Search

Phishing is a very serious security problem that poses a huge threat to the average user. Research on phishing prevention is attracting increasing attention. The root cause of the threat of phishing is that phishing can still succeed even when anti-phishing tools are utilized, which is due to the inability of users to correctly identify phishing attacks. Current research on phishing focuses on examining the static characteristics of the phishing behavior phenomenon, which cannot truly predict a user’s susceptibility to phishing. In this paper, a user phishing susceptibility prediction model (DSM) that is based on a combination of dynamic and static features is proposed. The model investigates how the user’s static feature factors (experience, demographics, and knowledge) and dynamic feature factors (design changes and eye tracking) affect susceptibility. A hybrid Long Short-Term Memory (LSTM) and LightGBM prediction model is designed to predict user susceptibility. Finally, we evaluate the prediction performance of the DSM by conducting a questionnaire survey of 1150 volunteers and an eye-tracking experiment on 50 volunteers. According to the experimental results, the correct prediction rate of the DSM is higher than that for individual feature prediction, which reached 92.34%. These research experiments demonstrate the effectiveness of the DSM in predicting users’ susceptibility to phishing using a combination of static and dynamic features.

With the development of science and computer technology, social networks are changing our daily lives. However, this leads to new, often hidden dangers in areas such as cybersecurity. Of these, the most complex and harmful is the Advanced Persistent Threat attack (APT attack). The development of personality analysis and prediction technology provides the APT attack a good opportunity to infiltrate personality privacy. Malicious people can exploit existing personality classifiers to attack social texts and steal users’ personal information. Therefore, it is of high importance to hide personal privacy information in social texts. Based on the personality privacy protection technology of adversarial examples, we proposed a Supervised Character Resemble Substitution personality adversarial method (SCRS) in this paper, which hides personality information in social texts through adversarial examples to realize personality privacy protection. The adversarial examples should be capable of successfully disturbing the personality classifier while maintaining the original semantics without reducing human readability. Therefore, this paper proposes a measure index of “label contribution” to select the words that are important to the label. At the same time, in order to maintain higher readability, this paper uses character-level resemble substitution to generate adversarial examples. Experimental validation shows that our method is able to generate adversarial examples with good attack effect and high readability.

Various machine-learning methods have been applied to anomaly intrusion detection. However, the Intrusion Detection System still faces challenges in improving Detection Rate and reducing False Positive Rate. In this paper, a Class-Level Soft-Voting Ensemble (CLSVE) scheme based on the Chaos Bat Algorithm (CBA), called CBA-CLSVE, is proposed for intrusion detection. The Support Vector Machine (SVM), K-Nearest Neighbor (KNN) and Decision Tree (DT) are selected as the base learners of the ensemble. The Chaos Bat Algorithm is used to generate class-level weights to create the weighted voting ensemble. A weighted fitness function considering the tradeoff between maximizing Detection Rate and minimizing False Positive Rate is proposed. In the experiments, the NSL-KDD, UNSW-NB15 and CICIDS2017 datasets are used to verify the scheme. The experimental results show that the class-level weights generated by CBA can be used to improve the combinative performance. They also show that the same ensemble performance can be achieved using about half the total number of features or fewer.

In order to improve user authentication accuracy based on keystroke dynamics and mouse dynamics in hybrid scenes and to consider the user operation changes in different scenes that aggravate user status changes and make it difficult to simulate user behaviors, we present a user authentication method entitled SIURUA. SIURUA uses scene-irrelated features and user-related features for user identification. First, features are extracted based on keystroke data and mouse movement data. Next, scene-irrelated features that have a low correlation with scenes are obtained. Finally, scene-irrelated features are fused with user-related features to ensure the integrity of the features. Experimental results show that the proposed method has the advantage of improving user authentication accuracy in hybrid scenes, with an accuracy of 84% obtained in the experiment.

In recent years, the security of online social networks (OSNs) has become an issue of widespread concern. Searching and detecting compromised accounts in OSNs is crucial for ensuring the security of OSN platforms. In this study, the authors proposed a new method of detecting compromised accounts based on a supervised analytical hierarchy process (SAHP). First, they considered the expression habits of a user to present the profile features of a user more comprehensively than previous research. Next, the information gain ratio was combined with the analytical hierarchy process algorithm to calculate the weight of each feature. Finally, a detection decision was taken, and varying thresholds were used to obtain different detection results. The experimental results showed that the accuracy and precision of the SAHP were 81.7 and 96.4%, respectively. The results indicated that the new method improved upon the previously established COMPA (detecting compromised accounts on social networks) methods for detecting compromised accounts.

IESs have a wide range of applications and special usage scenarios, but they are also expensive. Hence, it is common that a simulation platform is used to conduct security experiments on IESs, as well as to validate changes on the system and protocols. This article proposes a simulation framework based on a combination of hardware and software. This approach preserves the hardware characteristics of the system and has the flexibility of software simulation, making it ideal for analyzing and validating the security of IESs. We also implement some security attacks against IESs based on the simulation system for in-depth research.

Vehicular Ad-hoc Network (VANET) is a significant component of intelligent transportation system, which facilitates vehicles to share sensitive information and corporate with others. However, due to its unique characteristics, such as openness, dynamic topology and high mobility, VANET suffers from various attacks. This paper proposes an anti-attack trust management scheme in VANET called AATMS to evaluate the trustworthiness of vehicles. With the help of AATMS, vehicles in VANET can avoid malicious vehicles and cooperate with trusted vehicles. The idea of AATMS is mainly inspired by TrustRank algorithm, which is used to combat web spams. In this paper, we calculate local trust and global trust, which indicate the local and global trust relationships among vehicles. First, Bayesian inference is adopted to calculate local trust of vehicles based on historical interactions. Then we select a small set of seed vehicles according to local trust and some social factors. Once we identify the reputable seed vehicles, we use the local trust link structure of vehicles to evaluate the global trust of all vehicles. The simulation results show that AATMS can efficiently identify trustworthy and untrustworthy vehicles in VANET even under malicious attacks.

