Current Issue

25 June 2019, Volume 40 Issue 6

Previous Issue    Next Issue

Topics: Network Attack, Defense and Security Metrics

Automated crowdturfing attack in Chinese user reviews

WANG Li’na,GUO Xiaodong,WANG Run

2019, 40(6):  1-13.  doi:10.11959/j.issn.1000-436x.2019149

Asbtract ( 423 )   HTML ( 55)   PDF (838KB) ( 1026 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

The text-oriented automated crowdturfing attack has a series of features such as low attack cost and strong concealment.This kind of attack can automatically generate a large number of fake reviews,with harmful effect on the healthy development of the user review community.In recent years,researchers have found that text-oriented crowdturfing attacks for the English review community,but there was few research work on automated crowdsourcing attacks in the Chinese review community.A Chinese character embedding LSTM model was proposed to automatically generate Chinese reviews with the aim of antomated crowdturfing attacks,which model trained by a combination with Chinese character embedding network,LSTM network and softmax dense network,and a temperature parameter T was designed to construct the attack model.In the experiment,more than 50 000 real user reviews were crawled from Taobao's online review platform to verify the effectiveness of the attack method.Experimental results show that the generated fake reviews can effectively fool linguistics-based classification detection approach and texts plagiarism detection approach.Besides,the massive manually evaluation experiments also demonstrate that the generated reviews with the proposed attack approach perform well in reality and diversity.

Survey on network system security metrics

WU Chensi,XIE Weiqiang,JI Yixiao,YANG Su,JIA Ziyi,ZHAO Song,ZHANG Yuqing

2019, 40(6):  14-31.  doi:10.11959/j.issn.1000-436x.2019148

Asbtract ( 762 )   HTML ( 104)   PDF (778KB) ( 1581 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

With the improvement for comprehensive and objective understanding of the network system,the research and application of network system security metrics (NSSM) are noticed more.The quantitative evaluation of network system security is developing towards precision and objectification.NSSM can provide the objective and scientific basis for the confrontation of attack-defense and decision of emergency response.The global metrics of network system security is a crucial point in the field of security metrics.From the perspective of global metrics,the status and role of global metrics in security evaluation were pointed out.Three development stages of metrics (perceiving,cognizing and deepening) and their characteristics were analyzed and summarized.The process of global metrics was described.The metrics models,metrics systems and metrics tools were analyzed,and their functions,interrelations,and features in security metrics were pointed out.Then the technical challenges of global metrics of network systems were explained in detail,and ten opportunities and challenges were summarized in tabular form.Finally,the next direction and development trend of network system security metrics research were forecasted.The survey shows that NSSM has a good application prospect in network security.

Efficient revocable attribute-based encryption scheme

LI Xuejun,ZHANG Dan,LI Hui

2019, 40(6):  32-39.  doi:10.11959/j.issn.1000-436x.2019150

Asbtract ( 563 )   HTML ( 72)   PDF (821KB) ( 1031 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In the existing solutions,the time-based scheme is difficult to achieve immediate revocation,and the third-party-based scheme often requires re-encryption,which needs large amount of calculation and doesn’t apply to mas-sive data.To solve the problem,an efficient and immediate CP-ABE scheme was proposed to support user and attribute lev-els revocation.The scheme was based on the classic LSSS access structure,introducing RSA key management mechanism and attribute authentication.By means of a semi-trusted third party,the user could be authenticated before decryption.Com-pared with the existing revocation schemes,The proposed scheme didn’t need the user to update the key or re-encrypt the ciphertext.The semi-trusted third party wasn’t required to update the RSA attribute authentication key.The scheme greatly reduced the amount of computation and traffic caused by revocation,while ensuring anti-collusion attacks and forward and backward security.Finally,the security analysis and experimental simulation show that the scheme has higher revocation ef-ficiency.

