Detection of thewormhole attacks is a cumbersome process,particularly simplex and duplex over thewireless sensor networks(WSNs).Wormhole attacks are characterized as distributed passive attacks that can destabilize or...Detection of thewormhole attacks is a cumbersome process,particularly simplex and duplex over thewireless sensor networks(WSNs).Wormhole attacks are characterized as distributed passive attacks that can destabilize or disable WSNs.The distributed passive nature of these attacks makes them enormously challenging to detect.The main objective is to find all the possible ways in which how the wireless sensor network’s broadcasting character and transmission medium allows the attacker to interrupt network within the distributed environment.And further to detect the serious routing-disruption attack“Wormhole Attack”step by step through the different network mechanisms.In this paper,a new multi-step detection(MSD)scheme is introduced that can effectively detect the wormhole attacks for WSN.The MSD consists of three algorithms to detect and prevent the simplex and duplex wormhole attacks.Furthermore,the proposed scheme integrated five detection modules to systematically detect,recover,and isolate wormhole attacks.Simulation results conducted inOMNET++show that the proposedMSDhas lower false detection and false toleration rates.Besides,MSDcan effectively detect wormhole attacks in a completely distributed network environment,as suggested by the simulation results.展开更多
Generating attack pattern automatically based on attack tree is studied. The extending definition of attack tree is proposed. And the algorithm of generating attack tree is presented. The method of generating attack p...Generating attack pattern automatically based on attack tree is studied. The extending definition of attack tree is proposed. And the algorithm of generating attack tree is presented. The method of generating attack pattern automatically based on attack tree is shown, which is tested by concrete attack instances. The results show that the algorithm is effective and efficient. In doing so, the efficiency of generating attack pattern is improved and the attack trees can be reused.展开更多
Deep neural networks,especially face recognition models,have been shown to be vulnerable to adversarial examples.However,existing attack methods for face recognition systems either cannot attack black-box models,are n...Deep neural networks,especially face recognition models,have been shown to be vulnerable to adversarial examples.However,existing attack methods for face recognition systems either cannot attack black-box models,are not universal,have cumbersome deployment processes,or lack camouflage and are easily detected by the human eye.In this paper,we propose an adversarial pattern generation method for face recognition and achieve universal black-box attacks by pasting the pattern on the frame of goggles.To achieve visual camouflage,we use a generative adversarial network(GAN).The scale of the generative network of GAN is increased to balance the performance conflict between concealment and adversarial behavior,the perceptual loss function based on VGG19 is used to constrain the color style and enhance GAN’s learning ability,and the fine-grained meta-learning adversarial attack strategy is used to carry out black-box attacks.Sufficient visualization results demonstrate that compared with existing methods,the proposed method can generate samples with camouflage and adversarial characteristics.Meanwhile,extensive quantitative experiments show that the generated samples have a high attack success rate against black-box models.展开更多
In the expanding Internet of Things(IoT)ecosystem,billions of interconnected devices exchange sensitive data,making secure and usable authentication critical.IoT devices in public or shared environments are vulnerable...In the expanding Internet of Things(IoT)ecosystem,billions of interconnected devices exchange sensitive data,making secure and usable authentication critical.IoT devices in public or shared environments are vulnerable to shoulder-surfing and video recorded observation attacks.Traditional passwords and static graphical schemes remain susceptible due to predictable patterns and direct credential entry.This study presents a novel recognition-based graphical authentication scheme that combines pass-image selection with compass direction substitution and rotation logic to resist observation-based attacks.A prototype was evaluated with 58 participants over three days.Usability metrics included registration time,login time,success rate,and error rate.Memorability and resistance to shoulder-surfing were also assessed.Results showed that login times decreased from 43.62 to 37.78 s,while success rates increased from 40%to 53%,indicating rapid adaptation.Memorability scores improved from 2.05 to 2.19 on a 3-point scale,with perfect recall for five-image passwords by Day 3.Shoulder-surfing tests recorded a 0%attacker success rate.The preliminary results suggest that the scheme offers a useful balance of usability,memorability,and resistance to single session observation attacks.Future work will explore adaptive complexity and accessibility features to further enhance secure authentication.展开更多
