<?xml version="1.0" encoding="utf-8"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom" xmlns:cf="http://www.microsoft.com/schemas/rss/core/2005">
<channel>
<title><![CDATA[Editorial Board of Journal of Cyber Security -->Early Online Releases]]></title>
<item>
<title><![CDATA[Defense Method Against Indirect Prompt Injection Attacks Incorporating Intent Matching]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202511270000001&flag=2]]></link>
<description><![CDATA[Agents powered by large language models (LLMs) interact with the environment by integrating external tools, enabling widespread applications across several domains. However, this mechanism introduces the risk of indirect prompt injection (IPI) attacks. IPI attacks inject malicious instructions into tool-accessed external data, thereby manipulating tool responses and steering agents toward unauthorized actions. Existing defenses generally use predefined rules and semantic analysis to filter malicious instructions. However, by focusing solely on responses and lacking a well-defined criterion for identifying truly malicious anomalies, these defenses fall short when confronting more intricate attacks. To overcome this, we propose a defense method based on an LLM-based detector, which detects IPI attacks by assessing the intent deviation between re-sponses and user instructions, using a two-stage prompt engineering. In the first stage, the detector is guided by criteria like semantic density priority to locate high-risk segments within tool responses using a content extraction prompt template. In the second stage, a security validation prompt is applied to the extracted key segments, which assesses threats based on criteria such as intent alignment and operational legality. Experiments were conducted using the INJECAGENT benchmark and two derived datasets to evaluate the performance of our method and three mainstream baseline families in defending against both traditional and adaptive IPI attacks. The results demonstrate that our method, relying solely on the base model in the agent, exceeds the best baseline in key metrics. For example, in the IPI attack on the benchmark dataset, detection ac-curacy improves by about 39% and attack success rate drops by approximately 48%, compared to the baseline.]]></description>
<pubDate>2026/6/25 10:56:44</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[liyunpeng,liushuhe,sunhao,zhaoxusheng]]></author>
</item>
<item>
<title><![CDATA[VulRechecker: A Precise Memory Error Detection Method Based on Pointer Tagging]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202506280000001&flag=2]]></link>
<description><![CDATA[With the surge in network attack incidents, memory corruption vulnerabilities have become a focus of information security research due to their direct threats to system confidentiality, integrity, and availability. Fuzzing, as a main-stream detection approach, combined with Sanitizer-based tools, efficiently identifies memory corruption vulnera-bilities such as buffer overflows and use-after-free (UAF), driving the rapid growth of vulnerability databases (e.g., CVE). However, existing Sanitizer technologies suffer from significant defects: their intrusive memory checks alter the program"s memory layout, may leading to misreporting of vulnerability types (e.g., misclassifying vulnerability types) and misjudgment of crash locations, which severely undermines the reliability of vulnerability repair and exploit analysis.This paper addresses the above issues by proposing VulRechecker, a non-intrusive memory vul-nerability detection method based on pointer tagging. Leveraging the 16 high-order bits of idle address space in 64-bit systems, this method stores memory allocation boundary information in a separate metadata table via com-pile-time instrumentation, dynamically verifying the legitimacy of memory accesses at runtime. Without altering the original memory layout, it enables precise and effective detection for both heap and stack objects, providing critical support for subsequent analysis of memory corruption vulnerabilities. Compared with traditional memory safety detection tools (Sanitizers), this scheme offers two dvantages: first, by separating metadata storage, it fully pre-serves the original program memory layout, avoiding execution deviations caused by memory structure tampering; second, fine-grained checks based on pointer boundary information accurately report vulnerability types (e.g., heap buffer overflows), significantly reducing false positives. Experiments show that VulRechecker remarkably reduces false positives compared to AddressSanitizer, achieving zero false positives on 8 memory corruption vulnerability subsets (CWE121, CWE122, CWE124, CWE126, CWE127, CWE415, CWE416, CWE761) of the Juliet Test Suite and 13 real-world CVE vulnerabilities from basic component libraries (e.g., libming, binutils). Finally, through de-tailed comparisons of memory layouts among the original program, AddressSanitizer-instrumented program, and VulRechecker-instrumented program, this method enables high-precision detection of memory corruption vulnera-bilities without affecting the program"s native behavior, providing more reliable technical support for vulnerability diagnosis and repair, and holding significant implications for enhancing the practicality of automated vulnerability detection systems.]]></description>
<pubDate>2026/6/3 8:53:37</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[li rui lin,mao ling chu,tang chao jing,wang xiao lei]]></author>
</item>
<item>
<title><![CDATA[A Study on Poisoning Attack Detection Methods for Rec-ommender Systems Integrating Item Tag Information]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202510070000001&flag=2]]></link>
<description><![CDATA[Recommender systems are vulnerable to malicious user profile injection due to their openness, making their rec-ommendation results susceptible to intentional manipulation. Existing detection methods mainly focus on rating behaviors while neglecting critical semantic information such as item tags, making them less effective against com-plex or highly camouflaged attacks. To address this issue, this paper proposes a poisoning attack detection method named 3DCPA-PAD, which integrates 3D convolutional neural networks (3D-CNN) with the Multi-Head Performer Attention mechanism. Specifically, the proposed method constructs a user–item–tag three-dimensional tensor to fuse multi-source semantic information between rating behaviors and item tags, enabling unified modeling of het-erogeneous data. To capture both local and global behavioral features, a 3D-CNN is utilized to extract local rating patterns, while the Multi-Head Performer Attention mechanism is incorporated to learn global dependencies among rating behaviors. To address the challenge of adaptively fusing local and global features, a gated residual fusion strategy is introduced to enhance dynamic coordination among multi-dimensional features. Furthermore, to allevi-ate the feature ambiguity between different user categories, contrastive learning is employed to improve the model""s ability to identify malicious users. Additionally, data augmentation and adversarial training strategies are incorpo-rated to mitigate the issues of rating sparsity and behavioral perturbations, thereby enhancing model robustness. Comparative experiments conducted on two benchmark recommender system datasets, Movielens-1M and Amazon, demonstrate that the proposed 3DCPA-PAD method outperforms baseline detection approaches under various poi-soning attack scenarios.]]></description>
<pubDate>2026/5/14 14:32:27</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[fengliping,haoyaojun,李菊霞,liangfeng,yuangaojie]]></author>
</item>
<item>
<title><![CDATA[Decompilation Using Control Structure Recovery Techniques Towards Human Habits]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401080000001&flag=2]]></link>
<description><![CDATA[Decompilers are commonly employed for software security analysis where source code is inaccessible, such as in binary formats for tasks like malware analysis, vulnerability mining, and verification. Given the intricate nature of these tasks, reverse engineers often require deep analysis of the binaries, but analyzing all assembly code one by one is time-consuming and inefficient. Decompilers aid reverse engineers in extracting the semantics of each function within binaries, enabling quick identification of critical functions or code segments, thereby significantly boosting the efficiency of code analysis in reverse engineering. However, despite substantial efforts to enhance the control structure readability of decompiled code, the readability of high-level control statements generated by current decompilers still markedly differs from human-written code, necessitating extensive manual analysis of control conditions and logic by reverse engineers. This paper leverages the capabilities of large language models in human-aligned code understanding and generation to propose LLMReStructor, a control structure optimization technique oriented towards human programming habits. Compared to traditional decompilers, LLMReStructor can restore control structures to statements that more closely align with human programming habits based on the code"s specific function and usage scenario. Through comparative analysis with the source code, LLMReStructor"s restored control structures closely resemble the corresponding source code. Additionally, surveys assessing the readability of decompiled code from different decompilers have shown that code optimized by LLMReStructor is most favored by users. This novel approach underscores the integration of advanced language modeling techniques with decompilation processes, marking a significant advancement in reverse engineering by bridging the gap between machine-generated and human-readable code.]]></description>
<pubDate>2026/4/14 10:57:16</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Cao Ying,Liang Ruigang,xudandan@iie.ac.cn,Zhang Runze]]></author>
</item>
<item>
<title><![CDATA[IQR-Based Dynamic Defense Against Poisoning Attacks in Federated Learning]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202512090000002&flag=2]]></link>
<description><![CDATA[With the widespread adoption of federated learning in edge computing environments, defending against poisoning at-tacks on Non-Independent and Identically Distributed (Non-IID) data has become a critical challenge. However, existing defense schemes against poisoning attacks suffer from insufficient comprehensive protection capabilities and high computational complexity. To address this, this paper proposes an IQR-Based Dynamic Defense Against Poisoning At-tacks in Federated Learning (IQR-DDPA). The scheme adopts a "detection-trimming-noising" defense architecture and designs an IQR-based adaptive detection method for anomalous updates as well as a dynamic median-based model trimming and noising method. The IQR-based adaptive detection method introduces the IQR approach, which is robust to outliers and has low computational complexity, and incorporates historical training information to achieve adaptive de-tection of malicious client model updates. This maintains low computational overhead while adapting to Non-IID data distributions. The dynamic median-based model trimming and noising method introduces dynamic trimming and noise injection based on the median L2-norm of the filtered model updates from the current round, effectively suppressing re-sidual anomalous updates and directional attacks while providing the model with differential privacy protection. Theo-retical and experimental analyses show that the IQR-DDPA scheme achieves an average accuracy of 95.99% across vari-ous attack scenarios with a linear computational complexity of O(np), significantly outperforming baseline methods. It thus provides an efficient and comprehensive defense solution against poisoning attacks for edge intelligence environ-ments.]]></description>
<pubDate>2026/4/14 10:55:26</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Du Xue Hui,Hu Meng Die,Huang Bai Dong,Liu Ao Di,Wang Kai Yuan,Wang Na]]></author>
</item>
<item>
<title><![CDATA[A Blockchain-Based Isolated Searchable Encryption  Scheme in a Cloud-Edge-End Collaborative Framework]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202508200000001&flag=2]]></link>
<description><![CDATA[Under the cloud-edge-end collaborative architecture, the integration of blockchain and ciphertext retrieval is key to ensuring the secure sharing of sensitive Internet of Things (IoT) data. However, existing schemes still face multiple challenges, including semi-trusted edge nodes, centralized access control, and excessive computational overhead on terminal devices. To address these issues, this paper proposes a blockchain-based isolated ciphertext retrieval scheme under cloud-edge-end collaboration. To enhance system security and decentralization, the scheme utilizes a Blockchain Consensus System (BCS) to achieve decentralized key generation and real-time revocation. Concurrently, the scheme establishes a cloudedge-end computational model that offloads high-complexity encryption tasks to edge nodes, significantly reducing the computational overhead on terminals. Furthermore, to enable flexible authorization from any Data Owner (DO) to any Data User (DU), the scheme designs an isolated retrieval mechanism integrated with blockchain. The DO embeds a public index key into a search token, based on which the DU generates a trapdoor, thus supporting the extension of arbitrary search scenarios. Theoretical analysis shows that the scheme balances practicality, scalability, and security. Performance analysis indicates that our scheme provides an efficient solution for sensitive data sharing while guaranteeing data security.]]></description>
<pubDate>2026/3/20 9:03:05</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Huang Chuanlin,Liu Zhiquan,Miao Yinbin,Sun Wei,zheng kaifa,Zhou Junxu]]></author>
</item>
<item>
<title><![CDATA[High-security lossless image steganography based on Rossler chaotic system and integer wavelet transform]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202506260000002&flag=2]]></link>
<description><![CDATA[In the field of image steganography, existing high-capacity image-in-image methods often place too much emphasis on improving the visual quality of the stego image and embedding capacity. While these methods achieve significant gains in these areas, they tend to fall short in terms of lossless recovery of the secret image and the overall security of the embedded data. To address this issue, this paper proposes a secure and lossless image steganography method that integrates the R?ssler chaotic system with the Integer Wavelet Transform (IWT). This method combines the chaotic encryption of the secret image with the IWT-based process of embedding the ciphertext. During the encryption phase, a dynamic key generation system, based on " block integration + key," is developed, along with a multi-layer fusion encryption framework. This significantly increases the depth of encryption and enhances the overall security of the algorithm. To further improve the scrambling effect of the ciphertext image, an enhanced variable-step Joseph traversal algorithm is proposed. This method makes the traversal process more complex and unpredictable, effectively preventing attackers from deciphering the encrypted data. In the ste-ganography phase, part of the bit plane is used to embed the secret image using IWT, preserving the integrity of the eigen-value and improving the visual quality of the stego image. Additionally, a pixel value overflow processing mechanism is incorporated to ensure the lossless extraction of the ciphertext image. Experimental results show that this method improves the correlation coefficient of the ciphertext image by approximately 33% compared to existing algorithms, demonstrating strong resistance to statistical analysis. Despite achieving a high hidden capacity of 2 bpp and ensuring 100% lossless re-covery of the secret image, the stego image maintains excellent visual quality. Both theoretical and experimental analyses validate the effectiveness of this approach in ensuring the lossless recovery of the secret image and enhancing system secu-rity.]]></description>
<pubDate>2026/2/4 9:04:55</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenpeng,jiangweijin,liyi,tanlina,xiexiangyu,yangjifan]]></author>
</item>
<item>
<title><![CDATA[A Research Review on Privacy Detection in Visual Data]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202505150000002&flag=2]]></link>
<description><![CDATA[With the rapid development of social networks and the widespread adoption of portable image capture devices, a substantial amount of visual data generated in daily life is collected and shared on public platforms. However, while this visual data is broadly disseminated, its inherent privacy and security risks have become increasingly prominent. Since that visual data often contains personal privacy information, malicious use or leakage can easily lead to severe privacy breaches. To address this challenge, visual data privacy detection, serving as a crucial technical step in identifying and mitigating such risks, em-ploys deep learning models to analyze visual content, aiming to recognize potential privacy-sensitive regions or information within images and videos, thereby providing a necessary foundation for subsequent privacy protection mechanisms. As a result, research on visual data privacy detection has become an important research hotspot in the fields of computer vision and information security. This paper presents a comprehensive review of the current research status in visual data privacy detection. First, this paper points out the current situation where existing surveys on visual data privacy research lack cov-erage of privacy detection work. Then, it discusses the concept of privacy metrics and points out the lack of unified standards in this system, and deeply analyzes the characteristics of visual data privacy detection and the current research challenges. Subsequently, by reviewing recent research advances in the field of visual data privacy detection, this paper systematically analyzes existing visual privacy datasets, comparing their differences across multiple dimensions such as data scale and annotation granularity; and provides a systematic classification and detailed analysis of current visual data privacy detection methods, examining three technical approaches: visual content analysis, visual feature extraction, and multimodal infor-mation processing. Additionally, this paper explores the practical applications of visual data privacy detection technology in typical application scenarios such as social networks, surveillance videos, urban transportation, and targeted advertising. Finally, this paper summarizes the current research landscape in visual data privacy detection and outlines future develop-ment trends.]]></description>
<pubDate>2026/1/30 16:23:59</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CHEN Bingyuan,CHEN Hong,CHEN Tieming,LI Xingxing,LI Yinglong]]></author>
</item>
<item>
<title><![CDATA[Host Threat Detection by Integrating Data Provenance Graphs with Network Traffic]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202504250000001&flag=2]]></link>
