Search

Fog computing as an extension of cloud computing has attracted maximum attention over the recent years due to its suitability and applicability. The Fog computing is identified to handle the issues of inadequate mobility support and location sensitiveness and maximized latency. In the Internet of Things (IoT), a collection of IoT devices needs to be connected to the Fog nodes for supporting the center of the cloud service to process and store partial data part in prior. This possibility of connecting IoT devices with Fog nodes has the maximum possibility of enhancing the service quality and minimize the pressure involved in data processing in real time. However, Fog nodes used in data processing are considered from a diversified number of challenging issues introduced by the privacy violation of IoT devices, modification attacks and false data injection attack. In this paper, a Verifiable Quaternion Fully Homomorphic Encryption (VQFHE) scheme is proposed for mitigating False Data Injection Attacks by means of privacy preservation and fault tolerance in Fog computing scenario. This proposed VQFHE scheme derives the benefits of Quaternions for ensures that data injection always happens from the legitimate devices, inspite to the honest or curious behavior of the cloud control center (CCC) and Fog nodes. The simulation results conducted using iFogSim simulator confirmed its predominance over the benchmarked schemes with respect to communication overhead and computation overhead. [ABSTRACT FROM AUTHOR]

The SNOW-V stream cipher is a candidate cipher for 5G mobile communication system, and the SNOW-Vi stream cipher is a faster variant of SNOW-V. In this paper, we analyze the resistance of the reduced-round SNOW-V and SNOW-Vi against the chosen IV differential distinguishing attacks in the initialization phase. Firstly, we use the divide-and-conquer strategy to give a Mixed-integer Linear Programming (MILP) model to describe the probabilities within the Differential Distribution Table (DDT) of large S-boxes, which can more accurately search the best differential characteristics of SNOW-V and SNOW-Vi than using the probability lower bound of the DDT in the original MILP model. Secondly, we point out that the registers R 1 , R 2 , R 3 of SNOW-Vi filled with 0 were not considered in the original MILP model, resulting in the MILP model may return impossible differential characteristics. Then, we give the splicing search technology of C program and MILP model to solve this problem. Thirdly, based on these two studies, we present a more efficient and accurate MILP model for searching the best differential characteristics of the reduced-round SNOW-V and SNOW-Vi. The improved MILP model reduces the complexity of the distinguishing attacks. Finally, we give two multiple differential attack techniques on SNOW-V/SNOW-Vi structure, and apply them to the reduced-round SNOW-V and SNOW-Vi, respectively. While improving the results of single differential attacks, we also reduce the complexity of differential attack on the 4-round SNOW-V from 2 97 to 2 59. 985 , which can give the effective attack under the data limitation 2 64 for the single key. In addition, we give the first differential attack on 5-round SNOW-Vi, and the time complexity and data complexity is 2 96. 84. The success rate is 0.97725. Although this has exceeded the data complexity limitation of the single key attack, it is meaningful for us to analyze the security of SNOW-Vi. [ABSTRACT FROM AUTHOR]

Boolean functions play essential roles in certain symmetric cryptographic schemes and error-correcting codes. Apart from the cryptographic criteria satisfied by Boolean functions, constructions of functions with few Walsh spectral value are also of particular interests in cryptographic applications. Due to the problem that the five-value spectrum functions with duals being not basic plateaued functions remains to be answered, in this paper we intend to investigate the construction on non-basic plateaued duals of five-value spectrum functions. The issue of constructing non-basic totally disjoint spectra plateaued functions is dealt with from two aspects. We firstly address the characterization of non-basic plateaued functions corresponding to Walsh supports with unequal cardinality. Then the necessary and sufficient conditions of the spectral design of a partially non-basic five-value spectrum function are proposed. Meanwhile, we also provide the sufficient condition for constructing a valid five-value spectrum function whose duals are both defined on non-affine subspaces. Finally, the design of totally disjoint spectra functions on non-affine subspaces with equal cardinality is also studied. [ABSTRACT FROM AUTHOR]

This paper introduces an improved version of the secure hash algorithms, SHA-1, and SHA-2. The proposed work produces a strengthened secure hash design using the fusion between the SHA-1 and SHA-2 hash standards. This design helps to protect the SHA-1 and SHA-2 against collision and length extension attacks. The proposed design is incorporated in the round steps of the hash functions using the function manipulators of the SHA-1 and SHA-2. Moreover, the proposed design employs a padding method that is different from the one used in the SHA-1 and SHA-2 construction. The proposed design is verified by the official test vectors that were confirmed by the National Institute of Standard and Technology. Moreover, the avalanche effect, hamming distance, and bit-hit properties were studied using different test cases. The proposed design gives over 52 percent of the avalanche effect and over 84 hamming distance. The proposed design was tested against collision attack and produced unique hash values for real collided examples and shows resistance against length extension attack. [ABSTRACT FROM AUTHOR]

