Search

Intrusion detection systems play an important role in preventing security threats and protecting networks from attacks. However, with the emergence of unknown attacks and imbalanced samples, traditional machine learning methods suffer from lower detection rates and higher false positive rates. We propose a novel intrusion detection model that combines an improved conditional variational AutoEncoder (ICVAE) with a deep neural network (DNN), namely ICVAE-DNN. ICVAE is used to learn and explore potential sparse representations between network data features and classes. The trained ICVAE decoder generates new attack samples according to the specified intrusion categories to balance the training data and increase the diversity of training samples, thereby improving the detection rate of the imbalanced attacks. The trained ICVAE encoder is not only used to automatically reduce data dimension, but also to initialize the weight of DNN hidden layers, so that DNN can easily achieve global optimization through back propagation and fine tuning. The NSL-KDD and UNSW-NB15 datasets are used to evaluate the performance of the ICVAE-DNN. The ICVAE-DNN is superior to the three well-known oversampling methods in data augmentation. Moreover, the ICVAE-DNN outperforms six well-known models in detection performance, and is more effective in detecting minority attacks and unknown attacks. In addition, the ICVAE-DNN also shows better overall accuracy, detection rate and false positive rate than the nine state-of-the-art intrusion detection methods.

As a kind of behavioural characteristic, keystroke features are crucial to the accuracy of user identification system using shallow machine learning algorithms. Filter and wrapper feature selection algorithms are the two most important methods. The information gain and particle swarm optimisation algorithm represent the two feature optimisation methods, respectively. In this paper, new hybrid binary particle swarm optimisation methods combined with information gain theory are proposed in association with opposite-based learning and distributed techniques. The converted information gain values act as weight coefficients to adaptively adjust the flight speed of particles. The support vector machine (SVM) algorithm is applied to evaluate the performance of feature optimisation in terms of user identification accuracy and feature reduction rate. Experimental results of three public keystroke datasets show that the proposed optimisation methods achieve better classification accuracy with fewer features than four existing optimisation methods.

Identity-based cryptography (IBC) has drawn a lot of attentions in delay tolerant environment. However, the high computational cost of IBC becomes the most critical issue in delay tolerant mobile sensor network (DTMSN) because of the limited processing power. In this paper, an efficient identify-based signature scheme with batch authentication (ISBA) is proposed for DTMSN. ISBA designs an online/offline signature with batch authentication to reduce the computational cost, and improves data delivery mechanism to increase the number of messages for each batch authentication. Simulation results show that ISBA not only realizes a lower computational cost than existed schemes, but also does not induce negative impact on the delivery performance.

© 2016 IEEE. Biological epidemic models, widely used to model computer virus propagations, suffer from either limited scalability to large networks, or accuracy loss resulting from simplifying approximations. In this paper, a discrete-time absorbing Markov process is constructed to precisely characterize virus propagations. Conducting eigenvalue analysis and Jordan decomposition to the process, we prove that the virus extinction rate, i.e., the rate at which the Markov process converges to a virus-free absorbing state, is bounded. The bounds, depending on the infection and curing probabilities, and the minimum degree of the network topology, have closed forms. We also reveal that the minimum curing probability for a given extinction rate requirement, specified through the upper bound, is independent of the explicit size of the network. As a result, we can interpret the extinction rate requirement of a large network with that of a much smaller one, evaluate its minimum curing requirement, and achieve simplifications with negligible loss of accuracy. Simulation results corroborate the effectiveness of the interpretation, as well as its analytical accuracy in large networks.

The source-location privacy threat is one of the critical issues in Wireless Sensor Networks (WSNs). Adversaries may trace along the sensor traffic to hunt targets around source nodes. Previous works proposed dummy messages and network coding to eliminate time and content correlations. However, these proposed schemes may result in explosion of polluted and dummy messages, opening up vulnerability to active attackers. In this work, we propose pollution avoiding source location privacy preserving scheme PA-SLP. A probabilistic key predistribution is proposed to predistributed keys in nodes. It enables intermediate nodes to verify signatures and filter out dummy or polluted messages with a certain possibility. In PA-SLP, a triple type homomorphic signature algorithm is developed to detect and classify three message types with only one pair of asymmetric keys. PA-SLP is able to adjust key distribution parameters to balance network performance and privacy. Security analysis and simulation results demonstrate PA-SLP can resist traffic analysis and filter out polluted and dummy messages effectively.

