Search

Website fingerprinting (WF) attacks can infer website names from encrypted network traffic when the victim is browsing the website. Inherent defenses of anonymous communication systems such as The Onion Router(Tor) cannot compete with current WF attacks. The state-of-the-art attack based on deep learning can gain over 98% accuracy in Tor. Most of the defenses have excellent defensive capabilities, but it will bring a relatively high bandwidth overhead, which will seriously affect the user’s network experience. And some defense methods have less impact on the latest website fingerprinting attacks. Defense-based adversarial examples have excellent defense capabilities and low bandwidth overhead, but they need to get the complete website traffic to generate defense data, which is obviously impractical. In this article, based on adversarial examples, we propose segmented adversary defense (SAD) for deep learning-based WF attacks. In SAD, sequence data are divided into multiple segments to ensure that SAD is feasible in real scenarios. Then, the adversarial examples for each segment of data can be generated by SAD. Finally, dummy packets are inserted after each segment original data. We also found that setting different head rates, that is, end points for the segments, will get better results. Experimentally, our results show that SAD can effectively reduce the accuracy of WF attacks. The technique drops the accuracy of the state-of-the-art attack hardened from 96% to 3% while incurring only 40% bandwidth overhead. Compared with the existing proposed defense named Deep Fingerprinting Defender (DFD), the defense effect of SAD is better under the same bandwidth overhead.

In data-driven big data security analysis, knowledge graph-based multisource heterogeneous threat data organization, association mining, and inference analysis attach increasinginterest in the field of cybersecurity. Although the construction of knowledge graph based on deep learning has achieved great success, the construction of a largescale, high-quality, and domain-specific knowledge graph needs a manual annotation of large corpora, which means it is very difficult. To tackle this problem, we present a straightforward active learning strategy for cybersecurity entity recognition utilizing deep learning technology. BERT pre-trained model and residual dilation convolutional neural networks (RDCNN) are introduced to learn entity context features, and the conditional random field (CRF) layer is employed as a tag decoder. Then, taking advantages of the output results and distribution of cybersecurity entities, we propose an active learning strategy named TPCL that considers the uncertainty, confidence, and diversity. We evaluated TPCL on the general domain datasets and cybersecurity datasets, respectively. The experimental results show that TPCL performs better than the traditional strategies in terms of accuracy and F1. Moreover, compared with the general field, it has better performance in the cybersecurity field and is more suitable for the Chinese entity recognition task in this field.

Most malware employs packing technology to escape detection; thus, packer identification has become increasingly important in malware detection. To improve the accuracy of packer identification, this article analyses the differences in the function call graph (FCG) and file attributes between the non-packed executable files and the executable files packed by different packers, and further proposes a 2-stage packer i dentification method based on FCG and file attributes (2-SPIFF). In 2-SPIFF, the detection model of stage I distinguishes non-packed executable files from packed executable files based on the graph features extracted from the FCG, while the identification model of stage II identifies the packer used for packing the original executable file by using the concatenated features extracted from the FCG and file attributes. The experimental results show that 2-SPIFF can achieve an accuracy of 99.80% for packer detection and an accuracy of 98.49% for packer identification.

After entering the 20th century, great changes have taken place in the Chinese language, especially in terms of vocabulary. This change is not a simple increase in the number of words, but reflects a paradigm shift. The change involves not only nouns, but also a large number of verbs and adjectives, which this article calls “modern reconstruction of vocabulary system”. This article argues that the realization of scientific narration based on the consistency of words and texts is the fundamental motivation of language modernization; the reconstruction of Chinese vocabulary system can be basically completed in a short period of time, mainly due to the language contact within the cultural circle of Chinese characters in East Asia, which is also an important driving force for the rapid two character transformation of Chinese vocabulary. This paper gives a bird’s-eye view of the nature, new concepts and new forms of lexicalization, especially the interaction between Chinese and Japanese vocabulary.