<description><![CDATA[Host threats refer to attacks targeting hosts, such as viruses, trojans, worms, and malware, which can have a significant impact on the information security of Electric Power System. Currently, the mainstream approach in host threat detection research is to construct data provenance graphs (referred to as provenance graphs) based on host-generated logs for detection. In the context of host threat detection, a provenance graph refers to a directed acyclic graph constructed with system entities such as processes, files, and sockets of the protected host as nodes, and events as directed edges. When provenance graphs were initially applied to host threat detection, remote hosts connected to the target host via the network were simplified. Subsequent studies have mostly focused on the interactions among internal entities of the host while neglecting the importance of network traffic data. Moreover, many current studies rely on host threat event samples or expert knowledge for threat detection. How to effectively address emerging unknown attacks in the absence of these two factors is also an urgent issue that needs to be solved. To address these two issues, this paper combines network traffic data with host data and proposes a host threat detection system called Traffic Flow Provenance threat detector (TFProv). TFProv utilize heterogeneous provenance graph and zero-positive-learning to enable the detection of unknown threats. Experimental tests were conducted on data from three hosts subjected to different host threats, obtained from large public datasets, and compared with state-of-the-art methods. The results demonstrate that the proposed method achieved an average F1-score of 0.978 on the three hosts, consistently outperforming the state-of-the-art approach.]]></description>
<pubDate>2026/1/16 9:00:01</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[JIANG Zheyu,LI Xinpeng,LI Weixun,WANG Ming,WANG Zhiliang,ZHENG Feng]]></author>
</item>
<item>
<title><![CDATA[Machine Learning for Fuzzing: Current Status and Challenges]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202207180000001&flag=2]]></link>
<description><![CDATA[Software vulnerabilities are one of the main threats in cybersecurity. Timely vulnerability discovery and patching are important for cybersecurity. Fuzz testing is a dynamic software testing method. It proactively discovers vulnerabilities by providing large quantities of semi-random inputs to testing targets. Fuzz testing gains popularity since it"s conceptually simple, easy to deploy and very effective in vulnerability discovery. Fuzz testing is applied to various categories of software and discovers tons of vulnerabilities in them. However, naive fuzzing still suffers from energy waste in computing power allocation, requirement for expertise in parameter setting and labor intensive input format inference. Fuzzing campaigns produce large amount of data. Extracting and exploiting knowledge contained can improve fuzzing intelligence and reduce labor costs. Machine learning, especially deep learning, evolves rapidly in recent years and makes big breakthrough in areas such as pattern recognition and data generation. Thus more and more researchers try to overcome roadblocks in fuzzing with machine learning. This paper systematically surveys recent advances in machine learning applications for fuzzing. We highlight five subtasks suitable for applying machine learning from fuzzing workflow, namely input model inference, mutator inference, seed file scheduling, mutator scheduling and test case filtering. We introduce solutions in traditional fuzzing for each subtask and point out their deficiencies. Then we categorize and summarize related works applying machine learning from perspectives of algorithm employment and goals to achieve for each subtask. We analyze the popularity of different categories of machine learning algorithms and explain reasons behind. We discuss the design choices and typical solutions of dataset aquiring, data preprocessing, model training and model evaluation in related works. We introduce pass rate, an important evaluation metric in generation-based fuzz testing. We analyze evolvement of machine learning algorithms in certain subfields. Finally, we propose six promising directions for future research on applying machine learning algorithms in fuzz testing based on our analysis.]]></description>
<pubDate>2026/1/12 11:07:26</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenhongcheng,chenxiang,jishouling,mengguozhu,xianglu,yanqiucun]]></author>
</item>
<item>
<title><![CDATA[High-Capacity Text Steganography Using Information Transformation Strategy and Its Multimodal Extension]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202506110000001&flag=2]]></link>
<description><![CDATA[Due to the inherent characteristics and limited expressive dimensions of data carriers, traditional text steganography methods encounter significant challenges in effectively concealing high-capacity information within constrained textual spaces. These limitations often lead to problems such as insufficient embedding capacity, semantic distortion, and in-creased detectability, which in turn restrict the usability, robustness, and practicality of carrier-based text steganography techniques in real-world information security applications. To address these issues, this paper proposes a Hidden Infor-mation Transformation Strategy (HITS) based on text retrieval models and the Chinese Remainder Theorem (CRT). The proposed strategy transforms and distributes hidden information within the semantic space of carrier text, significantly improving embedding capacity and information security while maintaining the naturalness, fluency, and semantic con-sistency of the generated text. Building upon this foundation, a non-blind single-modal text steganography mechanism is designed by integrating positional encoding and synonym substitution techniques. This mechanism achieves high ca-pacity, strong concealment, and resistance to active attacks, enabling precise embedding and robust recovery of hidden information at both semantic and structural levels. It effectively balances imperceptibility, readability, and anti-analysis capability, ensuring that the steganographic text remains natural and resistant to detection or manipulation. To overcome the inherent limitations of single-modal steganography in terms of embedding capacity and security, the proposed mech-anism is further extended into a multi-modal steganography framework. By combining text-to-image generative models with several classical image steganography algorithms, including the Least Significant Bit (LSB) method, Discrete Cosine Transform (DCT), and Discrete Wavelet Transform (DWT), the framework achieves cross-modal semantic consistency and multi-level information fusion, thereby further enhancing embedding performance and resilience against statistical anal-ysis. Experimental results demonstrate that the proposed single-modal mechanism outperforms existing mainstream methods in terms of security, embedding capacity, and resistance to steganalysis, while the multi-modal steganographic carriers maintain high semantic coherence, exhibit stronger resistance to detection, and demonstrate broad potential for practical applications in secure communication and data protection.]]></description>
<pubDate>2026/1/4 15:25:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Yingquan,Li HuiFeng,Li Qianmu,Wu Xiaocong]]></author>
</item>
<item>
<title><![CDATA[FlowPatch: A Network Traffic Obfuscation Mechanism Based on Adversarial Patches]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202412110000001&flag=2]]></link>
<description><![CDATA[By leveraging deep learning–based traffic identification techniques, attackers can infer users’ encrypted network access behaviors, thereby compromising user privacy. However, existing defense methods suffer from high bandwidth overhead, difficulty adapting to black-box scenarios, and insufficient targeted perturbation capabilities. To address these challenges, we propose and implement FlowPatch, a network traffic obfuscation mechanism based on adversarial patches. FlowPatch introduces a network traffic image representation method to abstract network flows and designs a two-stage patch generation mechanism that balances obfuscation effectiveness and generation efficiency. This approach supports the strategy-based generation and injection of adversarial patches into network traffic, achieving targeted obfuscation of traffic features under black-box conditions. Evaluation on real network traffic data demonstrates that FlowPatch can achieve a targeted obfuscation success rate of 50%–96% and a identification evasion rate of over 87% across various network services, while keeping bandwidth overhead below 15%. Moreover, the adversarial patches exhibit strong transferability: when migrated to other deep learning models based on temporal features, targeted obfuscation is approximately 73%, with a identification evasion rate of about 97%.]]></description>
<pubDate>2025/10/17 9:40:32</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[dingke,xizongtang,xingchangyou,zhangguomin]]></author>
</item>
<item>
<title><![CDATA[Survey on Role-Based Access Control]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202504240000001&flag=2]]></link>
<description><![CDATA[The complexity of privilege management is always one of the most challenging issues in large-scale network systems. Role-based access control (RBAC) model has become the core technology of advanced privilege management by virtue of its simplicity, flexibility, and manageability, and has been widely used in enterprise information systems, cloud computing platforms, and the Internet of Things (IoT), etc. In recent years, with the growing demand for access control, a lot of research has been carried out in academia and industry around the RBAC model. In recent years, with the growing demand for access control, academia and industry have carried out a large number of studies around the RBAC model. In this paper, based on the systematic combing of the existing results, we analyze the current status and development trend of the RBAC model in depth. In this paper, we firstly review the basic structure and core mechanism of RBAC model from the theoretical point of view, and we also analyze its evolution process and main features in detail, so as to help the readers understand its inner principle clearly. On this basis, the paper focuses on the security policies involved in the RBAC model and the corresponding analysis techniques, and systematically classifies the different expression methods, which cover a wide range of modeling techniques from semi-formal to formal. Next, this paper focuses on the limitations of the RBAC model in complex systems, especially the challenges it faces in dynamic privilege management, context-awareness, cross-domain compliance, and intelligent evolution. Finally, combining with the development of artificial intelligence and blockchain and other emerging technologies, this paper looks forward to the future potential of the RBAC model in the direction of intelligent, adaptive and interpretable access control, and provides theoretical basis and technical guidance for the construction of a secure, trustworthy and efficient access control framework centered on the RBAC model.]]></description>
<pubDate>2025/9/17 16:53:09</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Hua-Lin,Chen Zhen,Guo Ji-Wen,Hong Zhong,Jiang Jian-Min]]></author>
</item>
<item>
<title><![CDATA[A Trusted Cross-Platform Live Migration Technology for Confidential Containers]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401300000001&flag=2]]></link>
<description><![CDATA[Confidential containers, which utilize hardware isolation and encryption through trusted execution environment technologies such as AMD SEV, can safeguard the data within the container when the operating system or runtime platform is untrustworthy. This enhances the overall security of the program. In the contemporary industrial landscape, confidential containers are gaining traction as emerging security technologies due to their wide-ranging application potential. As the industry undergoes advancements and evolution, there will likely be multiple confidential containers sharing a single confidential virtual machine. If the performance of this shared virtual machine falls short for multiple confidential containers, it becomes imperative to execute live migration on one or more of these containers. Traditional container live migration techniques, however, do not accommodate confidential containers because the memory state of these containers is encrypted. This makes existing migration methodologies unsuitable for direct application. While AMD SEV offers support for the comprehensive migration of confidential virtual machines, addressing the specific requirements of confidential container failure recovery, load balancing, and other applications remains challenging, especially when multiple confidential containers are housed within a single confidential virtual machine. To address this gap, this paper integrates the current state of confidential container technology and draws inspiration from the live migration strategies of ordinary containers and virtual machines. It introduces, for the first time, an infrastructure for cross-platform trusted live migration technology tailored for the cases when multiple confidential containers run within the same container runtime environment and proposes a novel technical approach for identifying individual container identifiers during the process of utilizing device drivers to handle requests. Building on this foundation, the paper presents a live migration methodology that aligns with this architecture. This paper presents a prototype of a confidential container live migration scheme, implemented on the AMD SEV-SNP platform and integrated into the CRIU framework. The scheme involves retrieving Virtio structures from confidential virtual machines running multiple confidential containers to obtain detailed information about the states of these virtual devices. This information is then saved on the source platform and restored on the target platform where the confidential containers are migrated. The evaluation of the proposed live migration scheme demonstrates its effectiveness, with experimental results indicating that it can successfully complete trusted live migration of confidential containers with negligible downtime.]]></description>
<pubDate>2025/9/17 16:51:39</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[GengZhaoyang,MinZhennan,WangWenhao]]></author>
</item>
<item>
<title><![CDATA[Conditional Code Dynamic Obfuscation Method based on Intel SGX]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211280000001&flag=2]]></link>
<description><![CDATA[The protection of intellectual property has practical significance for engineering applications and academic research, especially in the era of booming software industry. In recent years, many methods based on software obfuscation have been proposed to protect proprietary code from the threat of reverse engineering. Among them, control flow obfuscation and cryptography are the two most direct methods. Control flow obfuscation can hide control flow by means of transition conditions or branches, but it cannot prevent control flow from being inferred by analyzing the control flow context. The scheme based on the cryptography mechanism guarantees the confidentiality at static time by encoding or encrypting the executable file and decrypting it at runtime. But its ability to resist dynamic analysis is weak. The encryption granularity is too coarse, and the entire decrypted code is exposed in the memory, which is difficult to prevent memory dump attacks. The decryption function is not protected, and tracking the decryption function would threaten the security of the key. The trusted execution environment can effectively prevent dynamic analysis. CFHider is a method based on the trusted exe-cution environment to ensure the confidentiality of the program, which separates the control flow information from the program and transfers it to the Enclave, using the Enclave supported by Intel SGX. And it provides strong security guar-antees for control flow confidentiality, but it still has the problem of too small protection scope. This paper enhances CFHider and proposes a dynamic conditional code obfuscation method based on Intel SGX. Retains the basic strategy of decoupling the condition from the program and encrypts the condition code, further reduces the time exposure of the code in memory by re-encrypting the condition code at runtime. A variant of the unconditional branch is used to further obfuscate the control flow, and an instant generation mechanism of three-dimensional keys is proposed to ensure the security of keys. Theoretical analysis and experimental results show that the method in this paper effectively increases the complexity and confidentiality of the program, and introduces acceptable performance overhead.]]></description>
<pubDate>2025/9/5 8:32:49</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Du haichao,Guo xuan,Huang qingjia,Jia xiaoqi,QinTing,Song zhenyu,Wang ruiyi]]></author>
</item>
<item>
<title><![CDATA[Code Virtualization Protection Method Based on Sliding Window]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202110220000001&flag=2]]></link>
<description><![CDATA[With the vigorous development of the software industry, while the scale of software continues to expand, the soft-ware itself is facing increasingly serious security threats. Attackers can analyze the core algorithms and specific functions of the software through techniques such as reverse engineering to achieve the purpose of cracking the software. The commonly used software protection methods are too weak to effectively counter these analyses. As a new type of software protection method, code virtualization has been proposed in recent years. Its core is to virtu-alize the original instructions. The virtual instructions are interpreted and executed through a built-in custom inter-preter, combined with technologies such as code obfuscation and shell protection, which effectively increase the difficulty of static analysis. However, code virtualization also has some shortcomings. This article discusses the attacker’s reverse analysis techniques and various proposed code virtualization protection methods. It is believed that the existing methods still have coarse code encryption granularity and weak anti-dynamic analysis capabilities. In order to solve this problem, this paper proposes to take virtual instructions as the core of the entire protection method, and designs a sliding window-based code virtualization protection method to achieve a more fine-grained code encryption and decryption process. The entire sliding window model is composed of four states: decryption, execution, encryption and sliding, which cooperate with each other to realize the runtime protection of virtual in-structions. And use the method of integrity verification to realize the dynamic key generation mechanism and re-duce the possibility of key leakage. Theoretical analysis and experimental results show that the sliding window model improves the code encryption granularity, and the window size can be adjusted according to the situation. The method has less impact on the performance of the program. At the end of the experiment, the effectiveness of the model against attacks such as dynamic debugging, code injection, and memory dumping was also verified, and the proof method further increased the difficulty for attackers to understand semantics and reverse analysis.]]></description>
<pubDate>2025/9/4 16:08:50</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CHEN Jiayu,HUANG Qingjia,JIA Xiaoqi,TANG Jing,ZHANG Weijuan,ZHOU Mengting]]></author>
</item>
<item>
<title><![CDATA[Hidden Service Access Activity Recognition Based on Key Sequences Characteristics]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202112310000003&flag=2]]></link>