The wind tunnel experiments is conducted to get inspiration for understanding the mechanism of the asymmetric flow pattern and developing an innovative flow control technique for a slender body at high angle of attack...The wind tunnel experiments is conducted to get inspiration for understanding the mechanism of the asymmetric flow pattern and developing an innovative flow control technique for a slender body at high angle of attack. The bi-stable situation of the side forces is observed, which could be easily switched by a tiny disturbances either from coming flow or from artificial disturbances at nose tip (including manufacturing defect). In turbulent flows the side forces switched randomly between positive and negative. There exists a hysteresis loop of side force with the rolling angle. A rod in front of the slender body is used to change the vortex pattern, which could be kept even the rod is moved out from the stream. A miniature strake attached to the nose tip of the model can be moved to different circumferential position. When the strake is stationary, the hysteresis loop disappears and the side force does not change with the turbulent fluctuation of coming flow. The results from dynamic measurements of section side force indicates that when the strake swung at lower frequency the side force can follow the cadence of the swinging strake. With increasing frequency, the magnitude of the side force decreases. At still high frequency, the side force diminishes to zero. If the strake is swinging, while the middle position can be changed to different circumferential angle Фs on either left or right side, the side forces can be changed proportionally with the angle Фs. On the basis of the experimental results, the mechanism of the asymmetry is discussed.展开更多
The pattern password method is amongst the most attractive authentication methods and involves drawing a pattern;this is seen as easier than typing a password.However,since people with visual impairments have been inc...The pattern password method is amongst the most attractive authentication methods and involves drawing a pattern;this is seen as easier than typing a password.However,since people with visual impairments have been increasing their usage of smart devices,this method is inaccessible for them as it requires them to select points on the touch screen.Therefore,this paper exploits the haptic technology by introducing a vibration-based pattern password approach in which the vibration feedback plays an important role.This approach allows visually impaired people to use a pattern password through two developed vibration feedback:pulses,which are counted by the user,and duration,which has to be estimated by the user.In order to make the proposed approach capable to prevent shoulder-surfing attacks,a camouflage pattern approach is applied.An experimental study is conducted to evaluate the proposed approach,the results of which show that the vibration pulses feedback is usable and resistant to shoulder-surfing attacks.展开更多
1 Introduction Machine Learning(ML)has made significant progress in various tasks.This success is driven by powerful computational resources,expert experience,and,crucially,large-scale data.High-performance ML models ...1 Introduction Machine Learning(ML)has made significant progress in various tasks.This success is driven by powerful computational resources,expert experience,and,crucially,large-scale data.High-performance ML models typically require millions or even billions of samples.Training on such extensive datasets allows algorithms to capture complex patterns and improve generalization.Thus,large-scale data is essential for developing advanced ML models,driving the impressive advancements and implementations in the field today.展开更多
A common way to gain control of victim hosts is to launch buffer overflow attacks by remote exploits.This paper proposes a behavior-based buffer overflow attacker blocker,which can dynamically detect and prevent remot...A common way to gain control of victim hosts is to launch buffer overflow attacks by remote exploits.This paper proposes a behavior-based buffer overflow attacker blocker,which can dynamically detect and prevent remote buffer overflow attacks by filtering out the client requests that contain malicious executable codes.An important advantage of this approach is that it can block the attack before the exploit code begins affecting the target program.The blocker is composed of three major components,packet decoder,disassembler,and behavior-based detection engine.It decodes the network packets,extract possible instruction sequences from the payload,and analyzes whether they contain attack behaviors.Since this blocker based its effectiveness on the commonest behavior patterns of buffer overflow shellcode,it is expected to detect not only existing attacks but also zero-day attacks.Moreover,it has the capability of detecting attack-size obfuscation.展开更多
Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber secur...Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.展开更多
With the continuous development of network technology,various large-scale cyber-attacks continue to emerge.These attacks pose a severe threat to the security of systems,networks,and data.Therefore,how to mine attack p...With the continuous development of network technology,various large-scale cyber-attacks continue to emerge.These attacks pose a severe threat to the security of systems,networks,and data.Therefore,how to mine attack patterns from massive data and detect attacks are urgent problems.In this paper,an approach for attack mining and detection is proposed that performs tasks of alarm correlation,false-positive elimination,attack mining,and attack prediction.Based on the idea of CluStream,the proposed approach implements a flow clustering method and a two-step algorithm that guarantees efficient streaming and clustering.The context of an alarm in the attack chain is analyzed and the LightGBM method is used to perform falsepositive recognition with high accuracy.To accelerate the search for the filtered alarm sequence data to mine attack patterns,the PrefixSpan algorithm is also updated in the store strategy.The updated PrefixSpan increases the processing efficiency and achieves a better result than the original one in experiments.With Bayesian theory,the transition probability for the sequence pattern string is calculated and the alarm transition probability table constructed to draw the attack graph.Finally,a long-short-term memory network and embedding word-vector method are used to perform online prediction.Results of numerical experiments show that the method proposed in this paper has a strong practical value for attack detection and prediction.展开更多
Smart grids are increasingly dependent on data with the rapid development of communication and measurement.As one of the important data sources of smart grids,phasor measurement unit(PMU)is facing the high risk from a...Smart grids are increasingly dependent on data with the rapid development of communication and measurement.As one of the important data sources of smart grids,phasor measurement unit(PMU)is facing the high risk from attacks.Compared with cyber attacks,global position system(GPS)spoofing attacks(GSAs)are easier to implement because they can be exploited by portable devices,without the need to access the physical system.Therefore,this paper proposes a novel method for pattern recognition of GSA and an additional function of the proposed method is the data correction to the phase angle difference(PAD)deviation.Specifically,this paper analyzes the effect of GSA on PMU measurement and gives two common patterns of GSA,i.e.,the step attack and the ramp attack.Then,the method of estimating the PAD deviation across a transmission line introduced by GSA is proposed,which does not require the line parameters.After obtaining the estimated PAD deviations,the pattern of GSA can be recognized by hypothesis tests and correlation coefficients according to the statistical characteristics of the estimated PAD deviations.Finally,with the case studies,the effectiveness of the proposed method is demonstrated,and the success rate of the pattern recognition and the online performance of the proposed method are analyzed.展开更多
摘要Detection of thewormhole attacks is a cumbersome process,particularly simplex and duplex over thewireless sensor networks(WSNs).Wormhole attacks are characterized as distributed passive attacks that can destabilize or disable WSNs.The distributed passive nature of these attacks makes them enormously challenging to detect.The main objective is to find all the possible ways in which how the wireless sensor network’s broadcasting character and transmission medium allows the attacker to interrupt network within the distributed environment.And further to detect the serious routing-disruption attack“Wormhole Attack”step by step through the different network mechanisms.In this paper,a new multi-step detection(MSD)scheme is introduced that can effectively detect the wormhole attacks for WSN.The MSD consists of three algorithms to detect and prevent the simplex and duplex wormhole attacks.Furthermore,the proposed scheme integrated five detection modules to systematically detect,recover,and isolate wormhole attacks.Simulation results conducted inOMNET++show that the proposedMSDhas lower false detection and false toleration rates.Besides,MSDcan effectively detect wormhole attacks in a completely distributed network environment,as suggested by the simulation results.
摘要Generating attack pattern automatically based on attack tree is studied. The extending definition of attack tree is proposed. And the algorithm of generating attack tree is presented. The method of generating attack pattern automatically based on attack tree is shown, which is tested by concrete attack instances. The results show that the algorithm is effective and efficient. In doing so, the efficiency of generating attack pattern is improved and the attack trees can be reused.
