Search

Cyberspace mimic defense (CMD) is an active defense theory that has emerged in recent years. By dynamically constructing and scheduling multiple executors, the CMD can not only effectively defend against security threats caused by unknown cyberspace weaknesses, but also improve the present situation of information asymmetry between attackers and defenders in cyberspace. However, as one of the key technologies of the CMD, the scheduling strategy algorithm still needs to be improved in real-time security, reliability, and universality, which has restricted the development and large-scale deployment of the CMD. To solve this problem, we propose an optimal seed scheduling strategy algorithm (OSSSA) in this paper. After using continuous-time Markov processes to mathematically analyze the model of the mimic defense system in cyberspace, we introduce the key factors and their evaluation methods that affecting the CMD defense performance in the OSSSA, then propose a reliable working mechanism of the OSSSA. Furthermore, we present an evaluation method that can effectively evaluate the defense performance of the scheduling algorithms. Experimental results from software simulations and real experiments show that the OSSSA has better real-time defense performance than the current mainstream scheduling strategy algorithms, and can adapt to different practical application scenarios, which is helpful to the further development of the CMD.

In the big data era, machine learning is expected to be a promising solution for intrusion detection. However, most existing machine learning based Intrusion Detection Systems (IDSs) are not satisfactory in performing the multiclass intrusion detection task in the case when traffic data are imbalanced. In this paper, a multi-layer intrusion detection system named KC-IDS is proposed, which aims to improve the detection performance of multi-class classification task. The motivation of KC-IDS is to predict different kinds of traffic in different layers and combine the advantages of k-Nearest Neighbors (kNN) and Categorical Boosting (CatBoost) to alleviate the effects of imbalanced data. Experimental results on KDD99 dataset verified that KC-IDS can achieve better detection performance compared with some existing machine learning methods.

With the advent of IR (Industrial Revolution) 4.0, the spread of sensors in IoT (Internet of Things) may generate massive data, which will challenge the limited sensor storage and network bandwidth. Hence, the study of big data compression is valuable in the field of sensors. A problem is how to compress the long-stream data efficiently with the finite memory of a sensor. To maintain the performance, traditional techniques of compression have to treat the data streams on a small and incompetent scale, which will reduce the compression ratio. To solve this problem, this paper proposes a block-split coding algorithm named “CZ-Array algorithm,” and implements it in the shareware named “ComZip.” CZ-Array can use a relatively small data window to cover a configurable large scale, which benefits the compression ratio. It is fast with the time complexity O(N) and fits the big data compression. The experiment results indicate that ComZip with CZ-Array can obtain a better compression ratio than gzip, lz4, bzip2, and p7zip in the multiple stream data compression, and it also has a competent speed among these general data compression software. Besides, CZ-Array is concise and fits the hardware parallel implementation of sensors.

Distributed Denial of Service (DDoS) attack is a stubborn network security problem. Various machine learning-based methods have been proposed to detect such attacks. According to our survey, the features used to characterize the attack are usually selected manually according to some personal understanding, and the detection model is expected to perform good generalization performance in practical detection all the time. Therefore, how to select the optimal features that perform the best performance is a critical problem for constructing an effective detector. Meanwhile, as network traffic gets increasingly complex and changeable, some original features may become incapable of characterizing current traffic, and detector failure could occur when traffic changes. In this paper, we chose the multilayer perceptrons (MLP) to demonstrate and solve the proposed problem. In our solution, we combined sequential feature selection with MLP to select the optimal features during the training phase and designed a feedback mechanism to reconstruct the detector when perceiving considerable detection errors dynamically. Finally, we validated the effectiveness of our method and compared it with some related works. The results showed that our method could yield comparable detection performance and correct the detector when it performed poorly.

Lots of sensors in the IoT (Internet of things) may generate massive data, which will challenge the limited sensor storage and network bandwidth. So the study of big data compression is very useful in the field of sensors. In practice, BWT (Burrows-Wheeler transform) can gain good compression results for some kinds of data, but the traditional BWT algorithms are neither concise nor fast enough for the hardware of sensors, which will limit the BWT block size in a very small and incompetent scale. To solve this problem, this paper presents a fast algorithm of truncated BWT named “CZ-BWT algorithm” and implements it in the shareware named “ComZip.” CZ-BWT supports the BWT block up to 2 GB (or larger) and uses the bucket sort. It is very fast with the time complexity O(N) and fits the big data compression. The experiment results indicate that ComZip with the CZ-BWT filter is obviously faster than bzip2, and it can obtain better compression ratio than bzip2 and p7zip in some conditions. In addition, CZ-BWT is more concise than current BWT with SA (suffix array) sorts and fits the hardware BWT implementation of sensors.

As the wireless network has limited bandwidth and insecure shared media, the data compression and encryption are very useful for the broadcasting transportation of big data in IoT (Internet of Things). However, the traditional techniques of compression and encryption are neither competent nor efficient. In order to solve this problem, this paper presents a combined parallel algorithm named “CZ algorithm” which can compress and encrypt the big data efficiently. CZ algorithm uses a parallel pipeline, mixes the coding of compression and encryption, and supports the data window up to 1 TB (or larger). Moreover, CZ algorithm can encrypt the big data as a chaotic cryptosystem which will not decrease the compression speed. Meanwhile, a shareware named “ComZip” is developed based on CZ algorithm. The experiment results show that ComZip in 64 b system can get better compression ratio than WinRAR and 7-zip, and it can be faster than 7-zip in the big data compression. In addition, ComZip encrypts the big data without extra consumption of computing resources.

HTML webpages are widely used in computer networks. However, protecting the webpage content is a problem because browsers can obtain the HTML and Javascript source codes. This paper presents an algorithm of HTML code encryption based on polymorphic Javascript programs. The Javascript codes can transmute and protect themselves like polymorphic viruses. Furthermore, this HTML encryption uses compression, permutation and check digits to enhance the security effect. Based on this algorithm, a webpage encrypting shareware named “Athena WebLock” is designed. The experiment results show this encrypting algorithm can protect the webpage content in most cases, so it is valuable in the field of Data Rights Management.