<description><![CDATA[The identification of hidden service access behavior in tor dark network is an effective way to deanonymize tor darknet users. The existing identification algorithms take the TCP packets sequence in the user access process as the input to extract the characteristics and construct the classification model, which has achieved good recognition effect. However, when applied in the actual scene with large-scale network traffic to be detected and high timeliness of online identification, the existing methods need to rely on a long sequence of traffic packets, which can not realize early identification, and the memory and computing resources required to maintain detection and identification consume a lot. To solve this problem, based on the detailed analysis of the circuit semantics and message distribu-tion of tor network protocol, this paper proposes an access behavior recognition method of tor hidden service based on key sequence characteristics, which only uses the specific interval TCP packet sequence with important semantic distinction in the early stage of access behavior as the input to extract the characteristics to construct the classifica-tion model. Compared with the existing methods, this method needs to rely on a shorter TCP packet sequence, which can effectively improve the identification timeliness and reduce the cost of hardware resources. In order to verify the effectiveness of this method, this paper constructs the experimental data set based on a variety of actual access scenarios, and finely labels the link message sequence interval of tor protocol level semantics. The experi-mental results show that among the six access scenarios in the two categories of tor network direct connection and confusion, the network message with the greatest contribution to distinguishing the hidden service access behavior and other behaviors in the dark network has a high degree of coincidence with the key TCP sequence extracted in this paper. It is verified that the key TCP sequence extracted in this paper has important semantic discrimination. Compared with the existing work, the classification model constructed by extracting features from this key TCP se-quence can improve the recognition accuracy and F1 value by 2% - 3%, improve the recognition timeliness by 27% - 51%, and reduce the length of input feature sequence of the recognition model by 78% - 95%.]]></description>
<pubDate>2025/9/4 16:07:59</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fang Binxing,Huang Wentao,Li Zeyu,Liu Jie,Shi Jinqiao,Tan Qingfeng,Wang Meiqi,WANG XUEBIN]]></author>
</item>
<item>
<title><![CDATA[RFCFuzz: An RFC-guided network protocol fuzzing method]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202112270000002&flag=2]]></link>
<description><![CDATA[Recent network protocol fuzzing methods usually adopt a generation-based black-box testing technique. These methods heavily rely on human effort to write configuration files that describe the network packet format each protocol may ac-cept, the mutating strategies chosen for each packet fields, as well as the strategies for monitoring abnormal behaviors during fuzzing. These methods also have difficulties in triggering deep vulnerabilities of network protocol implementations and monitoring implicit abnormal behaviors such as information leakage or authentication bypass during fuzzing. In this paper, we propose an RFC-guided network protocol fuzzing method (abbr. RFCFuzz). For a given protocol implementa-tion, our method extracts or deduces following information from its corresponding Request for Comment (RFC) standard documents, including information about each network packet format, information about relationships among packet fields or different types of packets, and the responding information when receiving a certain type of packet. Our method then uses the information to automatically generate a configuration file, choose mutation strategies for each packet field, and guide the monitoring of implicit abnormal behaviors during fuzzing. In this way, we alleviate human efforts spent on writing configuration file and improve the efficiency of triggering and monitoring deep vulnerabilities when fuzzing a net-work protocol implementation. Based on this method, we implemented a prototype named RFCFuzz@VARA for network protocol fuzzing and demonstrated its efficacy by applying it on 13 historical implementations of 3 popular network basic protocols, including Domain Name System (DNS), Dynamic Host Configuration Protocol (DHCP) and Border Gateway Protocol (BGP). Comparing with Boofuzz, a state-of-art generation-based fuzzing method, RFCFuzz@VARA improved the efficiency of detecting known vulnerabilities in these implementations by 17 times on average using the same config-uration files generated by our method. We have also found 3 unknown defects in the latest versions of three above-mentioned protocol implementations (i.e., Knot, NSD and Bird), respectively.]]></description>
<pubDate>2025/9/4 16:07:08</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CHEN Jingting,HUO Wei,LI Feng,LI Ping,XU Mingjie,zhouyi]]></author>
</item>
<item>
<title><![CDATA[Cryptographic API Combination Misuse Detection in Blockchain Infrastructure]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202403180000001&flag=2]]></link>
<description><![CDATA[The security of blockchain infrastructures is the foundation of the security of blockchain systems, and in blockchain infra-structures, cryptographic security is crucial. Due to the complex infrastructure of blockchain, cryptographic APIs are uti-lized in a variety of scenarios, leading to inevitable misuse during development and resulting in severe security conse-quences. Particularly, misuse arising from improper combinations of multiple cryptographic APIs has yet to receive atten-tion. Traditional cryptographic API detection tools fall into two categories: those based on predefined rules identifying vulnerabilities via static analysis, and those inferring correct rules from code changes through machine learning. The for-mer overlooks due to a lack of rules addressing combination use of cryptographic APIs, while the latter fails to derive combinations that have not yet been misused.To address these issues, this paper presents an automated extraction tech-nique for combination usage patterns of cryptographic APIs. It first extracts cryptographic API sequences and key param-eters based on data flow and control dependency analysis. Frequently occurring sequences are then identified as correct usage patterns through sequence pattern mining algorithms. Finally, the detection of combination misuse of cryptographic APIs is conducted in conjunction with parameter detection rules.We implemented a static detection tool, ComboGuard, to detect combination misuse of cryptographic APIs. In tests with a benchmark dataset composed of 20 real programs, our tool detected 18 out of 25 known combination misuses, with a false alarm rate of 31%, and identified an additional two unreported misuses. The traditional tool, CryptoGo, failed to detect these 25 misuses. In effectiveness tests on 120 block-chain infrastructure projects, our tool detected 22 combination misuses of cryptographic APIs, including four publicly re-ported and 18 unreported misuses.]]></description>
<pubDate>2025/8/14 15:23:31</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huowei,lifeng,xiaoyang,yaoyican,yuanzimu]]></author>
</item>
<item>
<title><![CDATA[Dual Attack with Side Information]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202104050000001&flag=2]]></link>
<description><![CDATA[The Learning with Errors (LWE) problem[1] is the most widely used problem in lattice-based cryptography and has been widely used in constructing lattice-based schemes. The study of the hardness of LWE is essential to analyze the security of these schemes. The primal attack and dual attack are the most common and effective attacks in the concrete security analysis of LWE[2]. In addition to the attacks in the concrete security analysis, in 2020, Dachman-Soled, Ducas, Gong et al.[3] pioneered a framework of using the information from side channel in the concrete security analysis and implemented it on primal attack, but they did not consider dual attack. Recently, the results of the studies on hybrid dual attack[4-7] show that in many cases (hybrid) dual attack is more effective than primal attack, so it is an interesting open problem to study using side information in dual attack. In this paper, we study this problem. We give approaches to exploit side information in dual attack and analyze their effectiveness. Specifically, four types of side information are considered, and their effect on the dual attack is mainly on the volume of the lattice – when the volume of the lattice decreases, the attack becomes easier. Each type of side information has a different degree of influence on the volume of the lattice, and the specific changes of the lattice volume by different side information are also given in this paper under certain assumptions. Based on the changes in the lattice volume, the final impact on the effectiveness of dual attack can be analyzed. For instance, under the classical BKZ-core-SVP cost model, the integration of each perfect hint into embedded dual attack reduces the concrete security by about 0.3 bits.]]></description>
<pubDate>2025/7/30 16:43:50</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[BI Lei,LU Xianhui,LUO Junjie,WANG Kunpeng]]></author>
</item>
<item>
<title><![CDATA[Network traffic application identification method based on automatic generation of domain name rules]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202412310000001&flag=2]]></link>
<description><![CDATA[Traffic classification is an important part of the network security system. Its accuracy and real-time performance are directly related to the network"s security protection capabilities and response efficiency. Application identification, as one of the important subtasks of traffic classification, aims to accurately map network traffic to specific application services, which is of great significance to improving the accuracy of network security detection, optimizing resource allocation, and responding to malicious traffic. In recent years, with the rapid development of artificial intelligence technology, many studies have applied machine learning and deep learning methods to traffic application identification tasks. Although these methods have excellent performance in classification accuracy, the reasoning delay problem caused by the high complexity of their models greatly limits their actual deployment in real-time scenarios that require low latency. To address this issue, this paper proposes a network traffic application identification method based on the automatic generation of domain name rules. Different from traditional methods such as port numbers or deep packet inspection (DPI), this method makes full use of domain name information in network traffic as an important feature for classification. This method first performs word segmentation on the domain name field of traffic data and then extracts structured features for model training. Then, by analyzing and quantifying the interpretability of the machine learning model, it automatically extracts and generates a set of domain name rules that can be used for application identification, and combines it with existing regular expression matching tools to achieve the effect of significantly reducing classification delay while maintaining high classification accuracy. After evaluating this method on a large number of network datasets, the classification delay was significantly reduced, 20-60 times lower than the machine learning method and a thousand times lower than the deep learning method, fully demonstrating the practical application potential of this research.]]></description>
<pubDate>2025/7/9 15:25:15</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[mengxiangshuai,oujinhu,qiukun,zhaojin]]></author>
</item>
<item>
<title><![CDATA[A Survey of Research on Attack Surface Obfuscation for Network Active Defense]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202404090000001&flag=2]]></link>
<description><![CDATA[The current attack surface of traditional networks has static and isomorphic characteristics. With the continuous outbreak of Advanced Persistent Threat (APT), the passive defense strategy based on "building high walls, plugging vulnerabilities, and patching" has further highlighted the security situation of "asymmetric attack and defense". Using the attack surface obfuscation technology, the defenders dynamically adjusts the position of the attack surface to enhance its deceptive nature, which has become an important method for the academic community to enhance the network""s active defense capabilities. Therefore, it is necessary to pay attention to the research results and development trends of constructing network active defense capabilities based on attack surface obfuscation. This paper first elaborates on the concepts of attack surface, network attack surface, and network attack surface obfuscation. Then, the network attack surface obfuscation technology is classified into three categories: attack surface dynamic transfer, deception attack surface simulation, and deception dynamic transfer. The research status and progress of various obfuscation methods are analyzed and summarized, and the evaluation methods of attack surface obfuscation technology are also summarized. Finally, the future research directions of attack surface obfuscation technology were discussed.]]></description>
<pubDate>2025/7/8 14:33:08</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[xuguokun]]></author>
</item>
<item>
<title><![CDATA[Robust Encrypted Malicious Traffic Identification based on Proactive Defense in Adversarial Environment]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202404150000001&flag=2]]></link>
<description><![CDATA[With the continuous development of network encryption technology, malicious attacks concealed within encrypted traffic pose serious challenges to network security. Consequently, deep learning methods have gradually been used to accurately identify encrypted malicious traffic, which helps cybersecurity defenders promptly detect and prevent malicious behaviors of attackers. However, inherent security flaws within the deep learning models have led to new security risks. By using adversarial learning techniques, attackers could mislead deep learning-based encrypted malicious traffic identification models to make wrong decisions by adversarial samples. Therefore, it is urgent to study the vulnerability of deep learning-based traffic identification methods and reinforce them. This paper proposes a proactive defense method combining adversarial perturbation removal and adversarial training to enhance the robustness of deep learning-based identification models and achieve accurate identification of encrypted malicious traffic in adversarial environments. On the one hand, AdvGAN is employed to generate adversarial samples targeting the objective models for constructing a mixed training data set. On the other hand, a denoising autoencoder is trained with noise-added samples to realize the function of reconstructing adversarial samples into clean ones. On this basis, adversarial training is conducted on the new models constructed by the denoising autoencoder in series with the original models. Extensive experimental results demonstrate that, in the adversarial environment, the proposed proactive defense method is more effective in improving the identification accuracy of deep learning models for encrypted malicious traffic compared to other singular defense methods, achieving the highest accuracy of 99.1%, with an improvement of 98.2%. Furthermore, in the non-adversarial environment, compared with some existing classical robustness enhancement methods, the proposed proactive defense method not only does not reduce but can even improve the identification accuracy of deep learning models for encrypted malicious traffic. Specifically, the LSTM optimized by the proposed method is 3.78% more accurate in identifying encrypted malicious traffic than the original LSTM.]]></description>
<pubDate>2025/7/8 14:32:33</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fan Zuwei,Liu Yinlong,Zhang Shunliang]]></author>
</item>
<item>
<title><![CDATA[Large Language Models Driving Cyber Security Threat Detection: Progress and Trends]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202402280000001&flag=2]]></link>
<description><![CDATA[In the context of the continuous evolution of modern science and technology, network security problems are becoming more and more serious. Advanced and persistent threat attacks are increasing, and the attack methods are becoming more and more hidden and complex. Rule-based and machine learning-based threat detection methods have been widely used in the past research on network security threat detection. However, they have many limitations in dealing with new and unknown threats. For example, rule-based detection methods rely too much on expert knowledge, and machine learn-ing-based detection methods need to manually extract and select features, which greatly consumes human and material resources. And the generalization ability of the model is limited. In recent years, large language models (e.g. GPT-4, BERT, PaLM) provide a new solution for network security threat detection, and show strong performance and potential especially in the context of large amounts of unlabeled data. This paper comprehensively explores the network threat detection technology based on large language model. Firstly, this paper summarizes the core tasks of network threat de-tection and deeply analyzes the challenges faced by each task, including network traffic anomaly detection technology, system log analysis technology, malware detection technology and threat intelligence analysis technology. Then, the general training and usage process of large language models and mainstream large language models were summarized, and the application and potential of large language models in network threat detection in recent years were analyzed in detail. These large language models can automatically extract complex features from a large amount of unlabeled mul-timodal data, and thus show strong performance in identifying malicious code, abnormal network traffic, etc. Finally, based on the current research progress, the challenges of large language models in the field of cyber threat detection are pointed out, such as privacy security issues and interpretability, and the future research directions are proposed.]]></description>
<pubDate>2025/7/8 14:31:48</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[cuisusu,handongxu,jiangbo,liujinhao,liuqixu,liuyuling,songzekai,zhengwen]]></author>
</item>
<item>
<title><![CDATA[Evaluation of Software Composition Analysis Tools for Java Language]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202310120000003&flag=2]]></link>
<description><![CDATA[As the Open Source Software (OSS) ecosystem continues to expand, the number of vulnerabilities increases, and dependencies become increasingly complex, security issues arising from OSS have become a growing concern. In response, Software Composition Analysis (SCA) tools have emerged. These tools can be categorized into various technical categories, with those targeting Java projects commonly utilizing package managers to identify Third Party Libraries (TPLs) and matching them against vulnerability databases to report potential vulnerabilities. Due to the limitations of existing technologies, many emerging tools are still inadequate in key performance such as TPLs identification and vulnerability identification. We employed a benchmark dataset manually annotated the vulnerable versions of 140 CVEs and constructed a benchmark dataset contained TPLs and reachable vulnerabilities of 38 projects. From multiple dimensions of vulnerability database accuracy, TPLs detection rate and vulnerability existence, empirical research is conducted on the effectiveness evaluation of six open source and one commercial SCA tools. The study focuses on quantifying the performance of Java language SCA tools in terms of effectiveness and usability while highlighting key challenges they face. The key findings are as follows: i) The accuracy of vulnerability libraries used by most tools is limited by data sources. OWASP and the commercial tool use more accurate vulnerability databases, achieving the highest F1 score of 69.3%. ii) Most tools use Maven to resolve TPLs. The F1 score for direct dependency identification ranges from 72.65% to 81.02%, with many direct dependencies being incorrectly reported as indirect dependencies. The F1 score for indirect dependency identification ranges from 23.27% to 30.84%, with many missed indirect dependencies being optional or introduced by them. iii) The actual reachability of vulnerabilities reported by the evaluated tools ranges from 21.46% to 44.72%. Tools should incorporate more vulnerability code characteristics to identify potential vulnerabilities and improve their usability.]]></description>