Account hijacking threat attack detection for OAuth2.0 authorization API

LIU Qixu,QIU Kaili,WANG Yiwen,CHEN Yanhui,CHEN Langping,LIU Chaoge

2019, 40(6):  40-50.  doi:10.11959/j.issn.1000-436x.2019144

Asbtract ( 546 )   HTML ( 30)   PDF (872KB) ( 1538 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

OAuth2.0 protocol has been widely adopted to simplify user login to third-party applications,at the same time,existing risk of leaking user privacy data,what even worse,causing user accounts to be hijacked.An account hijacking attack model around authorization code was built by analyzing the vulnerabilities of the OAuth2.0 protocol.A vulnerable API identification method based on differential traffic analysis and an account hijacking verification method based on authorized authentication traffic monitoring was proposed.An account hijacking attack threat detection framework OScan for OAuth2.0 authorization API was designed and implemented.Through a large-scale detection of the 3 853 authorization APIs deployed on the Alexa top 10 000 websites,360 vulnerable APIs were discovered.The further verification showed that 80 websites were found to have threat of account hijacking attack.Compared with similar tools,OScan has significant advantages in covering the number of identity provider,the number of detected relying party,as well as the integrity of risk detection.

Papers

Robust deployment strategy for security data collection agent

2019, 40(6):  51-65.  doi:10.11959/j.issn.1000-436x.2019121

Asbtract ( 283 )   HTML ( 15)   PDF (1281KB) ( 635 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

With the frequent occurrence of “network black production” incidents,attackers strategically launch target attacks with the idea of “profit-seeking”.Existing network monitoring systems lack accurate and effective monitoring strategies for “strategic attacks”.Therefore,in an adversarial environment,how to optimize the deployment of collection agents for better monitoring results becomes an extremely important issue.Based on this,a robust deployment strategy of collection agents was proposed for the above mentioned problem.Firstly,the idea of attack-defense game was introduced to measure the collection agents,threat events and their relations,then the MADG model was built.Secondly,considering that the traditional accurate solution algorithm cannot solve the problem,the robust acquisition agent deployment algorithm called RCD algorithm was designed to approximate the problem by using the sub-module and non-growths of the objective function.Finally,the RCD algorithm was verified.The experimental results show that the above model and method is feasible,effective and expandable.

Research on critical SNR and power allocation of artificial noise assisted secure transmission

DENG Hao,WANG Huiming

2019, 40(6):  66-73.  doi:10.11959/j.issn.1000-436x.2019114

Asbtract ( 355 )   HTML ( 24)   PDF (769KB) ( 582 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A comprehensive performance analysis of artificial noise (AN) assisted secure transmission in multiple-input single-output (MISO) wiretap channels was presented.It was shown that the AN scheme did not always improve the security,and provided an exact signal-to-noise ratio (SNR) threshold below which AN did not work.An explicit result of the optimal power allocation (OPA) using the lower bound to the ergodic secrecy rate (ESR) was presented and the OPA for the worst case without the knowledge of the eavesdropper’s relative distance was also provided.Simulations demonstrate that the proposed power allocation result achieves a higher ESR than the equal one.

Study on utility optimization for randomized response mechanism

ZHOU Yihui,LU Laifeng,WU Zhenqiang

2019, 40(6):  74-81.  doi:10.11959/j.issn.1000-436x.2019088

Asbtract ( 394 )   HTML ( 30)   PDF (1048KB) ( 472 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

For the study of privacy-utility trade-off in local differential privacy,the utility optimization models of binary generalized random response mechanism for the case of differential privacy and approximate differential privacy were established.By graphic method,optimality proof,software solution and extreme point method,the exact expression of the optimal utility with privacy budget and the distribution of input data was obtained,and the corresponding optimal randomized response mechanism was given.The results show that both the optimal utility and optimal mechanism are related to privacy budget and input data distribution.Moreover,the discussion for multivariate randomized response mechanism shows that the method of extreme points of local differential privacy is feasible to the solution.

