Computers & Security最新文献

ATSDetector: An Android Trojan spyware detection approach with multi-features

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-28 DOI: 10.1016/j.cose.2024.104219

Siyu Wang , Haiyong Wu , Ning Lu , Wenbo Shi , Zhiquan Liu

引用次数: 0

Interpretable adversarial example detection via high-level concept activation vector

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-26 DOI: 10.1016/j.cose.2024.104218

Jiaxing Li , Yu-an Tan , Xinyu Liu , Weizhi Meng , Yuanzhang Li

{"title":"Interpretable adversarial example detection via high-level concept activation vector","authors":"Jiaxing Li , Yu-an Tan , Xinyu Liu , Weizhi Meng , Yuanzhang Li","doi":"10.1016/j.cose.2024.104218","DOIUrl":"10.1016/j.cose.2024.104218","url":null,"abstract":"<div><div>Deep neural networks have achieved amazing performance in many tasks. However, they are easily fooled by small perturbations added to the input. Such small perturbations to image data are usually imperceptible to humans. The uninterpretable nature of deep learning systems is considered to be one of the reasons why they are vulnerable to adversarial attacks. For enhanced trust and confidence, it is crucial for artificial intelligence systems to ensure transparency, reliability, and human comprehensibility in their decision-making processes as they gain wider acceptance among the general public. In this paper, we propose an approach for defending against adversarial attacks based on conceptually interpretable techniques. Our approach to model interpretation is on high-level concepts rather than low-level pixel features. Our key finding is that adding small perturbations leads to large changes in the model concept vector tests. Based on this, we design a single image concept vector testing method for detecting adversarial examples. Our experiments on the Imagenet dataset show that our method can achieve an average accuracy of over 95%. We provide source code in the supplementary material.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104218"},"PeriodicalIF":4.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142746971","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Cyberattack event logs classification using deep learning with semantic feature analysis

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-26 DOI: 10.1016/j.cose.2024.104222

Ahmad Alzu’bi , Omar Darwish , Amjad Albashayreh , Yahya Tashtoush

{"title":"Cyberattack event logs classification using deep learning with semantic feature analysis","authors":"Ahmad Alzu’bi , Omar Darwish , Amjad Albashayreh , Yahya Tashtoush","doi":"10.1016/j.cose.2024.104222","DOIUrl":"10.1016/j.cose.2024.104222","url":null,"abstract":"<div><div>Event logs play a crucial role in cybersecurity by detecting potentially malicious network activities and preventing data loss or theft. Previous work did not place a high value on log messages and their impact on security breach prediction and intrusion detection. This research paper introduces a novel approach for log message analysis applied to a dataset of event logs collected from various web sources. Event log messages were analyzed and categorized based on event and attack types with an explainable AI emphasizing the value of its key data. The study aims to enhance intrusion detection and minimize performance degradation by identifying suspicious events. In this regard, a new semantic vectorization framework is proposed, leveraging deep learning architectures to develop semantic discriminating log features, offering a cogent explanation and classification of event log messages. The use of BERT deep embeddings as a baseline for the prediction model allows for visualizing and interpreting the formulation of log message semantic features. Several empirical scenarios are set and conducted extensively to evaluate the performance of the event log classifier, considering the attack type, event type, and zero-shot logs. The experimental results demonstrate that the proposed event log classifier outperforms state-of-the-art machine learning models, achieving a recall of 99.27% and a precision of 99.29%. This highlights the model’s ability to accurately identify events of a particular type by detecting as many suspicious events as feasible while minimizing the misclassification rate.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104222"},"PeriodicalIF":4.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142746970","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Towards prompt tuning-based software vulnerability assessment with continual learning

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-26 DOI: 10.1016/j.cose.2024.104184

