Search

With the development of data plane programmable Software-Defined Networking (SDN), Distributed Denial of Service (DDoS) attacks on the data plane increasingly become fatal. Currently, traditional attack detection methods are mainly used to detect whether a DDoS attack occurs and it is difficult to find the path that the attack flow traverses the network, which makes it difficult to accurately mitigate DDoS attacks. In this paper, we propose a detection method based on Spatial-Temporal Graph Convolutional Network (ST-GCN) over the data plane programmable SDN, which maps the network into a graph. It senses the state of switches through In-band Network Telemetry (INT) with sampling, inputs the network state into the spatial-temporal graph convolutional network detection model, and finally finds out the switches through which DDoS attack flows pass. Based on this, we propose a defense method combined with an enhanced whitelist and a precise dropping strategy. The evaluation results show that our detection method can accurately detect the path that the DDoS attack flows pass through. Compared to classic methods, our method improves the detection accuracy by nearly 10%. At the same time, the southbound interface load, CPU overhead and defense process are much lower than the classic methods.

Academic publishing has undergone a transition from print-based, subscription access journals targeted toward physicians and scientists to the widely accessible, open access (OA) format made possible by the Internet. The objectives of OA broadly include audience expansion and improved public access to publicly funded research, reduction of limitations on content reuse and alteration, and prompt turnaround from submission to publication. Despite well-intended founding principles, unexpected disadvantages of the OA model have arisen including the emergence of predatory journals, which exploit the author-pays publishing model with the deceptive promise of reputable publishing platforms. Predatory journals can be difficult to discern from the legitimate yet unsophisticated novice journal, which represents a destructive influence on the credibility of surgeons and scientists within many specialties. As an author, when the highly reputable, "whitelisted" journals in our field are not available or interested in the scope of our work, how can we ensure authenticity of those journals that exist in the gray area between legitimate and illegitimate? Given these questions, the goal of this article is to demystify the history and selected issues that surround academic publication including content access, licensing, indexing, and journal metrics. With this background, we then evaluate highly visible OA journals in plastic and reconstructive surgery and build a basic framework, which authors can use to evaluate a journal for legitimacy and visibility.

As the number of low-cost Internet-of-Things (IoT) devices increases dramatically in recent years, they have become ideal targets for E-mail spammers. Some network cameras are shipped to the market with default passwords. Operating systems of many IoT devices are often outdated or not well-configured. Those practices make IoT devices easy to be compromised. Some of these compromised IoT devices may be used for E-mail spamming. Hence, how to handle undesired connections from client IoT devices becomes an important issue for mail server administrators. Even though the whitelist or blacklist are adopted by a mail server only allowing to receive E-mails relayed from few trusted SMTP servers, such list-based approach apparently cannot be applied for global SMTP clients when considering to the flexibility and cost of list maintenance. For most mail servers providing SMTP for desktop, laptop, or mobile clients rather than IoT devices, this paper proposes a server-side approach, called IoT detector (IoTD), to detect E-mails which are sent from IoT devices. Because the majority of IoT devices are not used by human users to send E-mail, administrators of mail servers may consider the E-mail sent by an IoT device as spam directly if IoT clients are not expected. Experimental results show that IoTD can accurately detect E-mails sent by IoT devices. The accuracy evaluation among five IoT devices and two non-IoT devices of this study shows that all tests for these five IoT devices are true positives, and all tests for these two non-IoT devices are true negatives as well.

With the development of IoT technology, everything in our daily lives became connected, forming a hyperconnected society. Subsequently, the importance of cyber security is being emphasized. Among them, cyber-attacks using malicious URLs have emerged as an addressing the issue of social problems. Malicious URLs are used by attackers with malicious purposes such as smishing, pharming, and phishing to steal user's information using abnormal URLs. In order to detect and block such malicious URL attacks, it is best that individuals not click on suspicious URL addresses. However, this is difficult because the contents that contain the URLs are alluring. Before, malicious URLs were detected through Blacklist/Whitelist techniques, but they couldn't protect users from new and variant attacks. On this, a malicious URL detection method based on the difference in length (amount of search volume) of normal and abnormal URLs was studied using the search engines. However, this technique showed little difference in the search volume of normal/abnormal URLs when searched from a low-profile URL. In addition when an abnormal URL is very similar to the original URL, there is almost no difference in the search volume since abnormal URLs change the automatic search of the portal site's search engine, making it impossible to be detected. To solve these, in this paper, we propose a malicious URL detection method based on Count which is a number of search results matching the search URL.

