direct use of uni-variate features. Moreover, the GCNN can effectively and efficiently capture discriminative traits, thus generalizing better over diverse human states.

With built-in artificial intelligence (AI), edge devices, e.g., smart cameras, can perform tasks like detecting and tracking individuals, which is referred to as edge biometrics. As a driving force for AI, machine/deep learning plays a critical role in edge biometrics. Machine/deep learning based edge biometric systems outperform their nonmachine learning counterpart. However, research shows that artificial neural networks, e.g., convolutional neural networks, are invertible such that adversaries can obtain a certain amount of information about the original inputs/templates. This information leakage is not tolerable for biometric systems because biometric data in the original (raw) templates cannot be reset or replaced. Once compromised, they are lost forever. Therefore, how to prevent original biometric templates from being attacked through inverting deep neural networks is a pressing, but unsolved issue, for deep learning based biometric recognition. To address the issue, in this paper, we develop a novel biometric template protection algorithm using the binary decision diagram (BDD) for deep learning based finger-vein biometric systems. The proposed algorithm is capable of creating a new noninvertible version of the original finger-vein template, which is stacked with an artificial neural network-the multilayer extreme learning machine (ML-ELM) to generate a privacy-preserving finger-vein recognition system, named BDD-ML-ELM. The proposed BDD-ML-ELM ensures the safety of the original finger-vein template even if its transformed version is compromised. The transformed template, if compromised, can be revoked and replaced with another new version by simply changing the user-specific keys. Therefore, the BDD-ML-ELM has a clear advantage over the existing machine/deep learning based biometric systems, whose raw biometric templates are vulnerable when the artificial neural network suffers an inversion attack.

Entropy has been widely investigated as an effective metric to evaluate the dynamic complexity of signals. EEG is biological signals that contain rich complex dynamics. Transforming the information encoded in the rich dynamics embedded within EEG into appropriate biomarkers with discriminatory powers is important for event detection. It has broad prospects in a wide range of applications including medical diagnosis, therapy, and rehabilitation. This paper proposes a new entropy-based measure, Multi-scale Weighted Inherent Fuzzy Entropy (WIFEn), as an effective EEG biomarker for improving event detection performance. WIFEn first extracts Inherent Mode Functions (IMFs) using the Empirical Mode Decomposition method, then uses a weighted sum scheme to fuse the fuzzy entropy metrics calculated on each IMF. Finally, the multi-scale variation accounts for the multi-timescale dynamics inherent in EEG signals. Since EEG signals are a superposition of series of oscillations where information embedded in these oscillations is useful for estimating signal complexity, the aforementioned decomposition, and weighted sum procedures can improve the estimation results. The proposed method is tested with three entropy-based metrics for two tasks. The first task is eye-open and eye-closed detection with resting state EEG signals recorded from 10 subjects; while the second task is seizure detection for 8 epilepsy patients. The results indicate that the multi-scale WIFEn provides a better discriminatory power that improves detection performance than classic entropy-based measures, with an averaged improvement of 13.7% (p-value <; 0.05) for resting-state classification and 5.9% (p-value <; 0.05) for seizure detection.

Autonomous Mobile agents can be extremely useful in dynamic environments that require a continuous network connection. Network bandwidth reduction, protocol encapsulation, software automation and intelligence gathering can significantly affect Web Services. Integrating mobile agents with Web Services enables software adaptation to cope with a dynamic environment, automated system configuration and application requirement changes that are frequent in today''s ever fast-evolving technology. In this paper, we use a lightweight and efficient composition for mobile agents based Web services complying with Representational State Transfer (REST) principles for agent creation, migration, and control. The paper presents the overall concept and architecture of RESTful agents for web services. A security scheme is proposed for mobile agent security based on an infrastructure-less Identity Based Encryption (IBE) scheme integrated with Broadcast based Secure Mobile Agent Protocol (BROSMAP). A proof- of-concept implementation is provided.

Cancellable fingerprint template has increasingly received interest in research thanks to not only the security for the user's original features but also the stable performance for the system. In this paper, we propose a new method to design cancellable fingerprint template with local structure by clustering the minutiae using the k Nearest Neighbor (kNN) algorithm. In other words, k minutiae in a fingerprint that are closest to a reference minutia form a local structure. Pairwise features from the reference minutia and each of the member in the cluster are extracted and used for local structure matching. The partial Discrete Fourier Transformation was applied as the non-invertible transformation. This method has been evaluated with four public databases FVC2002 DB1-DB3, and FVC2004 DB2. The Equal Error Rate achieved for each database is 0.2%, 0.04%, 4.78%, and 7.64%, respectively.

Automatic weed detection and mapping are critical for site-specific weed control in order to reduce the cost of farming as well as the impact of herbicides on human health. In this paper, we investigate patch-based weed identification using hyperspectral images. Convolutional Neural Network (CNN) is evaluated and compared with the Histogram of Oriented Gradients (HoG) for this purpose. Suitable patch sizes are investigated. The limitation of RGB imagery is demonstrated. The experimental results indicate that the overall accuracy of the weed classification using CNN increases with the increasing number of bands used. With more bands, CNN extracts more powerful and discriminative features and leads to improved classification as compared to the traditional HoG feature extraction method. The computational load of CNN, however, is slightly increased with the increasing number of bands.

Satellite high definition videos provide an opportunity to monitor moving targets over a large territory. However, the low spatial resolution and low contract of these videos make target detecting and tracking a challenging task. In this paper, we propose a zoom-in approach for detecting dim and small target proposals from each single frame of the videos to help with moving target tracking. Initialized by a coarse scale segmentation approach, dim and small targets are embedded in each superpixel due to limited size and weak signals. Similar superpixels are then merged using a graph-based approach based on the measurement of the overlap between their histograms. The background statistics become stronger and target pixels are more obvious in the merged superpixels, so that the target pixels can be extracted. Finally, the corresponding boundary box is generated for each spatially connected target pixels selected inside each superpixel. They form the dim and small target proposals. Experimental results show that our zoom-in scheme can generate less proposals with higher recall rate compared with state-of-the-art proposal extraction algorithms.

Abstract Several fully automated latent print forensic techniques have been reported. In this paper, we propose a fully automated latent print segmentation module for the partition of the fingerprint region in a query latent image, which can help find a corresponding match of the suspect reliably. Being different from the existing methods that build the prelearned dictionary from the high‐quality fingerprint image patches, the proposed dictionary learning procedure is conducted on the target images. The advantages of the proposed method are the following: (i) it does not require a large number of high‐quality “ridge‐valley” atoms and (ii) not only the structure similarity but also the pattern scale has been kept consistent between the target image patches and learned dictionary atoms. Because no commercial latent fingerprint matcher is publicly available and the latent matcher reported in the literature is not accessible to the public either, a latent fingerprint matching platform is implemented to evaluate the obtained segmentation results and automated latent fingerprint matching performance. On the basis of this platform, experimental comparisons are conducted to assess closeness to the system performance upper bound when different segmentation modules are deployed. Moreover, matcher‐independent criteria such as genuine minutiae preservation rate and the segmented region of interest's accuracy are used. All the experimental results demonstrate that the proposed segmentation approach outperforms state‐of‐the‐art techniques in terms of finding the correct fingerprint of the suspect subject.

With the development of cloud services, outsourcing computation tasks to a commercial cloud server has drawn attention of various communities, especially in the Big Data era. Public verifiability offers a flexible functionality in real circumstance where the cloud service provider (CSP) may be untrusted or some malicious users may slander the CSP on purpose. However, sometimes the computational result is sensitive and is supposed to remain undisclosed in the public verification phase, while existing works on publicly verifiable computation (PVC) fail to achieve this requirement. In this paper, we highlight the property of result confidentiality in publicly verifiable computation and present confidentiality-preserving public verifiable computation (CP-PVC) schemes for multivariate polynomial evaluation and matrix-vector multiplication, respectively. The proposed schemes work efficiently under the amortized model and, compared with previous PVC schemes for these computations, achieve confidentiality of computational results, while maintaining the property of public verifiability. The proposed schemes proved to be secure, efficient, and result-confidential. In addition, we provide the algorithms and experimental simulation to show the performance of the proposed schemes, which indicates that our proposal is also acceptable in practice.

Constrained shortest distance (CSD) querying is one of the fundamental graph query primitives, which finds the shortest distance from an origin to a destination in a graph with a constraint that the total cost does not exceed a given threshold. CSD querying has a wide range of applications, such as routing in telecommunications and transportation. With an increasing prevalence of cloud computing paradigm, graph owners desire to outsource their graphs to cloud servers. In order to protect sensitive information, these graphs are usually encrypted before being outsourced to the cloud. This, however, imposes a great challenge to CSD querying over encrypted graphs. Since performing constraint filtering is an intractable task, existing work mainly focuses on unconstrained shortest distance queries. CSD querying over encrypted graphs remains an open research problem. In this paper, we propose Connor, a novel graph encryption scheme that enables approximate CSD querying. Connor is built based on an efficient, tree-based ciphertext comparison protocol, and makes use of symmetric-key primitives and the somewhat homomorphic encryption, making it computationally efficient. Using Connor, a graph owner can first encrypt privacy-sensitive graphs and then outsource them to the cloud server, achieving the necessary privacy without losing the ability of querying. Extensive experiments with real-world data sets demonstrate the effectiveness and efficiency of the proposed graph encryption scheme.

Smart mobile devices are playing a more and more important role in our daily life. Cancelable biometrics is a promising mechanism to provide authentication to mobile devices and protect biometric templates by applying a noninvertible transformation to raw biometric data. However, the negative effect of nonlinear distortion will usually degrade the matching performance significantly, which is a nontrivial factor when designing a cancelable template. Moreover, the attacks via record multiplicity (ARM) present a threat to the existing cancelable biometrics, which is still a challenging open issue. To address these problems, in this paper, we propose a new cancelable fingerprint template which can not only mitigate the negative effect of nonlinear distortion by combining multiple feature sets, but also defeat the ARM attack through a proposed feature decorrelation algorithm. Our work is a new contribution to the design of cancelable biometrics with a concrete method against the ARM attack. Experimental results on public databases and security analysis show the validity of the proposed cancelable template.

Recently, the state estimation issue of a TCP/IP network has attracted much attention from different communities. In this paper, a terminal sliding-mode observer (TSMO) is proposed based on a fluid-flow model of a TCP/IP network to estimate traffic flow states. A novel control strategy is proposed to fasten the convergence of the estimation error for average congestion window (ACwnd). Furthermore, a continuous control strategy is directly used to estimates the flooding rate of additional traffic flow (ATF). The efficacy of the proposed TSMO is verified by a numerical simulation implementations via the networking simulator NS-2.