© 2016 IEEE. Advanced Persistent Threat (APT) imposes increasing threats on cyber security with the developing network attack technologies. APT is a highly interactive, specifically targeted and extremely harmful network-centric attack, which employs various technologies to evade detection during attacks leading to the result that victims will not be aware of attacks until they suffer from tremendous losses. Since command and control (C&C) is an essential component during the lifetime of APT, the detection of it is a practical measure to defend against the APT. In this paper, we analyze the features of C&C in APT and find that the HTTP-based C&C is widely used. Based on the analysis results, we propose a new feature of C&C, i.e., independent access, to characterize the difference between C&C communications and normal HTTP requests. Applying the independent access feature into DNS records, we implement a novel C&C detection method and validate it on public dataset. As a new feature of C&C, its advantages and drawbacks are also analyzed.

© 2015 IEEE. Data security is crucial to safety-related vehicular applications. Critical challenges of unstable topologies and the collisions of uncoordinated data transmissions arise, due to the mobile and distributed nature of vehicular ad-hoc networks (VANETs). We propose a new secure transmission protocol for VANETs, where the transmitter can adaptively switch between backing off transmissions to alleviate collisions, as well as changing keys, to increase success rate with matched keys. We also develop a new 3-dimensional (3-D) Markov model to characterize the protocol. Security analyses are carried out. Interesting insights and useful guidelines to adequately distribute keys among mobile vehicular nodes are also provided.

We propose a evaluation model of botnet based on peer to peer. We propose key metrics to measure their activities(e.g, Stealthy, Effectiveness, Efficiency and Robustness). Using these performance metrics, we can study p2p botnet in a systematic way, and more convenient to find the method to defense botnet. In particular, our models show that the important relationship between degree and these metrics in p2p botnet. Our experiments prove that, the degree of nodes play an important role in evaluating robust of botnet, at the same time, the differences of node degree also an important metric in our evaluation system. We evaluate some botnet using simulation and demonstrate the utility of our proposed metrics. Our analysis show how botnet can be evaluated according to structure and communication using our proposed metrics.

To provide security for data gathering based on network coding in wireless sensor networks (WSNs), a secure network coding-based data gathering model is proposed, and a data-privacy preserving and pollution preventing (DPP&PP) protocol using network coding is designed. DPP&PP makes use of a new proposed pollution symbol selection and pollution (PSSP) scheme based on a new obfuscation idea to pollute existing symbols. Analyses of DPP&PP show that it not only requires low overhead on computation and communication, but also provides high security on resisting brute-force attacks.

Delay Tolerant Mobile Sensor Networks (DTMSN) has the enormous potential to expand its applications in many previously impossible fields. Because of its intermittent link and limited network resources, this network needs an effective data forwarding algorithm to ensure valid data forwarding and highly delivery ratio. Recent approaches have drawbacks of computing nodes' delivery probability, because they only paid attention to partial factors. In this paper, a Location and Velocity vector based data Delivery approach (LVD) was proposed, which gives an in-depth description of nodes' motion state, and more accurately calculates the delivery probability based on the location and velocity vector. Simulation results show that this approach cannot only improve the message delivery rate with lower transmission overhead, but also reduce data transmission delay.

The resource constraint characteristic of sensor nodes make wireless sensor networks (WSN) very vulnerable to resource depletion attack such as DoS/DDos attack. On the other hand, the resource constraint characteristic also makes anomaly detection a challenging problem in WSN. To address the challenge, this paper presents an anomaly detection framework by taking the advantages of artificial immune system (AIS) and fuzzy theory. The proposed framework incorporates three components: local danger sensing, co-stimulation and global recognition. Due to the hierarchical structure and cooperative mechanism, the proposed model shows more advantages in detection performance than conventional method. The simulation results show that compared to watchdog method, the proposed method can provide higher detection rate and lower false detection rate. Moreover, the propose method shows advantages in flexibility and adaptability.

According to the propagation and destruction characteristics of mobile phone viruses, a virus detection model based on the Danger Theory is proposed. This model includes four phases: danger capture, antigen presentation, antibody generation and antibody distribution. In this model, local knowledge of mobile phones is exploited by the agents that are running in mobile phones to discover danger caused by viruses. The Antigen Presenting Cells (APCs) present the antigen from mobile phones in the danger zone, and the Decision Center confirms the infection of viruses. After the antibody is generated by self-tolerating using the negative selection algorithm, the Decision Center distributes the antibody to mobile phones. Due to the distributed and cooperative mechanism of artificial immune system, the proposed model lowers the storage and computing consumption of mobile phones. The simulation results show that based on the mobile phone virus detection model, the proposed virus immunization strategy can effectively inhibit the propagation of mobile phone viruses.