Since the damage from cyber-attacks increases, there is an urgent need to research and develop security countermeasures for control systems. In the control system, the controller is an important device. This paper then considers a whitelisting system that models the normal operation sequence of a PLC (Programmable Logic Controller) and detects deviations from the model as abnormal. We propose three methods to auto-generate the whitelisting system by LD (Ladder Diagram): Petri net model generation, constraint condition derivation, and LD conversion. The first method generates Petri net models form SFCs (Sequential Function Charts) that are compatible with LDs. The second method derives whitelist conditions from Petri net models to check whether PLC performs the correct operation sequence. The third method implements the whitelist conditions into LD. The auto-generated whitelisting system enables us to monitor the state transitions of the PLC programs. Further, this paper carries out an experimental validation of the methods using a testbed system.

Hardware Trojans (HT) have emerged as a significant threat to both the IC industry and the military due to their stealthy nature and destructive capabilities. An HT is a small piece of hardware (circuit) embedded by an adversary to disrupt the victim circuit’s regular operation. As a result, it becomes an utmost necessity to distinguish standard signals from them. The detection of HT has become critical due to the presence of enormous search space combined with its small size. A clustering-based approach is proposed to identify benign signals in this work. The proposed approach combines both transition probability and combinational controllability to generate an effective HT free whitelist. It reduces the overhead of search space for HT detection. The clusters generated (whitelist) are analyzed in the presence of several ultra-small triggers which advocates the efficacy of the proposed solution. Simulation results on various ISCAS benchmark circuits validate the significance and quality of such clusters in terms of observed transition. Experimental results also underpin the proposed methodology’s superiority over existing techniques by identifying proper whitelist easily.

This paper proposes a security testbed system for industrial control systems. In control systems, controllers are final fortresses to continue the operation of field systems. Then, we need countermeasures of controllers. The whitelisting function is efficient in controller security. The whitelisting function registers normal operations in a list and detects unregistered operations as abnormal. We need a testbed system to check whether the whitelist function does not affect other functions of the controller. The industrial controller and its engineering tool are relatively expensive, and are customized with respect to controller vendors. To enhance the whitelist development, this study proposes a testbed system using OpenPLC which is an open-source software. This system is independent of controller vendors and is applicable for controller programming languages. We implement a whitelist based anomaly detection method for the testbed system and validate that the anomaly detection method operates correctly.

Pinang is a digital application-based BRI Agro product that runs on the Android operating system, wherewith this application customers can apply for loans without collateral digitally, anywhere, and anytime. Of course, we need a system that can help the process of managing data from Pinang customers, starting from adding company cooperation with the Pinang application to maintaining and monitoring the system. So a Pinang dashboard information system is needed that can assist in the operation of the Pinang application that is capable of managing data, monitoring, and maintenance if there are problems in the Pinang application borrowing process. The Pinang dashboard can make it easier to manage, monitor, and provide information related to the Pinang application, including customer status, whitelist, repayment, disbursement, outstanding, ID card approval, and report withdrawal. The areca dashboard is built using the waterfall method, this method in its design uses UML diagrams, use case diagrams, activity diagrams, sequence diagrams, class diagrams, and entity-relationship diagrams (ERD). The implementation of making Pinang dashboards uses the Golang programming language, Node Js, React Js, keycloak, and the PostgreSQL database. With the Pinang Dashboard, it is hoped that it can facilitate the operational team in maintaining the Pinang application and building a system that can manage, monitor, and provide information related to the Pinang application.