Object proposal approach, where potential objects are extracted first, has been developed to improve the target searching efficiency. In this paper, we investigate two newly developed algorithms, namely Selective Search and EdgeBoxes, for object proposal extraction and evaluate their performance with very high resolution (VHR) remote sensing images. These object proposal extraction methods play a vital role in assisting the target detectors to find the targets rapidly and accurately in an image. Considering that the size of VHR satellite images is large and there are more than one targets in an image, these two methods are highly valuable as they can avoid exhaustive search using a sliding window to find the targets. Both methods were evaluated using NWPU VHR-10 class remote sensing data set. The performance is measured using the recall rate and execution time. Results indicate that the EdgeBoxes method is significantly faster and has high recall rate as compared to the Selective Search method. Therefore, for target detection, it is effective to use EdgeBoxes method for object proposals extraction using VHR satellite images.

Prior to deploying any intrusion detection system, it is essential to obtain a realistic evaluation of its performance. However, the major problems currently faced by the research community is the lack of availability of any realistic evaluation dataset and systematic metric for assessing the quantified quality of realism of any intrusion detection system dataset. It is difficult to access and collect data from real-world enterprise networks due to business continuity and integrity issues. In response to this, in this paper, firstly, a metric using a fuzzy logic system based on the Sugeno fuzzy inference model for evaluating the quality of the realism of existing intrusion detection system datasets is proposed. Secondly, based on the proposed metric results, a synthetically realistic next generation intrusion detection systems dataset is designed and generated, and a preliminary analysis conducted to assist in the design of future intrusion detection systems. This generated dataset consists of both normal and abnormal reflections of current network activities occurring at critical cyber infrastructure levels in various enterprises. Finally, using the proposed metric, the generated dataset is analyzed to assess the quality of its realism, with its comparison with publicly available intrusion detection system datasets for verifying its superiority.

Mobile agents are smart programs that migrate from one platform to another to perform the user task. Mobile agents offer flexibility and performance enhancements to systems and service real-time applications. However, security in mobile agent systems is a great concern. In this paper, we propose a novel Broadcast based Secure Mobile Agent Protocol (BROSMAP) for distributed service applications that provides mutual authentication, authorization, accountability, nonrepudiation, integrity, and confidentiality. The proposed system also provides protection from man in the middle, replay, repudiation, and modification attacks. We proved the efficiency of the proposed protocol through formal verification with Scyther verification tool.

Cloud storage system provides facilitative file storage and sharing services for distributed clients. To address integrity, controllable outsourcing, and origin auditing concerns on outsourced files, we propose an identity-based data outsourcing (IBDO) scheme equipped with desirable features advantageous over existing proposals in securing outsourced data. First, our IBDO scheme allows a user to authorize dedicated proxies to upload data to the cloud storage server on her behalf, e.g., a company may authorize some employees to upload files to the company's cloud account in a controlled way. The proxies are identified and authorized with their recognizable identities, which eliminates complicated certificate management in usual secure distributed computing systems. Second, our IBDO scheme facilitates comprehensive auditing, i.e., our scheme not only permits regular integrity auditing as in existing schemes for securing outsourced data, but also allows to audit the information on data origin, type, and consistence of outsourced files. Security analysis and experimental evaluation indicate that our IBDO scheme provides strong security with desirable efficiency.

In this paper, we focus on detecting a special type of anomaly in wireless sensor network (WSN), which appears simultaneously in a collection of neighboring nodes and lasts for a significant period of time. Existing point-based techniques, in this context, are not very effective and efficient. With the proposed distributed segment-based recursive kernel density estimation, a global probability density function can be tracked and its difference between every two periods of time is continuously measured for decision making. Kullback-Leibler (KL) divergence is employed as the measure and, in order to implement distributed in-network estimation at a lower communication cost, several types of approximated KL divergence are proposed. In the meantime, an entropic graph-based algorithm that operates in the manner of centralized computing is realized, in comparison with the proposed KL divergence-based algorithms. Finally, the algorithms are evaluated using a real-world data set, which demonstrates that they are able to achieve a comparable performance at a much lower communication cost.

Human identity is a prerequisite for trust assurance and assessment, which is essential for effective human-machine interaction in trusted autonomous systems. Unlike conventional authentication methods which do not require users to re-authenticate themselves for sustained access, continuous authentication affirms human identity in real-time, therefore is a solution for continued access monitoring in trusted autonomous systems. Robust continuous authentication needs robust multi-modal data sources. In this paper, we design a multi-modal biometrics system that continuously verifies the presence of a logged-in user. Two types of biometric data are used, face images and Electroencephalography (EEG) signals. Information from individual modalities is fused at matching score level. For face modality, matching scores are calculated by distances between eigenface coefficients. While for EEG signals, an event-related potential (ERP) modality is established by a simple ERP elicitation protocol and calculation of cross-correlation similarities. Scores from the two modalities are normalized and fused using three schemes, namely the sum-score, max-score and min-score scheme. The experiments reveal that individual variations found in the ERPs are detectable and can be used for continuous authentication. This is an interesting finding which indicates that the ERP biometrics are feasible for user authentication and worthy of further research. Results also show that combining ERP biometric with face biometric using sum-score scheme outperforms each modality in isolation. This piece of finding indicates the potential of integrating ERP into multimodal authentication systems.

Apple claims that iPhone 6, which is equipped with iOS 8.0 and later version, is secure enough to prevent a user's private data from law enforcement or malicious intruders. In pre-iOS 8.0 operating systems, a user's data were only encrypted by hardware-based keys, which can be obtained by Apple. But in iOS 8.0 and later version, the private data on the iPhone are protected by a secret key that is protected by the user's passcode, which the Apple does not hold. In this paper, supported by real-life experiments, we demonstrate that several vulnerabilities of iPhone 6 with iOS 8, which are brought by ordinary user operations, can lead to the leakage of the private data. Then we conduct vulnerability analysis and give the reasons that cause these vulnerabilities from a technical perspective. Meanwhile, experiments of forging attack aiming at iPhone 6 Touch ID are conducted.

Summary Existing work on partial fingerprint indexing attempts to make full use of the extracted features from the partial segments, such as singular points, minutiae, orientation field, and ridge count. However, singular points may not exist in partial fingerprints, and none of these features can form a complete set of feature vectors that can be used for matching with those derived from the corresponding full fingerprints for indexing. Our former work on fingerprint orientation model based on two‐dimensional Fourier expansion (FOMFE) coefficients‐based fingerprint indexing and global orientation field reconstruction has demonstrated the possibility of reconstructing a global feature vector for partial fingerprint indexing. In this paper, we design some novel features of minutiae triplets in addition to some commonly used features to constitute the local minutiae triplet features. Experiments carried out on fingerprint verification competition (FVC) 2000 DB2a, FVC 2002 DB1a, and National Institute of Standards and Technology (NIST) SD 14 demonstrate the performance improvement after adding the new features to minutiae triplet feature set. We then propose to combine the reconstructed global feature and local minutiae triplet features to improve the performance of partial fingerprint indexing. Specifically, the minutiae triplet‐based indexing scheme and the FOMFE coefficients‐based indexing scheme are applied separately to generate two candidate lists; then, a fuzzy‐based fusion scheme is designed to generate the final candidate list for matching. Experiments carried out on the public database NIST SD 14 show that the proposed approach can improve the performance that has been achieved by individual partial fingerprint indexing algorithms before fusion. Copyright © 2015 John Wiley & Sons, Ltd.

Internet of Things (IoT) is a fast-growing research area which spans various technological fields, including computer science, electronic engineering, mobile and wireless communications, embedded systems, etc. Many technologies serve as the building blocks of this new paradigm, such as wireless sensor networks, RFID, cloud services, machine-to-machine interfaces, and so on. IoT will allow billions of objects in the physical world as well as virtual environments to exchange data with each other in an autonomous way so as to create smart environments such as automotive, healthcare, logistics, environmental monitoring, and many others. However, IoT introduces new challenges for the security of systems and processes and the privacy of individuals. Protecting the information in IoT is a complex and difficult task. IoT requires global connectivity and accessibility, which means that anyone can access in anytime and anyway, and that the number of attack vectors available to malicious attackers might become staggering. Furthermore, the inherent complexity of the IoT, where multiple heterogeneous entities located in different contexts can exchange information with each other, further complicates the design and deployment of efficient, interoperable, and scalable security mechanisms. Ubiquitous and cloud computing also increase the urgency of the privacy leakage problem. As a result, there is an increasing demand for development of new security and privacy approaches to guarantee the security, privacy, integrity, and availability of resources in IoTs. Traditional security countermeasures cannot be directly used in IoTs because of the different standards and communication stacks involved. Moreover, the large number of interconnected devices in IoTs introduces scalability issues. Therefore, new and novel security and privacy methods, architectures, and solutions are needed to deal with security threats in IoTs. In this special issue, we are delighted to present a selection of nine papers, which, in our opinion, will contribute to the enhancement of knowledge in security and privacy research for IoTs. The collection of high-quality research papers provides a view on the latest research advances on security and privacy methods, architectures, and solutions in IoTs. The contributions of these papers are outlined in the succeeding text. In the first paper, A new authentication protocol for healthcare applications using wireless medical sensor networks with user anonymity, Xiong Li, Jianwei Niu, Saru Kumari, Junguo Liao, Wei Liang, and Muhammad Khurram Khan adopt the biometrics as the third authentication factor and propose a new authentication protocol to guarantee secure communication and protect the user privacy for healthcare application using WMSNs with user anonymity. In the proposed protocol, a wrong password detection mechanism is designed to reduce unnecessary computation and communication costs. In the second paper, Fusion: coalesced confidential storage and communication framework for the IoT, instead of developing independent security solutions, Ibrahim Ethem Bagci, Shahid Raza, Utz Roedig, and Thiemo Voigt present Fusion to address both the communication and storage security. The paper demonstrates that compared with performing traditional cryptographic operations separately, using the combined solution is much safer and more energy efficient. In the third paper, A changeable personal identification number-based keystroke dynamics authentication system on smart phones, Ting-Yi Chang, Cheng-Jung Tsai, Wang-Jui Tsai, Chun-Cheng Peng, and Han-Sing Wu propose a novel keystroke dynamics-based authentication (KDA) system to protect security of smart phones. Compared with the traditional KDA system, in the proposed new KDA system, the personal identification number codes of the subscribers can be well protected, and the users can change their personal identification number codes and passwords anytime without extra retraining. With the wide use of smart mobile devices, task collaborations among mobile devices are becoming ubiquitous and important. The security issues can be well guaranteed if the tasks can be effectively balanced. Therefore, in the fourth paper, SAFE-CROWD: secure task allocation for collaborative mobile social network, Xiaochen Fan, Panlong Yang, Qingyu Li, Dawei Liu, Chaocan Xiang, and Yonggang Zhao propose “SAFE-CROWD”, which is a secure task-allocation scheme. Using SAFE-CROWD, the tasks can be securely and collaboratively completed among mobile devices. In the fifth paper, ShoVAT: Shodan-based vulnerability assessment tool for Internet-facing services, Béla Genge and Cǎlin Enǎchescu propose a novel tool called Shodan-based vulnerability assessment tool (ShoVAT) to guarantee the automated vulnerability assessment of Internet-facing services. Based on the indexing capabilities of Shodan search engine, ShoVAT first finds services and then reconstructs key vulnerability identifiers. Finally, the vulnerabilities are obtained using National Vulnerability Database. The experiment results show that 3922 vulnerabilities are found on 1501 services in 12 different institutions. In the sixth paper, Distributed flood attack detection mechanism using artificial neural network in wireless mesh networks, Muhammad Altaf Khan, Shafiullah Khan, Bilal Shams, and Jaime Lloret propose an artificial neural network-based technique to detect distributed flooding attacks in multi-hop wireless mesh networks. The proposed scheme is named as the distributed flood attack detector. The distributed flood attack detector is designed to be implemented at mesh gateway in wireless mesh network. By using artificial neural networks, the network traffic can be divided into different categories, and thus, the flood attacks can be detected. In the seventh paper, Toward a flexible and fine-grained access control framework for infrastructure as a service clouds, Bo Li, Jianxin Li, Lu Liu, and Chao Zhou propose a flexible and fine-grained access control framework, named IaaS-oriented Hybrid Access Control (iHAC), to ensure that the resources cannot be illegally accessed or used. iHAC consists of three main parts: an IaaS-oriented Hybrid Access Control model, a VM-centric access control approach, and a VMM-enabled network access control mechanism. The simulation results show that iHAC can efficiently make correct access control decisions with acceptable performance overhead. In the eighth paper, An intrusion detection method for wireless sensor network based on mathematical morphology, Yanwen Wang, Xiaoling Wu, and Hainan Chen propose an innovative intrusion detection method called granulometric size distribution (GSD) method based on mathematical morphology to detect malicious attack in IoTs. If the number of active nodes in a wireless sensor network is fixed, the GSD curves are similar. Therefore, malicious nodes can be efficiently detected based on the abnormal GSD. In the last of the presented papers, A secure energy-efficient access control scheme for wireless sensor networks based on elliptic curve cryptography, Yuanyuan Zhang, Neeraj Kumar, Jianhua Chen, and Joel J. P. C. Rodrigues propose a secure energy-efficient access-control scheme for wireless sensor networks based on elliptic curve cryptography. The algorithm is explained in detail, and a variety of malicious attacks are simulated to evaluate the performance of the proposed algorithm. To summarize, we believe that this special issue will contribute to enhancing knowledge in security and privacy research in IoT in particular. In addition, we also hope that the presented results will stimulate further research in the important areas of information and network security. We also want to thank the editor-in-chief of the Security and Communication Networks journal, the leading researchers contributing to the special issue, and excellent reviewers for their great help and support that made this special issue possible.