基金the National Key Research and Development Program of China(No.2022ZD0210500)the National Natural Science Foundation of China(Nos.61972067,U21A20491,and 62103437)the Dalian Outstanding Youth Science Foundation(No.2022RJ01)。
摘要Deep neural networks,especially face recognition models,have been shown to be vulnerable to adversarial examples.However,existing attack methods for face recognition systems either cannot attack black-box models,are not universal,have cumbersome deployment processes,or lack camouflage and are easily detected by the human eye.In this paper,we propose an adversarial pattern generation method for face recognition and achieve universal black-box attacks by pasting the pattern on the frame of goggles.To achieve visual camouflage,we use a generative adversarial network(GAN).The scale of the generative network of GAN is increased to balance the performance conflict between concealment and adversarial behavior,the perceptual loss function based on VGG19 is used to constrain the color style and enhance GAN’s learning ability,and the fine-grained meta-learning adversarial attack strategy is used to carry out black-box attacks.Sufficient visualization results demonstrate that compared with existing methods,the proposed method can generate samples with camouflage and adversarial characteristics.Meanwhile,extensive quantitative experiments show that the generated samples have a high attack success rate against black-box models.
基金supported by the Ministry of Higher Education(MoHE),Malaysia through the Fundamental Research Grant Scheme(FRGS/1/2023/ICT03/UTAR/02/1)。
摘要In the expanding Internet of Things(IoT)ecosystem,billions of interconnected devices exchange sensitive data,making secure and usable authentication critical.IoT devices in public or shared environments are vulnerable to shoulder-surfing and video recorded observation attacks.Traditional passwords and static graphical schemes remain susceptible due to predictable patterns and direct credential entry.This study presents a novel recognition-based graphical authentication scheme that combines pass-image selection with compass direction substitution and rotation logic to resist observation-based attacks.A prototype was evaluated with 58 participants over three days.Usability metrics included registration time,login time,success rate,and error rate.Memorability and resistance to shoulder-surfing were also assessed.Results showed that login times decreased from 43.62 to 37.78 s,while success rates increased from 40%to 53%,indicating rapid adaptation.Memorability scores improved from 2.05 to 2.19 on a 3-point scale,with perfect recall for five-image passwords by Day 3.Shoulder-surfing tests recorded a 0%attacker success rate.The preliminary results suggest that the scheme offers a useful balance of usability,memorability,and resistance to single session observation attacks.Future work will explore adaptive complexity and accessibility features to further enhance secure authentication.
摘要The wind tunnel experiments is conducted to get inspiration for understanding the mechanism of the asymmetric flow pattern and developing an innovative flow control technique for a slender body at high angle of attack. The bi-stable situation of the side forces is observed, which could be easily switched by a tiny disturbances either from coming flow or from artificial disturbances at nose tip (including manufacturing defect). In turbulent flows the side forces switched randomly between positive and negative. There exists a hysteresis loop of side force with the rolling angle. A rod in front of the slender body is used to change the vortex pattern, which could be kept even the rod is moved out from the stream. A miniature strake attached to the nose tip of the model can be moved to different circumferential position. When the strake is stationary, the hysteresis loop disappears and the side force does not change with the turbulent fluctuation of coming flow. The results from dynamic measurements of section side force indicates that when the strake swung at lower frequency the side force can follow the cadence of the swinging strake. With increasing frequency, the magnitude of the side force decreases. At still high frequency, the side force diminishes to zero. If the strake is swinging, while the middle position can be changed to different circumferential angle Фs on either left or right side, the side forces can be changed proportionally with the angle Фs. On the basis of the experimental results, the mechanism of the asymmetry is discussed.
摘要The pattern password method is amongst the most attractive authentication methods and involves drawing a pattern;this is seen as easier than typing a password.However,since people with visual impairments have been increasing their usage of smart devices,this method is inaccessible for them as it requires them to select points on the touch screen.Therefore,this paper exploits the haptic technology by introducing a vibration-based pattern password approach in which the vibration feedback plays an important role.This approach allows visually impaired people to use a pattern password through two developed vibration feedback:pulses,which are counted by the user,and duration,which has to be estimated by the user.In order to make the proposed approach capable to prevent shoulder-surfing attacks,a camouflage pattern approach is applied.An experimental study is conducted to evaluate the proposed approach,the results of which show that the vibration pulses feedback is usable and resistant to shoulder-surfing attacks.