This paper proposes a cluster-based network coding data gathering (CNCDG) protocol used for the aggregated-data gathering scenario in wireless sensor networks, where the sink only wants an aggregated result of all the data sensed from an area. CNCDG integrates cluster-based routings with network coding. It aims to save more energy than flat-based network coding protocols by permitting cluster heads to perform some aggregation so as to reduce the amount of packets transmitted. This paper theoretically analyzes the feasibility of CNCDG and presents its energy consumption function in a regular rectangular grid network, and further demonstrates the fact that CNCDG will be energy efficient in most environments by simulations in random-deployed networks.

This paper presents a scheme of a multiple-image compressed encryption based on the compressive holography technique. Computer generate hologram (CGH) is implemented to record multiple images simultaneously into an encrypted hologram. Because its two-dimensional (2D) Fourier transform (FT) result is analogous a partial 3D Fourier transform sampling, the 2D FT result can be compressed by a nonuniform sampling accompanied with a quantization. The encryption and compression processes agrees with the requirement of the compressive sensing and composes the compressive holography. Therefore, the decryption is solved by a minimization. It remains the sparsity of the recovered natural images in the wavelet basis. Meanwhile, a total-variation regularization and a nonnegative constraint is employed to extract images with edge preserved and nonnegative gray scale, respectively. Experiments are conducted to demonstrate the feasibility of the multiple-image compressed encryption.

The paper proposes to apply Empirical Mode Decomposition (EMD) to network traffic signal. Then the corresponding intrinsic mode functions (IMFs) are obtained to calculate their Hurst index based on which the influence to the IMF Hurst after DDoS attack was analyzed. Finally, it makes a judgment on whether a DDoS attack happened or not by solving the IMF Hurst index of the unsure sequence. Experimental results show that, compared with the original signal Hurst index assay, this method can increase detection precision and CI, reduce the rate of false positives and false negative. The method behaves well in distinguishing attacked traffic from normal ones.

As an emerging network, Delay Tolerant Mobile Sensor Network (DTMSN) is susceptible to be attacked because of its limited resources and intermittent connectivity. Though authentication technology is usually used to prevent network from attacks, it is a challenging work in delay tolerant circumstance. In this paper, a node mutual authentication scheme based on Physical Unclonable Function (PUF) is proposed for DTMSN. We take advantage of the physical characteristics of chips with PUFs to prevent sensor nodes from cloning. Analysis indicates that the scheme is efficient and robust against different attacks, such as clone attack, replay attack, tampering attack, etc.

Internet of things (IOT) is vulnerable to malicious attacks because of opening deployment and limited resources. It's heterogeneous and distributed characters make conventional intrusion detection methodologies hard to deploy. To overcome this problem, this paper shows an intrusion detection scheme based on the anomaly mining. The paper has two parts (i) in the first part an anomaly mining algorithm is developed to detect anomaly data of perception layer, (ii) in the second part a distributed intrusion detection scheme is designed based on the detected anomalies. Since not all anomalies are triggered by malicious intrusion, the intrusion semantic is analyzed to distinguish intrusion behaviors from anomalies. Finally our evaluation and analysis shows that our approach is accurate and extensible.

This paper analyses the characteristics of the Web Accessing DoS attacks, then proposes an active defense model. Based on the differences of data and time between the Web Accessing DoS attacks and the normal users' browsing behavior, the active defense model will divide the web accessing traffic into three types: the normal browsing traffic, the actual attacking traffic, the dubitable attacking traffic. The policies for accessing traffic are different: the normal browsing traffic is permitted to access the web site; the actual attacking traffic is forbidden to access the web site; the dubitable attacking traffic will be led into the deception web site, then the active defense model will determine whether to permit the traffic to access the web site or not according to the observing result. The experimental results show that the model is effective in detecting and preventing the Web Accessing DoS attacks.