<pubDate>2025/7/8 14:31:10</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HUO Wei,NIE Zupei,PIAO Aihua,SHI Wenchang,Sun Dandan,SUN Qing,Xiao Yang,ZHOU Chenfeng]]></author>
</item>
<item>
<title><![CDATA[Research on Air Interface Interference Recognition Technology in Mobile Communication Networks Based on Cross-Layer Data Fusion Analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401280000001&flag=2]]></link>
<description><![CDATA[Due to the diverse interference signals in mobile communication frequency bands and the difficulty of feature extraction, the rapid and automated identification of activities such as unauthorized frequency use and malicious interference 
is challenging. The impact of interference signals on communication networks is difficult to assess accurately. This paper suggests methods to find air interface interference for uplink and downlink communication. It collects air interface data and base station measurement data. It constructs an interference recognition model, automatically identifies interference, and evaluates accuracy. This paper, at the terminal side, combines the advantages of signal feature extraction and deep learning. By extracting the time-frequency resource block (RB) occupancy features of signals, time-frequency resource block feature maps are constructed. Utilizing a semi-supervised learning model, Generative Adversarial Network (GAN), the study focuses on learning the normal time-frequency resource block occupancy behavior of mobile communication under regular communication scenarios. The trained model is then employed for accurate identification of interference signals, addressing challenges related to the difficulty of interference signal feature extraction and automated recognition. On the base station side, signal metrics such as Reference Signal Received Power, Reference Signal Received Quality, and Signal-to-Interference-plus-Noise Ratio, exported by the base station, are utilized. A Long Short-Term Memory (LSTM) autoencoder model is employed to learn normal signal patterns for interference detection. The paper also evaluates the impact of interference on communication networks. This method combines air interface data collection and base station measurement data, achieving the detection of six types of interference at the terminal side under normal voice and video business scenarios. Additionally, on the base station side, it achieves precise identification of fixed-frequency interference and assesses the impact of interference on communication networks. Experimental results demonstrate that the terminal-side method achieves an overall F1 score above 0.95 for the identification of the six types of interference. The base station-side method achieves an F1 score of 0.99 for the identification of fixed-frequency interference, surpassing single-class Support Vector Machine (OCSVM), Principal Component Analysis (PCA), and Isolation Forest (IForest) methods under equivalent conditions.]]></description>
<pubDate>2025/7/8 14:30:41</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Gao Zongning,Huang Jia,Li Xiaona,Meng Chen,Wei Dong,Zhang Shixiang]]></author>
</item>
<item>
<title><![CDATA[Combining Graph Neural Networks with Behavior Topology Maps For Malicious Container Detection Method]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202402010000001&flag=2]]></link>
<description><![CDATA[In recent years, with the rapid development of container technology, containers have played a crucial role in lightweight application deployment and efficient server resource scheduling. Despite their contribution to providing secure and lightweight runtime environments, the topic of container security is becoming more and more important, and malicious containers are emerging as a new threat. The accurate extraction of behavioral characteristics from malicious containers and their precise identification and classification have become a research focus in the field of cybersecurity. Current technologies primarily focus on container intrusion detection or anomaly monitoring. There is limited research on the analysis of malicious container behavior characteristics and the identification of malicious containers. Existing methods mainly detect specific types of malicious behavior within containers, resulting in a lack of comprehensive coverage and lower detection accuracy. To address these issues, this paper proposes a novel malicious container detection method com-bining graph neural networks with behavior topology maps. Specifically, the paper maps containers and system calls ex-tracted from dynamic analysis into a large heterogeneous graph, transforming the malicious container detection problem into a node classification problem solvable by a deep learning model. On this basis, "container-system call" edges are constructed, forming a container behavioral topology graph. To analyze and extract high-dimensional features from the container behavioral topology graph, the paper designs a container behavior feature recognition model based on graph attention network. It introduces a multi-head attention mechanism to enhance the feature learning capability of each layer of the graph neural network. The model iteratively generates node embeddings representing fused topological structures and node features. Finally, accurate behavioral graph embeddings are used to detect malicious containers. Experimental results demonstrate that the proposed method outperforms all state-of-the-art baseline models, achieving an overall classi-fication accuracy of 99.81%. It also attains a 99.61% accuracy in classifying malicious containers from unknown families, showcasing strong generalization capabilities.]]></description>
<pubDate>2025/7/8 14:30:06</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DU Haichao,DU Yuejin,JIA Xiaoqi,LI Yakai,LIU Puchun,TAI Jianwei,WANG Ruiyi,ZHOU Mengting]]></author>
</item>
<item>
<title><![CDATA[Multi-Party Collaborative Secure Inference Protocols for Vertically Distributed Feature Scenarios]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202312130000001&flag=2]]></link>
<description><![CDATA[In recent years, cloud-based neural network prediction services have become the dominant developmental trend in the artificial intelligence industry, with extensive application across a variety of scenarios. The rapid proliferation of this technology has been accompanied by a series of privacy concerns, such as the sensitivity of user data and the risk of model disclosure. Secure two-party computation protocols for inference provide solutions to these chal-lenges by safeguarding the confidentiality and integrity of information during computational processes. However, in multi-party applications with vertically distributed features, the potential for disparate technical standards, data formats, and processing protocols among clients intensifies the complexity and unpredictability of cross-platform and cross-organizational data integration and concurrent processing, with limited research addressing these issues to date. Addressing the aforementioned problems and challenges, this paper introduces VSecNN, a cooperative neural network inference protocol executed by a single server and multiple clients. For linear layers, the protocol employs homomorphic encryption to facilitate efficient matrix multiplication, while for non-linear layers, it inte-grates garbled circuits and oblivious transfer techniques to securely compute activation functions, with each layer’s results securely shared between the client and server via additive secret sharing. The protocol adheres to a two-phase paradigm that is relatively independent, concentrating the bulk of computational costs in an in-put-independent preprocessing stage, with the online phase necessitating only two rounds of interaction: one for the input of masked features and another for the output of inference results. Comparative experiments demonstrate that VSecNN significantly enhances efficiency and stability in the collaborative inference process within vertically dis-tributed feature scenarios, while substantially reducing system communication overhead and resource utilization, compared to solutions built upon the general MPC framework MP-SPDZ (ACM CCS""20). Further experimentation indicates that the method can accurately infer across all samples with minimal precision error (0.7%), marking a notable improvement in prediction accuracy over traditional two-party inference.]]></description>
<pubDate>2025/7/8 14:29:35</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DONG Ye,TANG Jinling,TANG Tao,XU Haixia,ZHOU Yinchang]]></author>
</item>
<item>
<title><![CDATA[Discussion on Identity Authentication in Internet of Things based on Blockchain]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202311160000002&flag=2]]></link>
<description><![CDATA[With the continuous expansion of the Internet of Things (IoT), the security issues faced by traditional identity authentication technologies are becoming increasingly prominent. These issues encompass challenges in unified management of identity information, malicious disclosure of user privacy, and the emergence of numerous novel attack threats. To address these challenges, a significant number of researchers have introduced emerging decentralized blockchain technologies into IoT identity authentication. As a result, they have designed distributed authentication architectures as substitutes for centralized ones, achieving authentication that is highly scalable, secure, and reliable. In response to the identity authen-tication security challenges encountered by the IoT in major industries such as smart homes, automotive, healthcare, and mobile communications, this paper presents a comprehensive review of existing blockchain-based identity authentication solutions for the IoT. Firstly, this study examines the key issues and security requirements faced by traditional IoT identity authentication technologies, focusing on identity information management and privacy protection. Secondly, based on the variations in the functioning of blockchain within IoT authentication systems, this paper categorizes and summarizes blockchain-based IoT identity authentication solutions from two perspectives: the storage medium for identity information and the consensus algorithms for authentication data. Specifically, the solutions are classified into three categories: deployment on underlying devices, single-layer cluster heads, and multi-layer cluster heads serving as blockchain miners. Additionally, the solutions are further classified into four categories based on the blockchain consensus protocols, namely Proof of Work (PoW), Proof of Stake (PoS), Byzantine Fault Tolerance (BFT), and other algorithms. Furthermore, we conduct a comprehensive comparative analysis to evaluate the strengths and weaknesses of these solutions. Subsequently, we elaborate on the security and performance achieved by these distributed authentication solutions, summarizing five key advantages demonstrated by blockchain in IoT identity authentication systems. These advantages include the elimination of single points of failure, assurance of data integrity, resilience against malicious attacks, encryption of data privacy, and enhancement of authentication efficiency. Finally, we conduct a comprehensive discussion on the existing deficien-cies of blockchain-based IoT identity authentication technology, encompassing four critical aspects: authentication effi-ciency, scalability, consensus optimization, and privacy protection. Moreover, we propose four promising research directions: the control of blockchain storage costs, the design of efficient consensus mechanisms, the integration of artificial intelligence assistance, and the evaluation of solutions in real-world environments.]]></description>
<pubDate>2025/7/8 14:28:57</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Cheng Di,Huang Weiqing,Kang Di,Li Jiacheng,Mao Rui,Wang Yan,Zheng Chonghui]]></author>
</item>
<item>
<title><![CDATA[Proofs of Linear Relations for Lattice Commitments]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401030000001&flag=2]]></link>
<description><![CDATA[Lattice-based commitment scheme is one of the fundamental cryptographic primitives in lattice cryptography. Its associ-ated opening proof and linear relation proof between the committed messages are important building blocks in the con-struction of lattice-based zero knowledge proofs and have been widely used in many applications. Currently, BDLOP commitment is the most frequently used lattice-based commitment scheme, in which the revealed short vector in the opening phase takes norm as a measurement. By taking the rejection sampling technique on the discrete Gauss-ian distribution, the zero knowledge properties in the opening proof and linear relation proof are achieved. In PQCrypto 2020, Tao et al. proposed a variant of BDLOP commitment, measuring the short vector in the opening phase with the largest singular value instead of norm. By the implementation of the rejection sampling technique on bimodal Gaussian distribution, they designed an opening proof for the variant. The obtained proof has a narrower desired distribu-tion and thus is much shorter in length. 

There are two results given in this paper. Firstly, in the research line with Tao’s, using the tighter upper bound on the largest singular value of matrices, we bring out a new variant of BDLOP commitment and present its corresponding open-ing proof. This new variant enjoys a weaker difficulty assumption and a shorter proof length. Secondly, considering the introduction of the bimodal Gaussian distribution based rejection sampling technique into proving the linear relation between the committed messages, we further design a linear relation proof for this variant with a much shorter length. For the above two results, the computation method and the concrete instances are given to take comparison on the size of the proofs.]]></description>
<pubDate>2025/7/8 14:28:21</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fang Dong,Hu Lei,Huang Chunzao,Huang Guifang,Yang Haonan]]></author>
</item>
<item>
<title><![CDATA[ExHyper: A Modularly Configurable SEV Extension]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401100000001&flag=2]]></link>
<description><![CDATA[With the development and popularization of cloud computing, the confidentiality of cloud tenant data has been increasingly emphasized. Hardware-based storage encryption technology is one of the powerful means to ensure data security. AMD has proposed the Secure Encrypted Virtualization (SEV) trusted execution environment solution, which encrypts the memory of cloud tenant virtual machines based on hardware, achieving selective encryption of memory areas of tenant virtual machines in a fine-grained manner, for example, by setting the c bit in page table entries (PTEs). Using AMD SEV can resist threats from cloud service providers" internal personnel or compromised malicious host systems attempting to snoop on cloud tenant data, making it an important means to ensure the confidentiality of cloud tenant data. However, AMD SEV regards all software systems outside the hardware, including the host system and hypervisor, as untrusted, and attempts to isolate the hypervisor outside the secure enclaves, which contradicts the original intention of the hypervisor to manage and handle virtual machines and their operations. Additionally, compared to the frequent occurrence of attacks, SEV hardware updates are costly and time-consuming, with relatively delayed version update speeds, making it difficult for SEV users to timely and effectively respond to newly emerging security threats. In response to these issues, this paper proposes a software-based, modularly configurable SEV extension called ExHyper to flexibly and quickly address security threats targeting AMD SEV. ExHyper uses a nested kernel architecture to protect itself as a software Trusted Computing Base (TCB) and provides users with interfaces to flexibly store sensitive code modules called PALs (Pieces of Application Logic). When faced with new threats, ExHyper can relatively quickly expand PAL modules as new security protection schemes, isolating and protecting PAL-sensitive code modules from malicious host system attacks. ExHyper uses the Core Root of Trust Measurement (CRTM) to provide its own security authentication and flexibly extends the trust chain to PALs.]]></description>
<pubDate>2025/7/8 14:27:49</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenjingqi,huangqingjia,jiaxiaoqi,tangjing,weiqiushi,zhangweijuan,zhouqihang]]></author>
</item>
<item>
<title><![CDATA[Review of explainable intrusion detection methods]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202311090000003&flag=2]]></link>
<description><![CDATA[Intrusion Detection Systems (IDS), as indispensable components in network security, have become increasingly vital due to the unprecedented surge in network data volumes. At present, machine learning approaches, especially those employing deep learning-based black box models, have emerged as significant focal points in the realm of IDS research owing to their unparalleled detection capabilities. However, the inherent opacity of these black box models and their susceptibility to gradient-based vulnerabilities obstruct users" understanding and trust in the models" decision-making processes. This situation urgently underscores the necessity for in-depth research into enhancing the explainability of black box IDS. This article introduces a formal definition of explainable IDS as sophisticated methods capable of providing detailed feature-level explanations and categorizes explanatory models into three distinct types based on the timing and manner of feature explanation: model-embedded, local model estimation, and counterfactual analysis, thereby offering a comprehensive framework for understanding and developing future explainable IDS(X-IDS) approaches. Drawing upon advancements in the field of explainable artificial intelligence (XAI) algorithms, this study meticulously selects 45 models deemed suitable for intrusion detection analysis. From each of the three categories of X-IDS methods, it identifies two emblematic methods, conducting a thorough comparative analysis of their effectiveness, robustness, and sparsity. This comparison elucidates the inherent strengths and weaknesses of each category, as informed by empirical results. Concluding, the paper explores the prevailing security and practical challenges encountered by current methodologies for X-IDS. In doing so, it aims to illuminate the complexities involved in implementing XAI within the realm of IDS, thus offering valuable insights and guidance for future efforts aimed at enhancing the transparency and reliability of IDS. This exploration is crucial for propelling the field toward more secure and interpretable cyber defense mechanisms, ensuring that the deployment of these systems meets the evolving needs of network security in an increasingly data-driven world.]]></description>
<pubDate>2025/7/8 14:27:14</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[li chen,tu bi bo,xu yang,zhang kun]]></author>
</item>
<item>
<title><![CDATA[Cyber Threat Intelligence Sharing: Opportunity and Challenge]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401120000001&flag=2]]></link>