Jiacheng Xue , Xiang Chen , Jiyu Wang , Zhanqi Cui

{"title":"Towards prompt tuning-based software vulnerability assessment with continual learning","authors":"Jiacheng Xue , Xiang Chen , Jiyu Wang , Zhanqi Cui","doi":"10.1016/j.cose.2024.104184","DOIUrl":"10.1016/j.cose.2024.104184","url":null,"abstract":"<div><div>Software vulnerability assessment (SVA) has become increasingly important due to the growing reliance on various software systems and the rising complexity of cyber threats. SVA aims to quickly identify and remediate high-risk vulnerabilities in software systems, which helps protect sensitive information and maintain the integrity of digital infrastructure. In our study, we focus on prompt tuning-based SVA. Prompt tuning reduces computational costs by tuning the input prompts instead of the entire model. We further incorporate the continual learning paradigm to enable the SVA model to adapt to new vulnerabilities as they emerge dynamically. This paradigm ensures the SVA model remains up-to-date, reduces the risk of catastrophic forgetting, and provides resource-efficient updates. To achieve this goal, we propose a novel method SVACL. SVACL combines confidence-based replay and regularization methods for continual learning. Additionally, SVACL uses both source code and vulnerability descriptions to create hybrid prompts for prompt tuning with the pre-trained model CodeT5. Experimental results demonstrate that SVACL outperforms state-of-the-art SVA baselines by 20% to 380% in terms of MCC performance measure. Finally, our ablation study results confirm the effectiveness of the component settings (such as confidence-based replay, regularization method, vulnerability information fusion, CodeT5, and hybrid prompts) for SVACL. Therefore, our study provides the first promising step toward prompt tuning-based SVA with continual learning.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104184"},"PeriodicalIF":4.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142746966","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Assessing of software security reliability: Dimensional security assurance techniques

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-26 DOI: 10.1016/j.cose.2024.104230

Mohammad Ali, Ahsan Ullah, Md. Rashedul Islam, Rifat Hossain

{"title":"Assessing of software security reliability: Dimensional security assurance techniques","authors":"Mohammad Ali, Ahsan Ullah, Md. Rashedul Islam, Rifat Hossain","doi":"10.1016/j.cose.2024.104230","DOIUrl":"10.1016/j.cose.2024.104230","url":null,"abstract":"<div><div>Security plays a crucial role in ensuring the reliability of software systems, making a secure and dependable security framework vital for safeguarding software integrity. However, evaluating the dynamic and multifaceted aspects of security presents significant challenges, as various security metrics and factors complicate the assessment of reliability. This study advances the core concepts of software security through the application of security assurance techniques, including vulnerability scanning, code review, penetration testing, threat assessment, control evaluation, mitigation, risk assessment, and configuration review. In the context of the Software Security Reliability Model (SSRM), a framework was developed to enhance software security assurance across different stages. A comprehensive systematic literature review was conducted to identify security challenges, and the STRIDE and DREAD methodologies were applied to model security threats effectively. Additionally, a mathematical CVSS scoring method was utilized for risk assessment. The synthesis of diverse security methods, tools, attack patterns, and systems was analyzed, identifying 15 critical software security terms: authentication, authorization, encryption, access control, network security, application security, data security, incident response, compliance, threat intelligence, privacy protection, third-party risk, cloud security, endpoint security, and identity management. The findings highlight these terms as key contributors to improving software security reliability.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104230"},"PeriodicalIF":4.8,"publicationDate":"2024-11-26","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142759136","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Palm vein template protection scheme for resisting similarity attack 抵御相似性攻击的掌静脉模板保护方案

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-24 DOI: 10.1016/j.cose.2024.104227

Yunpeng Li, Wei Wu, Yuan Zhang, Chuanyang Li

{"title":"Palm vein template protection scheme for resisting similarity attack","authors":"Yunpeng Li, Wei Wu, Yuan Zhang, Chuanyang Li","doi":"10.1016/j.cose.2024.104227","DOIUrl":"10.1016/j.cose.2024.104227","url":null,"abstract":"<div><div>Palm vein recognition technology has rapidly developed due to its high confidentiality and the advantages of liveness detection. Various palm vein template protection methods have emerged to safeguard palm vein data from theft and attack. To fulfill the performance loss requirement of the ideal biometric template protection scheme, these methods make the distribution of the original palm vein data and the palm vein protection templates have a strong distance preserving property (similarity preserving), making it difficult to defend against similarity attack (SA). To address these risks and prevent palm vein data leakage, we propose a Nonlinear Spectral Hashing (NSH) method for palm vein template protection. To obtain palm vein templates with both performance and security, the method first performs random projection on palm vein data to obtain revocable and unlinkable palm vein features. Subsequently, through spectral graph partitioning, it achieves mapping with a preserved similarity structure for palm veins, avoiding excessive performance loss. The method then employs a nonlinear activation function to alter the distribution of palm vein templates with large post-mapping differences, resulting in a uniform distribution of inter-class distances for palm vein data. By reducing the distance-preserving properties, the method enhances protection against similarity attacks. Finally, a sign function is applied to obtain non-invertible binary palm vein templates. Experimental evaluations on the public Tongji University palm vein database assess the method's non-invertibility, revocability, unlinkability, resistance to similarity attack, and recognition performance. The results indicate an Equal Error Rate (EER) of 0.50 %, demonstrating the method's ability to maintain good recognition performance while ensuring high security.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104227"},"PeriodicalIF":4.8,"publicationDate":"2024-11-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142723655","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A cyber-resilient open architecture for drone control 无人机控制的网络弹性开放架构