According to the propagation characteristics of Bluetooth and SMS/MMS,based on the preventive immunity and mutation of mobile phone virus, we built the Susceptible-Exposed-Infected-Recovered(SEIR) model for the Bluetooth and SMS/MMS hybrid spread mode. On the basis of the SEIR model, we further discuss at length the influence of the propagation parameter such as preventive immunity of mobile phone users, mutation of virus, immunity structure in SMS/MMS network and node average degree in Bluetooth network on the propagation of the virus. Simulation results show that the model can simulate the spread process and features of mobile phone for hybrid spread model perfectly.

Through deeply analysis of INVITE flooding attack of SIP based VoIP system, a novel VoIP flooding detection scheme called CDVFD (Call Duration based VoIP Flooding Detection) is presented. The CDVFD method makes use of SIP signaling bidirectional interaction, and it can make fast detection using Chi-square value, and can distinguish from normal high VoIP traffic. Experimental results show the effectiveness of the method.

Key management is challenging in wireless sensor networks (WSNs). Most existing key management schemes mainly consider using symmetric cryptosystems in homogeneous sensor network, but they often do not provide a satisfied storage performance and cause large overhead in establishing shared keys for all pairs of neighbor sensors. In this paper, we propose a key management scheme using for heterogeneous sensor networks (HSNs). Our scheme is based on pairing-based cryptography and has four types of keys according to networks security needs. The scheme reduces the communication cost and key storage spaces of nodes. In fact sensor nodes can agree shared keys without any interaction and no need to store any keys of the other nodes before deployed. Analysis and simulation indicate that the scheme is efficient, and it enables authentication, and robust against different attacks such as replay attack, masquerade attack, Sybil attack etc.

Studying the features of network traffic is a necessary method in many applications such as managing and monitoring the network, detecting network attack etc. Due to the non-stationary and random characteristics of the traffic signal, Hilbert-Huang Transformation(HHT) is an effective method in signal processing. However, endpoints effect comes subsequently in HHT. In this particular case, the paper introduces a multiple residual error gray forecast method to realize data continuation so as to inhibiting endpoints effect in applying HHT to network traffic signal. Experimental results show that this method can effectively restrain the endpoint divergence phenomenon in applying HHT to network traffic signal, but it is not applicable to deterministic signals.

The research recently focuses on the integration of peer-to-peer frame as incremental improvements to botnet. In hybrid P2P botnet, it is important to find a mechanism to select neighbor list for every super node, in order to improve stability of communication when some super nodes lose. At the same time, it needs to select high performance and nearest node as a super node, to provide command request and file transport for other ordinary nodes. In this paper, we propose a neighbor list selecting method based on Strongly Connected Graph and analysis a super node selecting mechanism based on AHP. Evaluation shows that this mechanism can increase coverage probability of commands and decrease average connection time (ACT) between super node and ordinary node.

How to distinguish abnormal access from normal ones is the key problem in Distribution Denial of service(DDoS) attack detection. This research aims at finding out the major difference between the abnormal access and the normal ones in application layer. To this end, the paper conducts modeling on Web users’ access behaviors based on hidden Markov model(HMM) with multiple chains and puts forward a method to identify abnormal access. Tests on simulation data indicate that this model can undo Web users access to a certain degree and discern the abnormal access well.

GSM and UMTS mobile radio network will coexist for a few years. Security of interoperation between GSM and UMTS becomes more important. This paper proposes a high security GSM/UMTS inter-system which supports all possible network roaming and provides high security service for both GSM and UMTS subscriber. The paper discusses the architecture of proposed system and authentication procedure in different network environment. The high security GSM/UMTS is efficient in GSM and UMTS coexistence environment in future through a comparison with previous GSM/UMTS inter-system.

The goal of this paper is to carry out a study in a new algorithm of digital watermark, which makes a information hiding calculation in spatial domain. This method can achieve a higher robustness to prevent many attacks from channel noise, JPEG, etc; and as while it can achieve a higher imperceptible than simple LSB method. The ownership insert the watermark into the host signal after analyzing the gradient of the host image based on difference method. A conclusion can be made that the proposed technique is practical.

A dynamic immunization model based on alarm information mail spreading was proposed to suppress email worms propagation. This model considers interaction between immunization process and worm infection process other than static immunization strategies. The simulation results show that the model can suppress infection process more effectively without understanding the whole network information than target immunization.