The detection and removal of malicious social bots in social networks has become an area of interest in industry and academia. The widely used bot detection method based on machine learning leads to an imbalance in the number of samples in different categories. Classifier bias leads to a low detection rate of minority samples. Therefore, we propose an improved conditional generative adversarial network (improved CGAN) to extend imbalanced data sets before applying training classifiers to improve the detection accuracy of social bots. To generate an auxiliary condition, we propose a modified clustering algorithm, namely, the Gaussian kernel density peak clustering algorithm (GKDPCA), which avoids the generation of data-augmentation noise and eliminates imbalances between and within social bot class distributions. Furthermore, we improve the CGAN convergence judgment condition by introducing the Wasserstein distance with a gradient penalty, which addresses the model collapse and gradient disappearance in the traditional CGAN. Three common oversampling algorithms are compared in experiments. The effects of the imbalance degree and the expansion ratio of the original data on oversampling are studied, and the improved CGAN performs better than the others. Experimental results comparing with three common oversampling algorithms show that the improved CGAN achieves the higher evaluation scores in terms of F1-score, G-mean and AUC.

To explore the advantages of adversarial learning and deep learning, we propose a novel network intrusion detection model called SAVAER-DNN, which can not only detect known and unknown attacks but also improve the detection rate of low-frequent attacks. SAVAER is a supervised variational auto-encoder with regularization, which uses WGAN-GP instead of the vanilla GAN to learn the latent distribution of the original data. SAVAER's decoder is used to synthesize samples of low-frequent and unknown attacks, thereby increasing the diversity of training samples and balancing the training data set. SAVAER's encoder is used to initialize the weights of the hidden layers of the DNN and explore high-level feature representations of the original samples. The benchmark NSL-KDD (KDDTest+), NSL-KDD (KDDTest-21) and UNSW-NB15 datasets are used to evaluate the performance of the proposed model. The experimental results show that the proposed SAVAER-DNN is more suitable for data augmentation than the other three well-known data oversampling methods. Moreover, the proposed SAVAER-DNN outperforms eight well-known classification models in detection performance and is more effective in detecting low-frequent and unknown attacks. Furthermore, compared with other state-of-the-art intrusion detection models reported in the IDS literature, the proposed SAVAER-DNN offers better performance in terms of overall accuracy, detection rate, F1 score, and false positive rate.

In recent years, machine learning-based intrusion detection systems (IDSs) have proven to be effective; especially, deep neural networks improve the detection rates of intrusion detection models. However, as models become more and more complex, people can hardly get the explanations behind their decisions. At the same time, most of the works about model interpretation focuses on other fields like computer vision, natural language processing, and biology. This leads to the fact that in practical use, cybersecurity experts can hardly optimize their decisions according to the judgments of the model. To solve these issues, a framework is proposed in this paper to give an explanation for IDSs. This framework uses SHapley Additive exPlanations (SHAP), and combines local and global explanations to improve the interpretation of IDSs. The local explanations give the reasons why the model makes certain decisions on the specific input. The global explanations give the important features extracted from IDSs, present the relationships between the feature values and different types of attacks. At the same time, the interpretations between two different classifiers, one-vs-all classifier and multiclass classifier, are compared. NSL-KDD dataset is used to test the feasibility of the framework. The framework proposed in this paper leads to improve the transparency of any IDS, and helps the cybersecurity staff have a better understanding of IDSs' judgments. Furthermore, the different interpretations between different kinds of classifiers can also help security experts better design the structures of the IDSs. More importantly, this work is unique in the intrusion detection field, presenting the first use of the SHAP method to give explanations for IDSs.

Obscuring or otherwise minimizing the release of personality information from potential victims of social engineering attacks effectively interferes with an attacker’s personality analysis and reduces the success rate of social engineering attacks. We propose a text transformation method named PerTransGAN using generative adversarial networks (GANs) to protect the personality privacy hidden in text data. Making use of reinforcement learning, we use the output of the discriminator as a reward signal to guide the training of the generator. Moreover, the model extracts text features from the discriminator network as additional semantic guidance signals. And the loss function of the generator adds a penalty item to reduce the weight of words that contribute more to personality information in the real text so as to hide the user’s personality privacy. In addition, the semantic and personality modules are designed to calculate the semantic similarity and personality distribution distance between the real text and the generated text as a part of the objective function. Experiments show that the self-attention module and semantic module in the generator improved the content retention of the text by 0.11 compared with the baseline model and obtained the highest BLEU score. In addition, with the addition of penalty item and personality module, compared with the classification accuracy of the original data, the accuracy of the generated text in the personality classifier decreased by 20%. PerTransGAN model preserves users’ personality privacy as found in user data by transforming the text and preserving semantic similarity while blocking privacy theft by attackers.

While antiphishing techniques have evolved over the years, phishing remains one of the most threatening attacks on current network security. This is because phishing exploits one of the weakest links in a network system—people. The purpose of this research is to predict the possible phishing victims. In this study, we propose the multidimensional phishing susceptibility prediction model (MPSPM) to implement the prediction of user phishing susceptibility. We constructed two types of emails: legitimate emails and phishing emails. We gathered 1105 volunteers to join our experiment by recruiting volunteers. We sent these emails to volunteers and collected their demographic, personality, knowledge experience, security behavior, and cognitive processes by means of a questionnaire. We then applied 7 supervised learning methods to classify these volunteers into two categories using multidimensional features: susceptible and nonsusceptible. The experimental results indicated that some machine learning methods have high accuracy in predicting user phishing susceptibility, with a maximum accuracy rate of 89.04%. We conclude our study with a discussion of our findings and their future implications.

