Cybersecurity最新文献_第2页

ProcSAGE: an efficient host threat detection method based on graph representation learning ProcSAGE：基于图表示学习的高效主机威胁检测方法

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-25 DOI: 10.1186/s42400-024-00240-w

Boyuan Xu, Yiru Gong, Xiaoyu Geng, Yun Li, Cong Dong, Song Liu, Yuling Liu, Bo Jiang, Zhigang Lu

{"title":"ProcSAGE: an efficient host threat detection method based on graph representation learning","authors":"Boyuan Xu, Yiru Gong, Xiaoyu Geng, Yun Li, Cong Dong, Song Liu, Yuling Liu, Bo Jiang, Zhigang Lu","doi":"10.1186/s42400-024-00240-w","DOIUrl":"https://doi.org/10.1186/s42400-024-00240-w","url":null,"abstract":"Advanced Persistent Threats (APTs) achieves internal networks penetration through multiple methods, making it difficult to detect attack clues solely through boundary defense measures. To address this challenge, some research has proposed threat detection methods based on provenance graphs, which leverage entity relationships such as processes, files, and sockets found in host audit logs. However, these methods are generally inefficient, especially when faced with massive audit logs and the computational resource-intensive nature of graph algorithms. Effectively and economically extracting APT attack clues from massive system audit logs remains a significant challenge. To tackle this problem, this paper introduces the ProcSAGE method, which detects threats based on abnormal behavior patterns, offering high accuracy, low cost, and independence from expert knowledge. ProcSAGE focuses on processes or threads in host audit logs during the graph construction phase to effectively control the scale of provenance graphs and reduce performance overhead. Additionally, in the feature extraction phase, ProcSAGE considers information about the processes or threads themselves and their neighboring nodes to accurately characterize them and enhance model accuracy. In order to verify the effectiveness of the ProcSAGE method, this study conducted a comprehensive evaluation on the StreamSpot dataset. The experimental results show that the ProcSAGE method can significantly reduce the time and memory consumption in the threat detection process while improving the accuracy, and the optimization effect becomes more significant as the data size expands.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"30 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181199","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Lightweight ring-neighbor-based user authentication and group-key agreement for internet of drones 无人机互联网基于邻圈的轻量级用户身份验证和群组密钥协议

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-18 DOI: 10.1186/s42400-024-00247-3

Zhuo Zhao, Chingfang Hsu, Lein Harn, Zhe Xia, Xinyu Jiang, Liu Liu

{"title":"Lightweight ring-neighbor-based user authentication and group-key agreement for internet of drones","authors":"Zhuo Zhao, Chingfang Hsu, Lein Harn, Zhe Xia, Xinyu Jiang, Liu Liu","doi":"10.1186/s42400-024-00247-3","DOIUrl":"https://doi.org/10.1186/s42400-024-00247-3","url":null,"abstract":"As mobile internet and Internet of Things technologies continue to advance, the application scenarios of peer-to-peer Internet of Drones (IoD) are becoming increasingly diverse. However, the development of IoD also faces significant challenges, such as security, privacy protection, and limited computing power, which require technological innovation to overcome. For group secure communication, it is necessary to provide two basic services, user authentication and group key agreement. Due to the limited storage of IoD devices, group key negotiation requires lightweight calculations, and conventional schemes cannot satisfy the requirements of group communication in the IoD. To this end, a new lightweight communication scheme based on ring neighbors is presented in this paper for IoD, which not only realizes the identity verification of user and group key negotiation, but also improves computational efficiency on each group member side. A detailed security analysis substantiates that the designed scheme is capable of withstanding attacks from both internal and external adversaries while satisfying all defined security requirements. More importantly, in our proposal, the computational cost on the user side remains unaffected by the variability of the number of members participating in group communication, as members communicate in a non-interactive manner through broadcasting. As a result, the protocol proposed in this article demonstrates lower computational and communication costs in comparison to other cryptographic schemes. Hence, this proposal presents a more appealing approach to lightweight group key agreement protocol with user authentication for application in the IoD.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"86 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142181198","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A multi-channel spatial information feature based human pose estimation algorithm 基于多通道空间信息特征的人体姿态估计算法

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-11 DOI: 10.1186/s42400-024-00248-2

Yinghong Xie, Yan Hao, Xiaowei Han, Qiang Gao, Biao Yin

{"title":"A multi-channel spatial information feature based human pose estimation algorithm","authors":"Yinghong Xie, Yan Hao, Xiaowei Han, Qiang Gao, Biao Yin","doi":"10.1186/s42400-024-00248-2","DOIUrl":"https://doi.org/10.1186/s42400-024-00248-2","url":null,"abstract":"Human pose estimation is an important task in computer vision, which can provide key point detection of human body and obtain bone information. At present, human pose estimation is mainly utilized for detection of large targets, and there is no solution for detection of small targets. This paper proposes a multi-channel spatial information feature based human pose (MCSF-Pose) estimation algorithm to address the issue of medium and small targets inaccurate detection of human key points in scenarios involving occlusion and multiple poses. The MCSF-Pose network is a bottom-up regression network. Firstly, an UP-Focus module is designed to expand the feature information while reducing parameter computation during the up-sampling process. Then, the channel segmentation strategy is adopted to cut the features, and the feature information of multiple dimensions is retained through different convolutional groups, which reduces the parameter lightweight network model and makes up for the loss of the feature information associated with the depth of the network. Finally, the three-layer PANet structure is designed to reduce the complexity of the model. With the aid of the structure, it also to improve the detection accuracy and anti-interference ability of human key points. The experimental results indicate that the proposed algorithm outperforms YOLO-Pose and other human pose estimation algorithms on COCO2017 and MPII human pose datasets.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"19 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-11","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141932915","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