By network security threat intelligence analysis based on a security knowledge graph (SKG), multi-source threat intelligence data can be analyzed in a fine-grained manner. This has received extensive attention. It is difficult for traditional named entity recognition methods to identify mixed security entities in Chinese and English in the field of network security, and there are difficulties in accurately identifying network security entities because of insufficient features extracted. In this paper, we propose a novel FT-CNN-BiLSTM-CRF security entity recognition method based on a neural network CNN-BiLSTM-CRF model combined with a feature template (FT). The feature template is used to extract local context features, and a neural network model is used to automatically extract character features and text global features. Experimental results showed that our method can achieve an F-score of 86% on a large-scale network security dataset and outperforms other methods.

With the increasing complexity of network attacks, an active defense based on intelligence sharing becomes crucial. There is an important issue in intelligence analysis that automatically extracts threat actions from cyber threat intelligence (CTI) reports. To address this problem, we propose EX-Action, a framework for extracting threat actions from CTI reports. EX-Action finds threat actions by employing the natural language processing (NLP) technology and identifies actions by a multimodal learning algorithm. At the same time, a metric is used to evaluate the information completeness of the extracted action obtained by EX-Action. By the experiment on the CTI reports that consisted of sentences with complex structure, the experimental result indicates that EX-Action can achieve better performance than two state-of-the-art action extraction methods in terms of accuracy, recall, precision, and F1-score.

Software-defined networking for IoT (SDN-IoT) has become popular owing to its utility in smart applications. However, IoT devices are limited in computing resources, which makes them vulnerable to Low-rate Distributed Denial of Service (LDDoS). It is worth noting that LDDoS attacks are extremely stealthy and can evade the monitoring of traditional detection methods. Therefore, how to choose the optimal features to improve the detection performance of LDDoS attack detection methods is a key problem. In this paper, we propose DIAMOND, a structured coevolution feature optimization method for LDDoS detection in SDN-IoT. DIAMOND is consisted of a reachable count sorting clustering algorithm, a group structuring method, a comutation strategy, and a cocrossover strategy. By analysing the information of SDN-IoT network features in the solution space, the relationship between different SDN-IoT network features and the optimal solution is explored in DIAMOND. Then, the individuals with associated SDN-IoT network features are divided into different subpopulations, and a structural tree is generated. Further, multiple structural trees evolve in concert with each other. The evaluation results show that DIAMOND can effectively select optimal low-dimension feature sets and improve the performance of the LDDoS detection method, in terms of detection precision and response time.

A large number of open source threat intelligence resources provide regularly updated threat sources that can be applied to a variety of security analysis solutions. Fragmented security news, security forums, and vulnerability information are important sources of cyber threat intelligence, but it is difficult to correlate these multiple-source data. Cybersecurity knowledge graph is a powerful tool for data-driven thread intelligence computing. Relation extraction is a very important task in construction of cybersecurity knowledge graph from unstructured data. In order to reduce the influence of noisy data in deep learning model, we propose a distant supervised relation extraction model ResPCNN-ATT based on deep residual convolutional neural network and attention mechanism. This method takes word vector and position vector of the word as input of the model, extracts semantic features of texts through the piecewise convolutional neural network model PCNN, achieves the learning effect of less noisy data and better extracts deep semantic features in sentenses by using deep residuals Compared with other models, the model proposed in this paper achieves higher accuracy than other models.

As a repository that holds computing facilities, storage facilities, network facilities and other facilities, the Software Defined Data Center (SDDC) can provide computing and storage resources for users. For a SDDC, it is important to provide continuous services for users. Hence, in order to achieve high reliability in Software Defined Data Center Networks (SDDCNs), a network failure recovery method for software defined data center networks (REVERT) is proposed to recover failures in SDDCNs. In REVERT, the network failures that occurred in SDDCNs are classified into three types, which are switch failure, failure of links among switches and failure of links between switches and servers. Specially, except recovering the switch failure and failure of links between switches, REVERT can also recover the failures of links between the switches and servers. To achieve that, a failure preprocessing method used to classify the network failures, a data structure for storing and finding the affected flows, a server cluster agent for communicating with the server clustering algorithm and a routing path calculation method are designed in REVERT. Meanwhile, REVERT has been implemented and evaluated on RYU controller and Mininet using three routing algorithms. Compared with the link usage before recovering the network failures, when there are more than 200 flows in the network, the mean link usages only slightly increase at about 1.83 percent. More importantly, the evaluation results also demonstrate that except recovering switch failures, intra-topo link failures, REVERT has the ability of recovering failures of links between servers and edge switches successfully.