<description><![CDATA[With the continuous evolution of the network attack and defense situation, the traditional security defense mode characterized by stacking security equipment and passive defense can no longer cope with the increasingly frequent and highly complex attacks, and the threat intelligence solution with the characteristics of “one point discovery, global sharing, cooperative linkage” has gradually been emphasized, and intelligence-driven dynamic defense has emerged as the prevailing method in security operations. It has also become an industry consensus that only wide-scale sharing of threat intelligence can realize its maximized value. In order to maximize the use of threat intelligence information, to solve the problem of information silos and flow restrictions faced by the current security field, there is a pressing need to research the sharing and exchange of threat intelligence. This paper focuses on reviewing the literature and industry achievements related to threat intelligence sharing over the past five years, drawing from previous threat intelligence sharing review articles. It combines these findings with the latest developments to present a comprehensive analysis. The paper rearranges and summarizes the fundamental concepts of threat intelligence, while highlighting the recent contributions of academia and industry in six specific areas of threat intelligence sharing. This paper specifically focuses on conducting an in-depth analysis of the common problems encountered in threat intelligence sharing. It provides a thorough examination of the nature of these problems, summarizes the latest research methods and solutions tailored to address them, and carries out a meticulous comparative analysis of similar approaches and solutions. Finally, the paper provides an outlook on the future research direction and development trends in threat intelligence sharing, which is based on thorough analysis of problems and the limitations of current research solutions, hoping to provide a valuable reference for future researchers and offer more effective guidance and suggestions for the industry.]]></description>
<pubDate>2025/7/8 14:26:26</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[dai guangxiang,peng xuanye,wang peng,wu pengyi,zhai lidong]]></author>
</item>
<item>
<title><![CDATA[Automated App Forensics Based on Multi-Agent]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202502230000001&flag=2]]></link>
<description><![CDATA[With the widespread use of mobile devices, malicious applications on mobile platforms have become increasingly diverse, making manual digital forensic no longer feasible. To address the shortage of experts in fields such as cybercrime investigation and judicial identification, where APP forensic work is challenging to conduct, many researchers have proposed methods combining static template matching, deep learning techniques, and APP forensics. However, these methods also face challenges, existing APP forensic approaches are typically merely auxiliary tools for human digital forensic analysts, lacking autonomous forensic capabilities. Recently, large language models (LLM) have demonstrated remarkable capabilities in various domains such as machine translation and code generation, and agent technologies relying on LLM have shown strong task execution abilities. Therefore, this paper proposes a novel approach integrating multi-agent collaboration with automatic APP forensics, leveraging the excellent text understanding and tool calling capabilities of LLM to present an efficient, accurate, and training-free method for automatic APP forensics. The method first unpacks and restores the program code of the Android application package (APK) under investigation, embedding it into a vector database to enable the LLM to comprehend the code information of the APP, actively searching for code required for forensic analysis. Simultaneously, a hybrid approach combining static and dynamic forensics is adopted, where the LLM autonomously performs dynamic analysis based on its understanding of static information. Additionally, the method employs a chain-of-thought prompting strategy to further enhance the forensic capabilities of the LLM. Most importantly, due to the requirement for explainability in electronic evidence, this paper designs a dual reflection mechanism for the large model, achieving improved explainability and reduced hallucinations with minimal additional overhead. Even when the development framework or updates of the application change, the method"s scalability and modular design ensure timely updates to forensic techniques. To evaluate the forensic performance of the method and address the lack of an APP forensic dataset, this paper constructs an automatic APP forensic dataset based on recently publicized digital evidence competition materials, open-source malicious samples from the internet, and real criminal APPs provided by the police. Experiments conducted on this dataset validate the effectiveness of the proposed method, highlighting its advantages in autonomous decision-making and explainability. Experimental results show that the method achieves a forensic accuracy of 84.5% with an average forensic time of only 125.3 seconds, while the existing framework Quark-engine attains an accuracy of merely 34.5% and an average forensic time of 261.0 seconds. The proposed method not only performs well in digital forensic competitions but also efficiently and cost-effectively extracts routine electronic evidence from criminal APPs provided by the police.]]></description>
<pubDate>2025/6/12 16:22:16</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Gao Jian,li xiaolin]]></author>
</item>
<item>
<title><![CDATA[A General Data Augmentation Method for Deep Learning Based Side-Channel Analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202402090000001&flag=2]]></link>
<description><![CDATA[Data augmentation methods can construct more accurate deep learning models without increasing the number of acquired training samples, thereby improving the technical effectiveness of deep learning based side-channel analysis. Nonetheless, the selection of parameters for current data augmentation techniques is predominantly dependent on specialized expertise and is tailored specifically to datasets associated with certain cryptographic algorithm implementations. Consequently, developing a universal data augmentation strategy that is versatile across various cryptographic algorithm implementations and capable of adaptively choosing augmentation parameters holds significant practical value. In this study, we introduce a comprehensive data augmentation approach designed to address this challenge. This method is structured around three core components: a controller employing the simulated annealing algorithm, a data augmentation module that leverages a sophisticated combination of augmentation techniques, and an attack evaluation module that generates feedback in the form of cost metrics. We validated the efficacy of this innovative approach through comparative experiments on widely recognized datasets in the domain of side-channel analysis, focusing on unprotected software and hardware AES implementations, as well as AES software implementations fortified with random delay and masking techniques. Our analysis, utilizing deep learning for side-channel attack investigation, confirmed the superior performance of our proposed universal data augmentation method across various scenarios. Specifically, in the case of the AES_HD, DPA v4, and ASCADf datasets, across five different settings with N=0, N=50, and N=100, we observed reductions in Measurements To Disclosure (MTD) by 21%, 25%, 24%, 48%, and 5%, respectively, when compared to DL-SCA approaches without data augmentation. Moreover, in four distinct scenarios across the AES_HD, DPA v4, and ASCADf datasets with N=0 and N=50, the MTD was reduced by 22%, 40%, 10%, and 30%, respectively in comparison to DL-SCA with SOTA data augmentation methods.]]></description>
<pubDate>2025/4/29 11:16:12</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[qiao ze hua,qiu xin kuan,zhang qian,zhao jing lin,zhou yong bin]]></author>
</item>
<item>
<title><![CDATA[A Secure and Compact AES Hardware Design Using BRAMs Based on Merging T-Tables]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202307110000003&flag=2]]></link>
<description><![CDATA[Designing hardware ciphers that simultaneously satisfy with small area, high throughput and resistance to side channel attacks on resource-constrained devices has always been a highly challenging task. To address this challenge, we propose a secure and compact AES hardware design method using BRAMs based on Merging T-Tables. In term of security, we employ sensitive intermediate value manipulating technique based on BRAM internal Flip-Flops and simplify the output design of BRAM internal latches, which increases the key guess space from 2^8 to 2^32, reducing the dependence of BRAM leakage and sensitive information. In term of compactness, we develop a shared round function design and a shared key schedule function design for encryption and decryption based on Merging T-Tables, which increases the BRAM memory utilization rate from 1/9 to 8/9, reducing the number of BRAMs and the number of decryption key schedule cycles. We develop a reference implementation of MB-AES that does not require random numbers. This implementation takes into account both security and compactness. It achieves throughputs of 1,636 Mbps, 2,345 Mbps, 2,673 Mbps respectively with 845 LUTs + 8 BRAMs, 649 LUTs + 8 BRAMs, 711 LUTs + 8 BRAMs resources for encryption and decryption on Spartan3E, Virtex5 and Kintex7 device. To evaluate the security of our MB-AES implementation on SAKURA-X development board, we conduct CPA/CEMA attacks using 1 million power/electromagnetic traces according to the evaluation methods of Standards. The experiment results show that the guess entropy is 100.4 and 81.6 for the MB-AES implementation. Additionally, we convert BRAMs and random numbers into equivalent LUTs numbers to compare the compactness of MB-AES with other AES hardware implementations. The results indicate that the compactness of MB-AES is 84.86 Kbps/LUT, 463.19 Kbps/LUT, and 502.54 Kbps/LUT on Spartan3E, Virtex5 and Kintex7 devices, re-spectively. These values are 1.53, 2.73 and 2.30 times of the known most compact AES hardware implementation ISWRTF-AES.]]></description>
<pubDate>2025/4/29 11:15:33</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[gao yi wen,liu yue jun,qiu shuang,zhang qian,zhao jing lin,zhou yong bin]]></author>
</item>
<item>
<title><![CDATA[Review on Detection Technology of VM Lateral Movement Attacks]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202304190000001&flag=2]]></link>
<description><![CDATA[Cloud computing, built on virtualization technology, offers a service model that enables flexible scalability and central-ized sharing of physical resources such as computing, storage, and networking among multiple tenants. While the central-ization of cloud computing consolidates business operations and data, it also concentrates security threats that were pre-viously distributed across independent physical nodes. Consequently, the unique characteristics of cloud environments, including the co-location of virtual machines (VMs) sharing underlying physical resources and the predominant flow of "east-west" network traffic, give rise to a new security threat known as virtual machine lateral movement attacks. This paper analyzes the vulnerabilities of virtual machine lateral movement attacks exposed by the new characteristics of cloud environments and provides a comprehensive summary of virtual machine lateral movement attacks. It delves into the root causes of virtual machine lateral movement attacks and proposes a threat model for virtual machine lateral movement attacks. Based on the threat model, virtual machine lateral movement attacks are categorized into three clas-ses: Cross-VM Side Channel Attacks (SCA), VM Distributed Denial of Service (DDoS) Attacks, and Virtual Machine Es-cape Attacks. Then a summary was made of the detection techniques for these three classes of lateral movement attacks. The summary points out that there are multiple types of lateral movement attacks in the current virtual machine envi-ronment, with constantly evolving attack methods, while the detection techniques still have many shortcomings. Effec-tively addressing these attacks to ensure cloud computing security is a pressing issue that needs to be resolved. In the cloud environment, continuous research into new technological means, exploration of more advanced detection methods, and constant improvement of existing detection and defense measures are necessary to achieve more comprehensive, efficient, and accurate detection of lateral movement attacks in virtual machines. Considering the technical challenges associated with the detection techniques for lateral movement attacks in virtual machines, this paper discusses the future research directions for the detection techniques of lateral movement attacks in virtual machines. This paper presents re-search prospects for achieving a loosely-coupled and systematic intrusion detection system for virtual machines in order to better ensure the security of cloud environments.]]></description>
<pubDate>2025/4/29 11:14:53</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[lichen,tubibo,xuyang,zhangkun]]></author>
</item>
<item>
<title><![CDATA[Characterizing and Detecting the File Permission Bugs in Distributed Systems]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202209150000001&flag=2]]></link>
<description><![CDATA[File is the most commonly used storage carrier during the operation of a system. Because the file contain sensitive infor-mation, system software usually needs to set strict permissions for files. However, in a distributed system, components launched by different users may access the same file. Developers may make mistakes in setting file permission, visitor, and path, resulting in file permission bugs. File permission bugs can cause serious damage to distributed systems, such as the failure of user requests, leakage of sensitive information, or even causing cluster downtime. In this paper, we focus on file permission bugs in distributed systems and collect 130 file permission bugs from 15 widely used distributed systems. The five factors that lead to file permission bugs are summarized as wrong user, wrong path, strict permission, loose per-mission, and ambiguous permission. The root causes and effects of file permission bugs are systematically studied through detailed bug analysis. In this paper, we find that ambiguous permissions account for the largest proportion of file permission bugs and have a broad impact. Ambiguous permissions can lead to not only resource inaccessibility caused by strict permission, but also resource leakage caused by loose permission. Therefore, in this paper, we design a targeted de-tection method based on the characteristics of file permission bug. A static ambiguous file permission detection tool named MFPChecker (Missing File Permission Checker) is developed. MFPChecker can effectively detect flaws where file permissions are not explicitly set in the system. Experiments on ten systems show that MFPChecker can detect 73.9% (17/23) old bugs and 769 new bugs with a false positive rate of only 5.7%. Of these, 14 have been confirmed by the open source community and 7 have been fixed by patches submitted by us, These bugs were fixed in a way that was accepted by the developers.]]></description>
<pubDate>2025/4/29 11:14:09</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Gong Xiaorui,Guo Qingli,Zhang Dongsheng,Zhao Beibei]]></author>
</item>
<item>
<title><![CDATA[Constrained Pseudorandom Functions: Discussion of Definitions and A Verifiability Construction]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202307220000001&flag=2]]></link>
<description><![CDATA[Pseudorandom Function (PRF) is one of the basic primitives in modern cryptography, is represented by a key space, a domain space and a range space. One party selects a secret key randomly from the key space, and calculates a PRF output for any point in the domain. In order to meet the increasingly rich security or application requirements, scholars have started to study the extensibility of PRF, that is, adding some additional features on the basis of PRF. In this paper, we focus on the study of Constrained PRF (CPRF), that is, a party in possession of a PRF secret key can generate a constrained key for some subset of the domain, which can be authorized to a third party to compute the PRF output at all points in the subset!
Specifically, our research is divided into two aspects. Firstly, the definition of CPRF is discussed from four aspects: the constraint category, correctness, security and additional properties, and some controversial issues are emphatically answered, such as whether the Functional PRF can be replaced by CPRF, and whether the security of one challenge is equivalent to the security of multiple challenges. Secondly, the Constrained Verifiable Random Function (CVRF) is studied, and a semi-adaptively secure construction of CVRF is proposed. It is worth noting that the known CVRF constructions, either satisfy weak security such as the selective-challenge security; Either it satisfies stronger security, such as semi-adaptive security or adaptive security. Unfortunately, the proofs satisfying the stronger security are all non-compact reductions and support relatively limited classes of constrained sets. While the construction in this paper not only satisfies the stronger security, that is, semi-adaptive security, but also has compact security reduction proofs and supports any effectively represented constrained sets.]]></description>
<pubDate>2025/4/29 11:13:38</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Li Hongda,Liang Bei,Meng Xianning,Zan Yao]]></author>
</item>
<item>
<title><![CDATA[A Survey on Privacy-preserving Neural Networks Based on Homomorphic Encryption]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202305060000001&flag=2]]></link>
<description><![CDATA[Deep learning, as a machine learning method based on neural networks, has achieved unparalleled success in various fields, including image processing, speech recognition, and natural language processing. In contrast to other neural network technologies, deep learning models are known for their complexity and scalability, enabling effective modeling of large-scale data and delivering exceptional performance in real-world scenarios. However, it"s important to note that obtaining high-quality deep learning models often demands substantial expertise and computational resources. Fortunately, with the widespread adoption of cloud computing, cloud servers offer robust computational capabilities to facilitate the utilization of such neural network technologies in tackling complex tasks and processing data. In this context, the "Machine Learning as a Service" came into being. However, a series of data security issues also follow. For example, if the client uploads local unencrypted data to the cloud server, the data access control will be lost, resulting in potential privacy leakage risks. Therefore, a growing number of privacy protection acts strictly prohibit businesses or organizations from collecting, distributing, and using user data. Homomorphic encryption, as a promising privacy-preserving technique, provides the ability to compute directly on encrypted data. Homomorphic encryption-based privacy-preserving neural network allows an untrusted third party to process the data without decrypting it, thus protecting the client"s sensitive information from being leaked. Therefore, how to efficiently implement homomorphic encryption-based privacy protection neural network has become an important hot research direction. Through the investigation of existing research work, this paper deeply analyzes the problems and challenges faced in the neural network reference and training implementations based on homomorphic encryption, and summarizes the combination method of neural network and homomorphic encryption and related optimization implementation. Finally, this paper summarizes the key challenges and future research directions in privacy-preserving neural network applications based on homomorphic encryption.]]></description>
<pubDate>2025/4/29 11:01:00</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chengjiahao,hourui,mengdan,wangzhiwei,zhaolutan]]></author>
</item>
<item>
<title><![CDATA[Identification of Influential Nodes in Complex Networks with Differentiated Propagation and Aggregation]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202311150000002&flag=2]]></link>