Abstract Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature‐then‐encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute‐based signcryption (ABSC), which simultaneously achieves the functionalities of attribute‐based encryption and attribute‐based signature, two important cryptographic primitives proposed to enforce fine‐grained access control and user authentication in cloud computing applications. In this paper, we present a threshold ABSC scheme. The scheme is proven secure under the well‐established Decisional Bilinear Diffie–Hellman and the standard Computational Diffie–Hellman assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle. Furthermore, we construct an authenticated key agreement protocol based on this threshold attribute‐based signcryption from the point of improving the security of cloud computing. Copyright © 2016 John Wiley & Sons, Ltd.

With the explosion of big data, processing large numbers of continuous data streams, i.e., big data stream processing (BDSP), has become a crucial requirement for many scientific and industrial applications in recent years. By offering a pool of computation, communication and storage resources, public clouds, like Amazon's EC2, are undoubtedly the most efficient platforms to meet the ever-growing needs of BDSP. Public cloud service providers usually operate a number of geo-distributed datacenters across the globe. Different datacenter pairs are with different inter-datacenter network costs charged by Internet Service Providers (ISPs). While, inter-datacenter traffic in BDSP constitutes a large portion of a cloud provider's traffic demand over the Internet and incurs substantial communication cost, which may even become the dominant operational expenditure factor. As the datacenter resources are provided in a virtualized way, the virtual machines (VMs) for stream processing tasks can be freely deployed onto any datacenters, provided that the Service Level Agreement (SLA, e.g., quality-of-information) is obeyed. This raises the opportunity, but also a challenge, to explore the inter-datacenter network cost diversities to optimize both VM placement and load balancing towards network cost minimization with guaranteed SLA. In this paper, we first propose a general modeling framework that describes all representative inter-task relationship semantics in BDSP. Based on our novel framework, we then formulate the communication cost minimization problem for BDSP into a mixed-integer linear programming (MILP) problem and prove it to be NP-hard. We then propose a computation-efficient solution based on MILP. The high efficiency of our proposal is validated by extensive simulation based studies.

As a promising bio-cryptographic technique, the fuzzy extractor seamlessly binds biometrics and cryptography for template protection and key generation. However, most existing methods hardly solve the following issues simultaneously: (1) Fingerprint registration, (2) Verification accuracy, (3) Security strength, and (4) Computational efficiency. In this article, we introduce a bio-crypto-oriented fingerprint verification scheme - Selective Vertex-indexed Triangulation (SViT) which maps minutia global topology to local triangulation with minimum information loss. Then, a SViT-based fuzzy extractor framework (FE-SViT) is proposed and high verification accuracy is achieved. The FE-SViT is highly parallelizable and efficient which makes it suitable for embedded devices.

Alignment-free fingerprint cryptosystems perform matching using relative information between minutiae, e.g., local minutiae structures, is promising, because it can avoid the recognition errors and information leakage caused by template alignment/registration. However, as most local minutiae structures only contain relative information of a few minutiae in a local region, they are less discriminative than the global minutiae pattern. Besides, the similarity measures for trivially/coarsely quantized features in the existing work cannot provide a robust way to deal with nonlinear distortions, a common form of intra-class variation. As a result, the recognition accuracy of current alignment-free fingerprint cryptosystems is unsatisfying. In this paper, we propose an alignment-free fuzzy vault-based fingerprint cryptosystem using highly discriminative pair-polar (P-P) minutiae structures. The fine quantization used in our system can largely retain information about a fingerprint template and enables the direct use of a traditional, well-established minutiae matcher. In terms of template/key protection, the proposed system fuses cancelable biometrics and biocryptography. Transforming the P-P minutiae structures before encoding destroys the correlations between them, and can provide privacy-enhancing features, such as revocability and protection against cross-matching by setting distinct transformation seeds for different applications. The comparison with other minutiae-based fingerprint cryptosystems shows that the proposed system performs favorably on selected publicly available databases and has strong security.

In recent years, water pollution or contamination incidents happened frequently, causing serious disasters and negative social impact. To reduce the water contamination risk, water quality monitoring sensors should be deployed in water distribution system (WDS) to enable real-time pollution detection. It is desirable to deploy sensors everywhere so that any contamination event can be detected and reported in a timely manner. Unfortunately, this is a luxury and unrealistic vision because of high deployment cost. It is significant to lower the deployment cost provided that the quality-of-sensing, e.g., coverage and contamination detection time, can be guaranteed for effective depollution action. In this paper, we consider a water quality monitoring sensor network consisting of two kinds of sensors with different prices. The expensive one is of cellular communication capability and therefore is able to send sensing information to control center directly, while the cheaper one is of only sensor-to-sensor communication capability. We investigate a cost-efficient sensor deployment problem on how to deploy these two kinds of sensors in a given WDS to minimize the deployment cost, without violating the quality-of-sensing requirement. We first formulate the problem into a mixed integer quadratically constrained programming problem, which is then linearized into an equivalent mixed integer linear programming. We further propose a polynomial two-stage heuristic algorithm and evaluate its efficiency via extensive simulation-based studies.

Cloud data owners prefer to outsource documents in an encrypted form for the purpose of privacy preserving. Therefore it is essential to develop efficient and reliable ciphertext search techniques. One challenge is that the relationship between documents will be normally concealed in the process of encryption, which will lead to significant search accuracy performance degradation. Also the volume of data in data centers has experienced a dramatic growth. This will make it even more challenging to design ciphertext search schemes that can provide efficient and reliable online information retrieval on large volume of encrypted data. In this paper, a hierarchical clustering method is proposed to support more search semantics and also to meet the demand for fast ciphertext search within a big data environment. The proposed hierarchical approach clusters the documents based on the minimum relevance threshold, and then partitions the resulting clusters into sub-clusters until the constraint on the maximum size of cluster is reached. In the search phase, this approach can reach a linear computational complexity against an exponential size increase of document collection. In order to verify the authenticity of search results, a structure called minimum hash sub-tree is designed in this paper. Experiments have been conducted using the collection set built from the IEEE Xplore. The results show that with a sharp increase of documents in the dataset the search time of the proposed method increases linearly whereas the search time of the traditional method increases exponentially. Furthermore, the proposed method has an advantage over the traditional method in the rank privacy and relevance of retrieved documents.

Abstract Several great features offered by wireless sensor networks (WSN) result in its wide deployment in various remote and continuous monitoring applications. As such, managing huge collected readings in this domain posted many challenges due to its design limitations. In order to provide seamless data transmission, which is of utmost importance in those delay‐sensitive applications, minimum delay and packet loss occurrence should be considered. Specifically, this paper addresses the common issue of congested networks in WSN with the combination technique of variance‐based distributed contention control (DCC‐V) and packet size optimization. The proposed integration technique, which operates on medium access control layer, takes into consideration the packet size advantages as it plays a key role in determining successful data delivery, given the error‐prone nature of WSN. While ensuring fewer corrupted packets, the proposed contention window (CW) in DCC‐V minimizes the chances of packet collisions and so alleviates congestion. In this technique, CW is determined based on slot utilization and average collision values, which also involve standard deviation measurements. Simulation analysis using network simulator‐2 shows outstanding performance of the proposed solution compared with the existing IEEE 802.15.4 protocol. Copyright © 2014 John Wiley & Sons, Ltd.