Industrial control systems (ICS) involve many key industries, which once attacked will cause heavy losses. However, traditional passive defense methods of cybersecurity have difficulty effectively dealing with increasingly complex threats; a knowledge graph is a new idea to analyze and process data in cybersecurity analysis. We propose a novel overall framework of data-driven industrial control network security defense, which integrated fragmented multisource threat data with an industrial network layout by a cybersecurity knowledge graph. In order to better correlate data to construct a knowledge graph, we propose a distant supervised relation extraction model ResPCNN-ATT; it is based on a deep residual convolutional neural network and attention mechanism, reduces the influence of noisy data in distant supervision, and better extracts deep semantic features in sentences by using deep residuals. We empirically demonstrate the performance of the proposed method in the field of general cybersecurity by using dataset CSER; the model proposed in this paper achieves higher accuracy than other models. And then, the dataset ICSER was used to construct a cybersecurity knowledge graph (CSKG) on the basis of analyzing specific industrial control scenarios, visualizing the knowledge graph for further security analysis to the industrial control system.

Recently, with the rapid increase in the number of malware, the traditional machine learning-based malware classification methods are faced with the severe challenge of efficiently and accurately detecting a large number of malicious programs. To meet this challenge, malware classification based on malware image and deep learning has become an effective solution. However, it is difficult to identify the section distribution information such as the number, order, and size of sections from the current gray images converted by the binary sequences of PE files. Therefore, this article proposes a novel visualization method that introduces the Colored Label boxes (CoLab) to mark the sections of a PE file to further emphasize the section distribution information in the converted malware image. Moreover, a malware classification method called MalCVS (Malware classification using CoLab image, VGG16, and Support vector machine) is constructed. The experimental results of the malware collected from VX-Heaven and Virusshare as well as the Microsoft Malware Classification Challenge dataset showed that MalCVS can effectively classify malware into families with high accuracy. The average accuracies of MalCVS are respectively 96.59% and 98.94% on the two datasets.

Software-Defined Networking (SDN) is widely considered as one of the next generation network architecture. However, SDN faces with a series of issues which restraint its development and application, where the security is one of the serious issues. The Distributed Denial of Service (DDoS) is such a devastating security problem. In this work, a comprehensive review of the DDoS detection mechanisms utilized in SDN is presented. DDoS attacks in SDN are classified into two types and five subtypes based on the features of DDoS and SDN. For each kind of DDoS, how the attackers can exploit the vulnerabilities of SDN to launch DDoS attacks is discussed. Subsequently, the DDoS detection mechanisms used in SDN are reviewed and categorized into five types and forty-six subtypes. These kinds of DDoS detection mechanisms are compared and analyzed, where we draw a conclusion that the machine learning-based DDoS detection mechanisms and threshold-based DDoS detection mechanisms are the two most popular technologies utilized to detect DDoS attacks in SDN. More importantly, for each kind of DDoS detection mechanism, the generational process, advantages, and disadvantages are discussed. Additionally, the open problems and future directions of DDoS detection in SDN are discussed. By presenting these review, discussion and analysis, we hope it can facilitate the understanding of DDoS detection in SDN.