Nowadays, advanced persistent threats (APTs) compromise critical large-scale networks more frequently, however, detecting these APTs is difficult. Since security sensors often miss some key steps of APTs, a lot of missed alerts exist. Moreover, large-scale networks often generate thousands of repeated alerts every day. To address this issue, a novel method for APT reconstruction in large-scale networks is proposed for attack forensics and traceability in this paper. Additionally, the proposed method consumes low transmission cost, and it doesn't require raw data from terminal devices, which makes it more appropriate for large-scale networks with numerous terminal devices. Specifically, an alert reduction and correlation method is first designed to reduce the alert volume. Then, these alerts are transformed into an alert graph, and the key missed alerts are obtained by searching history alerts and logs using Monte Carlo Tree Search (MCTS), which fast assembles multi-stage attacks with high confidence. The evaluation results on the modified CSE-CIC-IDS-2018 dataset indicate that the proposed method is robust against false negatives. Compared with other research, the proposed method has more advantages in efficiency and accuracy, and it can detect APTs within a longer time horizon. [ABSTRACT FROM AUTHOR]

Fully homomorphic encryption enables to perform arbitrary computations over encrypted data opening a new avenue for the secure outsourced computation in cloud computing. Data sorting is a classical computational problem in computer science. Previously, all the secure sorting algorithms based on fully homomorphic encryption made use of the bit-level encryption, which requires that each bit of the input data is encrypted separately. However, the bit-level encryption incurs expensive computational overheads and a large ciphertext expansion. In this paper, we propose a secure word-level sorting scheme based on fully homomorphic encryption. We introduce a set of novel techniques to design an efficient word-level sorting algorithm. These include a new technique to compare two encrypted integers, a constant extraction technique to postprocess the output ciphertext of the comparison algorithm, an equality test method to check whether two ciphertexts encrypt the same integer and the single instruction multiple data technique to reduce the ciphertext sizes and improve the computational performance. The experimental results show that our word-level sorting algorithm outperforms the state-of-the-art bit-level sorting algorithm by more than 10 times. [ABSTRACT FROM AUTHOR]

Dynamic group signatures (DGS) enable a user to generate a signature on behalf of a group of users, allowing a prospective user to join via an appropriate join protocol. A natural security requirement in the dynamic setting is to permit an adversary to concurrently perform join protocol executions. To date, most of DGS schemes do not provide the efficient concurrent join protocols in their security analysis, because of the need to use knowledge extractors. Also, DGS schemes have to provide efficient batch verifications for practical applications such as Vehicle-to-Vehicle (V2V) and Vehicle-to-Infrastructure (V2I) communication, where a large number of group signatures should be verified in a very short time. In this paper, we propose a new practical DGS scheme that supports not only efficient concurrent joins but also batch verifications. The concurrent security is proven by showing that our join protocols are simulated without any knowledge extractor in security analysis. To do this, we introduce a modified Pointcheval–Sanders (PS) problem that can guarantee efficiently checking equality of discrete logarithms. In terms of efficiency, when considering a type-3 pairing, our DGS scheme has the advantages that the signature generation and verification are faster and especially our batch verification is at least 7 times faster in case of verifying 100 signatures, compared to other comparable pairing-based DGS schemes in the literature. • Construct a dynamic group signature scheme based on the sign–randomize–prove paradigm. • Prove concurrent security of our join protocol under a variant of Pointcheval–Sanders assumption. • Achieve the fastest signing and (batch) verification, compared with all of the existing pairing-based schemes. [ABSTRACT FROM AUTHOR]

This paper highlights a lightweight token-based authentication scheme for smart sensor nodes in a smart home network. The token holds the capability information of a sensor node in a secure and trusted environment. The capability information adds another layer of security by incorporating the user's consent when registering in the network. The registration is a one-time activity in the node's life cycle, but it prevents unauthorized users or devices from intruding into the network. The method also mitigates the user and token impersonation attacks in the network. It does not need any manual intervention like entering user-id or password, which helps in seamless authentication, identity management, and secure communication. It also incorporates the position of the sensor nodes during the authentication phase. The capability-token mitigates the threats that arise from an independent node attempting to intrude whose position is near the smart home environment. The authors have demonstrated the communication time gain and compared it with the existing methods. [ABSTRACT FROM AUTHOR]

The obfuscation detection technology is an important auxiliary means of malware detection. Also, for security practitioners, it can carry out automatic obfuscation detection before manual reverse analysis, which helps reverse engineers to perform reverse analysis more specifically. Existing obfuscation detection methods are mainly for Android applications and based on traditional machine learning, whose detection granularity is coarse, generality is poor, and the performance is not good enough. To address these issues, in this paper, we propose a function-level obfuscation detection method based on Graph Convolutional Networks for X86 assembly code and Android applications. Firstly, our method is function-level obfuscation detection, and we extract the Control Flow Graph (CFG) of each function as its feature, including the adjacency matrix and the basic block feature matrix. Secondly, we build a hybrid neural network model GCN-LSTM as our obfuscation detection model, which combines the Graph Convolutional Network (GCN) and the Long Short-Term Memory (LSTM). Finally, we conduct experiments using real-world open-source programs and compare results with baseline methods. For function-level detection, the accuracy of our method is 94.7575% for X86 assembly code and 98.9457% for Android applications, both of which are better than baseline methods. For APK-level detection, our method can almost completely detect the obfuscated APKs. Experimental results show that our method performs well for both X86 assembly code and Android applications and is superior to the baseline methods in both function-level detection and APK-level detection. Our research showcases a successful application of the Graph Convolutional Network and the Control Flow Graph on code obfuscation detection problems. [ABSTRACT FROM AUTHOR]

