Search

Serverless computing is a promising paradigm that greatly simplifies cloud programming. With serverless computing, developers simply provide event-driven functions to a serverless platform, and these functions can be orchestrated as serverless workflows to accomplish complex tasks. Due to the lightweight limitation of functions, serverless workflows not only suffer from existing vulnerability-based threats but also face new security threats from the function compiling phase. In this paper, we present SMWE, a secure and makespan-oriented workflow execution framework in serverless computing. SMWE enables all life cycle protection for functions by adopting compiler shifting and running environment replacement in the serverless workflow. Furthermore, SMWE balances the tradeoff between security and makespan by carefully scheduling functions to running environments and selectively applying the secure techniques to functions. Extensive evaluations show that SMWE significantly increases the security of serverless workflows with small makespan cost. [ABSTRACT FROM AUTHOR]

Firstly, the basic concept of network layer hopping technology was introduced and the security threats it faced were given. Then, two type of models and communication methods of network layer hopping technology based on traditional networks and software-defined networks were given. And the network layer hopping technology was classified from three aspects of hopping attributes, the method of hopping realization and the method of hopping trigger, two evaluation models of network layer hopping were given. Finally, the problems that still exist in the network layer hopping technology and the corresponding development direction were summarized.

In addressing the inefficiencies and limitations in proactive defense against Regular Expression Denial of Service (ReDoS) attacks in cloud-native environments, we have developed a defense method based on Moving Target Defense (MTD) technology. Initially, we analyzed the behaviors of both attackers and defenders within microservice applications characteristic of cloud-native environments. Subsequently, leveraging Kubernetes, we de signed an MTD-based defense system. This system incorporates dynamic and static multi-dimensional microservice weight indices based on topology information and request arrival rates, as well as service efficiency judgment indices based on queue theory. It also includes a method for selecting the timing of key microservice rotations to guide the selection and rotation timings of critical microservices. Finally, we introduced a multi-dimensional MTD heterogeneous rotation algorithm, grounded in heterogeneity and service efficiency, and conducted simulations using Python. Experimental results indicate that our proposed algorithm reduces defense latency by approximately 50% com pared to dynamic scaling and that defense costs stabilize after the initial defense against an attack, preventing continuous growth. [ABSTRACT FROM AUTHOR]

Due to software and hardware differentiation, the problem of false positives mistakenly identified as network attack behavior caused by inconsistent mimic decision results frequently occurs. Therefore, a mimic decision method based on deep learning was proposed. By constructing an unsupervised autoencoder-decoder deep learning model, the deep semantic features of diverse normal response data were explored from different executions and its statistical rules were analyzed and summarized. Additionally, the offline learning-online decision-making mechanism and the feedback optimization mechanism were designed to solve false positive problem, thereby accurately detecting network attacks and improving target system security resilience. Since statistical rules of normal response data was understood and mastered by deep learning model, the mimic decision results among different executions could remain consistent, indicating that the target system was in a secure state. However, once the target system was subjected to a network attacks, the response data outputted by the different executions was deviated from statistical distribution of deep learning model. Therefore, inconsistent mimic decision results were presented, indicating that the affected execution was under attack and the target system was exposed to potential security threats. The experiments show that the performance of the proposed method is significantly superior to the popular mimic decision methods, and the average prediction accuracy is improved by 14.89%, which is conducive to integrating the method into the mimic transformation of real application to enhance the system's defensive capability. [ABSTRACT FROM AUTHOR]

In the face of an increasingly intricate network structure and a multitude of security threats, cyber deception defenders often employ deception assets to safeguard critical real assets. However, when it comes to the intranet lateral movement attackers in the cyber kill chain, the deployment of deception assets confronts the challenges of lack of dynamics, inability to make real-time decisions, and not considering the dynamic change of an attacker's strategy. To address these issues, this study introduces a novel maze pathfinding model tailored to the lateral movement context, in which we try to find out the attacker's location to deploy deception assets accurately for interception. The attack–defense process is modeled as a multi-agent stochastic game, by comparing it with random action policy and Minimax-Q algorithm, we choose Nash Q-learning to solve the deception asset's deployment strategy to achieve the optimal solution effect. Extensive simulation tests reveal that our proposed model exhibits good convergence properties. Moreover, the average defense success rate surpasses 70%, attesting to the model's efficacy. [ABSTRACT FROM AUTHOR]

Introducing multiple controllers to software defined network so that dynamically altering the mapping relationship between controller and the underlying network is an effective method to ease the security threats in control plane. However, little previous work has been done to investigate the economical time in dynamic-scheduling controllers. Firstly, the importance of scheduling-time in dynamic control plane based on security in SDN and dynamic control plane was introduced. Further, this problem was modeled as a renewal reward process and an optimal algorithm in deciding the right time to schedule was proposed. In our experiments, Simulations based on real network attack dataset are conducted and it demonstrate that proposed algorithm outperforms fixed-cycle algorithms and random algorithm.

With the rise of image manipulation techniques, an increasing number of individuals find it easy to manipulate image content. Undoubtedly, this presents a significant challenge to the integrity of multimedia data, thereby fueling the advancement of image forgery detection research. A majority of current methods employ convolutional neural networks (CNNs) for image manipulation localization, yielding promising outcomes. Nevertheless, CNN-based approaches possess limitations in establishing explicit long-range relationships. Consequently, addressing the image manipulation localization task necessitates a solution that adeptly builds global context while preserving a robust grasp of low-level details. In this paper, we propose GPNet to address this challenge. GPNet combines Transformer and CNN in parallel which can build global dependency and capture low-level details efficiently. Additionally, we devise an effective fusion module referred to as TcFusion, which proficiently amalgamates feature maps generated by both branches. Thorough extensive experiments conducted on diverse datasets showcase that our network outperforms prevailing state-of-the-art manipulation detection and localization approaches. [ABSTRACT FROM AUTHOR]

Software diversity is commonly utilized in scenarios such as software distribution and operating systems to improves system resilience and security. However, existing software diversity evaluation methods are typically based on conventional code features and are relatively limited in scope, which can make it difficult to accurately reflect the security benefits of software diversity. To address this issue, a software diversity evaluation method was proposed from the perspective of ROP attack by analyzing the impact of software diversity on the difficulty of building a gadget attack chain, the attacker's potentially available computing power, and the attacker's cost of searching for gadgets in different variants. Metrics for the quality, practicability, and distribution of gadgets were integrated into this method. Testing was conducted using diversity technologies with different granularity. The evaluation results showed that the proposed method could accurately and comprehensively reflect the security gain brought by software diversity. It was observed that software diversity could relocate/modify/delete a large number of gadgets in the software, increasing the cost of attacking different software variants but also leading to different degrees of software expansion. Finally, an analysis and discussion of the advantages and disadvantages of existing diversity techniques were conducted based on the experimental results. [ABSTRACT FROM AUTHOR]