The generation of representative computer system behavior profile from system calls in LINUX environments to establish reliable Host Based Anomaly Detection Systems (HADS) against Next Generation of Attacks (NGA) is a challenge due to two major reasons. Firstly, NGA causes a low footprint upon host activities and consequently, attack activities are difficult to detect from normal computer processes in terms of accuracy and processing time. Secondly, there is no effective method to extract the natural difference from the two different types of traces (e.g. normal or abnormal) of system calls. Following these reasons, a semi-supervised model is proposed, which is comprised of two parts. Firstly, to establish an unsupervised computer behavior classification, an integer data zero-watermarking algorithm is developed to extract abstract hidden representation of system calls. This hidden representation constitutes the natural difference between attack and normal computer system behavior in real-time. Secondly, various supervised Machine Learning (ML) algorithms and normalizations are realized with proposed hidden representation of the system calls to evaluate the semi-supervised model in HADS. To evaluate the performance in terms of accuracy and processing time, the publicly available bench mark host based data sets: ADFA-LD and KDD 98 have been utilized. Each data set is the collection of traces of processes and each trace comprises of process's system calls. Experimental results shows that the suggested semi-supervised model outperforms existing methodologies in terms of accuracy and processing time for the detection of low and high foot print attacks.

Signcryption is a public key cryptosystem that achieves the functions of digital signature and public key encryption simultaneously. It significantly reduces the cost of traditional signature-then-encryption approach. Although a large body of signcryption schemes have been proposed, few works have been done on attribute-based signcrytion (ABSC) which simultaneously achieves the functionalities of attribute-based encryption (ABE) and attribute-based signature (ABS), two important cryptographic primitives proposed to enforce fine-grained access control and user authentication in cloud computing applications. In this paper, we present a threshold attribute-based signcryption (TABSC) scheme. The scheme is proven secure under the well-established Decisional Bilinear Diffie-Hellman (DBDH) and the standard Computational Diffie-Hellman (CDH) assumptions in the standard model. Compared with the state of the ABSC art, our scheme has comparable efficiency without relying on any random oracle.

Body sensor networks (BSNs) are deployed around the human body to measure and process physiological signals in real time, which have wide application prospects in intelligent healthcare. Physiological signals measured and processed by BSNs involve individual privacy, thus security mechanisms must be developed to secure BSNs, and therein adoption of key negotiation protocols is fundamental. Due to stringently limited operation resources, BSNs require these protocols to be low-energy and highly efficient. Recent development has discovered that certain physiological signals can be used for efficiently negotiating common keys among biosensor nodes. These signals and fuzzy technology are used to design lightweight key negotiation protocols, and many solutions have been proposed. In this paper, we explore and classify these solutions, and evaluate their performance by analyzing their merits and demerits. Finally, we present open research issues that should be solved in the future.

The dramatic growth of mobile multimedia communications imposes new requirements on quality-of-service and energy efficiency in wireless networks. In this paper, we study the energy- and spectrum-efficient cooperative communication (ESCC) problem by exploiting the benefits of cooperative communication (CC) for mobile multimedia applications in multi-channel wireless networks. In a static network, it is formulated as a mixed-integer nonlinear programming problem. To solve this problem, we use linearization and reformulation techniques to transform it into a mixed-integer linear programming problem that is solved by a branch-and-bound algorithm with enhanced performance. To deal with the problem in dynamic networks, we propose an online algorithm with low computational complexity and deployment overhead. Extensive simulations are conducted to show that the proposed algorithm can significantly improve the performance of energy efficiency in both static and dynamic networks.

Detection of Denial-of-Service (DoS) attacks has attracted researchers since 1990s. A variety of detection systems has been proposed to achieve this task. Unlike the existing approaches based on machine learning and statistical analysis, the proposed system treats traffic records as images and detection of DoS attacks as a computer vision problem. A multivariate correlation analysis approach is introduced to accurately depict network traffic records and to convert the records into their respective images. The images of network traffic records are used as the observed objects of our proposed DoS attack detection system, which is developed based on a widely used dissimilarity measure, namely Earth Mover's Distance (EMD). EMD takes cross-bin matching into account and provides a more accurate evaluation on the dissimilarity between distributions than some other well-known dissimilarity measures, such as Minkowski-form distance Lpand X2statistics. These unique merits facilitate our proposed system with effective detection capabilities. To evaluate the proposed EMD-based detection system, ten-fold cross-validations are conducted using KDD Cup 99 dataset and ISCX 2012 IDS Evaluation dataset. The results presented in the system evaluation section illustrate that our detection system can detect unknown DoS attacks and achieves 99.95 percent detection accuracy on KDD Cup 99 dataset and 90.12 percent detection accuracy on ISCX 2012 IDS evaluation dataset with processing capability of approximately 59,000 traffic records per second.

After a decade of extensive research on application-specific wireless sensor networks (WSNs), the recent development of information and communication technologies makes it practical to realize the software-defined sensor networks (SDSNs), which are able to adapt to various application requirements and to fully explore the resources of WSNs. A sensor node in SDSN is able to conduct multiple tasks with different sensing targets simultaneously. A given sensing task usually involves multiple sensors to achieve a certain quality-of-sensing, e.g., coverage ratio. It is significant to design an energy-efficient sensor scheduling and management strategy with guaranteed quality-of-sensing for all tasks. To this end, three issues are investigated in this paper: 1) the subset of sensor nodes that shall be activated, i.e., sensor activation, 2) the task that each sensor node shall be assigned, i.e., task mapping, and 3) the sampling rate on a sensor for a target, i.e., sensing scheduling. They are jointly considered and formulated as a mixed-integer with quadratic constraints programming (MIQP) problem, which is then reformulated into a mixed-integer linear programming (MILP) formulation with low computation complexity via linearization. To deal with dynamic events such as sensor node participation and departure, during SDSN operations, an efficient online algorithm using local optimization is developed. Simulation results show that our proposed online algorithm approaches the globally optimized network energy efficiency with much lower rescheduling time and control overhead.

Object-oriented remote sensing image classification is becoming more and more popular because it can integrate spatial information from neighboring regions of different shapes and sizes into the classification procedure to improve the mapping accuracy. However, object identification itself is difficult and challenging. Superpixels, which are groups of spatially connected similar pixels, have the scale between the pixel level and the object level and can be generated from oversegmentation. In this paper, we establish a new classification framework using a superpixel-based graphical model. Superpixels instead of pixels are applied as the basic unit to the graphical model to capture the contextual information and the spatial dependence between the superpixels. The advantage of this treatment is that it makes the classification less sensitive to noise and segmentation scale. The contribution of this paper is the application of a graphical model to remote sensing image semantic segmentation. It is threefold. 1) Gradient fusion is applied to multispectral images before the watershed segmentation algorithm is used for superpixel generation. 2) A probabilistic fusion method is designed to derive node potential in the superpixel-based graphical model to address the problem of insufficient training samples at the superpixel level. 3) A boundary penalty between the superpixels is introduced in the edge potential evaluation. Experiments on three real data sets were conducted. The results show that the proposed method performs better than the related state-of-the-art methods tested.

Biometric cryptosystems provide an innovative solution for cryptographic key generation, encryption as well as biometric template protection. Besides high authentication accuracy, a good biometric cryptosystem is expected to protect biometric templates effectively, which requires that helper data does not reveal significant information about the templates. Previous works predominantly follow an appropriate entropy definition to measure the security of biometric cryptosystems. In this paper, we point out limitations of entropy-based security analysis and propose a new security analysis framework that combines information-theoretic approach with computational security. In addition, we construct a fingerprint-based multibiometric cryptosystem (MBC) using decision level fusion. Hash functions are employed in our construction to further protect each single biometric trait. The experimental results and security analysis demonstrate that the proposed MBC provides stronger security and better authentication accuracy compared with a cryptosystem based on single biometric.

Automated cell segmentation for microscopy cell images has recently become an initial step for further image analysis in cell biology. However, microscopy cell images are easily degraded by noise during the readout procedure via optical-electronic imaging systems. Such noise degradations result in low signal-to-noise ratio (SNR) and poor image quality for cell identification. In order to improve SNR for subsequent segmentation and image-based quantitative analysis, the commonly used state-of-art restoration techniques are applied but few of them are suitable for corrupted microscopy cell images. In this paper, we propose a multistaged method based on a novel integration of trend surface analysis, quantile-quantile plot, bootstrapping, and the Gaussian spatial kernel for the restoration of noisy microscopy cell images. We show this multistaged approach achieves higher performance compared with other state-of-art restoration techniques in terms of peak signal-to-noise ratio and structure similarity in synthetic noise experiments. This paper also reports an experiment on real noisy microscopy data which demonstrated the advantages of the proposed restoration method for improving segmentation performance.

In wireless sensor networks (WSNs), it has been observed that most abnormal events persist over a considerable period of time instead of being transient. As existing anomaly detection techniques usually operate in a point-based manner that handles each observation individually, they are unable to reliably and efficiently report such long-term anomalies appeared in an individual sensor node. Therefore, in this paper, we focus on a new technique for handling data in a segment-based manner. Considering a collection of neighbouring data segments as random variables, we determine those behaving abnormally by exploiting their spatial predictabilities and, motivated by spatial analysis, specifically investigate how to implement a prediction variance detector in a WSN. As the communication cost incurred in aggregating a covariance matrix is finally optimised using the Spearman’s rank correlation coefficient and differential compression, the proposed scheme is able to efficiently detect a wide range of long-term anomalies. In theory, comparing to the regular centralised approach, it can reduce the communication cost by approximately 80 percent. Moreover, its effectiveness is demonstrated by the numerical experiments, with a real world data set collected by the Intel Berkeley ResearchLab (IBRL).

ABSTRACT Various template protection techniques have been developed in the past few years, among which cancelable biometrics is a very popular and efficient one. It uses a noninvertible transformation to map an original template to a transformed domain to prevent the recovery of the original template from a compromised transformed template. Generally, cross‐template attacks over cancellable template schemes are evaluated through statistic independence metrics. In this paper, we investigate approaches to launch attacks through cryptanalysis. Four typical cancelable fingerprint template design algorithms have been investigated by applying the attack via record multiplicity attack to retrieve the original template. Concrete attack examples are also given to make the demonstration more intuitive and comprehensive. The results show that all of them are vulnerable if an attacker can obtain multiple transformed templates and their corresponding transformation parameters. Copyright © 2013 John Wiley & Sons, Ltd.

Host-based anomaly intrusion detection system design is very challenging due to the notoriously high false alarm rate. This paper introduces a new host-based anomaly intrusion detection methodology using discontiguous system call patterns, in an attempt to increase detection rates whilst reducing false alarm rates. The key concept is to apply a semantic structure to kernel level system calls in order to reflect intrinsic activities hidden in high-level programming languages, which can help understand program anomaly behaviour. Excellent results were demonstrated using a variety of decision engines, evaluating the KDD98 and UNM data sets, and a new, modern data set. The ADFA Linux data set was created as part of this research using a modern operating system and contemporary hacking methods, and is now publicly available. Furthermore, the new semantic method possesses an inherent resilience to mimicry attacks, and demonstrated a high level of portability between different operating system versions.