摘要1 Introduction Machine Learning(ML)has made significant progress in various tasks.This success is driven by powerful computational resources,expert experience,and,crucially,large-scale data.High-performance ML models typically require millions or even billions of samples.Training on such extensive datasets allows algorithms to capture complex patterns and improve generalization.Thus,large-scale data is essential for developing advanced ML models,driving the impressive advancements and implementations in the field today.
摘要A common way to gain control of victim hosts is to launch buffer overflow attacks by remote exploits.This paper proposes a behavior-based buffer overflow attacker blocker,which can dynamically detect and prevent remote buffer overflow attacks by filtering out the client requests that contain malicious executable codes.An important advantage of this approach is that it can block the attack before the exploit code begins affecting the target program.The blocker is composed of three major components,packet decoder,disassembler,and behavior-based detection engine.It decodes the network packets,extract possible instruction sequences from the payload,and analyzes whether they contain attack behaviors.Since this blocker based its effectiveness on the commonest behavior patterns of buffer overflow shellcode,it is expected to detect not only existing attacks but also zero-day attacks.Moreover,it has the capability of detecting attack-size obfuscation.
摘要Detecting cyber-attacks undoubtedly has become a big data problem. This paper presents a tutorial on data mining based cyber-attack detection. First,a data driven defence framework is presented in terms of cyber security situational awareness. Then, the process of data mining based cyber-attack detection is discussed. Next,a multi-loop learning architecture is presented for data mining based cyber-attack detection. Finally,common data mining techniques for cyber-attack detection are discussed.
基金This work is supported by the National Key R&D Program of China(2016QY05X1000)the National Natural Science Foundation of China(Grant No.201561402137).
摘要With the continuous development of network technology,various large-scale cyber-attacks continue to emerge.These attacks pose a severe threat to the security of systems,networks,and data.Therefore,how to mine attack patterns from massive data and detect attacks are urgent problems.In this paper,an approach for attack mining and detection is proposed that performs tasks of alarm correlation,false-positive elimination,attack mining,and attack prediction.Based on the idea of CluStream,the proposed approach implements a flow clustering method and a two-step algorithm that guarantees efficient streaming and clustering.The context of an alarm in the attack chain is analyzed and the LightGBM method is used to perform falsepositive recognition with high accuracy.To accelerate the search for the filtered alarm sequence data to mine attack patterns,the PrefixSpan algorithm is also updated in the store strategy.The updated PrefixSpan increases the processing efficiency and achieves a better result than the original one in experiments.With Bayesian theory,the transition probability for the sequence pattern string is calculated and the alarm transition probability table constructed to draw the attack graph.Finally,a long-short-term memory network and embedding word-vector method are used to perform online prediction.Results of numerical experiments show that the method proposed in this paper has a strong practical value for attack detection and prediction.
基金supported by the National Key Research and Development Program of China(No.2017YFB0902900,No.2017YFB0902901)National Natural Science Foundation of China(No.51627811,No.51725702)the Fundamental Research Funds for the Central Universities(No.2018ZD01)
摘要Smart grids are increasingly dependent on data with the rapid development of communication and measurement.As one of the important data sources of smart grids,phasor measurement unit(PMU)is facing the high risk from attacks.Compared with cyber attacks,global position system(GPS)spoofing attacks(GSAs)are easier to implement because they can be exploited by portable devices,without the need to access the physical system.Therefore,this paper proposes a novel method for pattern recognition of GSA and an additional function of the proposed method is the data correction to the phase angle difference(PAD)deviation.Specifically,this paper analyzes the effect of GSA on PMU measurement and gives two common patterns of GSA,i.e.,the step attack and the ramp attack.Then,the method of estimating the PAD deviation across a transmission line introduced by GSA is proposed,which does not require the line parameters.After obtaining the estimated PAD deviations,the pattern of GSA can be recognized by hypothesis tests and correlation coefficients according to the statistical characteristics of the estimated PAD deviations.Finally,with the case studies,the effectiveness of the proposed method is demonstrated,and the success rate of the pattern recognition and the online performance of the proposed method are analyzed.