Presently, more and more electronic medical records (EMR) are used to replace traditional recording methods. However, there has potential safety hazard in the transmission of EMR because of the personal privacy disclosure. So, how to store, transmit and share EMR effectively and securely has become a research hotspot. In this paper, we propose an improved Merkle tree based-blockchain EMR storage scheme. The hallmark of the proposed scheme is that we employ the convolutional layer structure to replace the original binary tree structure in the proposed convolution Merkle tree, which can improve the efficiency effectively. Experiments show that the number of stored nodes has decreased significantly with the same amount of input data, and the layers number of the improved convolution Merkle tree and hash calculated amount are all reduced dramatically. The security and efficiency analysis also illustrate that the proposed scheme can provide a reliable choice for the further development of data storage security in the future. • Propose a new convolution operation based-Merkle tree structure. • It can significantly reduce the number of layers and data calculation amount. • The improved Merkle tree structure ensures the convenience of data storage. • It provides a reliable choice for the further development of data storage security. [ABSTRACT FROM AUTHOR]

Domain generation algorithm (DGA) is used by botnets to build a stealthy command and control (C&C) communication channel between the C&C server and the bots. A DGA can periodically produce a large number of pseudo-random algorithmically generated domains (AGDs), a few of which direct the bots to the C&C server. AGD detection algorithms provide a lightweight, promising solution in response to the existing DGA techniques. In the constantly evolving attacker–defender game, attackers may seek more advanced DGA techniques to gain a better chance of evading detection by defenders. In this paper, we propose a new DGA, namely a neural networks-based domain name generation (NDG) architecture. NDG is based on a variational autoencoder (VAE), where the encoder and decoder networks use stacked gated convolutional neural networks (GCNNs) to learn the contextual structure hierarchically. NDG is experimentally validated using a set of state-of-the-art AGD detection algorithms. The existing DGAs of different classes following a DGA taxonomy are used to benchmark NDG. NDG shows the best overall anti-detection performance among all tested DGAs. We also demonstrate that NDG is effective in benchmarking AGD detection algorithms. [ABSTRACT FROM AUTHOR]

In this paper, a (k , n , m) -intragroup and intergroup secret image sharing (I 2 SIS) scheme for the multi-group (i.e., m -group) environment is investigated. (2 m − 1) secret images are shared within groups (intragroups) and between groups (intergroups). Differing from existing SIS methods, any k or more qualified participants among different groups (i.e., intergroup) can collaboratively recover the respective secret image via the homomorphic Lagrange interpolation. The proposed scheme consists of three major procedures: preprocessing, sharing, and recovering. In the preprocessing procedure, an approach is designed to partition the coefficients in the m (k − 1) -degree polynomials for sharing the (2 m − 1) secret images. In addition, an optimal algorithm for the preprocessing is given to let all the percentages of recovering secret images be the same as possible. Shadows belonging to all participants in the m groups are generated in the sharing procedure. In the recovering procedure, the secret images can be reconstructed in intragroups and intergroups. Moreover, experiments and comparisons are demonstrated to show the merits of the proposed scheme. [ABSTRACT FROM AUTHOR]

With the increasing frequency, severity and complexity of recent cyber attacks around the world, network intrusion detection has become mandatory and highly sophisticated task. Achieving high performance in network intrusion detection by applying benchmark machine learning classifiers (including deep learning techniques) has become a major challenge in recent times. One of the biggest challenges is improving the memorization capacity and generalization ability of NIDS (Network Intrusion Detection Systems). In this paper, we propose a highly scalable novel wide & deep transfer learning (TL) based stacked GRU (Gated Recurrent Unit) model to deal with multi-dimensional point data and multi-variate time series regression and classification problems in network intrusion detection. The proposed model has the memorization capacity of linear regression model and the generalization ability of deep GRU model. The deep component consists of a transfer learning framework that pretrains a source model and then fine-tunes the whole source model on the same dataset multiple times until it gives peak performance. This method gives a multi-class evaluation accuracy of 99.92% on KDDCup 99(10%) dataset and 94.22% on UNSW-NB15 dataset respectively. Extensive experimentations and evaluations have been carried out by comparing it with other machine learning (including deep learning) network intrusion detection techniques. The proposed method outperforms most of the existing intrusion detection approaches. [ABSTRACT FROM AUTHOR]