TVRAVNF: an efficient low-cost TEE-based virtual remote attestation scheme for virtual network functions TVRAVNF：基于 TEE 的高效低成本虚拟网络功能远程验证方案

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-04 DOI: 10.1186/s42400-024-00235-7

Jie Yuan, Rui Xu, Xinghai Wei, Keji Miao, Dongxiao Liu

{"title":"TVRAVNF: an efficient low-cost TEE-based virtual remote attestation scheme for virtual network functions","authors":"Jie Yuan, Rui Xu, Xinghai Wei, Keji Miao, Dongxiao Liu","doi":"10.1186/s42400-024-00235-7","DOIUrl":"https://doi.org/10.1186/s42400-024-00235-7","url":null,"abstract":"With the continuous advancement of virtualization technology and the widespread adoption of 5G networks, the application of the Network Function Virtualization (NFV) architecture has become increasingly popular and prevalent. While the NFV architecture brings a lot of advantages, it also introduces security challenges, including the effective and efficient verification of the integrity of deployed Virtual Network Functions (VNFs) and ensuring the secure operation of VNFs. To address the challenge of efficiently conducting virtual remote attestation for VNFs and establishing trust in virtualized environments like NFV architecture, we propose TVRAVNF, which is a highly efficient and low-cost TEE-based virtual remote attestation scheme for VNFs. The scheme we proposed ensures the security and effectiveness of the virtual remote attestation process by leveraging TEE. Furthermore, we introduces a novel local attestation mechanism, which not only reduces the overall overhead of the virtual remote attestation process but also shortens the attestation interval to mitigate Time-Of-Check-Time-Of-Use attacks, thereby enhancing overall security. We conduct experiments to validate the overhead of the TVRAVNF scheme and compare its performance with that of a typical remote attestation process within a maximum unattested time interval. The experimental results demonstrate that, by employing the local attestation mechanism, our solution achieves nearly an 80% significant performance improvement with a relatively small time overhead for small to medium-sized files. This further substantiates the significant advantages of our approach in both security and efficiency.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"30 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-04","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141932917","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Efficient post-quantum secure deterministic wallet scheme 高效的后量子安全确定性钱包方案

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-03 DOI: 10.1186/s42400-024-00216-w

Mingxing Hu, Zhen Liu, Yunhong Zhou

{"title":"Efficient post-quantum secure deterministic wallet scheme","authors":"Mingxing Hu, Zhen Liu, Yunhong Zhou","doi":"10.1186/s42400-024-00216-w","DOIUrl":"https://doi.org/10.1186/s42400-024-00216-w","url":null,"abstract":"Since the advent of Bitcoin, cryptocurrencies have gained substantial popularity, and crypto wallets have evolved into the predominant tool for safeguarding and managing cryptographic keys to access cryptocurrency funds. Deterministic wallets are proposed as an advanced wallet mechanism to provide benefits such as low-maintenance, easy backup and recovery, and support for functionalities required by cryptocurrencies. Alkeilani Alkadri et al. (ACM CCS’20) presented the first post-quantum secure deterministic wallet scheme, but it exhibits a gap to bridge before achieving practical applicability, as reflected in both their concrete parameters size and computational efficiency. In this paper, we propose an efficient post-quantum secure deterministic wallet scheme. In particular, we present a new construction method for deterministic wallets, prove the security in the quantum random oracle model, and provide an efficient instantiation. The comparison result, with the work of Alkeilani Alkadri et al. (ACM CCS’20), shows our work has a comprehensive improvement on efficiency, e.g., the pk size is (approx 40.7) times shorter, sk is (approx 9.2) times shorter, and the signing time is (approx 3.1) times faster.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"41 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141932918","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Classification of DDoS attack traffic on SDN network environment using deep learning 利用深度学习对 SDN 网络环境中的 DDoS 攻击流量进行分类

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-02 DOI: 10.1186/s42400-024-00219-7