Although some nice properties of the Delaunay triangle-based structure have been exploited in many fingerprint authentication systems and satisfactory outcomes have been reported, most of these systems operate without template protection. In addition, the feature sets and similarity measures utilized in these systems are not suitable for existing template protection techniques. Moreover, local structural change caused by nonlinear distortion is often not considered adequately in these systems. In this paper, we propose a Delaunay quadrangle-based fingerprint authentication system to deal with nonlinear distortion-induced local structural change that the Delaunay triangle-based structure suffers. Fixed-length and alignment-free feature vectors extracted from Delaunay quadrangles are less sensitive to nonlinear distortion and more discriminative than those from Delaunay triangles and can be applied to existing template protection directly. Furthermore, we propose to construct a unique topology code from each Delaunay quadrangle. Not only can this unique topology code help to carry out accurate local registration under distortion, but it also enhances the security of template data. Experimental results on public databases and security analysis show that the Delaunay quadrangle-based system with topology code can achieve better performance and higher security level than the Delaunay triangle-based system, the Delaunay quadrangle-based system without topology code, and some other similar systems.

Being the most important critical infrastructure in Cyber-Physical Systems (CPSs), a smart grid exhibits the complicated nature of large scale, distributed, and dynamic environment. Taxonomy of attacks is an effective tool in systematically classifying attacks and it has been placed as a top research topic in CPS by a National Science Foundation (NSG) Workshop. Most existing taxonomy of attacks in CPS are inadequate in addressing the tight coupling of cyber-physical process or/and lack systematical construction. This paper attempts to introduce taxonomy of attacks of agent-based smart grids as an effective tool to provide a structured framework. The proposed idea of introducing the structure of space-time and information flow direction, security feature, and cyber-physical causality is innovative, and it can establish a taxonomy design mechanism that can systematically construct the taxonomy of cyber attacks, which could have a potential impact on the normal operation of the agent-based smart grids. Based on the cyber-physical relationship revealed in the taxonomy, a concrete physical process based cyber attack detection scheme has been proposed. A numerical illustrative example has been provided to validate the proposed physical process based cyber detection scheme.

Delay/Disruption Tolerant Network (DTN) differs from the conventional networks in that it has no continuous or contemporaneous connections among wireless nodes. Its inherent characteristic of intermittent connections makes existing routing solutions hardly to be applied directly. Epidemic routing using random linear network coding has been studied and proved as an efficient way for delivering small amount of data. To our best knowledge, we are the first to study high performance reliable transmission for bulk or stream-like data in DTNs. In this paper, we propose a dynamic segmented network coding scheme to efficiently exploit the transmission opportunity that is scarce in DTNs. In particular, we adopt a dynamic segment size control mechanism, which makes the segmentation adapt to the dynamics of the network. A lower bound of the expected delivery delay for bulk-data dissemination using segmented network coding is also derived. Both analytical and simulation results validate the high performance of our proposal. Several other interesting findings are also observed.

In this paper, we consider the reliable broadcast and multicast lifetime maximization problems in energy-constrained wireless ad hoc networks, such as wireless sensor networks for environment monitoring and wireless ad hoc networks consisting of laptops or PDAs with limited battery capacities. In packet loss-free networks, the optimal solution of lifetime maximization problem can be easily obtained by tree-based algorithms. In unreliable networks, we formulate them as min-max tree problems and prove them NP-complete by a reduction from a well-known minimum degree spanning tree problem. A link quality-aware heuristic algorithm called Maximum Lifetime Reliable Broadcast Tree (MLRBT) is proposed to build a broadcast tree that maximizes the network lifetime. The reliable multicast lifetime maximization problem can be solved as well by pruning the broadcast tree produced by the MLRBT algorithm. The time complexity analysis of both algorithms is also provided. Simulation results show that the proposed algorithms can significantly increase the network lifetime compared with the traditional algorithms under various distributions of error probability on lossy wireless links.

Intrusion detection systems are generally tested using datasets compiled at the end of last century, justified by the need for publicly available test data and the lack of any other alternative datasets. Prominent amongst this legacy group is the KDD project. Whilst a seminal contribution at the time of compilation, these datasets no longer represent relevant architecture or contemporary attack protocols, and are beset by data corruptions and inconsistencies. Hence, testing of new IDS approaches against these datasets does not provide an effective performance metric, and contributes to erroneous efficacy claims. This paper introduces a new publicly available dataset which is representative of modern attack structure and methodology. The new dataset is contrasted with the legacy datasets, and the performance difference of commonly used intrusion detection algorithms is highlighted.

Multiple targets tracking is a popular application with huge potentials in many practical areas, such as military air combat and civilian surveillance. Recent years, sensor networks, comprising of a large number of cheap, portable and tiny sensors, have attracted a lot of research interests in many disciplines. Alternative forms of sensors such as camera, can provide rich and vivid observation information. They have been widely applied into the environment monitoring or object surveillance. However, these devices are usually very expensive, especially, it becomes impractical to fulfill tasks cooperatively done within a group of such high cost devices. Recent work shows that despite the low information volume provided by the passive binary-detection based sensor, a group of such sensors can work together to achieve good target tracking performance. In this paper, we investigate a passive proximity binary sensor-based multiple target tracking system which can autonomically achieve the self-organized tracking capabilities without the intervention of human operators. The localization and tracking algorithm is achieve false alarm rates, robust under low detection probabilities and sensor ambiguity localization errors. Experimental results show promising performance in adopting this application in practice.

Doubly hidden Markov models (DHMMs) have been widely used to analyze a type of time process whose driving factors are hierarchical and hierarchically correlated. A common issue of these models is that they implicitly assume that the dwell time of any system state is constant or exponentially distributed. This property comes from the standard hidden Markov models and causes the DHMM to limitations in some actual application environment, where an application has latent temporal structure and does not follow the exponential distribution but has the period-like or variable-period feature. Such problems are frequently encountered in practice, e.g. network traffic. In this paper, we remove this limitation by a new structural discrete approach named nested hidden semi-Markov model. The proposed model includes a nested latent semi-Markov chain and one observable discrete stochastic process. The bottom latent semi-Markov chain is the core layer and controls the second-layer semi-Markov chain that generates the observable process. The state duration of both the semi-Markov chains can be variable or explicit. The model makes no assumptions on the distribution of the state-duration and the observable processes. An efficient forward and backward recursion procedure is developed for estimating the generator of the proposed model and inferring the underlying state processes for a given observation sequence. To evaluate the performance of the proposed model, we apply the model to the arrival process of network traffic and compare its simulation traffic and the real traffic. The performance evaluation in the experiments includes time dynamic process, auto-correlation, cross-correlation, statistical distribution and self-similarity.

Online anomaly detection (AD) is an important technique for monitoring wireless sensor networks (WSNs), which protects WSNs from cyberattacks and random faults. As a scalable and parameter-free unsupervised AD technique, $(k)$-nearest neighbor (kNN) algorithm has attracted a lot of attention for its applications in computer networks and WSNs. However, the nature of lazy-learning makes the kNN-based AD schemes difficult to be used in an online manner, especially when communication cost is constrained. In this paper, a new kNN-based AD scheme based on hypergrid intuition is proposed for WSN applications to overcome the lazy-learning problem. Through redefining anomaly from a hypersphere detection region (DR) to a hypercube DR, the computational complexity is reduced significantly. At the same time, an attached coefficient is used to convert a hypergrid structure into a positive coordinate space in order to retain the redundancy for online update and tailor for bit operation. In addition, distributed computing is taken into account, and position of the hypercube is encoded by a few bits only using the bit operation. As a result, the new scheme is able to work successfully in any environment without human interventions. Finally, the experiments with a real WSN data set demonstrate that the proposed scheme is effective and robust.

Network traffic modeling is a fundamental problem in communication. A traffic model should be able to capture and reproduce various properties of a real trace. Despite the widespread success of most numerical models in various applications, few actually focus on the oscillation behavior proven to be one of the basic properties in network traffic. In this paper, a new mathematical method is proposed to model and synthesize stationary and nonstationary oscillatory processes of network traffic. The proposed model is based on the structure of the hierarchical hidden Markov model, which includes two nested hidden Markov chains and one observable process. The first-layer hidden Markov chain with variable state-duration controls the time-varying oscillatory process. Conditional on the first-layer Markov chain, the local fluctuation process is modeled by the second-layer hidden Markov chain. Algorithms are derived for inference of model parameters and traffic synthesis. The proposed approach is compared with four classical models for performance evaluation. The selected performance criterion includes time structure, statistical properties, self-similarity, queuing behavior and multiscale properties. The flexibility and accuracy of the proposed model results in a close fit to the real traces.

A novel server-side defense scheme is proposed to resist the Web proxy-based distributed denial of service attack. The approach utilizes the temporal and spatial locality to extract the behavior features of the proxy-to-server traffic, which makes the scheme independent of the traffic intensity and frequently varying Web contents. A nonlinear mapping function is introduced to protect weak signals from the interference of infrequent large values. Then, a new hidden semi-Markov model parameterized by Gaussian-mixture and Gamma distributions is proposed to describe the time-varying traffic behavior of Web proxies. The new method reduces the number of parameters to be estimated, and can characterize the dynamic evolution of the proxy-to-server traffic rather than the static statistics. Two diagnosis approaches at different scales are introduced to meet the requirement of both fine-grained and coarse-grained detection. Soft control is a novel attack response method proposed in this work. It converts a suspicious traffic into a relatively normal one by behavior reshaping rather than rudely discarding. This measure can protect the quality of services of legitimate users. The experiments confirm the effectiveness of the proposed scheme.

Body sensor networks (BSNs) are distributed systems where biosensor nodes are distributed in different positions to collect health data from the human body and deliver the information to a remote medical center. Due to medical data regulations, security of BSNs is very important. However, the operational resources of biosensor nodes in BSNs are very restricted, and traditional security technologies are not directly applicable to BSNs. Due to characteristics of biosensors, time synchronization and low-energy communication are two challenging problems for BSNs. In this paper, a fuzzy commitment technology with weak time synchronization mechanism for keys negotiation is developed, with a multihop route key management scheme proposed for efficient energy consumption management, including an energy-based multihop-route-choice method. Security analyses and performance evaluation have been provided to validate the proposed scheme.