Phishing has become one of the biggest and most effective cyber threats, causing hundreds of millions of dollars in losses and millions of data breaches every year. Currently, anti-phishing techniques require experts to extract phishing sites features and use third-party services to detect phishing sites. These techniques have some limitations, one of which is that extracting phishing features requires expertise and is time-consuming. Second, the use of third-party services delays the detection of phishing sites. Hence, this paper proposes an integrated phishing website detection method based on convolutional neural networks (CNN) and random forest (RF). The method can predict the legitimacy of URLs without accessing the web content or using third-party services. The proposed technique uses character embedding techniques to convert URLs into fixed-size matrices, extract features at different levels using CNN models, classify multi-level features using multiple RF classifiers, and, finally, output prediction results using a winner-take-all approach. On our dataset, a 99.35% accuracy rate was achieved using the proposed model. An accuracy rate of 99.26% was achieved on the benchmark data, much higher than that of the existing extreme model.

Based on the openness and accessibility of user data, personality recognition is widely used in personalized recommendation, intelligent medicine, natural language processing, and so on. Existing approaches usually adopt a single deep learning mechanism to extract personality information from user data, which leads to semantic loss to some extent. In addition, researchers encode scattered user posts in a sequential or hierarchical manner, ignoring the connection between posts and the unequal value of different posts to classification tasks. We propose a hierarchical hybrid model based on a self-attention mechanism, namely HMAttn-ECBiL, to fully excavate deep semantic information horizontally and vertically. Multiple modules composed of convolutional neural network and bi-directional long short-term memory encode different types of personality representations in a hierarchical and partitioned manner, which pays attention to the contribution of different words in posts and different posts to personality information and captures the dependencies between scattered posts. Moreover, the addition of a word embedding module effectively makes up for the original semantics filtered by a deep neural network. We verified the hybrid model on the MyPersonality dataset. The experimental results showed that the classification performance of the hybrid model exceeds the different model architectures and baseline models, and the average accuracy reached 72.01%.

Protecting the user's personality privacy can effectively interfere with or deceive the attacker's personality analysis, avoid the attacker's use of personality vulnerability, and reduce the success rate of social engineering attacks. However, the current research on personality privacy protection is at a blank stage. To solve this problem, we propose a personality privacy protection method based on adversarial text generation. This paper mainly uses gradient-based adversarial method and cosine similarity to generation adversarial text. We formed a set of replacement words to test the impact of the number of replacement words on the performance of the model. Experiments show that the method proposed in this paper has achieved good effects on model attacks (reducing the performance of the model), and can well complete the task of protecting personality privacy.

Feature subset selection is an efficient step to reduce the dimension of data, which remains an active research field in decades. In order to develop highly accurate and fast searching feature subset selection algorithms, a filter feature subset selection method combining maximal information entropy (MIE) and the maximal information coefficient (MIC) is proposed in this paper. First, a new metric mMIE-mMIC is defined to minimize the MIE among features while maximizing the MIC between the features and the class label. The mMIE-mMIC algorithm is designed to evaluate whether a candidate subset is valid for classification. Second, two searching strategies are adopted to identify a suitable solution in the candidate subset space, including the binary particle swarm optimization algorithm (BPSO) and sequential forward selection (SFS). Finally, classification is performed on UCI datasets to validate the performance of our work compared to 9 existing methods. Experimental results show that in most cases, the proposed method behaves equally or better than the other 9 methods in terms of classification accuracy and F1-score.

The Internet of Things (IoT) is poised to transform human life and unleash enormous economic benefit. However, inadequate data security and trust of current IoT are seriously limiting its adoption. Blockchain, a distributed and tamper-resistant ledger, maintains consistent records of data at different locations, and has the potential to address the data security concern in IoT networks. While providing data security to the IoT, Blockchain also encounters a number of critical challenges inherent in the IoT, such as a huge number of IoT devices, non-homogeneous network structure, limited computing power, low communication bandwidth, and error-prone radio links. This paper presents a comprehensive survey on existing Blockchain technologies with an emphasis on the IoT applications. The Blockchain technologies which can potentially address the critical challenges arising from the IoT and hence suit the IoT applications are identified with potential adaptations and enhancements elaborated on the Blockchain consensus protocols and data structures. Future research directions are collated for effective integration of Blockchain into the IoT networks.

Keystroke biometrics is a well-investigated dynamic behavioral methodology that utilizes the unique behavioral patterns of users to verify their identity when tapping keys. However, the performance of keystroke biometrics is unreliable due to its high error rate and low robustness. In this paper, we propose differential evolution and adversarial noise-based user authentication (DEANUA), which is a verification scheme for enhancing reliability by reducing the error rate and improving robustness. We investigate the current mainstream features and build a more comprehensive feature set that composed of 146 features. Then, we use a differential evolution method to select an optimized feature set. With the support vector regression method on this feature set, we achieve an equal error rate (EER) of 0.12660% and also a 31.25% energy consumption reduction rate. In this paper, the model is trained with the training samples collected from one situation, but the model is used in various situations. Thus, the robustness of the model is inadequate. We constructed the adversarial noise samples to simulate users' behavioral characteristics in different situational contexts. We use the adversarial noise samples to test the models in a strict experimental environment, which raises the EER by 83.59%, to 10.9299%. Then, we enhance the model with adversarial noise samples to obtain an EER of 8.70932%, which is a reduction of 20.32%.