<description><![CDATA[As information systems continue to evolve, computer network autonomous systems are becoming increasingly complex, encompassing a diverse array of network roles. This growing complexity introduces fresh challenges concerning network security and performance. Notably, complex networks, which have demonstrated their significance in various fields like power grids and social networks, form the foundation of computer networks. The analysis of key nodes within computer networks and the customization of security measures play pivotal roles in predicting the spread of viruses, detecting ab-normal traffic patterns, and optimizing network performance. Existing methods for identifying key nodes encompass de-gree-based approaches, gravity model-based methods, and graph convolution network-inspired techniques. However, these methods often exhibit limitations, such as low identification accuracy, inadequate ranking resolution, and limited applicability. Drawing inspiration from the information aggregation techniques in graph convolutional networks (GCN), we introduce KSDPA, a novel method for information aggregation based on K-Shell values. K-Shell incorporates global net-work information, while our approach engages in both global and local impact analyses across 2R iterations. The first R rounds stratify nodes based on their importance, while the subsequent R rounds further stratify and rank nodes within each layer. Extensive experimentation conducted across 16 real networks underscores the efficacy of our approach. KSDPA excels in terms of accuracy within 13 of the 16 networks and achieves superior ranking resolution in 12 of them. In comparison to the EHCC method, our approach boosts accuracy by 5% while outperforming the DGCM+ method in ranking resolution. In conclusion, our research underscores the increasing complexity of computer network systems and the significance of identifying key nodes for network optimization and security. The KSDPA method offers a substantial improvement in accuracy and ranking resolution, showcasing its potential for enhancing network analysis and perfor-mance. Furthermore, we present a detailed analysis of a computer network topology and provide our recommendations for further research and development in this domain.]]></description>
<pubDate>2025/4/29 11:00:06</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenfansong,linweicheng,liuyongji,sunlimin,zhuhongsong,zhuboyuan]]></author>
</item>
<item>
<title><![CDATA[A Survey of evasion malware detection methods]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401040000002&flag=2]]></link>
<description><![CDATA[Evasive malware is a kind of malware with the ability to evade or resist analysis. With the continuous game of attack and defense technology, the evasion techniques used by malicious code show a trend of diversification and concealment. Conventional security measures such as debuggers and sandboxes cannot effectively detect evasion malware. In order to defend against the growing and evolving evasion malware, academia and industry have proposed a variety of effective detection methods to support the rapid discovery of evasion malware. This paper focuses on the characteristics of evasion malicious code and the pain points of detection difficulties, and studies the existing evasion strategies and detection methods. Firstly, the concept and characteristics of evasive malicious code are summarized. By analyzing the evasive strategies used by different families, the common evasive technologies of malicious code are condensed. These evasive strategies include traditional static evasive technologies such as obfuscation, encryption, and shelling, artificial intelli-gence-assisted evasive methods, as well as dynamic evasive methods such as anti-virtualization, anti-debugging, time-based attacks, and resource-based attacks. Subsequently, this paper takes evasive malicious code as the research object and conducts research around the detection methods of evasive malicious code. The latest progress and research results in the field of evasive malware detection are summarized from two aspects of static detection and dynamic detec-tion. The detection technology based on virtual machine introspection, the detection technology based on dynamic binary, the detection technology based on bare metal, and the application scenarios, advantages and limitations of auxiliary methods such as fingerprint camouflage are discussed. In addition, in order to achieve more efficient evasion malware detection, this paper also discusses the main challenges and future research directions of evasion malware detection, in-cluding malware enforcement analysis technology, detection technology based on fingerprint generation, detection tech-nology based on artificial intelligence, and analysis technology based on dynamic time series.]]></description>
<pubDate>2025/4/29 10:58:43</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Zhengcai,Du Haichao,Jia Xiaoqi,Xie Yamin,Tang Jing,Yan Kuihao]]></author>
</item>
<item>
<title><![CDATA[A Review of Homomorphic Encryption-Friendly Symmetric Cryptographic Algorithms]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202306300000001&flag=2]]></link>
<description><![CDATA[This review provides a comprehensive evaluation of homomorphic-friendly symmetric encryption algorithms in hybrid homomorphic encryption schemes. It discusses the background and significance of these algorithms and their application requirements. The review describes in detail the hybrid frameworks based on block ciphers and stream ciphers, as well as the Real-to-Finite Field (RtF) transformation framework. It delves into the integration of symmetric encryption algorithms with homomorphic encryption algorithms in these hybrid schemes, aiming to achieve efficient and low-communication hybrid encrypted outsourcing computations. The review focuses on the characteristics of homomorphic-friendly symmetric encryption algorithms, such as low multiplication complexity and multiplication depth, which are essential for their suitability in hybrid homomorphic encryption schemes. It provides a comprehensive exploration of these algorithms, covering their linear and non-linear components and discussing how they enable efficient homomorphic implementations without increasing the computational burden on the client. Furthermore, the review implements and compares selected homomorphic-friendly symmetric encryption algorithms in the same environment, analyzing their performance on both the client and server sides. The results clearly demonstrate the significant performance advantages of these symmetric encryption algorithms over traditional symmetric block ciphers. In conclusion, this review aims to provide readers with a comprehensive understanding of homomorphic-friendly symmetric encryption algorithms and their applications in hybrid frameworks. It serves as a valuable reference for practical applications and future research in the field of homomorphic encryption.]]></description>
<pubDate>2025/4/24 15:21:11</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Li Yongqiang,Liu Fen,Wang Mingsheng]]></author>
</item>
<item>
<title><![CDATA[A Survey of Implementation Security of LWE-based Key-establishment Algorithms]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202305250000001&flag=2]]></link>
<description><![CDATA[With the rapid development of quantum computing, especially shor"s algorithm and large-scale quantum computers, discrete logarithm problem and large integer factorization problem are thought to be resolved in about 20 years, which are computationally infeasible by traditional computers. It means that many public-key cryptosystems widely used now, including RSA and elliptic curve cryptosystems, would be no longer secure by then. As a result, algorithm design and security research of post-quantum cryptography have become a new and quite urgent problem that the world needs to face together. Many researchers have begun to work on public key cryptography algorithms resistant to quantum computing, and many countries and international organizations have carried out corresponding standardization work. As we all know, mathematical theory based on a variety of difficult mathematical problems ensure the theoretical security of post-quantum cryptographic algorithms. However, theoretical security of cryptographic algorithms does not guarantee the implementation security. Actually, post-quantum cryptographic algorithms are vulnerable to side-channel attacks in specific implementation and application scenarios, which seriously threatens the implementation security. Now, there are several post-quantum cryptographic algorithms have been proposed, including lattice-based cryptosystems, hash-based cryptosystems, code-based cryptosystems, multivariate cryptosystems and isogeny-based cryptosystems. Among them, lattice-based cryptosystems have become the most concerned post-quantum cryptosystem due to its great efficiency and concurrency. In this paper, we systematically investigate the attack points and attack methods of lattice-based cryptographic components, including Fujisaki-Okamoto transformation, error correcting codes, polynomial multiplication and error sampling, to analyze the side-channel security risks when implementing LWE-based key encapsulation schemes.Furthermore, we summarize the protection strategies against the existing attack points and attack methods in detail. Finally, according to the existing attack points, attack methods and protection strategies, the potential analysis methods and defense schemes have been discussed. This work provides a basis for the design, analysis and evaluation of secure lattice-based post-quantum cryptography algorithms.]]></description>
<pubDate>2025/4/24 11:12:57</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[dujianfeng,wangzhu]]></author>
</item>
<item>
<title><![CDATA[A differential-linear attack of Lightweight Cipher Schwaemm]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202212070000004&flag=2]]></link>
<description><![CDATA[Sparkle is one of the winning algorithms in the third round of LWC. Its algorithm family includes the authenticated encryption algorithm Schwaemm, the hash function Esch and extendable-output function, all of which use the Sparkle permutation designed based on the ARX structure Alzette. The designer Beierle et al. used data trade-off attack and guess and determine attack, and gave 3.5 rounds of analysis results for the initialization algorithm of the authentication encryption algorithm Schwaemm128-128/192-192/256-256, and gave 4.5 rounds of birthday differential attack results of Schwaemm128-128/192-192/256-256, but because the 4.5 rounds of attack complexity is too large, it is not an effective attack. This paper presents a 4-round differential-linear trail of Sparkle256, and performs distinguish attack and key recovery attack on the initialization algorithm of Schwaemm128-128. First, a 4-round difference-linear trail model is given through theo-retical analysis. Then, using the Matsui’s search algorithm combined with the middle trail calculation algorithm, a 4-round difference-linear trail conforming to the model is obtained. Finally, calculate the probability for the 4-round difference-linear trail. When the round constant is c[0], we use the differential trail value calculation algorithm, 192 pairs of nonces are obtained so that the probability of the 4-round difference-linear trail being established is 2^-6. The experimental results show that when the round constant is c[0], the success probability of distinguishing attack on the initialization algorithm of Schwaemm128-128 for four rounds is 98.5%, and the key recovery attack on the initialization algorithm of Schwaemm128-128 for 4.5 rounds has a 12-bit advantage, and the success probability is 77.0%. However, the input to the Schwaemm128-128 contains a 128-bit key, and the designers claim a security bit of 120 bits. Our research shows that security bit of the initialization algorithm of Schwaemm128-128 with 4.5 rounds is less than 116 bits when the round constant is c[0].]]></description>
<pubDate>2025/2/26 9:30:38</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LIU Meicheng,XIONG Zhicheng]]></author>
</item>
<item>
<title><![CDATA[A Fine-Grained Cache Side-Channel Attack Detection Method for Cloud Environment]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201190000001&flag=2]]></link>
<description><![CDATA[With the gradual growth of cloud computing market share, cloud security has been paid more and more attention by researchers. In order to improve the utilization efficiency of resources in cloud environment, virtualization technology is used to integrate and allocate the underlying resources. Therefore, there are a large number of shared resources between virtual machines, which makes the cloud platform vulnerable to side channel attacks. Cache side channel attacks are a kind of side channel attacks which have wide attack range, many attack variants and do great harm to victims. Attack detection is an important part of defense work, even as a preparation of other defense methods. Although many researchers have done research on the cache side channel attack detection, there is little research on the cloud environment, and the existing cache side channel attack detection methods have some problems, such as poor anti-interference, too coarse detection granularity and so on. In order to solve these problems, through the analysis of typical cache side channel attacks, this paper proposes a cache side channel attack detection method based on instruction monitoring. This detection is implemented based on virtualization technology, and combines anomaly based and feature-based detection methods. It can detect a variety of cache side channel attacks at the process level. It is worth mentioning that this method does not need to modify the underlying hardware and the upper-level virtual machine, so it is transparent to tenants. In this paper, an attack detection system is implemented by using this attack detection method in the cloud platform based on KVM. Experiments show that the impact of the operation of the cache side channel attack detection system on the performance of normal cloud services is basically controlled within 5%, and the detection system can maintain the target detection effect even under different loads.]]></description>
<pubDate>2025/2/17 10:31:46</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HUANG Qingjia,JIA Xiaoqi,LING Yuqing,QING Haoxiang,TANG Jing,WANG Ruiyi,YAO Wentao,ZHANG Weijuan]]></author>
</item>
<item>
<title><![CDATA[A Method for Calculating Behavioral Risk in Network Systems Based on Lie Group]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202311300000001&flag=2]]></link>
<description><![CDATA[With the widespread use of the Internet in our lives, more and more software is beginning to collect more user information to improve the user experience. However, there is also a significant risk of leakage of user privacy stored on servers. Real-time assessment of network risks can not only help to monitor changes in network status, but also facilitate the adjustment of network defense measures at any time, and timely defense against network attacks, reducing attack losses. Traditionally, network risk assessment often uses statistical methods to calculate. This article proposes a new algorithm for real-time calculation of network risks by using the Lie group model in mathematics to mathematically model network systems. This article uses Lie group kinematics to describe attack behaviors in the network. By mapping the matrix composed of indicators and topology in the network system to the Lie group, it gives the numerical definition of attack behavior paths and network attack and defense. Using geodesic to calculate the distance between elements in the Lie group, it serves as a network risk indicator, and proposes a corresponding network risk damage assessment method, thus quantifying network risks and achieving real-time evaluation of network security status. In order to test the effectiveness of this network security risk assessment method, this paper uses existing datasets and writes code to conduct relevant experiments to evaluate the applicability and efficiency of this method. The experimental results confirm that the Lie group-based network system behavior risk calculation method is effective for the objective quantitative calculation of network attack and defense risk values, and can achieve quantitative assessment of network risks. Compared with other machine learning algorithms, there is no significant difference in various indicators, and some of its characteristics have the potential for further development.]]></description>
<pubDate>2025/1/20 14:31:15</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chang Yue,Liu Zhenyan,Song Ce,Xiao Yuming,Zhao Xiaolin]]></author>
</item>
<item>
<title><![CDATA[Survey on Cyber Attack Scenario Reconstruction Techniques]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202204290000001&flag=2]]></link>
<description><![CDATA[As the confrontation between attackers and defenders in cyberspace escalates, traditional analysis methods such as cyber threat awareness, detection, and forensics are being challenged by the emergence of new vulnerabilities, advancing technologies, and expanded attack surfaces. While threat actors in cyberspace carry out threat behaviors such as reconnaissance, delivery, or exploitation, their actions are inevitably captured and recorded by the victims’ defense system as a variety of traces that reflect the attackers’ methods, intentions, or next attack plan from multiple angles. Attack scene reconstruction is a technology that extracts attack information from traffic, alarms, logs, or other trace information and reconstructs them to the attack process, which can help analysts or defense systems to provide accurate identification, in-depth analysis, and accurate attribution of attack activities, and improve the efficiency of threat investigation and resolution. A large number of researchers have provided deep insights into the field of cyber attack reconstruction and published many papers in recent years. This paper summarizes these works from the perspective of the attack scenario reconstruction process to provide a reference for security researchers. First, this paper introduces the critical concept of attack scenario reconstruction techniques, points out the similarities and differences with other threat analysis methods that are easily confused, and explains the main processes and core steps of attack scenario reconstruction. Second, this paper expounds on the threat model, data model, and reconstruction method in detail according to the order of the reconstruction process, introduces representative works, summarizes innovations, and compares their advantages, disadvantages, differences, and application areas. Finally, this paper summarizes the common evaluation indicators and dominant application domains of attack scenario reconstruction techniques, discusses the problems existing in the existing methods in the reconstruction process, and looks forward to several significant research directions based on mentioned problems in this field in the future.]]></description>
<pubDate>2024/10/14 17:09:53</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DONG Fangming,DU Xiangyu,FAN Zijing,JIANG Jun,JIANG Zhengwei,LI Ning,LIU Baoxu,YANG Peian,ZHANG Kai]]></author>
</item>
<item>
<title><![CDATA[A noise-resistant and privacy-preserving fingerprinting  scheme for datasets]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211180000004&flag=2]]></link>
<description><![CDATA[Differentially private (DP) fingerprinting has recently been widely studied and used for privacy and copyright 
protection in dataset distribution. DP fingerprinting technology combines digital fingerprinting techniques and privacy 
models: -DP. The former can be used for traitor tracking to locate data recipients who illegally distributed datasets; the 
latter can be used to protect sensitive information in datasets and provide some accuracy in the statistical analysis of data. 
The current DP fingerprinting schemes have two weaknesses: 1. The DPFP scheme based on 
ε -entry-level DP 
implementation will publish primary key attributes when distributing datasets, so the scheme is weak in protecting the 
privacy of datasets. 2. The SNFP-DP scheme based on 
ε -DP implementation provides strong privacy protection for the 
dataset, but it performs fingerprint detection by computing the variance, so the robustness of the noise attack of this 
scheme is low.