ABSTRACT Orthogonal frequency division multiplexing (OFDM) transmission equipped with multiple receive antennas constitutes a single‐input multiple‐output (SIMO) OFDM system. SIMO‐OFDM systems have been widely used in wireless communications. Compared to those approaches using training sequences, blind channel estimation methods for SIMO‐OFDM systems have the advantage of saving bandwidth and improving energy efficiency and system throughput. As far as blind channel identification is concerned, it is known that zero padding (ZP)‐based single‐input single‐output (SISO)‐OFDM systems have desirable features compared to conventional cyclic prefix (CP)‐based SISO‐OFDM systems. However, it is yet unknown whether ZP‐ or CP‐based SIMO‐OFDM systems are favourable for blind channel estimation. To investigate this problem, we first propose a short‐data effective method for blind channel estimation for ZP‐based SIMO‐OFDM systems. Then we analyse a number of issues surrounding blind channel estimation for ZP‐ and CP‐based SIMO‐OFDM systems. The issues brought up in the paper have not been discussed in the existing research. The significance of our investigation is that it provides a deep insight into blind channel estimation for ZP‐ and CP‐based SIMO‐OFDM systems. Copyright © 2011 John Wiley & Sons, Ltd.

Oblivious Transfer protocol (OTP) is a paramount important primitive tool in modern cryptography. Essentially, OTP can be used to construct a secure multi-party computation protocol and distributed oblivious transfer protocol (DOTP). DOTP is the general OTP in the distributed setting. Private information retrieval (PIR) and symmetric private information retrieval (SPIR) problems are also analogous to those of the OTP. Due to its importance, the task of constructing efficient and secure OTP has attracted a lot interests. In this paper, a paradigm of OPT protocol and a practical fully-simulatable OTP protocol based on blind GDH (Gap Diffie-Hellman) signature are presented. The proposed schemes can achieve higher efficiency and better security than the popular Malkhi & Sella scheme. The salient property of short signature length of GDH signature scheme enables our proposals applicable to low-bandwidth communication environments.

Future large-scale complex computing environments present challenges to the real-time intrusion detection systems (IDSs). In this paper, we design a prototype with hybrid software-enabled detection engine on the basis of our improved block-based neural network (BBNN), and integrate it with a high-frequency FPGA board to form a real-time intrusion detection system. The established prototype can seamlessly feed the large-scale NetFlow data obtained from Cisco routers directly into the improved BBNN based IDS. The corresponding BBNN structure and parameter settings have been improved and experimentally tested. Experimental performance comparisons have been conducted against four major schemes of Support Vector Machine (SVM) and Naive Bayes algorithm. The results show that the improved BBNN outperforms other algorithms with respect to the classification and detection performances. The false alarm rate is successfully reduced as low as 5.14% while the genuine detection rate 99.92% is still maintained.

Online anomaly detection is critical for protecting wireless sensor networks (WSNs) from cyber-attacks and random faults, which handles the streaming data in real-time. Comparing to other techniques, histogram-based anomaly detection is cheaper in computation, which should be suitable for WSNs. However, performing histogram-based anomaly detection with an online manner in WSNs is not a straightforward issue. Most of the existing histogram-based schemes have to depend on a verification procedure, which costs a great amount of computational overhead as well as communication overhead. Thus, it almost wipes out the advantage of low complexity of histogram-based anomaly detection. This paper introduces a simple estimating approach to detect anomalies with the histogram, which takes account into the distributed manner and online manner at the same time. It also proves the error caused by the new estimate is very small, through a theoretical analysis. Moreover, the optimal parameter will be suggested by minimizing the error. Finally, a set of experiments are implemented with a real WSN dataset, which prove the new scheme is effective and efficient.

Bio-cryptography is a new security technology which combines cryptography with biometrics. Fuzzy extractors are effective in terms of binding a cryptographic key to biometric features. However, most existing fuzzy extractors require fingerprint registration prior to the application of fuzzy extractors, and depend on error-correction codes to rectify the biometric uncertainty. This is not operative in practice due to low matching performance. In this paper, by taking full advantage of a Delaunay triangulation net, e.g. local structural stability, we propose a new registration-free Delaunay triangle-based fuzzy extractor. The new fuzzy extractor not only can mitigate biometric uncertainty but also eliminate the feature pre-alignment process in fingerprint authentication. Experimental results show that the proposed scheme achieves a better performance than those of the those of existing registration-based fuzzy extractor methods.

Many wireless sensor networks (WSNs) consist of a large number of distributed sensor nodes that are batteries powered, vulnerable to tampering, and equipped with limited computational capabilities and memory. These characteristics render WSNs facing many security threats, which require cryptographic security mechanisms for secure communication, key revocation and management of security issues arising from the addition of new nodes. In this paper, we propose a key management scheme to meet the security requirements of wireless sensor networks. The scheme relies on the theory of random graph to build a fully secure connectivity for distributed sensor nodes. It uses heterogeneous structure to limit ranges of attacks, and utilizes hash chains to realize authentication of pool keys and broadcast messages of auxiliary nodes. The security and network connectivity characteristics supported by the key management scheme are discussed and simulation experiments are presented.

Jiankun Hu, Yang Xiang, Wanlei Zhou; Advances in Network and System Security: Editorial Statement, The Computer Journal, Volume 55, Issue 4, 1 April 2012, Pages

doi: 10.1093/comjnl/bxr022 Comp J 2011;54(4): 549–569 This paper was intended to be published as part of the Advances in Network and System Security special issue butwas published separately in issue 54(4) of The Computer Journal in error.We would like to apologise to the authors for this oversight.

The majority of current anonymous systems focus on improving anonymity at the network and website level in order to defend against traffic analysis attacks. However, the vulnerability of the connections between end users and the anonymous network do not attract any attention yet. For the first time, we reveal an end user browsing dynamics based attack on anonymous browsing systems at the LAN where the victim locates. This new attack method is fundamentally different from existing attack methodologies. In general, web surfers browse the web following certain patterns, such as requesting a web page, viewing it and requesting another page. The browsing pattern of a victim can be clearly observed by a local adversary when the victim is viewing the web without protection. Unfortunately, browsing dynamics releases rich information for attacking even though the web page content is encrypted. In order to show how a local eavesdropper can decipher which pages have been viewed with the knowledge of user browsing dynamics and the public information of a given website, we established a specific hidden Markov model to represent browsing dynamics for the website. By using this model, we can then identify the optimal of the accessed pages using the Viterbi algorithm. In order to confirm the effectiveness of the revealed attack method, we have conducted extensive experiments on a real data set. The results demonstrated that the attack accuracy can be more than 80%. A few possible counter-attack strategies are discussed at the end of the paper.

SUMMARY This paper investigates face authentication based access control solutions for camera‐equipped mobile devices. A new hierarchical correlation based face authentication (HCFA) scheme is proposed, which suits resource‐constrained mobile devices such as mobile phones and personal digital assistants. The idea of HCFA is conducting a partial correlation output peak analysis (analyze the relationship between each cross‐correlation output peak generated from selected sub‐regions of a face), in conjunction with conventional direct cross‐correlation methods. The experimental results on the public domain database demonstrate that the proposed scheme achieved better performance than that of the conventional direct correlation based schemes. Furthermore, HCFA was implemented on the Nokia S60 CLDC emulator using Java ME (previously J2ME) programming technology in order to test the applicability and implementability. The test results show that the proposed algorithm is implementable on mobile devices. It not only shortens processing time but also reduces resource demand significantly, compared with the direct correlation algorithms. Copyright © 2011 John Wiley & Sons, Ltd.

Current computer networks and systems are facing serious threats from cyber terrorism andcrime, which cause huge financial loss and potential life hazard. Although these attack systems have become more easy-to-use, sophisticated, and powerful, interest has greatly increased in the field of building more effective, intelligent, adaptive, active, and high performance networks and systems. This special issue focuses on issues related to Network and System Security, such as authentication, access control, availability, integrity, privacy, confidentiality, dependability and sustainability of computer networks and systems. We are pleased to present to you eight technical papers dealing with cutting-edge research and technology related to this topic. These papers were selected out of the significantly extended versions of the 131 submissions from 44 countries in the 4th International Conference on Network and System Security (NSS 2010) and a large number of open submissions. The selection has been very rigorous and only the best papers were selected. In the first paper, ‘DHTrust: A robust and distributed reputation system for trusted peer-to-peer Networks’ 1, Xue et al. propose a robust and distributed reputation system, DHTrust, which takes full advantage of the distributed hash table to distribute local reputation to trade off the damage of fake reputation information by genuine reputation information. This system can effectively distinguish and evaluate the fundamental behaviors of peers in peer-to-peer networks and thus to provide service and issue reputation scores. In the second paper, ‘Breaking Tor anonymity with game theory and data mining’ 2, Wagner et al. propose a mechanism to break Tor anonymity with one rogue exit node. The attack is composed of two elements: an active tag injection scheme and an inference attack that leverages a semi-supervised learning algorithm to reconstruct browsing sessions. A prototype is implemented and its performance is evaluated on the Tor network. The article also describes several countermeasures and interesting advanced attacks. In the third paper, ‘Mobile device access control: an improved correlation based face authentication scheme and its Java ME application’ 3, Xi et al. investigate face authentication based access control solutions for camera-equipped mobile devices. They propose a new hierarchical correlation based face authentication scheme by analyzing the relationship between each cross-correlation output peak generated from selected subregions of a face, in conjunction with conventional direct cross-correlation methods. The proposed algorithm is implementable on mobile devices with shortened processing time and reduced resource demand. In the fourth paper, ‘Energy efficient authentication strategies for network coding’ 4, Apavatjrut et al. investigate different strategies based on message authentication codes algorithms to deal with the attacks against network coding schemes. In wireless sensor networks, the node resources are limited in energy and in computational power. The authors develop new strategies to defend against pollution attacks on wireless sensor networks. In the fifth paper, ‘On the identity anonymization of high dimensional rating data’ 5, Sun et al. study the challenges of protecting privacy of individuals in the large public survey rating data, which is prone to attacks that can potentially identify user information. The authors propose a greedy approach to anonymize survey rating data that scales almost linearly with the input size. They apply the method to two real-life data sets to demonstrate their efficiency and practical utility. Intrusion detection systems (IDS) have been widely deployed in practice for detecting malicious behaviors. In the sixth paper, ‘An alert correlation platform for memory-supported techniques’ 6, Roschke et al. present a new way to enhance the detection process of intrusion detection systems by correlation and clustering of alerts. The proposed platform can be distributed over multiple processing units to share memory and processing power. The efficiency and the effectiveness of the platform is tested by practical experiments with several alert storage approaches, multiple algorithms, as well as a local and a distributed deployment. In the seventh paper, ‘CAFS: A novel lightweight cache-based scheme for large-scale intrusion alert fusion’ 7, Wen et al. propose a lightweight cache-based alert fusion scheme that is capable of reducing the quantity of useless alerts generated by an intrusion detection system and enhance the accuracy of alerts, therefore greatly reducing the cost of fusion processing. The authors also present reasonable and practical specifications for the target-oriented fusion policy that provides a quality guarantee on alert fusion. In the last paper, ‘A purpose based access control in native XML databases’ 8, Sun and Wang propose a model for privacy preserving access control based on the notion of purpose. In this model, purpose information associated with given data elements in an XML document specifies the intended use of the data elements. A new approach is proposed to represent purpose information to support access control based on purpose information. This method relies on usage access control models and the components, which are based on the notions of the purpose information used in subjects and objects. We sincerely hope that you will enjoy reading these papers and find them interesting. We thank all the international reviewers for their professional services. We deeply thank Professor Geoffrey Fox, the Editor-in-Chief, for providing this opportunity to publish this special issue. With his continuous support, encouragement and guidance throughout this publishing project, this special issue has been very successful.