The increasing complex tasks and growing size of data have necessitated the application of distributed transaction processing (DTP), which decouples tasks and data among multiple nodes for jointly processing. However, compared with the revolutionary development of computation power, the network capability falls relatively behind, leaving communication as a more distinct bottleneck. This paper focuses on the recent emerging RDMA technology, which can greatly improve communication performance but cannot be well exploited in many cases due to improper interactive design between the requester and responder. Our research finds that the typical implementation of confirming per work request (CPWR) triggers considerable CPU involvement, which further degrades the overall performance of RDMA communication. Targeting at this, we propose HiPower, which leverages a batched confirmation scheme with lower CPU utilization, to improve high-frequency communication efficiency. Our experiments show that, compared with CPWR, HiPower can improve the communication efficiency by up to 75% and reduce CPU cost by up to 79%, which speeds up the overall FCT (Flow Completion Time) by up to 14% on real workflow (Resnet-152).

Data share and exchange platform is an infrastructure of data open and share. How to ensure the security of government data in the exchange and sharing platform is a key problem. To solve this problem, we developed a security monitoring system for data share and exchange platform - DataSESec. A multi-layer graph model is provided to realize multi-source heterogeneous security monitoring metadata organization, data tracking and forensics, and multi-dimensional security monitoring data analysis. The system extracts network traffic data without authorization, which can achieve early security warning. The deployment of the security monitoring system is very flexible, the interface that interacts with the existing platform is very flexible, and the impact on the existing data share and exchange platform is very small.

We study a new influence maximization problem about how to find a seed set which can maximize the influence spread to a targeted user group in microblogging. To solve this problem, we propose a threestage User group greedy algorithm (UGGreedy) based on user attributes. To reduce network scale, we delete useless user nodes, and rank the rest of users based on user attributes to form a seed candidate set. We employ the seed candidate set to construct a simplified microblogging network graph. We propose a novel influence greedy algorithm based on influence accumulation spread to find the seed set. Experimental results show that UGGreedy can achieve remarkable efficiency on the influence maximization problem for user group in real microblogging networks.

The purpose of this study was to investigate the protective effects of curculigoside A (CA) on adjuvant arthritis (AA) rats and explore its possible mechanisms. AA was induced by intradermal injection of Freund's complete adjuvant (FCA). Male SD rats were treated with CA(10 and 20mg/kg) from days 18 to 24 after immunization. The levels of interleukin (IL)-6, IL-1β, tumor necrosis factor-α (TNF-α) and prostaglandin E2 (PGE2) in serum were determined by ELISA. Moreover, the levels of super oxide dismutase (SOD) and malondialdehyde (MDA) were determined using commercial kits. In particular, NLRP3 inflammasome and NF-кB pathway were detected by Western blot. As expected, CA at 10 and 20mg/kg significantly relieved the hind paw swelling and arthritis index, reduced the levels of IL-6 IL-1β, PGE2, TNF-α, MDA and increased SOD activity in serum. In addition, CA effectively down-regulated the expression of NF-кB/NLRP3 pathway. These findings showed that CA exerted beneficial effects on rheumatoid arthritis in rats.

Traditional anomaly detection on microblogging mostly focuses on individual anomalous users or messages. Since anomalous users employ advanced intelligent means, the anomaly detection is greatly poor in performance. In this paper, we propose an innovative framework of anomaly detection based on bipartite graph and co-clustering. A bipartite graph between users and messages is built to model the homogeneous and heterogeneous interactions. The proposed co-clustering algorithm based on nonnegative matrix tri-factorization can detect anomalous users and messages simultaneously. The homogeneous relations modeled by the bipartite graph are used as constraints to improve the accuracy of the co-clustering algorithm. Experimental results show that the proposed scheme can detect individual and group anomalies with high accuracy on a Sina Weibo dataset.