In this paper, we propose a privacy model 
ε -multiset-level DP for datasets and design a noise-robust DP 
fingerprinting scheme (NLAP) that satisfies 
ε -multiset-level DP solves the dataset representation problem in 
ε -DP, i.e., 
changing the ordering of data in the 
ε -DP dataset causes not satisfying 
ε -DP, and 
ε - multiset-level DP can provide the 
same privacy protection for datasets as 
ε -DP. The DP fingerprinting scheme proposed in this paper achieves privacy 
protection by adding noise obeying Laplace distribution to the dataset and recording the range of noise added to each data 
item in the dataset while adding noise. The robustness of our scheme to noise is ensured by the fingerprinting detection 
method by subtracting the noisy dataset from the corresponding position of the original dataset, collecting the Laplace 
noise with offset greater than 
θ
and calculating the mean value of the noise for fingerprinting. Since unbiased noise does 
not affect the expectation of the mean value, such an NLAP achieves provable robustness to noise attacks. Our scheme 
outperforms the DPFP scheme in terms of privacy-preserving capability. We perform a comprehensive comparison with 
the SNFP-DP scheme based on the 
ε -DP implementation. The robustness experimental results show that the fingerprint 
recovery rate of NLAP under noise attacks is improved by 4 times compared to the SNFP-DP scheme, and we also 
perform a robustness theory analysis to provide theoretical support for our experimental results. The usability experimental 
results show that NLAP has a significant improvement over SNFP-DP under various metrics.]]></description>
<pubDate>2024/10/14 17:09:12</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenchi,qiujiabao,wangwenhao,yuanshuguang]]></author>
</item>
<item>
<title><![CDATA[A Survey on Threats and Countermeasures of Container]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202210090000004&flag=2]]></link>
<description><![CDATA[With the application of container technology and container ecosystem components, web services offer benefits from rapid deployment, cross-platform migration, continuous delivery to horizontal scaling, which has brought about a far-reaching impact on cloud computing. Subsequently, container technology has been widely used in the world, and related projects around container technology have been increasingly enriched and improved, further improving the functionality and usability of the container itself. However, the deployment of container and container ecosystem components could further weaken the isolation among traditional services and raise the exposure of the attack surface of applications, platforms, systems, and hardware, which places severe limitations on the growth of containers. Malware implantation, container escape, and unau-thorized access to orchestration platforms are just a few of the assaults that target containers. As a result, the harm degree and impact range of these attacks are expanding, and the security issue of containers has drawn more and more attention. In that case, valuable security mechanisms and solutions, including as intrusion detection, permission management, isolation optimization, and trusted hardware, have been proposed in both academic and industrial domains to safeguard containers and their ecological components. In this paper, we propose a framework for the study of container and container ecosystem components based on the previous existing research work. Given that framework, threats are analyzed from eight aspects: container instance, container image, container network, container core, orchestration platform, system kernel, hardware, and configuration management components. Furthermore, the countermeasures in response to the threats faced will be detailed and comparisons of the differences between various security protection schemes will be explained. By following this, our alignment analysis exposes the application trends of container technology in “multi-tenant” scenarios and potential research directions of multi-tenant container security. Specifically, we further discuss the security issues associated with the mul-ti-tenant container development trend and propose a more efficient solution for container-level security protection.]]></description>
<pubDate>2024/10/14 17:08:16</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DENG Qiqing,LU Zhitong,SONG Chen,WANG Liming,XU Zhen]]></author>
</item>
<item>
<title><![CDATA[Steganalysis of large-size image based on channel selection and deep feature fusion]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202209060000002&flag=2]]></link>
<description><![CDATA[In recent years, the development of adaptive image steganography technology has brought great challenges to image steganalysis technology, and the application of deep learning  in the field of steganalysis has made breakthrough pro-gress in steganalysis technology. All aspects of performance have surpassed machine learning steganalysis technology. However, due to the limitation of GPU, the size of images that can be analyzed by the current image steganalysis net-work is still limited to a small size range, and it is impossible to directly analyze images of larger sizes. With the  devel-opment of multimedia technology, large-size, high-resolution images have been used normally, and most steganalysis networks are no longer suitable for the current environment. To solve this problem, this paper proposes a large-size im-age steganalysis method based on channel selection and deep feature fusion. The image is divided into image blocks of the size that the network can directly train and detect, and a method to calculate the feature complexity is designed. Then based on the improvement of the existing network, the network can output the steganographic discrimination results of the block image and extract the depth features at the same time. Then, according to the basic principle of the content adaptive algorithm, the weight of the block image provided to the fusion discriminator is adaptively provided by the knowledge of the selection channel. Finally, use the detection results of all the block images and the adaptive weight to make a fusion decision.  This method can achieve high detection accuracy on larger sizes images , which is relatively high in the current environment. Experiments have shown that the method has achieved better detection performance than the direct analysis method on a variety of adaptive steganography algorithms on slightly larger images that can be directly analyzed by the current  network. On the analyzed large-size images, the detection performance is better than that of the traditional general steganalysis method fused with channel selection knowledge, and the detection accuracy can be improved by up to 10%.]]></description>
<pubDate>2024/10/14 16:02:28</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[hexiaolei,Xiaojunchao,yixiaowei,zhaofeng,zhaoxianfeng]]></author>
</item>
<item>
<title><![CDATA[Interpretable Graph Neural Network-based Android Malware Detection Method]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202302150000001&flag=2]]></link>
<description><![CDATA[In recent years, with the widespread use of smartphones, the number of Android malicious software has increased rapidly, which becoming a serious threat to smartphone users. The academic and industrial communities have begun to adopt deep learning-based methods to automate the detection of malicious software. Among them, the method of using Graph Neural Networks (GNN) to detect features of Function Call Graphs (FCG) has shown excellent accuracy and robustness. However, existing graph neural network-based detection methods lack interpretability, making it difficult to understand and analyze the detection results, which hinders their practical application. In existing research, some graph neural net-work interpretation models have been proposed. However, these interpretation models often only focus on the accuracy of the interpretation results, while ignoring the fidelity of the interpretation results, resulting in poor accuracy when inter-preting FCG graphs. To address this problem, this paper proposes an interpretable graph neural network-based Android malware detection method (IGAMD). The proposed method first decompiles the Android APK to obtain the FCG, and further analyzes to obtain the Attribute Function Call Graph (AFCG) features. Then, IGAMD inputs the AFCG into both the GNN classification model and the GNN interpretation model to obtain the classification and interpretation results. Un-like other GNN interpretability methods, the GNN interpretation model of IGAMD simultaneously considers the accuracy and fidelity of the interpretation results, achieving better performance. The GNN interpretation model can identify the subgraphs in the Android malware FCG that contribute the most to the classification and provide node importance scores for further analysis. Experimental results show that compared to the three state-of-the-art GNN interpretability methods in existing research, IGAMD"s interpretation results have higher accuracy and fidelity, and can accurately reveal the behav-ior patterns of android malicious software. At the same time, IGAMD shows excellent performance in malware detection tasks, achieving a recognition accuracy of 96.23%.]]></description>
<pubDate>2024/9/19 15:41:34</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[duhaichao,fuyuxia,huangqingjia,jiaxiaoqi,liyakai,xiejing,zhoumengting,zhouqihang]]></author>
</item>
<item>
<title><![CDATA[A Survey on Intra-process Memory Isolation Technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202301050000001&flag=2]]></link>
<description><![CDATA[System security defense mechanisms have evolved significantly in recent years, but memory corruption vulnerabilities continue to pose a significant threat to the security of modern software and remain one of the most prevalent and dan-gerous security vulnerabilities in modern applications. However, the memory isolation mechanisms provided by modern operating systems only work between processes and do not effectively support the establishment of secure isolation boundaries within processes. If a memory corruption vulnerability exists in the target process, an attacker could use this type of vulnerability to compromise the security of the process"s own code, maliciously access sensitive information inside the process, or hijack the original execution flow of the program to take control of the entire application process. By dividing the original single process memory space into multiple mutually isolated memory areas, intra-process space isolation not only protects the security of special modules within the process, but also protects sensitive information within the process, and can also be used to detect, monitor and defend against malicious behavior of untrusted modules within the process, thus reducing the security risk caused by vulnerabilities and greatly improving the security and ro-bustness of related applications. To this end, researchers have designed a number of research schemes for enhancing the spatial isolation effect within the process. In this paper, we first give a general overview of the intra-process memory isolation technology, and secondly demonstrate the advantages and necessity of the intra-process memory isolation mechanism by comparing it with traditional security mechanisms. Next, we analyze and summarize the current research status of various security mechanisms, and then summarize the current implementation mechanism of intra-process memory isolation and point out the development trend of related research and how to achieve a safer and more efficient intra-process memory isolation mechanism, while abstracting each security mechanism into four indicators for compari-son and analysis. Finally, we look into the future research directions related to the intra-process memory isolation, con-sidering the current problems.]]></description>
<pubDate>2024/9/19 15:41:01</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Feng Wenzhi,Fu Yuxia,Huang Qingjia,Huang Sicong,Jia Xiaoqi,Liu Guanting,Xie Jing,Zhou Mengting]]></author>
</item>
<item>
<title><![CDATA[Survey of Deep Learning-Based Human-Object Interaction Detection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202304190000002&flag=2]]></link>
<description><![CDATA[Human-object interaction detection aims to identify humans, objects, and their interactions in images. In human-centered scenarios, human-object interaction detection serves as the foundation for higher-level semantic understanding, and plays an important role in computer vision tasks such as behavior analysis, scene understanding, and video structuring. It also has high application value in social life fields such as public safety and enterprise management. In recent years, the de-velopment of deep learning and the availability of large-scale datasets have driven the advancement of human-object in-teraction detection. However, there are few comprehensive reviews on this field currently. This paper aims to provide a comprehensive overview of human-object interaction detection methods based on deep learning, considering it as con-sisting of three parts: object detection, human-object pair association, and interaction prediction. This paper focuses on methods for human-object pair association and interaction prediction, and summarizes the methods from the perspectives of framework, feature, and interaction region. Specifically, this paper first introduces the background of human-object interaction detection, then outlines the framework of deep learning-based human-object interaction detection, and dis-cusses the human-object pair association module and interaction prediction module in both sequential and parallel human-object interaction detection. It further introduces the datasets and evaluation metrics for human-object interaction detection, compares the performance of different methods on two commonly used datasets, and points out the long-tail distribution problem in human-object interaction datasets, as well as discusses solutions to this problem. Finally, this paper summarizes and prospects the future research directions in the field of human-object interaction detection. It is expected that this paper will provide insightful ideas for the future direction of research in the field of deep learning-based hu-man-object interaction detection through a comprehensive review of the current research status.]]></description>
<pubDate>2024/9/19 15:14:44</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[bai ru wen,huang wei qing,jiang miao,li min,ren jun xing,yang yang,zhao shi xian]]></author>
</item>
<item>
<title><![CDATA[Cyber Security Knowledge Graph Entity Alignment via Bootstrapping with Reinforcement Learning]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202303030000002&flag=2]]></link>
<description><![CDATA[Knowledge graphs provide people with an intuitive and efficient way to understand and utilize complex knowledge, and have been widely applied in cyber security fields such as network security threat analysis, public opinion event prediction, etc. However, different cyber security fields lack unified knowledge graph construction standards, resulting in existing work neglecting the generality and scalability of knowledge graphs when constructing them. Therefore, how to integrate existing cyber security knowledge graphs on a large scale is a key problem in this field. Entity alignment is as a key task for integrating knowledge graphs, existing work has fully explored how to align entities by encoding their semantic and structural information. However, these works rely on a large number of pre-aligned seed nodes to assist learning, which are difficult to effectively apply to the alignment tasks of cyber security knowledge graphs with scare pre-aligned seeds. In order to alleviate the sparsity problem of pre-aligned seed nodes, some work proposed an iterative way of selecting pseudo-aligned samples from unlabeled data to expand training data. However, these algorithms rely on heuristic rules when selecting samples, which cannot guarantee the structural consistency of pseudo-aligned samples, making it difficult to effectively mine high-quality pseudo-aligned samples between different cyber security knowledge graphs. To solve the above problems, this paper studies the general-purpose cyber security knowledge graph fusion task. Based on the basic graph structure and semantic information of the knowledge graph, we propose a new Bootstrapping Entity Alignment with Reinforcement Learning (BEAR) model. The model can use the structural consistency of the graph to automatically select high-quality pseudo-aligned samples for alignment assistance. We abstracted the bootstrapping sample selection process as a sequential decision problem and designed a reinforcement learning framework for solving it so that the model can automatically select the most effective pseudo-aligned samples. In addition, in order to make full use of the structural information in the knowledge graph and maintain structural independence when representing entities and relationships we designed a new directional relationship-aware graph convolutional network for learning entity and relationship representations. Experimental results on four real-world datasets show that our proposed BEAR model outperforms several state-of-the-art baseline methods on entity alignment tasks.]]></description>
<pubDate>2024/9/19 15:14:16</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[gao zhanchao,wang ding,yang jinzhu,zhou wei]]></author>
</item>
<item>
<title><![CDATA[Privacy-Preserving Blockchain with Separation of Regulation Based on Sigma Protocols]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202301230000001&flag=2]]></link>
<description><![CDATA[Blockchain is the basic infrastructure of cryptocurrencies such as Bitcoin and Ethereum, providing a decentralized, tamper-resistant and publicly verifiable ledger that can record transactions of digital assets. The open and transparent characteristics of the blockchain ledger facilitate the transaction verification, but at the same time reveal sensitive information that could cause threats for the security of individuals and companies. In recent years, many studies have focused on anonymity and confidentiality for users. However, strong privacy makes it easy for malicious users to hide addresses and illegal transaction contents, which creates regulation issues for current institutions such as the anti-money laundering organization. Some traceable and auditable blockchain schemes often do not provide both anonymity and confidentiality. In addition, there exist problems such as few regulation operations, regulation overreaching, and the need to interact with the regulated parties. In this paper, we present a strong privacy-preserving scheme with the separation of regulation power based on efficient Sigma protocols, which obtains the purposes of anonymity, confidentiality, traceable addresses and auditable transaction contents. We achieve confidentiality and auditability of the transaction content by the homomorphic public-key cryptosystem with a double trapdoor decryption mechanism proposed by Bresson, Catalano, and Pointcheval. We also achieve anonymity and traceability of the transaction participant"s address by a one-time address. To limit the authority of the regulator, we design a novel regulation model that separates the authority of address tracing from that of content audit, where regulators can condition and cooperate with each other. We design four zero-knowledge proofs based on the Sigma protocol for the public verification of transactions without trusted setup, including the ownership proof, the consistency proof, the balance proof and the range proof. Moreover, we provide security definitions and formal security analysis of our scheme, and implement zero-knowledge proofs and system algorithms to demonstrate the practicability.]]></description>
<pubDate>2024/9/19 15:14:01</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DingJiong,Xu Haixia]]></author>
</item>
<item>
<title><![CDATA[An Identification System for Non-Cooperative 5G Attack Signals in Complex Electromagnetic Environment]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202301210000001&flag=2]]></link>
<description><![CDATA[Unauthorized non-cooperative attack signals in wireless communication countermeasure bring huge risks to 5G communication system security. There is an urgent need for a 5G attack signal identification method, which has stronger ability to identify attack and resist complex environment based on the wireless attack signals of high-speed, inherent defect of non-cooperative communication lacking prior information and strict requirements for signal quality of 5G communication system. Based on parameter estimation and blind identification of mul-ti-level 5G attack signals from the perspective of signals, this paper constructs a systematic and evolvable security identification system for non-cooperative 5G attack signals. Firstly, the paper takes analysis of 5G attack signals sample library construction and automatic matching and identification technology, and introduces a sequence minimum optimization algorithm of feasible direction strategy and construct a bottom-up multi-level feature classi-fier. Constructing a resolvable, easily measured and stable characteristic parameter group of attack signals to fully utilize the prior information of attack types and preliminary security monitoring results, in order to achieve rapid matching identification and security research and judgment. The knowledge map in the 5G attack signal security threat library is constructed in the form of triplets. Then, under the condition of attack sample library failure, this paper studies the blind identification and parameter estimation of 5G attack signals. A feedback iterative processing framework for closed-loop attack parameter estimation and blind attack identification is innovatively proposed. The decision feedback is used to assist feature parameter correction and attack parameter judgment, and a decision tree is constructed to determine the attack type level by level, so as to improve the ability of 5G attack signal identi-fication. Different from the general signal identification method that pursues high accuracy, this paper attempts to identify attack signals from the perspective of security, to ensure normal communication and information security of 5G communication system under complex electromagnetic environment, thus lays a theoretical and technical foundation for security monitoring of 5G communication signals.]]></description>