Reducing the redundancy of spectral information is an important technique in classification of hyperspectral image. The existing methods are classified into two categories: feature extraction and band selection. Compared with the feature extraction, the band selection method preserves most of the characteristics of the original data without losing valuable details. However, the choice of the effective band remains challenging, especially when considering the computational burden, which makes many enumerative methods infeasible. Recently, immune clonal strategy (ICS) has been applied to solve complex computation problems. The major advantages of algorithms based on ICS are that they are highly paralleled, distributed, adaptive, and self-organizing. Therefore, in this paper, we convert the band selection problem into an optimization issue and propose a new algorithm, ICS-based effective band selection (ICS-EBS), to select effective band combinations. Then, the selected bands are used in classification of hyperspectral image. We evaluated the proposed algorithm by using two data sets collected from the Washington DC Mall and Northwest Tippecanoe County. ICS-EBS was compared against one latest proposed band selection algorithm, interclass separability index Algorithm (ICSIA). We also compared the results with those achieved by other stochastic algorithms such as genetic algorithm (GA) and ant colony optimization (ACO). The experimental results indicate that our proposed algorithm outperforms ICSIA, GA-EBS, and ACO-EBS for hyperspectral image classification.

In this paper, multiple detection engines with multi-layered intrusion detection mechanisms are proposed. The principle is to coordinate the results from each single-engine intrusion alert system, by seamlessly integrating with the multiple layered distributed service-oriented structure. An improved hidden Markov model (HMM) is created for the detection engine which is capable of the immunology-based self/nonself discrimination. The classifications of normal and abnormal behaviours of system calls are further examined by an advanced fuzzy-based inference process called HPSOWM. Considering a real benchmark dataset from the public domain, our experimental results show that the proposed scheme can greatly shorten the training time of HMM and reduce the false positive rate significantly. The proposed HPSOWM especially works for the efficient classification of unknown behaviors and malicious attacks.

The International Conference on Network and System Security (NSS) is an annual conference on all theoretical and practical aspects related to information, network, and system security. The fifth International Conference on Network and System Security (NSS 2011) was held in Milan, Italy, September 6 to September 8, 2011.

The objective of self-healing key distribution is to enable group users to recover session keys by themselves, without requesting additional transmissions from the group manager (GM), even when they miss some broadcast messages. One major benefit of the self-healing key distribution mechanism is the reduction of energy consumption due to the elimination of such additional transmission. Also in some applications, e.g., uni-directional broadcast channel from the GM, the self-healing key distribution mechanism seems to be the ideal solution. Desired features of self-healing key distribution schemes include energy awareness, short broadcast message, efficient users addition, revocation and so on. A primary challenge is managing the trade-off between providing an acceptable level of security and conserving scarce resources in particular energy which is critical for wireless network operations. Over a decade, a great number of self-healing key distribution schemes have been proposed for establishing a group key amongst a dynamic group of users over an unreliable, or lossy, network. In this paper a comprehensive survey is conducted on the state-of-the-art in the field of self-healing key distribution. First, we clarify the security requirements of self-healing key distribution scheme for their special application environment. Then, we present a classification of self-healing key distribution schemes according to different cryptographic primitives, and give an insight to their features and goals. Furthermore, we consider several problems, namely authentication on broadcast messages, sponsorization and mutual-healing, related to the robustness of self-healing key distribution schemes. At last, we delineate their similarities and differences and outline several future research directions.

Cloud security is a major concern that may delay its widespread adoption. User access control (UAC) is the core component of security in cloud computing environment, aiming to ensure that stored data are allowed to be accessed only by authenticated/authorized users. As a typical behavioural biometrics, keystroke dynamics provides a promising UAC solution. The most challenging issue that hinders the wide deployment of keystroke is the high verification error rate. Gunetti et al. proposed a classical n-graph-based keystroke verification method (GP method), which can achieve a low False Acceptance Rate (FAR). However, the GP method suffers from a high False Rejection Rate (FRR) and a severe scalability issue. Thus, GP is not a feasible solution for computing cloud application where scalability is a big issue. In this paper, two keystroke verification approaches (nGdv-V and nGdv-C) are proposed to overcome GP's shortcomings. To reduce high FRR, we designed a new correlation measure using n-graph equivalent feature (nGdv) that enables more accurate recognition for genuine users. Moreover, correlation-based hierarchical clustering is proposed to address the scalability issue. The experimental results show that the nGdv-C can produce much lower FRR while achieving almost the same level of FAR as that of the GP method. Furthermore, 1250 times (when using nGdv-V) and three times (when using nGdv-C(17,4)) authentication speed gains have been achieved.

Identifying incomplete or partial fingerprints from a large fingerprint database remains a difficult challenge today. Existing studies on partial fingerprints focus on one-to-one matching using local ridge details. In this paper, we investigate the problem of retrieving candidate lists for matching partial fingerprints by exploiting global topological features. Specifically, we propose an analytical approach for reconstructing the global topology representation from a partial fingerprint. First, we present an inverse orientation model for describing the reconstruction problem. Then, we provide a general expression for all valid solutions to the inverse model. This allows us to preserve data fidelity in the existing segments while exploring missing structures in the unknown parts. We have further developed algorithms for estimating the missing orientation structures based on some a priori knowledge of ridge topology features. Our statistical experiments show that our proposed model-based approach can effectively reduce the number of candidates for pair-wised fingerprint matching, and thus significantly improve the system retrieval performance for partial fingerprint identification.

This paper provides an editorial statement for the special issue on biometric security in mobile computing environment.

Abstract Cryptography is one of the key elements in providing security for modern e‐commerce systems. It is well known that software‐based encryption has built‐in security weaknesses due to storing and managing digital certificates/keys in a high‐risk environment such as a local hard disk or software. This makes embedded hardware encryption a superior solution. However, most existing embedded hardware encryption modules need additional dedicated software in order to implement a secure e‐commerce application, which increases cost as well as adds complexity. In this paper, a new embedded hardware DSP (digital signal processor) encryption module, using the RSA (Rivest, Shamir, and Adleman) algorithm, is developed for secure e‐commerce transactions from the client side. The goal is to seamlessly integrate the embedded DSP hardware encryption module, which combines computational power and flexibility in programming, with a widely available web browser that provides the required e‐commerce functions. The integrated system can store and process security sensitive data inside the plug‐in hardware. The proposed scheme tries to maximize security strength while limiting overheads by utilizing a widely available web browser to perform e‐commerce functions such as product searching, etc. A fully functional web e‐commerce system has been developed as a proof of concept. Our major contribution is a design of a functional RSA plug‐in encryptor which can store and encrypt sensitive information originated from the e‐commerce process using standard web browsers. Implementation details addressing challenging issues such as big integer, large message, and communication components have been provided which have never been reported in the public literature. This can be very useful for real‐life industry security applications. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract Electrocardiography (ECG) signal is popularly used for diagnosing cardiovascular diseases (CVDs). However, in recent times ECG is being used for identifying person. As ECG signals contain sensitive private health information along with details for person identification, it needs to be encrypted before transmission through public media. Moreover, this encryption must be applied with minimal delay for authenticating CVD patients, as time is critical for saving CVD affected patient's life. Within this paper, we propose the usage of multi‐scroll chaos to encrypt ECG packets. ECG packets are being encrypted by the mobile phones using the chaos key by patients' subscribed in tele‐cardiology applications. On the other hand, doctors and hospital attendants receive the encrypted ECG packets, which can be decrypted using the same chaos key. Using the techniques described in this paper, end‐to‐end security can be applied to wireless tele‐cardiology application, with minimal processing. Our experimentation with 12 ECG segments shows that with multi‐scroll chaos implementation, CVD patients remain completely unidentified, upholding patients' privacy and preventing spoof attacks. Most importantly, the proposed method is 18 times faster than permutation‐based ECG encoding, 25 times faster than wavelet‐based ECG annonymization techniques and 31 times faster than noise‐based ECG obfuscation techniques, establishing the proposed technique as the fastest ECG encryption system according to the literature. Copyright © 2010 John Wiley & Sons, Ltd.

Abstract With fast evolution of mobile devices and mobile network, the need of protecting user sensitive information locally and performing secure user authentication remotely become evermore increasing. Bio‐cryptography is emerging as a powerful solution which can combine the advantages of conventional cryptography and biometric security. In this paper, we present an efficient bio‐cryptographic security protocol designed for client/server authentication in current mobile computing environment, with a reasonable assumption that server is secure. In this protocol, fingerprint biometric is used in user verification, protected by a computationally efficient Public Key Infrastructure (PKI) scheme, Elliptic Curve Cryptography (ECC). The genuine fingerprint information is hidden in the feature vault which is the mixture of genuine and chaff features. Fingerprint features are not only used for biometric verification but also for cryptographic key generation. Our security analysis shows that the proposed protocol can provide a secure and trustworthy authentication of remote mobile users over insecure network. Experimental results on public domain database show an acceptable verification performance. We also tested the computational costs and efficiency of our protocol on the CLDC emulator using Java ME (previous J2ME) programming technology. The simulation results prove that the proposed protocol suits current mobile environment. Copyright © 2010 John Wiley & Sons, Ltd.

Biometrie authentication systems can address the problems of genuine user verification and usability suffered by the conventional cryptosystems based on the password and token. However, as biometrics is not replaceable, its privacy has become a concern. Also, if the same biometrics is used in multiple applications, it will be vulnerable to potential cross-matching attacks. In this paper, a projection line method is proposed for cancelable fingerprint template design. The main advantage of this method is its simplicity. Because there exist many possibilities projecting minutia into the projection line controlled by the whole range of possible projection line properties, the proposed approach offers non-invertible transformation and also possess good revocability property.

In fingerprint feature extraction, it is perceived that pixel-level image rotation transformation is a lossless transformation process. In this paper, investigation has been conducted on analyzing the underlying mechanisms of fingerprint image rotation processing and potential effect on the major features, mainly minutiae and singular point, of the rotation transformed fingerprint. Qualitative and quantitative analysis have been provided based on the intensive experiments. It is observed that the information integrity of the original fingerprint image can be significantly compromised by the image rotation transformation process, which can cause noticeable singular point change and produce non-negligible number of fake minutiae. It is found that the quantization and interpolation process can change the fingerprint features significantly though they may not change the image visually.

