Although Software-Defined Networking (SDN) introduces architectural innovations, it retains fundamental network properties. As a result, Low-rate Denial of Service (LDoS) attacks, which exploit bottleneck links and TCP congestion control mechanisms, still pose a serious threat to SDN. Currently, to accurately detect LDoS attacks at lower average attack rates, many methods focus on extracting and analyzing single-dimensional features. However, these methods are often complex and offer only limited improvements in detection accuracy. Moreover, critical security vulnerabilities in mainstream mitigation strategies highlight their inability to ensure long-term stability. To this end, we propose BDTM, a cross-dimensional bidirectional detection and traceability mitigation scheme. Through attack parameter estimation with a precision of 0.1s, BDTM achieves precise detection of LDoS attacks that incorporate IP spoofing. In terms of mitigation, we have identified, verified, and resolved critical vulnerabilities in existing mainstream mitigation strategies for the first time. Upon detecting an attack, BDTM rapidly mitigates the ongoing anomaly while performing reverse-flow tracing to pinpoint the attacking host. Ultimately, BDTM enforces port-level isolation targeting the attacker rather than the attack flows, ensuring more effective and comprehensive mitigation. Experimental results demonstrate that BDTM achieves a high detection accuracy of 98.85%, with an average response time of just 5.67s when performing attack traceability.

Summary Role mining was recently proposed to automatically find roles among user‐permission assignments using data mining technologies. However, the current studies about role mining mainly focus on how to find roles, without considering the constraints that are essentially required in role‐based access control systems. In this paper, we present a role mining algorithm with constraints, especially for the cardinality constraints. We illustrate it is essential for role mining to take cardinality constraints into account, and introduce the concepts of the cardinality constraints of roles and permissions. We further propose a role mining algorithm to generate roles based on these two kinds of cardinality constraints. The algorithm uses graph theory to model the role mining problem and maps the relation of two roles to the relation of graph elements. We set an optimization goal for role mining and employ graph optimization theory to find roles that satisfy the aforementioned cardinality constraints. We carry out the experiments to evaluate our approach. The experimental results demonstrate the rationality and effectiveness of the proposed algorithm. Copyright © 2015 John Wiley & Sons, Ltd.

Constraint is an essential aspect of role-based access control RBAC and is sometimes argued to be the principle motivation for RBAC. However, most of role mining algorithms do not consider the constraint. Furthermore, they just compare the least cost of the authorization process but do not consider how to assess the accuracy of the derived role state, thus, providing the motivation for this work. In this paper, we first define a wide variety of constraints, especially the permission cardinality constraint and user cardinality constraint. We further propose a role mining algorithm to generate roles based on these two kinds of cardinality constraints that consider the similarity between roles in the process of merging roles in order to improve the accuracy of the role state at the same time. Finally, we carry out the experiments to evaluate our approach. The experimental results demonstrate the effectiveness of our proposed algorithm. Copyright © 2014 John Wiley & Sons, Ltd.

Recently, there are many approaches proposed for mining roles using automated technologies. However, it lacks a tool set that can be used to aid the application of role mining approaches and update role states. In this demonstration, we introduce a tool set, RMiner, which is based on the core of WEKA, an open source data mining tool. RMiner implements most of the classic and latest role mining algorithms and provides interactive tools for administrator to update role states. The running examples of RMiner are presented to demonstrate the effectiveness of the tool set.

Cloud-oriented service mashup can aggregate many services to provide personalized services for end-users on demand. However, how to securely aggregate mashup services becomes a bottleneck of hampering the development of cloud computing. In this paper, we present a secure cloud service mashup framework called SMEF to address this problem. In SMEF, we employ security entropy to measure the unascertained security degree of service mashup. The nonfunctional criteria of SMEF are aggregated as a single criterion by defining a utility function. Then the relatively optimal mashup services are selected to meet the user requirements. Finally, we have implemented a simulation of SMEF and conducted extensive experiments using simulations of different sizes of services and security factors. Experimental results show the feasibility and efficiency of the SMEF service mashup framework.

Abstract The principle of least privilege in role‐based access control is an important area of research. There are two crucial issues related to it: the specification and the enforcement. We believe that the existing least privilege specification schemes are not comprehensive enough and few of the enforcement methods are likely to scale well. In this paper, we formally define the basic principle of least privilege problem and present different variations, called the delta‐approx principle of least privilege problem and the minimizing‐approx principle of least privilege problem. Since there may be more than one result to enforce the same principle of least privilege, we introduce the notation about weights of permissions and roles to optimize the results. Then we prove that all least privilege problems are NP‐complete. As an important contribution of the paper, we show that the principle of least privilege problem can be reduced to minimal cost set covering (MCSC) problem. We can borrow the existing solutions of MCSC to solve the principle of least privilege problems. Finally, different algorithms are designed to solve the proposed least privilege problems. Experiments on performance study prove the superiority of our algorithms. Copyright © 2011 John Wiley & Sons, Ltd.

Traditional web application development often encounters tight coupling problem between access control logic and business logic. It is hard to configure and modify access control policies after a system has been deployed. In this demonstration, we present SecTag, a multi-policy supported secure web tag framework, to address this problem. We define a series of general-purpose secure attributes that meet the demand of fine-grained access control in web presentation layer. We also design a set of high interactive secure tags, which encapsulate secure features to provide reusable secure components for web development. A running example of SecTag is presented to demonstrate the effectiveness of the proposed framework.

Role mining from the existing permissions has been widely applied to aid the process of migrating to an RBAC system. While all permissions are treated evenly in previous approaches, none of the work has employed the weights of permissions in role mining to our knowledge, thus providing the motivation for this work. In this paper, we generalize this to the case where permissions are given weights to reflect their importance to the system. The weights can correspond to the property of operations, the sensitive degree of objects, and the attribute of users associated with permissions. To calculate the weight of permissions, we introduce the concept of similarity between both users and permissions, and use a similarity matrix to reinforce the similarity between permissions. Then we create a link between the reinforced similarity and the weight of permissions. We further propose a weighted role mining algorithm to generate roles based on weights. Experiments on performance study prove the superiority of the new algorithm.