In a real network environment, multiple types of attacks can occur. The more important the service or network, the more attacks it may suffer simultaneously. Moving target defense (MTD) technology is a revolutionary game-changing cyberspace technology that has found various applications in recent years. However, the existing strategies are targeted at defending against specific types of attacks and do not meet the security requirements for multiple attacks. Therefore, we propose a joint defense strategy based on the MTD that can select one or multiple mutant elements to defend against different types of attacks. In addition, we use the analytic hierarchy process (AHP) to quantify the factors affecting the attack and defense costs. After comprehensively analyzing the effects of the different MTD technologies against different attacks, we propose an efficient strategy selection algorithm based on joint defense. Finally, we conduct experiments to evaluate the selection of a joint defense strategy under multiple attacks. The experimental results demonstrate the feasibility and effectiveness of the proposed joint defense strategy selection approach.

The main challenge of user personality recognition is low accuracy resulting from small sample size and severe sample distribution imbalance. This paper analyzes the impact of imbalanced data distribution and positive and negative sample overlap on the machine learning classification model. The classification model is based on the data resampling technique, which can improve the classification accuracy. These problems can be solved once the data are effectively resampled. We present a personality prediction method based on particle swarm optimization (PSO) and synthetic minority oversampling technique+Tomek Link (SMOTETomek)resampling (PSO-SMOTETomek), which, apart from effective SMOTETomek resampling of data samples, is able to execute PSO feature optimization for each set of feature combinations. Validated by simulation, our analysis reveals that the PSO-SMOTETomek method is efficient under a small dataset, and the accuracy of personality recognition is improved by up to around 10%. The results are better than those of previous similar studies. The average accuracies of the plain text dataset and the non-plain text dataset are 75.34% and 78.78%, respectively. The average accuracies of the short text dataset and the long text dataset are 75.34% and 64.25%, respectively. From the experimental results, we found that short text has a better classification effect than long text. Plain text data can still have high personality discrimination accuracy, but there is no relevant external information. The proposed model is able to facilitate the design and implementation of a personality recognition system, and the model significantly outperforms existing state-of-the-art models.

Online social networks (OSNs) suffer from forged messages. Current studies have typically been focused on the detection of forged messages and do not provide the analysis of the behaviors of message publishers and network strategies to suppress forged messages. This paper carries out the analysis by taking a game theoretic approach, where infinitely repeated games are constructed to capture the interactions between a publisher and a network administrator and suppress forged messages in OSNs. Critical conditions, under which the publisher is disincentivized to publish any forged messages, are identified in the absence and presence of misclassification on genuine messages. Closed-form expressions are established for the maximum number of forged messages that a malicious publisher could publish. Confirmed by the numerical results, the proposed infinitely repeated games reveal that forged messages can be suppressed by improving the payoffs for genuine messages, increasing the cost of bots, and/or reducing the payoffs for forged messages. The increasing detection probability of forged messages or decreasing misclassification probability of genuine messages also has a strong impact on the suppression of forged messages.

Social engineering has been increasingly used during the past few years. Social engineering attacks have resulted in great financial losses. Research on social engineering models and frameworks is still in its elementary stage. An appropriate social engineering framework can interpret all the attack components and their relationships clearly, which will contribute to the defense of social engineering attacks. In this tutorial paper, existing social engineering models and frameworks are summarized and a new social engineering framework is proposed involving the concept of the session and dialogue. An entire social engineering attack is defined as a social engineering session (SES). A social engineering dialogue (SED) refers to a specific attack phase, which is included in a SES. A SES contains several well-organized SEDs. Then, the attack graph is used to formalize the proposed social engineering framework. The SED is treated as an atomic attack during the whole SES. The human weaknesses that an attacker can exploit are described as vulnerabilities, the information, and trust that an attacker owns as permissions. Finally, three real-world social engineering cases are analyzed using the proposed framework and attack graph. The analyses illustrate the usability of the proposed framework and provide a better understanding of various social engineering attacks.

Weibo and other online social networks have be-come the basic platform for information dissemination and diffusion. Prediction of information forwarding in social networks has attracted a lot of research work, especially how to effectively consider the characteristics of users and information, as well as the interaction between them. In this paper, we construct a weighted heterogeneous network based on users and information, and propose an improved heterogeneous network graph representation algorithm Mpath-wMetapath2vec to generate low dimensional representation for forwarding prediction. The experimental results on Weibo dataset show that our model outperforms the algorithms without considering node features and other graph vector representation algorithms.

In recent years, deep learning-based encrypted traffic classification has proven to be effective; especially, using neural networks to extract features from raw traffic to classify encrypted traffic. However, most of the neural networks need a fixed-sized input, so that the raw traffic need to be trimmed. This will cause the loss of some information; for example, we do not know the number of packets in a session. To solve these problems, a framework, which implements both a convolutional neural network (CNN) and a stacked autoencoder (SAE), is proposed in this paper. This framework uses a CNN to extract high-level features from raw network traffic and uses an SAE to encode the 26 statistical features calculated by raw traffic directly. The statistical features can be used to supplement the information loss due to trimming. After that, the outputs from the CNN and the encoder in SAE are combined into new high-level features; these new features include the information from the trimmed raw traffic and statistical features. Finally, these new high-level features are used to classify encrypted traffic. “ISCX VPNnonVPN” traffic dataset is used to demonstrate the feasibility of this framework. The framework proposed in this paper can improve the performance of encrypted traffic classification; it achieves an f1-score of 0.98. Furthermore, new high-level features, which generated by combining the features extracted from a convolutional neural network and a stacked autoencoder, can represent different classes of traffic well. More importantly, this work is unique in the encrypted traffic classification field, for it is the first time to use both raw traffic and statistical features as the input of the model.