Acquisition algorithm for BOC signals in high dynamic environment

PAN Yi,ZHANG Tianqi,ZHANG Gang,MA Baoze

2019, 40(6):  82-89.  doi:10.11959/j.issn.1000-436x.2019145

Asbtract ( 348 )   HTML ( 18)   PDF (900KB) ( 631 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

As the synchronization of binary offset carrier (BOC) signals couldn’t be realized in high dynamic environment by traditional acquisition algorithms,an acquisition algorithm based on fractional Fourier transform (FRFT) and discrete polynomial-phase transform (DPT) was proposed.Firstly,the algorithm determined how to process the received signal according to the dynamic order obtained by the order operation.And then the acquisition was achieved by searching the spectral peak of the FRFT algorithm to obtain the estimation of dynamic parameters and code phase.Theoretical analysis and simulations show that the proposed algorithm eliminates the influence of second-order doppler shift rate based on original FRFT acquisition algorithm,which can successfully capture high dynamic BOC signals.The proposed algorithm further enhances the dynamic adaptability and anti-noise performance and has superior performance in detection probability and acquisition time in comparison with other algorithms.

Interference-aware node access scheme in UAV-aided VANET

FAN Xiying,HUANG Chuanhe,ZHU Junyu,WEN Shaojie

2019, 40(6):  90-101.  doi:10.11959/j.issn.1000-436x.2019081

Asbtract ( 599 )   HTML ( 57)   PDF (1170KB) ( 963 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

In vehicular Ad Hoc network (VANET),frequent link handovers and channel interference can lead to increased transmission delay and decreased network throughput.To address the issues,unmanned aerial vehicle (UAV) were introduced to cooperate with vehicles and construct UAV-assisted air-ground integrated VANET.An interference-aware node access scheme was proposed.The node access problem was formulated as a multi-objective optimization problem considering link transmission rate,link handovers and transmit power.Then the optimization problem was decomposed into two convex optimization sub-problems by dual decomposition method,the sub-problem jointly optimizes handovers and link transmission rate while the sub-problem optimizes the transmit power based on link reliability.Finally,simulation results show that the proposed mechanism can effectively improve data delivery ratio,average end-to-end delay and network throughput.

Multidimensional QoS cloud computing resource scheduling method based on stakeholder perspective

SU Mingfeng,WANG Guojun,LI Renfa

2019, 40(6):  102-115.  doi:10.11959/j.issn.1000-436x.2019113

Asbtract ( 333 )   HTML ( 19)   PDF (1056KB) ( 614 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A multidimensional cloud computing architecture is designed and a multidimensional cloud resource scheduling model is constructed based on the stakeholder perspective of cloud users and cloud service providers to meet the high QoS requirements of cloud users (such as task execution time and task completion time) with low computing costs (such as energy consumption,economic costs and system availability).For the second-level cloud resource scheduling,an MQoS cloud resource scheduling algorithm based on multiple Greedy algorithm is proposed.The experimental results show that under the four cloud computing application scenarios with no aftereffects,the MQoS cloud resource scheduling algorithm has an overall increase of 206.42%~228.99% and 34.26%~56.93 in terms of multidimensional QoS degree compared with FIFO and M2EC algorithms.It has an average overall reduction of 0.48~0.49 and 0.20~0.27 in terms of cloud data center load balance difference.

3D channel modeling and space-time correlation analysis for V2V communications

ZENG Wenbo,HE Yigang,LI Bing,SHI Guolong,ZHAO Feng

2019, 40(6):  116-127.  doi:10.11959/j.issn.1000-436x.2019115

Asbtract ( 357 )   HTML ( 24)   PDF (1587KB) ( 913 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

To match complex wireless propagation scenarios,an improved 3D geometry-based stochastic model was proposed for vehicle to vehicle (V2V) communications channel.The exact relationship between the azimuth angle and elevation angle was taken into account and the corresponding space–time correlation function and space–Doppler power spectral density were derived,and the influence of important factors was analyzed.The observations and conclusions show that correlation characteristics is closely related to distribution of the scatterers and the angle of the antenna array under the non-isotropic scattering environment and is affected by the elevation angle of the antenna array under the isotropic scattering environment.And the space-time correlation characteristics in high vehicular traffic density is significantly lower than that in low vehicular traffic density.The corresponding simulation model is also derived by using a reasonable parameter calculation method.The simulation results validate the rationality of proposed model.It greatly improves analysis and simulation efficiency of V2V MIMO system.