A "whitelist network switch (WLS)", which can monitor and filter packets based on a whitelist, is particularly effective for stronger information security in closed network environments, such as in factories. This paper focuses on the base network environment for a nurse call system within a large hospital. This network environment is of particular importance to security, and the types of network protocols used are limited. We note important points regarding the practical operation and effectiveness of WLS through two approaches: (i) test introduction into an existing, actual hospital network system; (ii) test introduction in an experimental nurse call system environment.

Contains fulltext : 231716.pdf (Publisher’s version ) (Closed access) BACKGROUND: Scientific research can offer the joy of discovery. For many graduating neurosurgeons, often, a seminar, class, or instructional module is their first and only formal exposure to the world of conducting research responsibly, to write down and report the results of such research. The pressure to publish scientific research is high, but any young neurosurgeon who is unaware of how predatory publishers operate can get duped by it and can lose their valuable and hard-fought research. Hence, we have attempted to provide an overview of all potentially predatory neurosurgery publications and provide some "red flags" to recognize them. METHODS: A suspected list of predatory publications was collected via a thorough review of the Neurosurgery journals listed in 4 major so-called blacklists, i.e., Beall's list, Manca's list, Cabell's blacklist, and Strinzel blacklist and then cross-referenced with UGC CARE whitelist to remove any potential legitimate journals. All journals with a scope of the Neurosurgery publication were searched using terms in the search bar: "Neurosurgery", "Neuroanatomy", "Neuropathology", and "Neurological disorder/disease". Since all predatory journals claim to be open access, all possible types of open access journals on Scimago were also searched, and thus a comparison was possible in terms of publication cost and number of legitimate open access journals when compared with predatory ones. In addition, methodologies by which these journals penetrate legitimate indexes like PubMed was investigated. RESULTS: A total of 46 predatory journals were found and were enlisted along with their publishers and web addresses. Sixty of the 360 Neurosurgery journals listed on Scimago were open access and the fee for the predatory journals was substantially lower (

Ransomware, which is one type of malware, encrypts a user's files on a device and then requires the user to pay a ransom to recover the damaged files. The amount of ransomware is growing so rapidly that it constituted more than 70% of the malware found in 2017. Although many ransomware solutions have been released, similar to traditional antimalware solutions, most ransomware solutions are designed based on a blacklist that includes the code signatures of known ransomware. However, such blacklist-based solutions cannot prevent unknown ransomware, which may be either new or a variation of an existing ransomware. Another solution is to continuously monitor the abnormal behavior of every software program running on a user's device. To do so, some solutions monitor the executing programs that access the files stored on a device, while other solutions specify a folder as a safe folder and control executing programs when they access the objects in the folder. However, these solutions can degrade the performances of devices or inconvenience users. This article presents a new solution to detect/prevent ransomware using a whitelist. We analyze the file operation procedures of a user-device operating system and then implement a whitelist-based access control as a partial file operation procedure. Since the solution utilizes a whitelist and not a blacklist, it does not need to patch in the information on new ransomware regularly provided by a ransomware solution provider. Therefore, it can prevent both unknown and future ransomware in real time.

Substation automation system uses IEC 61850 protocol for the data transmission between different equipment manufacturers. However, the IEC 61850 protocol lacks an authentication security mechanism, which will make the communication face four threats: eavesdropping, interception, forgery, and alteration. In order to verify the IEC 61850 protocol communication problems, we used the simulation software to build the main operating equipment in the IEC 61850 network environment of the communication system. We verified IEC 61850 transmission protocol security defects, under DoS attack and Reply attack. In order to enhance security agreement, an improved algorithm was proposed based on identity authentication (W-EAP, Whitelist Based ECC & AES Protocol). Experimental results showed that the method can enhance the ability to resist attacks.