Cross-domain relation extraction has become an essential approach when target domain lacking labeled data. Most existing works adapted relation extraction models from the source domain to target domain through aligning sequential features, but failed to transfer non-local and non-sequential features such as word co-occurrence which are also critical for cross-domain relation extraction. To address this issue, in this paper, we propose a novel tripartite graph architecture to adapt non-local features when there is no labeled data in the target domain. The graph uses domain words as nodes to model the co-occurrence relation between domain-specific words and domain-independent words. Through graph convolutions on the tripartite graph, the information of domain-specific words is propagated so that the word representation can be fine-tuned to align domain-specific features. In addition, unlike the traditional graph structure, the weights of edges innovatively combine fixed weight and dynamic weight, to capture the global non-local features and avoid introducing noise to word representation. Experiments on three domains of ACE2005 datasets show that our method outperforms the state-of-the-art models by a big margin.

Personality recognition is a classic and important problem in social engineering. Due to the small number and particularity of personality recognition databases, only limited research has explored convolutional neural networks for this task. In this paper, we explore the use of graph convolutional network techniques for inferring a user&rsquo, s personality traits from their Facebook status updates or essay information. Since the basic five personality traits (such as openness) and their aspects (such as status information) are related to a wide range of text features, this work takes the Big Five personality model as the core of the study. We construct a single user personality graph for the corpus based on user-document relations, document-word relations, and word co-occurrence and then learn the personality graph convolutional networks (personality GCN) for the user. The parameters or the inputs of our personality GCN are initialized with a one-hot representation for users, words and documents, then, under the supervision of users and documents with known class labels, it jointly learns the embeddings for users, words, and documents. We used feature information sharing to incorporate the correlation between the five personality traits into personality recognition to perfect the personality GCN. Our experimental results on two public and authoritative benchmark datasets show that the general personality GCN without any external word embeddings or knowledge is superior to the state-of-the-art methods for personality recognition. The personality GCN method is efficient on small datasets, and the average F1-score and accuracy of personality recognition are improved by up to approximately 3.6% and 2.4&ndash, 2.57%, respectively.

While there have been significant advances in detecting emotions in text, in the field of utterance-level emotion recognition (ULER), there are still many problems to be solved. In this paper, we address some challenges in ULER in dialog systems. (1) The same utterance can deliver different emotions when it is in different contexts. (2) Long-range contextual information is hard to effectively capture. (3) Unlike the traditional text classification problem, for most datasets of this task, they contain inadequate conversations or speech. (4) To better model the emotional interaction between speakers, speaker information is necessary. To address the problems of (1) and (2), we propose a hierarchical transformer framework (apart from the description of other studies, the &ldquo, transformer&rdquo, in this paper usually refers to the encoder part of the transformer) with a lower-level transformer to model the word-level input and an upper-level transformer to capture the context of utterance-level embeddings. For problem (3), we use bidirectional encoder representations from transformers (BERT), a pretrained language model, as the lower-level transformer, which is equivalent to introducing external data into the model and solves the problem of data shortage to some extent. For problem (4), we add speaker embeddings to the model for the first time, which enables our model to capture the interaction between speakers. Experiments on three dialog emotion datasets, Friends, EmotionPush, and EmoryNLP, demonstrate that our proposed hierarchical transformer network models obtain competitive results compared with the state-of-the-art methods in terms of the macro-averaged F1-score (macro-F1).

In order to improve the recognition rate of users with single behavioral feature and prevent impostors from restricting an input device to avoid detection, a dual-index user authentication method based on Multiple Kernel Learning (MKL) for keystroke and mouse behavioral feature fusion was proposed in this paper. Due to the heterogeneity between the keystroke features and the mouse features, we argue that each type of features is mapped to a suitable kernel and the weights of each kernel are obtained through computing and then summed to obtain a compound kernel that implements the multifeature fusion. The dataset used in this paper was collected under complete uncontrolled condition from some volunteers by using our data collection program. The experimental results show that the proposed method can obtain the best recognition accuracy of 89.6%. Compared to the traditional methods of single feature, the dual-index method can get more stable and effective authentication. Therefore, the proposed method in this paper fully demonstrates the reliability of dual-index user authentication.

With the development of network technology, web services become more convenient and popular. However, web services are also facing serious security threats, especially SQL injection attack(SQLIA). Due to the diversity of attack techniques and the static of defense configurations, it is difficult for existing passive defence methods to effectively defend against all SQLIAs. To reduce the risk of successful SQLIAs and increase the difficulty of the attacker, an effective defence technique based on moving target defence (MTD) called dynamic defence to SQLIA (DTSA) was presented in this article. DTSA diversifies the types of databases and implementation languages dynamically, turns the Web server into an untraceable and unpredictable moving target and slows down SQLIAs. Moreover, the period of mutation was determined by the concept of dynamic programming so as to reduce the hazards caused by SQLIAs and minimize the impact on normal users as much as possible. Final, the experimental results showed that the proposed defence method can effectively defend against injection attacks in relational databases.

© 2005-2012 IEEE. A major challenge in distributed mobile networks is network integrity, resulting from short link duration and severe transmission collisions. This paper analyzes the impact of link duration and transmission collisions on a range of on-the-fly authentication protocols, which operate based on predistributed keys and can instantly verify and forward messages. All unexpired messages within a link duration can be verified retrospectively, once the keys are matched on-the-air. We develop a new general 4D Markov model which, apart from the first three dimensions modeling a cycle of the protocols, is able to unprecedentedly capture unexpired messages between cycles in the fourth dimension. Validated by simulation, our analysis reveals that the on-the-fly authentication is efficient under short link duration, but is susceptible to transmission collisions. The authentication requires holistic cross-layer designs of retransmission and rekeying. The proposed model is able to facilitate the design of the protocol parameters, which allows the protocols to significantly outperform the state of the art.