Internet topology measurement is an important part of Network measurement. Nowadays, traceroute probing method is widely used to obtain the original route data, and the IP alias resolution technique is to identify IP addresses belonging to the same router for constructing accurate Internet maps. However, there are thousands of IP addresses only in a region topology exploration, while current alias resolution technique has limited effectiveness. So we need to apply a new approach to refine the collected path traces before IP alias resolution which is called Alias Filter (AF). In this paper we propose an improved algorithm called RAF which based on rules set according to experiences for dealing with the path data. The performance analysis proves the algorithm has low cost and high efficiency.

As the number of VoIP users increase and as the deployment of SIP devices gains ground, security has risen as a potential issue worthy of our consideration. VoIP is an application running on the data network and as such, inherits the security issues common to IP. The Man-in-the-Middle (MitM) attacks and the denial of service (DoS) attacks are the hackneyed and evil cyber attacks in the IP which can be easily implemented in the SIP VoIP. In this paper, a unified communication model of SIP VoIP infrastructure is established to analyze the DoS attacks launched by the MitM (MitM-DoS). Then we use the set theory to research the models of MitM-DoS attacks formally.

To overcome the secure weakness of the existing proxy blind signature scheme based on ECDLP, an improved scheme is presented. The security of the improved scheme is enhanced by improving on the generate form of the proxy commission and the proxy private key in the proxy phase, the procedure of blinding and unblinding, and the corresponding verification equation of proxy blind signature. The analysis shows that the new scheme resolves secure problems in the former schemes, meets the seven aspects of security features needed by proxy blind signature scheme. The analytic results prove that the new scheme is more secure and practicable.

In this paper, we analyze the security access domain in the third generation communication system (3G) is vulnerable to Man in the Middle (MitM) attack and denial of service (DoS). Basing on deep analysis of Authentication and Key Agreement (AKA) protocol, we formally established the MitM-DoS attack models in the wireless network and in the wired network. Aiming at the vulnerability in the access domain of 3G, finally, a new defense strategy modeling is demonstrated in the paper.

The existing analytic models on network worm propagation rarely consider the effect of topology structure, and it usually considers the probability and spread parameter as fixed values. They are not coinciding with real situation. Here in the paper, a microstructure based propagation model is proposed to inflect the variability with time. In this model, many probability factors are considered, for example the connecting probability from one node to another node, one node's immune probability, which make the model more general and suitable for simulation.

As the number of wireless users increases and as more powerful mobile devices become available for lower cost, Man-in- the-Middle attacks will pose an increasingly real threat to wireless network security. In this paper, a unified mathematical model is established to analyze Man-in-the-Middle attacks in diverse wireless networks. Then we use propositions and logical operations to analyze the relationships of the elements in the model formally. The model and the logical reasoning used in it can assess whether a given system is vulnerable to this type of attack. The defense model of removing the vulnerability is also presented.

Peer-to-Peer (P2P) network is a fast developing branch of Computer Science and many researchers are developing new algorithms for such systems. After the success of systems like Napster, Kazza, the use of such networks became a necessity. This paper analyses the reason of the redundant search packets in the area of resource discovery and search of the P2P system, details in the Multi-hop BFS algorithm and the apriority policy-based model, puts forward the apriority policy-based multi-hop BFS search algorithm and gives the correctness proof of APM-MHBFS.

Feature selection is a valid method to reduce the dimension of text vector in automatic text categorization system. The paper finds a defect among several normal evaluation functions based on experiments data and proposes that normalization should be taken into these methods as a necessary step. Furthermore, the paper also brings forward a new idea named classified feature selection that applies traditional evaluation function among each class. Experiments prove the validity of these two solutions.

Considering trust issues in cloud computing, we analyze the feasibility of adopting ant colony optimization algorithm to simulate trust relationships between entities in the cloud and then propose a novel behavior trust model: ACO-BTM. Trust relationships between entities in cloud computing are dynamic, uncertain and hard to quantify. ACO-BTM introduces the conception of ‘pheromone’ and transition probability to represent behavior trust. Then, it focuses on the research of dynamic trust evaluation, time constraint and some other issues. Furthermore, a detailed algorithm process of behavior trust evaluation is given in this context. Finally, ACO-BTM is applied to cloud computing platform to simulate the establishment of behavior trust relationships. The simulation experiment verifies that trust degree change with time varies and the frequency of interactions. Compared with the other model, ACO-BTM can provide better trust recommendation services and protect against attacks of malicious nodes effectively in cloud computing environment. It is proved that ACO-BTM has good flexibility, accuracy and robustness.