This article aims at analyzing the impact of predatory publishing in ophthalmology, criteria to identify a legitimate journal, red flags of a predatory journal, sources, and checkpoints available before publishing scientific work in a standard ophthalmology journal. A retrospective review was performed and a list of suspected Ophthalmology predatory journals was extracted through four major so-called blacklists: Beall's, Cabell's, Manca's, and Strinzel's list. This list of journals was then cross-referenced with the UGC CARE and vetted whitelist of vision science journals to remove the legitimate journals. Moreover, as all the predatory journals are supposed to be open access, all possible types of open-access journals on the Scimago webpage were also searched. A gross estimate in terms of publication cost was searched for, and a list of authentic links to find out a legitimate journal was prepared. Additionally, the methodology by which these predatory journals penetrate legitimate indexes such as PubMed was also evaluated. A total of 51 ophthalmology predatory journals were enlisted. Thirty-eight out of 124 Ophthalmology journals listed on Scimago were open access, and the cost of publishing in predatory journals ranged from USD50–500, which is substantially lower than that in legitimate journals (USD 50–3000). A total of 13 open-access platforms exist, with 10 characteristic red flags to identify a predatory journal. These journals have penetrated legitimate indexes such as PubMed by similar-sounding names to the legitimate journals and have published articles with external funding, which needs indexing. Predatory publishing impacts the quality of research in every field, including Ophthalmology, and must be discouraged.

Container escape, which exploits vulnerabilities in the shared kernel to break container isolation, is a severe security threat in cloud-native computing. To alleviate the threat, we should allow the minimum number of system calls required by individual containers, but figuring out which system calls an arbitrary container will need is a challenging problem. This paper presents Prof-gen that automatically creates a restrictive system call policy using static binary analysis and dynamic analysis without any prior knowledge. The tool only requires a container image and a run command. We compared the created system call policy with the results of Confine, a recent study for container attack surface reduction. For 120 official images, Prof-gen reduced the attack surface by 20.2% compared to Confine. All the test containers that applied the profile generated in the application-specific tests ran without failure.

Phishing is a social engineering attack that is based on a cyberattack and it focuses on naive online users by spoofing them to provide their sensitive credentials such as password, username, security number, or debit card number, etc. Phishing can be performed by masking a webpage as a legitimate page to pull the personal credentials of the user. Nonetheless, there are a lot of methodologies that have been introduced as a solution for detecting the phishing websites such as the whitelist approach or blacklist approach, visual similarity-based approach, and meta-heuristic approach however still the online users are getting scammed into revealing sensitive credentials in phishing websites. In this research paper, a novel hybrid methodology PB-cup learner was proposed, which is based on integration dimensional and neural learning that is pulled from the source code, uniform resource locator, and representative state transfer API to overcome the drawbacks of the existing phishing techniques. This model gives the accuracy analysis of the Naive Bayes Classifier, Genetic Algorithm, Multi-Layer Perceptron, Multiple Linear Regression, and PB-CUP neural learner and out of which, the Multi-Layer Perceptron algorithm has been performed the best with an accuracy of 99.17%. The experiments were iteratively analyzed with different orthogonal algorithms for finding the best classifier accuracy for phishing website detection.

Broadband PLC (power line communication) has become one of the most important communication technologies for Smart Gird applications, especially for AMI (Advanced Metering Infrastructure) and HAN (Home Area Network). Currently, most broadband PLC products are based on OFDM, DMT or Spread-Spectrum technologies. Their performances differ from each other on certain circumstances. Before the STA device successfully entered the network, because the STA device was receiving After the beacon frame of any network, the network access request will be sent after the CCO receives the network access request sent by the STA device, if the MAC address of the STA device is not in the whitelist, it sends a downlink message to reject the STA device's network access. If there are multiple CCO, it will cause waste of useless uplink and downlink packets, prolong networking time, and cause channel congestion. To solve the problems, An Efficient Networking Approach for broadband PLC Networks is proposed. The present invention propose a new broadband PLC networking, it's characteristic is after any neighbor network receives a beacon of ,it selects the network with the closest MAC address of the device to the network. Results of OPNET simulation show that compared with the scheme of literature [10] mechanism and purposed new mechanism ANENA-BPLC. Purposed new mechanism ANENA-BPLC has improved Network Success rate, Average End to End delay, the network CCO and STA Id's, Number of packets

State Polytechnic of Malang is an educational institution based on technique where the database is needed here, the database itself is important data that must be stored and cannot be seen by others. Database security must be developed and prioritized so that no one breaks into important data on the server. This whitelist method utilizes a port that can block port access to outside networks that are vulnerable to criminal acts, this method uses ssh as a medium to manage control of an ip address. The ip address will be added a port behind it. Use IP block with Linux OS and tested via the web and laptop using a local access point. The test results show that the quality used for security is whitelist, where this method is used for the IP security used. IP block and unblock process can be done well. The process of adding and deleting ports can be done well. So that in general, the whole system is running well and easy access.

