Search

The popularity of encryption method brings a great challenge to malware traffic identification. Traditional classes defined by expert experience are usually classified based on the host behaviors of malware, such as banking malware or ransomware, which are often irrelevant to its communication traffic behaviors. It leads to the fact that the boundaries of traffic feature dataset of different malware classes are fuzzy and make these traditional classes unhelpful for classification based on traffic features. Meanwhile, traditional machine learning-based encrypted malware traffic identification methods, such as using the multi-classification supervised learning model, are inefficient both in model training and detection, and its detection accuracy cannot meet the demand. In this paper, we propose a distance-based method, which utilizes unsupervised learning algorithm Gaussian mixture model (GMM) and ordering points to identify the clustering structure (OPTICS) to calculate the Distance between malwares and make use of the Distance to define the new malware class called FClass. Then, a set of models are trained by XGBoost algorithm to build an identification framework based on the FClass. The performance of the proposed method has been evaluated by comparing it with the other four methods. The results show that the proposed distance-based method is more efficient and accurate.

The transport layer security (TLS) protocol is widely adopted by apps as well as malware. With the geometric growth of TLS traffic, accurate and efficient detection of malicious TLS flows is becoming an imperative. However, current studies focus on either detection accuracy or detection efficiency, and few studies take into account both indicators. In this paper, we propose a two-layer detection framework composed of a filtering model (FM) and a malware family classification model (MFCM). In the first layer, a new set of TLS handshake features is presented to train the FM, which is devised to filter out a majority of benign TLS flows. For identifying malware families, both TLS handshake features and statistical features are applied to construct the MFCM in the second layer. Comprehensive experiments are conducted to substantiate the high accuracy and efficiency of the proposed two-layer framework. A total of 96.32% of benign TLS flows can be filtered out by the FM with few malicious TLS flows being discarded provided the threshold of the FM is set to 0.01. Moreover, a multiclassifier is selected to construct the MFCM to provide better performance than a set of binary classifiers under the same feature set. In addition, when the ratio of benign and malicious TLS flows is set to 10:1, the detection efficiency of the two-layer framework is 188% faster than that of the single-layer framework, while the average detection accuracy reaches 99.45%.

Several organizations use auctions in a procurement bidding system to maintain a low procurement cost. Although several privacy-preserving auction solutions for different application scenarios have been proposed over the past few decades, none of them can perform efficient average procurement bidding while ensuring strong privacy protection for the bids of suppliers. To address this problem, we propose PSPAB, a lightweight, secure average procurement bidding system based on cryptographic tools, to provide full privacy for bids. In addition, this system allows the procurement manager to identify the users in the case of double spending. We formally prove the security of PSPAB under a semi-honest adversary model. Experimental results validate the theoretical analysis and practical application of PSPAB in real-world scenarios.

Pornographic and gambling websites become increasingly stubborn via disguising, misleading, blocking, and bypassing, which hinder the construction of a safe and healthy network environment. However, most traditional approaches conduct the detection process through a single aspect of these sites, which would fail to handle the more intricate and challenging situations. To alleviate this problem, this study proposed an automatic detection system for porn and gambling websites based on visual and textual content using a decision mechanism (PG-VTDM). This system can be applied to the intelligent wireless router at home or school to realize the identification, blocking, and warning of ill-suited websites. First, Doc2Vec was employed to learn the textual features that can be used to represent the textual content in the hypertext markup language (HTML) source code of the websites. In addition, the traditional bag-of-visual-words (BoVW) was improved by introducing local spatial relationships of feature points for better representing the visual features of the website screenshot. Then, based on these two types of features, a text classifier and an image classifier were both trained. In the decision mechanism, a data fusion algorithm based on logistic regression (LR) was designed to obtain the final prediction result by measuring the contribution of the two classification results to the final category prediction. The efficiency of this proposed approach was substantiated via comparison experiments using gambling and porn website datasets crawled from the Internet. The proposed approach outperformed the approach based on a single feature and some state-of-the-art approaches, with accuracy, precision, and F-measure all over 99%.

A simple and novel electrochemical sensor was developed to determine levofloxacin based on the Ag nanoparticles/electrospun CeO2-Au composite nanofibers modified glassy carbon electrode (AgNPs/CeO2-Au/GCE). The electrospun CeO2-Au composite nanofibers provided a stable matrix and a large surface area for the fabrication of the sensing interface while the Ag nanoparticles dramatically promoted the current of levofloxacin on the electrode. Scanning electron microscopy and electrochemical methods were used to characterize the AgNPs/CeO2-Au composite film. The oxidative peak current was linear with the levofloxacin concentration in the range of 0.03-10 μM. The detection limit was as low as 0.01 μM (S/N = 3), and the sensitivity could reach 1240 μA mM-1 cm-2. Furthermore, the proposed modified electrode also could be feasibly applied to the determination of levofloxacin in human urine and blood serum samples. [ABSTRACT FROM AUTHOR]