As a kind of behavioral characteristics, the analysis of keystroke behavior and the selection of keystroke features are crucial operations to improve the accuracy of user identification using shallow machine learning algorithms. In this paper, we discuss the typing behavior phenomena and put forward a targeted feature optimization strategy in order to meet the need of improving the accuracy of user identification. Three types of keystroke features are analyzed including duration time features (Hold Time) and two types of latency time features (UD Time and DD Time) from three aspects of features distribution, features correlation and features contribution. The differential evolution (DE) algorithm is used to optimize keystroke features and the new proposed fitness function of DE algorithm is defined based on the analysis of keystroke features. Finally, random forest (RF) algorithm is devoted to evaluate the performance of feature optimization. Feature analysis results show that latency time features distribution among users is more diverse than duration time; the two types of latency time features have a strong correlation of which is as high as 0.9766; the combination of duration and latency time features have the best classification accuracy. Final experimental results of an open dataset show that DE algorithm based on features correlation analysis selects features which have better contribution to user classification, reduces the correlation between UD Time and DD Time features, and improves the classification accuracy by an average of 2.6206%.

An integration of Internet-of-Things (IoT) and blockchain becomes increasingly important to secure IoT data in an anti-tampering manner. Challenges arise from the immense scale of IoT and the resultant impact of network partitioning on blockchain. We design a new testbed to evaluate the impact, where resource-limited IoT devices, acting as light nodes, are an integral part of a blockchain. Our testbed is built on the Ethereum platform with non-trivial modifications on key modules. The partitioning of IoT is emulated by probabilistically dropping blocks travelling among the miners. We also propose a new discrete-time Markov chain model to validate our testbed and analyze the impact of block mining rates and network conditions on the capacity of public blockchains. The model is first formed to be non-ergodic with an infinite state space. By exploiting the eventual consistency property of blockchain, the model is collapsed to be ergodic and approximated with a finite state space and significantly improved tractability. Both the testbed and analysis reveal the blockchain capacity can be improved by accelerating the block mining rates which, however, increases stale blocks. Our analysis provides an asymptotic upper bound for the blockchain capacity.

A new metric (joint maximal information entropy (JMIE)) is defined to measure a feature subset.A new feature selection method combining the joint maximal information entropy among features (FS-JMIE) and binary particle swarm optimization (BPSO) algorithm is proposed in this paper.Experimental results on 5 UCI datasets show the efficiency of the proposed feature selection method.The proposed method manifests advantage in feature selection with multiple classes.FS-JMIE shows higher consistency and better time-efficiency than BPSO-SVM algorithm. Feature selection remains a popular method for quantity reduction of attributes of high-dimensional data, to reduce computational costs in classifications. A new feature selection method based on the joint maximal information entropy between features and class (FS-JMIE) is proposed in this paper. Firstly, the joint maximal information entropy (JMIE) is defined to measure a feature subset. Next, a binary particle swarm optimization (BPSO) algorithm is introduced to search the optimal feature subset. Finally, classification is performed on UCI corpora to verify the performance of our proposed method compared to the traditional mutual information (MI) method, CHI method, as well as a binary version of particle swarm optimization-support vector machines (BPSO-SVMs) feature selection. Experiments show that FS-JMIE achieves an equal or better performance than MI, CHI, and BPSO-SVM. Further, FS-JMIE manifests relatively better robustness to the number of classes. Moreover, the method shows higher consistency and better time-efficiency than BPSO-SVM.

© 2013 IEEE. Software-defined network (SDN) provides a solution for the scalable network framework with decoupled control and data plane. Migrating switches can balance the resource utilization of controllers and improve network performance. Switch migration problem has to date been formulated as a resource utilization maximization problem to address the scalability of the control plane. However, this problem is NP-hard with high-computational complexities and without addressing the security challenges of the control plane. In this paper, we propose a switch migration method, which interprets switch migration as a signature matching problem and is formulated as a 3-D earth mover's distance model to protect strategically important controllers in the network. Considering the scalability, we further propose a heuristic method which is time-efficient and suitable to large-scale networks. Simulation results show that our proposed methods can disguise strategically important controllers by diminishing the difference of traffic load between controllers. Moreover, our proposed methods can significantly relieve the traffic pressure of controllers and prevent saturation attacks.

The security demands in humanization should be considered as important, because artificial intelligence is developing rapidly in this area. Recent studies have shown the vulnerability of many deep learning models to adversarial examples; however, only a few studies on facial expression adversarial examples have been conducted. Thus, in this paper, we propose a novel method for generating facial expression adversarial examples using facial saliency maps and facial masking maps. Extensive numerical experiments demonstrate the outstanding performance of our method in terms of attack accuracy, structural similarity index measure score, and computational time, compared with other leading methods, such as the fast gradient sign method, projected gradient descent method, and Carlini–Wagner attacks.

Artificial intelligence is developing rapidly in the direction of intellectualization and humanization. Recent studies have shown the vulnerability of many deep learning models to adversarial examples, but there are fewer studies on adversarial examples attacking facial expression recognition systems. Human–computer interaction requires facial expression recognition, so the security demands of artificial intelligence humanization should be considered. Inspired by facial expression recognition, we want to explore the characteristics of facial expression recognition adversarial examples. In this paper, we are the first to study facial expression adversarial examples (FEAEs) and propose an adversarial attack method on facial expression recognition systems, a novel measurement method on the adversarial hardness of FEAEs, and two evaluation metrics on FEAE transferability. The experimental results illustrate that our approach is superior to other gradient-based attack methods. Finding FEAEs can attack not only facial expression recognition systems but also face recognition systems. The transferability and adversarial hardness of FEAEs can be measured effectively and accurately.