Optimal strategy selection method for moving target defense based on signaling game

JIANG Lyu,ZHANG Hengwei,WANG Jindong

2019, 40(6):  128-137.  doi:10.11959/j.issn.1000-436x.2019125

Asbtract ( 428 )   HTML ( 28)   PDF (775KB) ( 903 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

To solve the problem of the optimal strategy selection for moving target defense,the defense strategy was defined formally,the defense principle from the perspective of attack surface shifting and exploration surface enlarging was taken into account.Then,network attack-defense behaviors were analyzed from the sight of dynamic confrontation and bounded information.According to the analysis of attack-defense game types and confrontation process,the moving target defense model based on signaling game was constructed.Meanwhile,the method to quantify strategies was improved and the solution of perfect Bayesian equilibrium was proposed.Furthermore,the optimal defense strategy selection algorithm was designed by the equilibrium analysis.Finally,the simulation demonstrates the effectiveness and feasibility of the proposed optimal strategy and selection method.

Secure authentication enhancement scheme for seamless handover and roaming in space information network

XUE Kaiping,ZHOU Huancheng,MENG Wei,LI Shaohua

2019, 40(6):  138-147.  doi:10.11959/j.issn.1000-436x.2019128

Asbtract ( 395 )   HTML ( 33)   PDF (896KB) ( 919 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Space information network composed of a variety of heterogeneous networks is widely concerned.However,the space information network is facing more security threats and more likely to roam due to its complex topology and large user scale.Considering the characteristics of space information network,a secure authentication enhancement scheme for seamless handover and roaming in space information network was presented.The fast mutual authentication and reasonable accounting between the user and the visiting domain based on the combination of Token and Hash chain was achieved.In addition,two seamless handover mechanisms were proposed to ensure the continuity of user communication.Finally,security analysis indicates that the scheme can not only provide essential security properties,but also achieve reasonable accounting.

Incremental clustering method based on Gaussian mixture model to identify malware family

HU Jianwei,CHE Xin,ZHOU Man,CUI Yanpeng

2019, 40(6):  148-159.  doi:10.11959/j.issn.1000-436x.2019135

Asbtract ( 526 )   HTML ( 32)   PDF (1259KB) ( 962 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Aiming at the logical similarity of the behavioral characteristics of malware belonging to the same family,the characteristics of malware were extracted by tracking the logic rules of API function call from the perspective of behavior detection,and the static analysis and dynamic analysis methods were combined to analyze malicious behavior characteristics.In addition,according to the purpose,inheritance and diversity of the malware family,the transitive closure relationship of the malware family was constructed,and then the incremental clustering method based on Gaussian mixture model was improved to identify the malware family.Experiments show that the proposed method can not only save the storage space of malware detection,but also significantly improve the detection accuracy and recognition efficiency.

Comprehensive Review

Survey of the deterministic network

HUANG Tao,WANG Shuo,HUANG Yudong,ZHENG Yao,LIU Jiang,LIU Yunjie

2019, 40(6):  160-176.  doi:10.11959/j.issn.1000-436x.2019119

Asbtract ( 2176 )   HTML ( 300)   PDF (1606KB) ( 5504 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

The current Internet faces a huge increase in video traffic and industrial machine applications,causing a lot of congestion and packet delays.Besides,many network applications,such as industrial Internet,telemedicine,driverless,VR games,etc,require a latency from 1 to 10 milliseconds and jitters within microsecond.But traditional network can only reduce the end-to-end latency to tens of milliseconds.Under this background,how to transit from “best effort” to“punctuality,accuracy”,controlling the end-to-end delay has become a hot field of global network research.The application scenarios and requirements of the deterministic network were introduced，and the main research results of the current parties were described as well as the trend of development and core issues were summarized.It hopes to provide a reference and help for the research in this field.