DLL injection is a technique used for executing code within the address space of another process by forcing the load of a dynamic-link library. In a software ecosystem, the interactions between the host and third-party software increase the maintenance challenges of the system and may lead to bugs. In this work, we empirically investigate bugs that were caused by third-party DLL injections into the Mozilla Firefox browser. Among the 103 studied DLL injection bugs, we found that 93 bugs (90.3%) led to crashes and 57 bugs (55.3%) were caused by antivirus software. Through a survey with third-party software vendors, we observed that some vendors did not perform any QA with pre-release versions nor intend to use a public API (WebExtensions) but insist on using DLL injection. To reduce DLL injection bugs, host software vendors may strengthen the collaboration with third-party vendors, e.g., build a publicly accessible validation test framework. Host software vendors may also use a whitelist approach to only allow vetted DLLs to inject.

Malicious domain names usually refer to a series of illegal activities, posing threats to people's privacy and property. Therefore, the problem of detecting malicious domain names has aroused widespread concerns. In this study, a malicious domain names detection algorithm based on lexical analysis and feature quantification is proposed. To achieve efficient and accurate detection, the method includes two phases. The first phase checks an observed domain name against a blacklist of known malicious uniform resource locator (URLs). The observed domain name is classified as being definitely malicious or potentially malicious based on its edit distances to the domain names on the blacklist. The second phase further evaluates a potential malicious domain name by its reputation value that represents its lexical feature and is calculated based on an N-gram model. The top 100,000 normal domain names in Alexa are used to obtain a whitelist substring set using the N-gram method in which each domain name excluding the top-level domain is segmented into substrings with the length of 3, 4, 5, 6 and 7. The weighted values of the substrings are calculated according to their occurrence counts in the whitelist substring set. A potential malicious domain name is segmented by the N-gram method and its reputation value is calculated based on the weighted values of its substrings. Finally, the potential malicious domain name is determined to be malicious or normal based on its reputation value. The effectiveness of the proposed detection method has been demonstrated by experiments on public available data.

The computational linguistics community has developed tools, called wikifiers, to identify links to Wikipedia articles from free-form text. Software engineering research can leverage wikifiers to add semantic information to software artifacts. However, no empirically-grounded basis exists to choose an effective wikifier and to configure it for the software domain, on which wikifiers were not specifically trained. We conducted a study to guide the selection of a wikifier and its configuration for applications in the software domain, and to measure what performance can be expected of wikifiers. We applied six wikifiers, with multiple configurations, to a sample of 500 Stack Overflow posts. We manually annotated the 41 124 articles identified by the wikifiers as correct or not to compare their precision and recall. Each wikifier, in turn, achieved the highest precision, between 13% and 82%, for different thresholds of recall, from 60% to 5%. However, filtering the wikifiers’ output with a whitelist can considerably improve the precision above 79% for recall up to 30%, and above 47% for recall up to 60%. Results reported in each wikifier’s original article cannot be generalized to software-specific documents. Given that no wikifier performs universally better than all others, we provide empirically grounded insights to select a wikifier for different scenarios, and suggest ways to further improve their performance for the software domain.

Since the Black Lives Matter movement rose to mainstream prominence, the academic enterprise has started recognizing the systematic racism present in science. However, there have been relatively few efforts to make sure that the language used to communicate science is inclusive. Here, I quantify the number of research articles published between 2000 and 2020 that contained non-inclusive terms with racial connotations, such as “blacklist” and “whitelist”, or “master” and “slave”. This reveals that non-inclusive language is being increasingly used in the life sciences literature, and I urge the global academic community to expunge these archaic terms to make science inclusive for everyone.