Malicious social media bots are disseminators of malicious information on social networks and seriously affect information security and the network environment. Efficient and reliable classification of social media bots is crucial for detecting information manipulation in social networks. Aiming to correct the defects of high-cost labeling and unbalanced positive and negative samples in the existing methods of social media bot detection, and to reduce the training of abnormal samples in the model, we propose an anomaly detection framework based on a combination of a Variational AutoEncoder and an anomaly detection algorithm. The purpose is to use Variational AutoEncoder to automatically encode and decode sample features. The normal sample features are more similar to the initial features after decoding, however, there is a difference between the abnormal samples and the initial features. The decoding representation and the original features are combined, and then the anomaly detection method is used for detection. The results show that the area under the curve of the proposed model for identifying social media bots reaches 98% through the experiments on public datasets, which can effectively distinguish bots from common users and further verify the performance of the proposed model.

© 2018 IEEE. Ethereum, as the first Turing-complete blockchain platform, provides various application program interfaces for developers. Although blockchain has highly improved security, faulty configuration and usage can result in serious vulnerabilities. In this paper, we focus on the security vulnerabilities of the official Go-version Ethereum client (geth). The vulnerabilities are because of the insecure API design and the specific Ethereum wallet mechanism. We demonstrate attacks exploiting these vulnerabilities in an Ethereum testbed. The vulnerabilities are confirmed by the scanning results on the public Internet. Finally, corresponding countermeasures against attacks are provided to enhance the security of the Ethereum platform.

Machine learning plays an important role in building intrusion detection systems. However, with the increase of data capacity and data dimension, the ability of shallow machine learning is becoming more limited. In this paper, we propose a fuzzy aggregation approach using the modified density peak clustering algorithm (MDPCA) and deep belief networks (DBNs). To reduce the size of the training set and the imbalance of the samples, MDPCA is used to divide the training set into several subsets with similar sets of attributes. Each subset is used to train its own sub-DBNs classifier. These sub-DBN classifiers can learn and explore high-level abstract features, automatically reduce data dimensions, and perform classification well. According to the nearest neighbor criterion, the fuzzy membership weights of each test sample in each sub-DBNs classifier are calculated. The output of all sub-DBNs classifiers is aggregated based on fuzzy membership weights. Experimental results on the NSL-KDD and UNSW-NB15 datasets show that our proposed model has higher overall accuracy, recall, precision and F1-score than other well-known classification methods. Furthermore, the proposed model achieves better performance in terms of accuracy, detection rate and false positive rate compared to the state-of-the-art intrusion detection methods.

© 2019 Xu Wang et al. Epidemic models trade the modeling accuracy for complexity reduction. This paper proposes to group vertices in directed graphs based on connectivity and carries out epidemic spread analysis on the group basis, thereby substantially reducing the modeling complexity while preserving the modeling accuracy. A group-based continuous-time Markov SIS model is developed. The adjacency matrix of the network is also collapsed according to the grouping, to evaluate the Jacobian matrix of the group-based continuous-time Markov model. By adopting the mean-field approximation on the groups of nodes and links, the model complexity is significantly reduced as compared with previous topological epidemic models. An epidemic threshold is deduced based on the spectral radius of the collapsed adjacency matrix. The epidemic threshold is proved to be dependent on network structure and interdependent of the network scale. Simulation results validate the analytical epidemic threshold and confirm the asymptotical accuracy of the proposed epidemic model.

Nearest neighbor (NN) models play an important role in the intrusion detection system (IDS). However, with the advent of the era of big data, the NN model has the disadvantages of low efficiency, noise sensitivity, and high storage requirement. This paper presents a neighbor prototype selection method based on CCHPSO for intrusion detection. In the model, the prototype selection and feature weight adjustment are performed simultaneously and k-nearest neighbor (KNN) is used as the basic classifier. To deal with large-scale optimization problems, a cooperative coevolving algorithm based on hybrid standard particle swarm and binary particle swarm optimization, which employs the divide-and-conquer strategy, is proposed in this paper. Meanwhile, a fitness function based on the accuracy and data reduction rate is defined in the CCHPSO to obtain a set of appropriate prototypes and feature weights. The KDD99 and NSL datasets are used to assess the effectiveness of the method. The empirical results indicate that the data reduction rate of the proposed method is very high, ranging from 82.32% to 92.01%. Compared with all the data used, the proposed method can not only achieve comparable accuracy performance but also save a lot of storage and computing resources.

Automatically classifying human personality traits through analysis of their social network behaviors is an important yet challenging task to date considering the low accuracy of current researches. In that detection of significant features is an essential part of a personality recognition system, this paper proposes an in-depth analysis of features that contributes to the recognition of a given trait. Besides the common features of social network used by most current researches, text style features and TF-IDF-based psychological features are proposed and prove to be effective to predict certain personality trait. Also particle swarm optimization (PSO) feature optimization algorithm has been adopted to select the best combination of features. Simulation results show that with the best combination of features, the F-measure value of the personality recognition has been improved around 12%.

Intrusion detection aims to detect intrusion behavior and serves as a complement to firewalls. It can detect attack types of malicious network communications and computer usage that cannot be detected by idiomatic firewalls. Many intrusion detection methods are processed through machine learning. Previous literature has shown that the performance of an intrusion detection method based on hybrid learning or integration approach is superior to that of single learning technology. However, almost no studies focus on how additional representative and concise features can be extracted to process effective intrusion detection among massive and complicated data. In this paper, a new hybrid learning method is proposed on the basis of features such as density, cluster centers, and nearest neighbors (DCNN). In this algorithm, data is represented by the local density of each sample point and the sum of distances from each sample point to cluster centers and to its nearest neighbor. k-NN classifier is adopted to classify the new feature vectors. Our experiment shows that DCNN, which combines K-means, clustering-based density, and k-NN classifier, is effective in intrusion detection.