Urikhimbam Boby Clinton, Nazrul Hoque, Khumukcham Robindro Singh

{"title":"Classification of DDoS attack traffic on SDN network environment using deep learning","authors":"Urikhimbam Boby Clinton, Nazrul Hoque, Khumukcham Robindro Singh","doi":"10.1186/s42400-024-00219-7","DOIUrl":"https://doi.org/10.1186/s42400-024-00219-7","url":null,"abstract":"Distributed Denial of Service (DDoS) attack is a major threat to the Internet of Things (IoT), Software Defined Networks (SDN), and Cloud Computing Networks. Due to the tremendous applications of IoT networks, the number of DDoS attacks is increasing significantly, and most sophisticated DDoS attacks are generated through IoT botnets. An IoT botnet-based DDoS attack can disrupt the network quickly with a surge of malicious traffic. Especially in an SDN network, it is important to detect the DDoS attack before it occurs to the SDN controller. DDoS attacks on the centralized controller of the SDN can disrupt the whole network. So, identifying DDoS attacks at the earliest is a critical security measure for network experts and practitioners. In this paper, we analyze the DDoS attack on an SDN environment and develop a method to identify the DDoS attack using Deep Learning (DL). The proposed method converts the captured raw network traffic to image data and classifies the malicious data from normal data. The method is evaluated on our test-bed simulated dataset and two other benchmark datasets. The experimental comparison shows that the proposed method performs better on all three datasets, giving more than 99% classification accuracy.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"1 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-08-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141887008","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Revisiting frequency-smoothing encryption: new security definitions and efficient construction 重温频率平滑加密：新的安全定义和高效构造

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-08-01 DOI: 10.1186/s42400-024-00208-w

Haobin Chen, Yue Yang, Siyi Lv

引用次数: 0

GLDOC: detection of implicitly malicious MS-Office documents using graph convolutional networks GLDOC：利用图卷积网络检测隐含恶意的 MS-Office 文档

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-07-25 DOI: 10.1186/s42400-024-00243-7

Wenbo Wang, Peng Yi, Taotao Kou, Weitao Han, Chengyu Wang

{"title":"GLDOC: detection of implicitly malicious MS-Office documents using graph convolutional networks","authors":"Wenbo Wang, Peng Yi, Taotao Kou, Weitao Han, Chengyu Wang","doi":"10.1186/s42400-024-00243-7","DOIUrl":"https://doi.org/10.1186/s42400-024-00243-7","url":null,"abstract":"Nowadays, the malicious MS-Office document has already become one of the most effective attacking vectors in APT attacks. Though many protection mechanisms are provided, they have been proved easy to bypass, and the existed detection methods show poor performance when facing malicious documents with unknown vulnerabilities or with few malicious behaviors. In this paper, we first introduce the definition of im-documents, to describe those vulnerable documents which show implicitly malicious behaviors and escape most of public antivirus engines. Then we present GLDOC—a GCN based framework that is aimed at effectively detecting im-documents with dynamic analysis, and improving the possible blind spots of past detection methods. Besides the system call which is the only focus in most researches, we capture all dynamic behaviors in sandbox, take the process tree into consideration and reconstruct both of them into graphs. Using each line to learn each graph, GLDOC trains a 2-channel network as well as a classifier to formulate the malicious document detection problem into a graph learning and classification problem. Experiments show that GLDOC has a comprehensive balance of accuracy rate and false alarm rate − 95.33% and 4.33% respectively, outperforming other detection methods. When further testing in a simulated 5-day attacking scenario, our proposed framework still maintains a stable and high detection accuracy on the unknown vulnerabilities.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"50 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-07-25","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141782356","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Revealing the exploitability of heap overflow through PoC analysis 通过 PoC 分析揭示堆溢出的可利用性

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-07-18 DOI: 10.1186/s42400-024-00244-6

Qintao Shen, Guozhu Meng, Kai Chen

{"title":"Revealing the exploitability of heap overflow through PoC analysis","authors":"Qintao Shen, Guozhu Meng, Kai Chen","doi":"10.1186/s42400-024-00244-6","DOIUrl":"https://doi.org/10.1186/s42400-024-00244-6","url":null,"abstract":"The exploitable heap layouts are used to determine the exploitability of heap vulnerabilities in general-purpose applications. Prior studies have focused on using fuzzing-based methods to generate more exploitable heap layouts. However, the exploitable heap layout cannot fully demonstrate the exploitability of a vulnerability, as it is uncertain whether the attacker can control the data covered by the overflow. In this paper, we propose the Heap Overflow Exploitability Evaluator (Hoee), a new approach to automatically reveal the exploitability of heap buffer overflow vulnerabilities by evaluating proof-of-concepts (PoCs) generated by fuzzers. Hoee leverages several techniques to collect dynamic information at runtime and recover heap object layouts in a fine-grained manner. The overflow context is carefully analyzed to determine whether the sensitive pointer is corrupted, tainted, or critically used. We evaluate Hoee on 34 real-world CVE vulnerabilities from 16 general-purpose programs. The results demonstrate that Hoee accurately identifies the key factors for developing exploits in vulnerable contexts and correctly recognizes the behavior of overflow.","PeriodicalId":36402,"journal":{"name":"Cybersecurity","volume":"19 1","pages":""},"PeriodicalIF":3.1,"publicationDate":"2024-07-18","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"141739606","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":4,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Threshold ring signature: generic construction and logarithmic size instantiation 阈值环签名：通用构造和对数大小实例化

IF 3.1 4区计算机科学

Cybersecurity Pub Date : 2024-07-11 DOI: 10.1186/s42400-024-00233-9

Huizhuo Wang, Yang Tao, Rui Zhang

引用次数: 0