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-23 DOI: 10.1016/j.cose.2024.104205

Nicola d’Ambrosio, Gaetano Perrone, Simon Pietro Romano, Alberto Urraro

{"title":"A cyber-resilient open architecture for drone control","authors":"Nicola d’Ambrosio, Gaetano Perrone, Simon Pietro Romano, Alberto Urraro","doi":"10.1016/j.cose.2024.104205","DOIUrl":"10.1016/j.cose.2024.104205","url":null,"abstract":"<div><div>Unmanned Aerial Vehicles (UAVs) are becoming important tools in both military and civilian sectors. However, the prevalent use of monolithic architectures in contemporary platforms limits the swift integration of new features and significantly hampers the adaptability of UAVs to an ever-changing operational environment. Furthermore, this constantly evolving landscape highlights the inherent complexity of assessing drone safety and security since this process requires managing multiple and rapidly changing variables. Therefore, it is imperative to adopt an open system approach that relies on microservices and virtualization in order to overcome the limits of traditional drone architectures. This study presents a new method that involves breaking down the UAV monolithic system into a network of separate and virtualized components, each holding a single responsibility and designed according to the Open System Architecture (OSA) principle. Moreover, this work proposes a novel cyber-resilience model to determine cyber threats and assess their impact on the system. This approach leverages NIST 800-53, MITRE ATT&CK, STPA-Sec, and Attack Graph in order to identify the sequence of malicious actions that can lead to a specific hazardous scenario. Lastly, we demonstrate the effectiveness of this novel architectural paradigm by developing a software-in-the-loop simulation testbed for fast prototyping new features and validating the results of the cyber-resilience model.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104205"},"PeriodicalIF":4.8,"publicationDate":"2024-11-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142723572","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"OA","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

A reliability anomaly detection method based on enhanced GRU-Autoencoder for Vehicular Fog Computing services 基于增强型 GRU 自动编码器的可靠性异常检测方法，用于车载雾计算服务

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-23 DOI: 10.1016/j.cose.2024.104217

Yingqing Wang, Guihe Qin, Yanhua Liang

{"title":"A reliability anomaly detection method based on enhanced GRU-Autoencoder for Vehicular Fog Computing services","authors":"Yingqing Wang, Guihe Qin, Yanhua Liang","doi":"10.1016/j.cose.2024.104217","DOIUrl":"10.1016/j.cose.2024.104217","url":null,"abstract":"<div><div>With the rapid development of the Internet of Vehicles (IoV), Vehicular Fog Computing (VFC) reduces communication latency by pushing computational resources from the cloud to the fog layer close to the vehicle. However, in dynamic IoV systems, VFC services face the challenge of abnormal reliability, which are the phenomenon of decreased reliability caused by various factors. Most of the existing IoV anomaly detection methods are designed to protect data security, thus ignoring service reliability anomalies in IoV. Therefore, in order to ensure the stability of the VFC service during runtime, in this paper, we propose an enhanced Gated Recurrent Unit (GRU)-Autoencoder method to detect VFC service reliability anomalies. Our method uses GRU-Autoencoder as the anomaly detection model and uses the Bayesian Optimization with the Tree Parzen Estimator (BO-TPE) algorithm to select the optimal threshold coefficient. The method identifies reliability anomalies in the VFC service by estimating the reconstruction loss of the input samples. To address the challenge of time series data anomaly detection methods that rely heavily on representative normal reliability data for training, we propose an algorithm called Multi-stage Scored Reservoir Sampling (MSRS), which enhances the model by automatically selecting representative normal reliability data as the training set. Moreover, we elaborately designed the checkpoint restart algorithm to ensure that the VFC service rolls back to the most recent checkpoint state when reliability anomalies occur. We extensively evaluated the proposed method on five simulated datasets and validated its effectiveness. Our method brings a novel, automated and efficient reliability anomaly detection solution to VFC services.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104217"},"PeriodicalIF":4.8,"publicationDate":"2024-11-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142723570","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Constructing arbitrary write via puppet objects and delivering gadgets in Linux kernel