Feature selection (FS) plays an important role in machine learning. FS under minimum redundancy maximum relevance framework based on mutual information behaved well according to existing researched. This paper focus on the validity of the Min-Redundancy Max-Relevance (mRMR) framework with some traditional correlative criteria, such as Spearman coefficient, distance correlation (dCor), and maximal information coefficient (MIC), etc. Experimental results show that mRMR can bring encouraging feature selection result compared with the traditional K-BEST feature selection method, no matter which criterion is adopted and the classification accuracy of these criteria is improved under the mRMR framework.

Software-defined networking (SDN) provides a solution for scalable network framework with decoupled control and data plane. However, this architecture also induces a particular distributed denial-of-service (DDoS) attack that can affect or even overwhelm the SDN network. DDoS attack detection problem has to date been mostly researched as entropy comparison problem. However, this problem lacks the utilization of SDN, and the results are not accurate. In this paper, we propose a DDoS attack detection method, which interprets DDoS detection as a signature matching problem and is formulated as Earth Mover’s Distance (EMD) model. Considering the feasibility and accuracy, we further propose to define the cost function of EMD to be a generalized Kullback-Leibler divergence. Simulation results show that our proposed method can detect DDoS attacks by comparing EMD values with the ones computed in the case without attacks. Moreover, our method can significantly increase the true positive rate of detection., {"references":["P. Zhang, H. Wang, C. Hu, and C. Lin, \"On denial of service attacks\nin software defined networks,\" IEEE Network, vol. 30, no. 6, pp. 28-33,\n2016.","S. M. Mousavi and M. St-Hilaire, \"Early detection of DDoS\nattacks against SDN controllers,\" in Computing, Networking and\nCommunications (ICNC), 2015 International Conference on. IEEE, 2015,\npp. 77-81.","R. Kokila, S. T. Selvi, and K. Govindarajan, \"DDos detection and analysis\nin SDN-based environment using support vector machine classifier,\" in\nAdvanced Computing (ICoAC), 2014 Sixth International Conference on.\nIEEE, 2014, pp. 205-210.","K. Kumar, R. Joshi, and K. Singh, \"A distributed approach using\nentropy to detect DDoS attacks in ISP domain,\" in Signal Processing,\nCommunications and Networking, 2007. ICSCN'07. International\nConference on. IEEE, 2007, pp. 331-337.","X. Ma and Y. Chen, \"DDoS detection method based on chaos analysis\nof network traffic entropy,\" IEEE Communications Letters, vol. 18, no.\n1, pp. 114-117, 2014.","Y. Xiang, K. Li, and W. Zhou, \"Low-rate DDoS attacks detection and\ntraceback by using new information metrics,\" IEEE Transactions on\nInformation Forensics and Security, vol. 6, no. 2, pp. 426-437, 2011.","Q. Yan, F. R. Yu, Q. Gong, and J. Li, \"Software-defined networking\n(SDN) and distributed denial of service (DDoS) attacks in cloud\ncomputing environments: A survey, some research issues, and\nchallenges,\" IEEE Communications Surveys & Tutorials, vol. 18, no. 1,\npp. 602-622, 2016.","L. Barki, A. Shidling, N. Meti, D. Narayan, and M. M. Mulla,\"Detection\nof distributed denial of service attacks in software defined networks,\"\nin Advances in Computing, Communications and Informatics (ICACCI),\n2016 International Conference on. IEEE, 2016, pp. 2576-2581.","N.-N. Dao, J. Park, M. Park, and S. Cho, \"A feasible method to combat\nagainst DDoS attack in SDN network,\" in Information Networking\n(ICOIN), 2015 International Conference on. IEEE, 2015, pp. 309-311.\n[10] X. Huang, X. Du, and B. Song, \"An effective DDoS defense scheme for\nSDN,\" in Communications (ICC), 2017 IEEE International Conference\non. IEEE, 2017, pp. 1-6.\n[11] Y. Rubner, C. Tomasi, and L. J. Guibas, \"The earth mover's distance\nas a metric for image retrieval,\" International journal of computer vision,\nvol. 40, no. 2, pp. 99-121, 2000.\n[12] D. Zhang and G. Lu, \"Evaluation of similarity measurement for image\nretrieval,\" in Neural Networks and Signal Processing, 2003. Proceedings\nof the 2003 International Conference on, vol. 2. IEEE, 2003, pp. 928-931.\n[13] K. Benton, L. J. Camp, and C. Small, \"OpenFlow vulnerability\nassessment,\" in Proceedings of the second ACM SIGCOMM workshop\non Hot topics in software defined networking. ACM, 2013, pp. 151-152.\n[14] M. Team, \"Mininet,\" 2014.\n[15] S. Floodlight, \"OpenFlow controller,\" Web:\nhttps://github.com/floodlight/floodlight.\n[16] P. Biondi, \"Scapy, a powerful interactive packet manipulation program,\"\n2010.\n[17] Y Zhou, W Ni, K Zheng, R. P. Liu, and Y. Yang, \"Scalable Node-Centric\nRoute Mutation for Defense of Large-Scale Software-Defined Networks,\"\nSecurity and Communication Networks, 2017.\n[18] Y Zhou, K Zheng, W Ni, and R. P. Liu. \"Elastic Switch Migration\nfor Control Plane Load Balancing in SDN,\" IEEE Access, 2018, DOI\n10.1109/ACCESS.2018.2795576."]}