Ambiguity function (AF) provides an effective way for analysis of the resolving performance of a radar system. With the development of ultra-wideband (UWB) and multiple-input-multiple-output (MIMO) radio techniques, recently, the combination of them-the concept of UWB MIMO radar has been proposed and received much attention. For a UWB MIMO radar, first, the signal waveform with an exponential expression which is widely adopted in narrowband cases is not appropriate anymore. Second, the MIMO radar sensors are typically organized in a certain spatial topology, which greatly impacts the performance of the MIMO system. In addition, for a typical MIMO radar application scenario, generally, there are relative motions existing between the radar sensors and the targets. The presence of the relative motions would further complicate the performance analysis of the system. In fact, for a MIMO radar, the overall performance of the system is jointly determined by the parameters, such as the signal waveform, the topology, and the relative motions. Each of the parameters impacts the resolving performance in a particular way. In order to evaluate the contribution of each individual parameter of interest, in this paper, a UWB MIMO AF is developed and factorized into several factors. By this means, each individual parameter can be evaluated via the corresponding factor to examine a certain specific characteristic of the system, instead of via the complicated whole MIMO AFs.

Objective To observe the regulation of acupuncture and moxibustion for gastric motility of patients who experienced vomiting following chemotherapy.

Chinese characters are considered as an adaptable system, open to expansion and revision. Throughout history, the creation of new characters was one of the most important solutions to enlargements of the conceptual repertoire. Both scholars of “Dutch Learning” in Japan and missionaries active in nineteenth- century China used Chinese characters in their translations of western concepts. From a methodological point of view, Japanese scholars mostly coined compound words rendering the literal meanings of their terms of departure while translators in China, invigorated by the success of the new characters devised for chemical elements, believed that drafting new characters was more in line with the characteristics of the Chinese language. However, notwithstanding the painstaking efforts with which they were created, the new characters proposed by missionaries were eventually replaced by compound terms first used in Japanese adaptations. This paper examines the different practices and attitudes of Chinese and Japanese authors toward the creation of new characters as a method of translation. Analyzing the influence of their divergent approaches on the lexical systems of their respective languages, since Chinese has a very limited number of phonetic patterns, I conclude that it is impossible to create viable technical terminologies only by increasing new characters.

With the eruptible popularity of wireless sensing, wireless device-free passive human detection has received widespread attention. Indoor fine-grained device-free passive human motion detection based on the PHY layer information is rapidly developed. Since the received signal features can vary under different multipath propagation conditions, in the paper, we propose a lightweight and real-time passive human motion via physical layer phase information, which is independent of the indoor scenarios and needs no re-calibration. We firstly obtain available phase feature by a linear transformation on the raw channel state information(CSI). The real-time human motion detection is implemented based on two developed schemes: short-term averaged variance ratio (SVR) and long-term averaged variance ratio (LVR). We realize the design with commercial WiFi devices and evaluate it in typical multipath-rich indoor scenarios. As demonstrated in the experiments, our approach can achieve high detection rate and low false positive rate.

Microblog provides the first communication platform for burst event due to the immediacy and interactivity of microblog. In this paper, we research on user-oriented and message-oriented measurements of burst topic in Sina microblog. The measurements and analysis on large-scale Sina microblog data set show that our proposed measurement method can measure the characteristics of user and message propagation in burst topic. The measurement results in this paper can contribute to better research of relevant issues on burst topic and ensure the well-developed of microblog.

Along with the widely using of microblog, third party services such as follower markets sell bots to customers to build fake influence and reputation. However, the bots and the customers that have large numbers of followers usually post spam messages such as promoted messages, messages containing malicious links. In this paper, we propose an effective approach for bots detection based on interaction graph model and BP neural network. We build an interaction graph model based on user interaction and design robust interaction-based features. We conduct a comprehensive set of experiments to evaluate the proposed features using different machine learning classifiers. The results of our evaluation experiments show that BP neural network classifier using our proposed features can be effectively used to detect bots compared to other existing state-of-the-art approaches.

In microblogging, user interaction is the main factor that promotes the information diffusion rapidly. According to the user interaction in the process of information diffusion, this paper proposes a directed tree model based on user interaction that considering the history, type and frequency of interaction. User interaction matrix was used to describe the interactions between pairs of users. A directed diffusion tree was generated from the sparsification of interaction graph. The edges of directed diffusion tree were used to measure the information influence and identify the spam in microblogging. Experimental results show that the directed tree model can describe the information diffusion, measure the influence more accurately and identify the spam in the dataset more effectively.