Correspondences

Attribute-based proxy re-encryption scheme with multiple features

FENG Chaosheng,LUO Wangping,QIN Zhiguang,YUAN Ding,ZOU Liping

2019, 40(6):  177-189.  doi:10.11959/j.issn.1000-436x.2019127

Asbtract ( 647 )   HTML ( 54)   PDF (948KB) ( 1026 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

A ideal proxy re-encryption scheme has five features,such as one-way encryption,non-interaction,repeatability,controllability and verifiability.The existing schemes,however,have only two or three of the five features,which reduces the utility of them to some extent.For this,a new ciphertext-policy attribute-based proxy re-encryption (CP-ABPRE) scheme with the above five features was proposed.In the proposed scheme,the cloud proxy server could only re-encrypt the ciphertext specified by the delegator by using the re-encryption key,and resist the collusion attack between the user and the proxy satisfying the re-encryption sharing policy.Most of encryption and decryption were outsourced to cloud servers so that it reduced the computing burden on the user’s client.The security analysis show that the proposed scheme resists the selective chosen plaintext attack (SCPA).

(t,k)-diagnosability of exchanged crossed cube under the PMC model

GUO Chen,XIAO Zhifang,LEMG Ming,PENG Shuo,WANG Bo

2019, 40(6):  190-202.  doi:10.11959/j.issn.1000-436x.2019099

Asbtract ( 276 )   HTML ( 7)   PDF (1094KB) ( 732 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Exchanged crossed cube(ECQ) is one of the latest achievements in the research of topology of novel interconnection networks.ECQ is a more optimized form of organization for multi-processor parallel computers,which retains the advantages of exchanged hypercube and crossed cube in terms of the smaller diameter,fewer links,and lower cost factor,and which indicates more balanced consideration.However,so far,ECQ hadn’t been formally introduced into multi-processor parallel computers.One of the main reasons was that its reliability research wasn’t yet systematic.Among them,the operational reliability represented by diagnosability was the most urgent.ECQ was taken as studying object,after topological analyzing,some important topological properties of ECQ were introduced,which determines the (t,k)-diagnosability of ECQ(s,t) under the PMC model by theoretical deduction and simulation experiments.Simulation results show that ECQ reliability complement and improvement,which provides strong technical support for subsequent application and popularization.

Performance comparison of systematic polar code and non-systematic polar code

LI Hui,YE Ming,TONG Qiang,CHENG Jie,WANG Lijie

2019, 40(6):  203-209.  doi:10.11959/j.issn.1000-436x.2019147

Asbtract ( 730 )   HTML ( 49)   PDF (797KB) ( 873 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Polar code in channel coding schemes is a research hotspot in 5G communication field.Polar code is susceptible to error propagation under successive cancellation decoding,and the performance of the code at short and medium block lengths is not ideal.For the problems,the performance difference between systematic polar code and non-systematic polar code was studied under various simulation conditions.Simulation results demonstrate that systematic polar code has advantage over non-systematic polar code in bit error rate performance,and the former are more robust against error propagation than the latter under successive cancellation decoding.The above results are considerable importance from the theoretical values in 5G communication and performance optimization of polar code.

Research on low-rate DDoS attack of SDN network in cloud environment

CHEN Xingshu,HUA Qiang,WANG Yitong,GE Long,ZHU Yi

2019, 40(6):  210-222.  doi:10.11959/j.issn.1000-436x.2019120

Asbtract ( 630 )   HTML ( 69)   PDF (931KB) ( 1138 )   Knowledge map   

Figures and Tables | References | Related Articles | Metrics

Aiming at the problems of low-rate DDoS attack detection accuracy in cloud SDN network and the lack of unified framework for data plane and control plane low-rate DDoS attack detection and defense,a unified framework for low-rate DDoS attack detection was proposed.First of all,the validity of the data plane DDoS attacks in low rate was analyzed,on the basis of combining with low-rate of DDoS attacks in the aspect of communications,frequency characteristics,extract the mean value,maximum value,deviation degree and average deviation,survival time of ten dimensions characteristics of five aspects,to achieve the low-rate of DDoS attack detection based on bayesian networks,issued by the controller after the relevant strategies to block the attack flow.Finally,in OpenStack cloud environment,the detection rate of low-rate DDoS attack reaches 99.3% and the CPU occupation rate is 9.04%.It can effectively detect and defend low-rate DDoS attacks.