The availability of group communications over inexpensive wireless networks has facilitated new types of applications and created new security challenges. One of the security challenges is how to securely distribute session keys over wireless networks. Self-healing key distribution mechanism is an ideal countermeasure for enabling session key distribution and recovery. In order to address the issue that personal keys could not be reused if more than a threshold number of nodes are revoked in self-healing key distribution schemes, a new self-healing key distribution scheme using bilinear pairings is proposed in this paper. Another motivation for developing this new scheme is to reduce computation cost in some existing ID-based self-healing key distribution schemes. The new scheme enables users to have constant size personal keys. The personal key of each user can be reused as long as it is not disclosed. Further, any coalition of non-authorized users can not recover the session keys. That is, the scheme is collusion-free secure. The ID-based scheme can support key management by mitigating the certificate management overload. Additional advantage includes sliding-window mechanism can be applied to our scheme such that it is unnecessary to determine the number of sessions during the Setup procedure.

While witnessing a remarkable and rapid emergence of Wireless Sensor Network (WSN) that seems to facilitate promising features, congestion problem still remains the key issue that attract very high attention in research community. Congestion not only severely degrades network performance, but also gives adverse quality to various related applications such as real-time monitoring systems that demands strict and stringent requirements. A robust solution is therefore required to mitigate this critical issue, yet to cope with challenging dynamic WSN's nature. Concerning this issue, in this paper, we have investigated a potential solution to alleviate congestion by determining an appropriate packet size in various error conditions. This prospective factor have high potential in improving network efficiency by maximizing the link utilization and minimizing the number of retransmissions, thus ensuring reliability. In addition, the error-prone characteristic and noisy channel in sensor network increase the needs for determining appropriate packet size during data transmission in order to massively reduce congestion and helps providing consistent WSN's performance. This paper investigates the impact of varying packet size in various Bit Error Rate (BER) conditions and highlights other key factors that may help alleviate congestion in WSN. Simulation study demonstrates an overall network efficiency improvement and favourable performance.

Biometric authentication is emerging as the promising solution to conventional cryptography based authentication technologies. However, protecting users' biometric templates stored in a mobile device in a secure way is a challenge issue and has attracted many attentions. As one of the possible solutions, the Fuzzy Vault construct binds a secret key and biometric information to provide template protection. Most existing Fingerprint Fuzzy Vault algorithms use pre-aligned fingerprint impressions and rely strongly on image registration, a process that is well known to be nontrivial and unreliable. Moreover, it is inherently insecure to store raw fingerprint images for the alignment. In this paper, we propose a Fingerprint Fuzzy Vault based on composite features which are reliable, distortion tolerant and registration-free. Experimental results on public database show that our scheme can improve verification performance significantly.

The wide-spread use of mobile devices has made it possible to develop mobile voting system as a complement to the existing electronic voting system. However, due to limited onboard resource, it is challenging to achieve both efficiency and security strength for mobile voting system. Conventional solution is to either use symmetric encryption algorithms or hybrid symmetric and asymmetric algorithms at the expense of weaker security strength. In our proposed mobile voting scheme, the users' votes are secured by using the elliptic curve cryptography (ECC) algorithm. ECC is chosen as it has smaller key size than other public key cryptographies; and its homomorphic encryption property which is able to keep users' anonymity. We evaluate the method of ECDH with AES and ECC in comparison with our proposed method. The experiment demonstrates that our proposed ECC based scheme can outperform the traditional hybrid symmetric and asymmetric cryptographic scheme in the context of mobile evoting environment.

SCADA (supervisory control and data acquisition) systems control and monitor industrial and critical infrastructure functions, such as the electricity, gas, water, waste, railway and traffic. Recent attacks on SCADA systems highlight the need of a SCADA security testbed, which can be used to model real SCADA systems and study the effects of attacks on them. We propose the architecture of a modular SCADA testbed and describe our tool which mimics a SCADA network, monitors and controls real sensors and actuators using Modbus/TCP protocol. Using distributed denial of service (DDoS) scenarios we show how attackers can disrupt the operation of a SCADA system.

Keystroke dynamics exhibit people's behavioral features which are similar to hand signatures. A major problem hindering the large scale deployment of this technology is its high FAR (false acceptance rate) and FRR (false rejection rate). A significant progress, in terms of improving the FAR and FRR performance, has been made by the work of Gunetti and Picardi (2005). However, their identification based authentication suffers a severe scalability issue as it needs to verify the input with every training sample of every user within the whole database. In this paper, a k-nearest neighbor approach has been proposed to classify users' keystroke dynamics profiles. For authentication, an input will be checked against the profiles within the cluster which has greatly reduced the verification load. Experiment has demonstrated the same level of FAR and FRR as that of Gunetti and Picardi approach while as high as 66.7% improvement of the authentication speed has been achieved.

Abstract In this paper, an investigation is conducted on the security issues in massive multiplayer games. A taxonomy framework for online cheating is provided. Under this proposed framework, online cheating is classified and state of the art counter‐cheating techniques are analysed with emphasis on attacks that pose a considerable challenge to the security of massive multiplayer online games. Copyright © 2008 John Wiley & Sons, Ltd.

Generating reliable biometric passwords/PINs is a very challenging research topic in access security control. This paper provides a method for the generation of a reliable password/PIN from fingerprint images. A fictitious triangle whose sides are composed of lines connecting two minutiae points closest to the core of a fingerprint image is constructed. The maximal side, the minimal and medial angles, together with the minutiae type involved in the three sides of this triangle are used as the source of password/PIN generation. The noise-tolerant transform criteria convert a decimal value to one digit PIN is provided. Experiments based on public database are presented.

An orientation model provides an analytical means for describing fingerprint ridge orientations. It can help in data storage and recovery as well as other possible communication applications related to biometric security. Since fingerprint ridge patterns often possess both smooth features and high curvature patterns, it is not easy to describe the overall topology with a single analytical model. A combination approach of different models is a way to address the problem. In this paper, we explore this topic by investigating local orientation models for estimating high curvature patterns in the singular regions. Our experimental results show that the resulting combination approach can improve the overall topology estimation and thus the end performance of a fingerprint authentication system.

In this paper, we have proposed a fingerprint orientation model based on 2D Fourier expansions (FOMFE) in the phase plane. The FOMFE does not require prior knowledge of singular points (SPs). It is able to describe the overall ridge topology seamlessly, including the SP regions, even for noisy fingerprints. Our statistical experiments on a public database show that the proposed FOMFE can significantly improve the accuracy of fingerprint feature extraction and thus that of fingerprint matching. Moreover, the FOMFE has a low-computational cost and can work very efficiently on large fingerprint databases. The FOMFE provides a comprehensive description for orientation features, which has enabled its beneficial use in feature-related applications such as fingerprint indexing. Unlike most indexing schemes using raw orientation data, we exploit FOMFE model coefficients to generate the feature vector. Our indexing experiments show remarkable results using different fingerprint databases.

TCP is known to have bandwidth fairness problems for flows of different RTT. Highspeed TCP, which adapts TCP's congestion avoidance to grow faster, and thus be able to scale to high bandwidth environments, aggravates the RTT fairness problem since the congestion window increases at a rate proportional to the RTT and the current window size. We propose a method to eliminate the RTT fairness problem for competing high bandwidth flows. We decouple the rate of window growth in Highspeed TCP from the current window size, such that competing flows adjust their window size, instead, according to their perceived byte sending rate. We derive condiitions and a normalisation scheme to ensure that high bandwidth competing flows converge to fair bandwidth allocation regardless of the RTT or segment size used, while maintaining Highspeed TCP's ability to scale to very high bandwidth environments. We introduce features to preserve TCP friendliness in low bandwidth environments such that, the RTT fairness is no worse than that of standard TCP in scenarios of moderate packet loss. We have conducted simulations to validate the abilities of our proposal to eliminate the RTT bias from Highspeed TCP.

Key management is a major challenge in the design and deployment of secure wireless sensor networks. A common assumption in most distributed key management schemes is that all sensor nodes have the same capability. However, recent research work has shown that the connectivity and lifetime of the sensor network can be substantially improved if a small number of sensor nodes have more energy capacity and transmission capability. Therefore, how to utilize these heterogeneity features to design a good distributed key management scheme has become an important issue and needs to be explored. In this paper, we propose a framework for key management schemes in distributed wireless sensor networks with heterogeneous sensor nodes. We show by simulations analysis that, with a small number of heterogeneous nodes, the wireless sensor network can achieve higher key connectivity and higher resilience

In this paper, we first develop a delay-dependent condition for the stability and Hinfinperformance of systems with time-variant delays in both the state and output equations in terms of an LMI (linear matrix inequality). The analysis result is then applied to derive a Hinfincongestion control where the congestion problem is formulated as the Hinfincontrol of systems with time-variant input delays. Illustrative examples are provided to show excellent performance of the proposed algorithm in achieving an equilibrium in the buffer occupancy in the presence of time-variant delays. To the best of our knowledge, no such congestion control approach that directly accommodates the issue of the uncertain time-variant delays has been reported

It is known that analytic modelling for TCP latency is a non trivial task. Recently, some significant progress has been made, such as the comprehensive result by Sikdar et al. However, models similar to these often rely on trial and error methods such as "data fitting". This can lead to a very limited scope for the resulting model and also large estimation error. In this paper, we propose improvements to Sikdar's SACK TCP model. A new delayed acknowledgement slow start model is developed that is analytically derived from the slow start algorithm which provides a novel mechanism to model the relationship between RTT and the delayed acknowledgement timer. We introduce a simple mechanism to include time taken to send an HTTP get request to broaden the scope of our SACK TCP model to Website file transfer. Simulation and live Internet experimentation has validated our scheme.

This is a case study on using a DSP board to construct an encryption/decryption module embedded in a e-commerce Web server. The idea of using DSP is to push beyond the key length limits of encryption/decryption algorithms and computational power in a software environment while avoiding the heavy investment in a dedicated hardware encryptor/encryptor. The low cost, high computational power, high flexibility of DSP and the ubiquitous availability of a PC peripheral component interconnect slot for the DSP can provide any Web browser or Web server an excellent cost-effective option to improve the security level of Internet applications. The paper provides a step-by-step procedure and reveals every detail of a successful implementation of a DSP RSA encryptor/decryptor for an e-commerce Web server by using the latest TMS320C6000/sup TM/ Evaluation Module (EVM) DSP hardware. A strong prime concept and Garner algorithm are introduced to generate more secure keys and compute encryption/decryption more efficiently than that of recent publications. Experiments show that the performance of using DSP hardware encryption can be 300 times faster than that in software environment.