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-22 DOI: 10.1016/j.cose.2024.104189

Danjun Liu , Xuan Meng , Pengfei Wang, Xu Zhou, Wei Xie, Baosheng Wang

{"title":"Constructing arbitrary write via puppet objects and delivering gadgets in Linux kernel","authors":"Danjun Liu , Xuan Meng , Pengfei Wang, Xu Zhou, Wei Xie, Baosheng Wang","doi":"10.1016/j.cose.2024.104189","DOIUrl":"10.1016/j.cose.2024.104189","url":null,"abstract":"<div><div>Researchers have proposed various methods to perform kernel exploitation, which facilitates vulnerability evaluation and fixing. To sum up, traditional approaches tend to construct ROP chains or perform arbitrary write to escalate privileges. However, the former depends on some unusual ROP gadgets to save the stack frame pointer and demands adequate kernel memory space to hold the ROP chain. Additionally, to construct arbitrary write, existing approaches either rely on the usability of a certain kernel object or have restrictions on the write value. These limitations sometimes hinder the exploitation of the vulnerability.</div><div>In this paper, to overcome the limitations of existing exploitation strategies, we propose an elegant approach, which uses <em>puppet objects</em> and <em>delivering gadgets</em> to construct arbitrary writes. This approach relies on common ROP gadgets, requires less controllable memory, imposes fewer restrictions, and features a concise exploitation process. We also devise a tool named <span>PODE</span> to automatically identify puppet objects in Linux kernel and select suitable puppet objects and delivering gadgets for a given vulnerability. We evaluate <span>PODE</span> using 22 real-world kernel vulnerabilities and successfully exploit 16 of them using puppet objects, demonstrating that it not only diversifies the ways to perform kernel exploitation but also escalates the exploitability of kernel vulnerabilities.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104189"},"PeriodicalIF":4.8,"publicationDate":"2024-11-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142746967","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

AECR: Automatic attack technique intelligence extraction based on fine-tuned large language model AECR：基于微调大语言模型的自动攻击技术情报提取

IF 4.8 2区计算机科学

Computers & Security Pub Date : 2024-11-20 DOI: 10.1016/j.cose.2024.104213

Minghao Chen , Kaijie Zhu , Bin Lu , Ding Li , Qingjun Yuan , Yuefei Zhu

{"title":"AECR: Automatic attack technique intelligence extraction based on fine-tuned large language model","authors":"Minghao Chen , Kaijie Zhu , Bin Lu , Ding Li , Qingjun Yuan , Yuefei Zhu","doi":"10.1016/j.cose.2024.104213","DOIUrl":"10.1016/j.cose.2024.104213","url":null,"abstract":"<div><div>Cyber Threat Intelligence (CTI) reports contain resourceful intelligence on cyber-attack campaigns, which provides great help for security analysts to infer attack trends and enhance their defenses. However, due to the diversity of report content and writing styles, current intelligence extraction is mostly based on time-consuming manual efforts. Moreover, existing automatic methods generally neglect the importance of background knowledge and produce inexact extraction results. These problems prevent the effective utilization and sharing of intelligence from CTI reports. In this paper, we primarily focus on the automatic extraction of attack technique (AT) intelligence, which reveals patterns of attack behaviors and hardly changes over time. We propose a novel automatic AT extraction pipeline for CTI reports (AECR). AECR explores the feasibility of extracting AT intelligence based on a fined-tuned large language model (LLM). Particularly, we endow the selected LLM with enhanced domain-specific knowledge to improve its comprehension of AT-relevant content and alleviate the hallucination problem. Experimental results demonstrate that AECR outperforms state-of-the-art methods by a wide margin with a reasonable time cost. Specifically, we improve the accuracy, precision, recall, and F1-score by 108%, 37.2%, 22.4%, and 67.5% respectively. To the best of our knowledge, AECR is the first to perform AT extraction based on fine-tuned LLM.</div></div>","PeriodicalId":51004,"journal":{"name":"Computers & Security","volume":"150 ","pages":"Article 104213"},"PeriodicalIF":4.8,"publicationDate":"2024-11-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"142707219","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":2,"RegionCategory":"计算机科学","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0