<pubDate>2024/9/19 15:13:40</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[FAN Wei,HUANG Weiqing,PENG Cheng]]></author>
</item>
<item>
<title><![CDATA[A survey on DNS covert channel detection technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202212280000001&flag=2]]></link>
<description><![CDATA[DNS (Domain Name System) is widely used as the critical information infrastructure of the Internet all along. Network defense devices (such as firewall, intrusion detection system) generally tend to directly release or loosely inspect DNS data to avoid damaging the availability of information systems due to false interception. Considering the application advantages of DNS, DCC (DNS Covert Channel) is favored by attackers and it is widely used in APT (Advanced Persistent Threat) and botnets attacks to conceal sensitive data. To a certain extent, the emergence of encrypted DNS technology can partly solve the problem of personal privacy data exposure. However, encrypted DNS can still be used as a DNS covert channel, which also has the risk of data leakage. Since DCC is an important part in the network attack chain, DCC detection has become the research hot spot in recent years and it has also become an important security issue that cannot be ignored in network security. Firstly, in this paper, we concretely analyze the basic principle of DCC (Divided into plaintext DCC and encrypted DCC), and analyze the typical application of DCC in APT attack from two aspects: command control and data transmission; Secondly, we discuss the data processing, feature extraction and feature representation of plaintext DCC detection, and analysis the key technologies in each part. Then, we summarize the current detection method, and compare the advantages and disadvantages of plaintext DCC model detection sort by feature threshold method, machine learning model, deep learning model. Thirdly, taking DoH covert channel detection as the object, we divide it into two analysis steps: DoH detection and DoH covert channel detection, and summarize the existing encrypted DNS covert channel detection methods respectively. Finally, by analyzing the current typical problems and the factors affecting detetion sound effect in DCC detection, we discuss the challenges and future research directions.]]></description>
<pubDate>2024/9/19 15:13:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[cuixiang,dudan,guijianyong,handongxu,lining,liubaoxu,liusong,liuyuling,luzhigang,wudi]]></author>
</item>
<item>
<title><![CDATA[Research on Active Defense-based Anti-Ransomware Technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202302070000003&flag=2]]></link>
<description><![CDATA[Ransomware is easy to attack but difficult to defend. Once it uses vulnerabilites to enter the system to encrypt data using a high-intensity cryptographic algorithm, the probability of reverse self cracking is extremely low, and it has become one of the serious threats to network security and data security. Ransomware varieties emerge in endlessly, and the traditional defense methods can no longer resist the increasingly intelligent and complex new ransomware attacks. Therefore, it is of great significance to study the anti-ransomware technology based on active defense. Firstly, this paper analyzes the background, current situation and research significance of active anti-ransomware technology, and describes the technology context and research classification. Then we introduce the related knowledge of ransomware, and analyzes the active defense countermeasures against the life cycle of ransomware. We classify the attack techniques of ransomware from three aspects: intrusion means, circumvention mechanism and data security threats, and analyze the attack principles of typical ransomware. According to the defense principle, we divide the active anti-ransomware technology into four categories: ransomware prevention technology, ransomware blocking technology, data tamper prevention technology and data leakage prevention technology. Then, we classify and analyze each category, and compare the advantages and disadvantages of the existing active anti ransomware technologies. Furthermore, we propose the security framework of active anti-ransomware defense with the goal of data protection, and point out the research direction for the game confrontation of subsequent anti-ransomware technology.]]></description>
<pubDate>2024/9/12 10:17:03</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Xiaoyan Sun,Ma Duohe,Tang Zhimin,Wang Xinzhe,Zhang Yaqin]]></author>
</item>
<item>
<title><![CDATA[Applications of Large Language Models Technology for Threat Intelligence: A Survey]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202401160000001&flag=2]]></link>
<description><![CDATA[With the continuous development of computer and network technology, cyberspace faces increasingly complex se-curity threats. To effectively defend against cyber attacks, cyber threat intelligence has emerged. However, the cur-rent network threats such as zero-day vulnerability and Advanced Persistent Threat (APT) are characterized by their complex form, strong targeting, high harm, high covert, and long time span, which are difficult to be effectively dealt with by the traditional threat intelligence technology. In recent years, the rise of Large Language Models (LLM) has not only reduced the costs of attacks but also facilitated the widespread adoption of cyber attack techniques. Therefore, the goal of this article aims to explore the current state of technology application of LLM in the field of threat intelligence and to utilize the potential of LLM to improve the ability to aggregate, analyze, and apply threat intelligence, so as to identify, analyze, and respond to cyber threats more accurately. This paper first outlines the background knowledge of cyber threat intelligence and then introduces the concept, development history, and re-search status of large language models to explore the possibility of applying large language models in the field of threat intelligence. Then, we analyze in-depth the relevant literature on the combination of threat intelligence and large language model. Around the threat intelligence life cycle, we systematically combine the results of the large language model in enhancing threat intelligence aggregation, driving threat intelligence analysis, and empowering threat intelligence application, and categorize them from the perspectives of technical application scenarios and main methods. In addition, the research status, technical characteristics and potential development directions are summarized for each of these three aspects. Finally, this paper discusses the challenges faced by the application of large language models to threat intelligence and cyber security and gives future research directions to further pro-mote the development of cyber threat intelligence.]]></description>
<pubDate>2024/9/12 10:12:34</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenyiren,cuimengjiao,fenghuamin,jiangjun,jiangzhengwei,lingzhiting,yangpeian,zhangkai]]></author>
</item>
<item>
<title><![CDATA[A Survey of Insider Threat Detection Based on Behavior Analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202107150000001&flag=2]]></link>
<description><![CDATA[With the development of the Internet era, Insider threat are increasing, which usually lead to system damage, economic loss and information leakage, posing a serious threat to the security of individuals, organizations, and the country. It is one of the security challenges faced by many enterprises and organizations. Insider threat detection has become a very important means of network attack detection, and it is becoming more and more urgent. Researchers in this field have proposed a large number of insider threat detection technologies, especially with the development of artificial intelligence, insider threat detection technologies based on behavior analysis have become the main research content in this field. This paper investigates a large number of related literature and does the following work: First, it summarizes the basic concepts of insiders and insider threat, and the behaviors and characteristics of insider threat. Then, the existing work is classified from the two dimensions of data source and detection method, and the related feature engineering is summarized at the same time. Next, on the basis of classification in Chapter 2, different detection methods and main lines of technology development are discussed. Afterwards, the evaluation and measurement methods and research resources are discussed. Finally, the challenges faced in current research are discussed and future opportunities and prospects are prospected. This article hopes to provide some valuable references for researchers in this field.]]></description>
<pubDate>2024/9/11 19:12:55</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[liu jie,shi jin qiao,wang xue bin,zhang chuang,zhang hao liang,zhang peng]]></author>
</item>
<item>
<title><![CDATA[Survey on Deep Learning Based Malicious Encrypted Traffic Detection and Adversarial Techniques]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202302250000001&flag=2]]></link>
<description><![CDATA[With the continuous improvement of people"s awareness of network security and the wide application of encryption technology, the encrypted traffic in the network is emerging explosive growth. While encryption technology protects safety of user data and privacy, attackers can misuse encryption technology to hide malicious and illegal behaviors, which brings new challenges to network security protection and supervision. On the one hand, detecting malicious encrypted traffic without decryption has become a difficult issue in the field of network security. With the increasing amount of malicious encrypted traffic, traditional deep packet inspection techniques are no longer applicable. On the other hand, attackers use traffic obfuscation and other adversarial techniques to hide malicious traffic in normal traffic, or generate adversarial samples to interfere with the detection model, which misleads the detection system into making wrong decisions. At present, the research on applying deep learning methods to malicious encrypted traffic detection and confrontation is developing continuously, and there is no literature review on the latest achievements and trends. In this paper, the latest work of malicious encryption traffic detection and adversarial techniques are comprehensively investigated from the aspects of task scenarios, data preprocessing, features extraction, models and evaluation indicators. Firstly, a general framework for malicious encryption traffic detection is proposed, and the target task scenarios are classified according to the framework. Secondly, the system applied to malicious encryption traffic detection are presented from the perspectives of data collection and preprocessing techniques, feature extraction and selection techniques, and evaluation index, and the solutions to data imbalance problem are discussed. Moreover, the applicability, advantages and disadvantages of different detection models are compared and analyzed, and the techniques of adversarial attack and corresponding countermeasures are discussed. Finally, the open issues and challenges in the field of malicious encryption traffic detection are discussed, and the future research direction is prospected.]]></description>
<pubDate>2024/9/11 14:20:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fan Zuwei,Zhang Shunliang,Zhao Hongce]]></author>
</item>
<item>
<title><![CDATA[Malware family core function-based Linux malware lineage analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202302070000002&flag=2]]></link>
<description><![CDATA[In recent years, malware has developed rapidly, showing a trend of familial proliferation. It has become a hot topic in academia and industry. However, the traditional methods relying on manual analysis have the bottleneck of poor scalability, low efficiency, and difficulty in dealing with the increasing number of malware. The detection and classification technology based on machine learning also faces the inability to detect and warn of unknown malicious software in time and a lack of accurate analysis and understanding of the potential lineage relationships between families. Given the above problems, this paper proposes a family core function-based malware classification and family lineage analysis method FCF-MLA (Family Core Functions-based Malware Lineage Analysis), which can discover and capture unknown malware families while locating and tagging their core code, enabling accurate inferences about potential lineage relationships that exist among families. The method first identifies the malware tags through the code similarity clustering method based on tag voting. Secondly, we filter the full function of the malware family and extract the core function group of each family by the coverage rate of the similar function set in the family. Finally, we quantify the pedigree relationship between families in the real world. We perform distance grading based on the similarity between the core functions of different families, use the statistical grading distance to characterize the similarity between families, and combine the magnitude difference between families to infer the lineage relationship. This paper implements a prototype system based on the proposed method, tested on a real-world dataset of 10,578 malware samples from 10 families. The experimental results show that the method can effectively classify malware with an accuracy rate of 98.26% and can accurately infer the lineage relationships among malware families.]]></description>
<pubDate>2024/9/11 14:20:03</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huangweihao,lishufei,liangruigang,mengguozhu,xianglu]]></author>
</item>
<item>
<title><![CDATA[Research on Lightweight Directed Fuzzing]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202301090000001&flag=2]]></link>
<description><![CDATA[Fuzzy testing technology plays a vital role in the field of software vulnerability mining. With its advantages of high auto-mation, easy scalability, and low cost, it has been the mainstream security testing technology to support and guarantee software security. However, with the increasing complexity of systems and software, a large number of version iterations have raised new demands and challenges on the efficiency of vulnerability mining, requiring more efficient techniques for targeted testing of potential vulnerabilities that may be introduced by new code. To address this problem, this paper analyzes the efficiency bottlenecks of current mainstream fuzzy testing techniques, investigates how to improve the efficien-cy of targeted fuzzy testing in version iteration scenarios, and proposes a lightweight targeted fuzzy testing method for migrating seeds in program version iterations. Our approach optimizes the fuzzy testing process by optimizing the staking mechanism, designing the seed migration method, and building a lightweight guidance mechanism, records and iterates the correspondence between valid test inputs and program branches in the historical fuzzy testing process, accumulates and uses these relationships to guide the fuzzy testing process of subsequent versions of this program, and realizes the effective improvement of the large-scale version iteration process based on low time cost The paper further implements a lightweight fuzzy testing system to improve the coverage rate of fuzzy testing during large-scale version iterations and enhance the effect of directional guidance for testing between adjacent versions of the target program. We further implement a lightweight directed fuzzy testing framework LFuzz, select AFL as the benchmark fuzzy testing tool, and conduct experimental validation using four open-source software, which achieves an average improvement of 22.39% in fuzzy testing coverage and reduces the average time spent on directed triggering of any target edge by 36.15%, thus verifying the effectiveness and feasibility of our approach.]]></description>
<pubDate>2024/9/11 14:19:30</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LIANG Ruigang,Liu Jinghua,PENG Yu,Zhang Zhiyu,ZONG Peiyuan]]></author>
</item>
<item>
<title><![CDATA[Survey on physical layer secure transmission of UAV communication for B5G/6G]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211110000001&flag=2]]></link>
<description><![CDATA[Due to its advantages of flexibility, easy deployment, low cost, and ease to establish line-of-sight links with the ground, Unmanned Aerial Vehicles(UAV) will play an extremely important role in the future space-air-ground integrated B5G/6G networks. However, the openness of wireless channels and the strong Line of Sight of UAV communication links pose multiple security threats to UAV communication systems. As a potential technology to ensure communication security, physical layer security is increasingly valued. Physical layer security can resist the threat of eavesdropping and jamming faced by UAV information transmission. With the development of technology, UAVs combined with physical layer security technology have been applied in new scenarios such as mobile edge computing and emerging technologies such as B5G/6G. Due to the particularity of new technologies in new scenarios and the limitations of UAVs, such as computing resources and power consumption, traditional physical layer security technology faces new challenges. This paper reviews the current stage work on physical layer secure transmission of UAV network for B5G /6G. Firstly, we introduce the security threats to UAVs, and the typical physical layer security transmission technologies. Typical physical layer security transmission technologies include physical layer encryption, artificial noise, beamforming, and relay collaboration. Then, the research work related to the physical layer secure transmission of UAV communication in recent years has been sorted out and summarized in accordance with the order of theoretical modeling, safety performance evaluation, and system security optimization. In the optimization section, two optimization solutions based on traditional mathematical methods and machine learning methods are introduced. Subsequently, combined with new scenarios such as mobile edge computing and satellite vehicle collaboration, the research on the physical layer security of UAVs based on 5G/B5G has been discussed. Finally, the future research directions of UAV physical layer security have been prospected for 6G, and the open problems are discussed in depth.]]></description>
<pubDate>2024/9/11 14:17:54</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Guo Xiaolei,Zhang Shunliang,Zhang Xiaohui]]></author>
</item>
<item>
<title><![CDATA[Optimization of Byzantine Fault-Tolerant Consensus Algorithm for Consortium Blockchain]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211250000001&flag=2]]></link>
<description><![CDATA[Byzantine fault-tolerant protocols based on synchronous network assumptions can tolerate up to 1/2 the number of Byzantine nodes. Sync HotStuff is an extremely simple and intuitive synchronous byzantine fault-tolerant protocol consisting of two sub-protocols: steady state and view change. In the steady state, an honest leader node can pro-pose a block at a fixed rate and the block can be committed in a short time. When the leader node is a byzantine node other nodes will execute the view change protocol to ensure the progress of the system. However, if an adver-sary controls up to 1/2 of the byzantine nodes to cascade mischief during the election of the leader node the per-formance of the system is severely affected. This paper first defines a new performance evaluation framework to quantitatively analyze the performance of Sync HotStuff. Then, two delay attack scenarios that Sync HotStuff may face are proposed and their impact on Sync HotStuff performance is analyzed. Finally, two countermeasures are proposed to resist the above attacks. The analysis shows that the more the number of byzantine nodes that are ma-ligned by the adversary control cascade, the more severely the system progress is affected, and the more our im-provements become prominent.]]></description>
<pubDate>2024/9/11 14:16:59</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Xu Haixia,Xue Meihua]]></author>
</item>
<item>
<title><![CDATA[A Blockchain-based Electronic Voting System with Supervision Functionality]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211150000001&flag=2]]></link>
<description><![CDATA[Because of its advantages and efficiency, the electronic voting system has attracted more and more attention and has been applied in various scenarios. However, the centralized system architecture of the traditional electronic voting system has problems such as a single point of failure, information opacity, and resources that are difficult to verify. Many researchers have proposed distributed electronic voting systems based on blockchain to solve this problem. However, the existing centralized or decentralized electronic voting systems often pay attention to the security of voters" voting information and ignore the supervision of voters. Voters may abuse their voting rights, making such electronic voting systems inapplicable. Aiming to address the problem, we propose a new electronic voting system based on various techniques, i.e., deformed ElGamal encryption with additive homomorphism, ring signature, knowledge signature, and blockchain. The proposed system not only satisfies the security attributes of integrity, correctness, confidentiality, suitability, fairness, non-reusability, and ex-tensive verifiability but also achieves voter supervision through voter ratings. Furthermore, we implemented a Python prototype and conducted extensive experiments on the local Ethernet test network to verify the system"s performance. The results demonstrated that the proposed system performs well in terms of feasibility and effectiveness and has good application prospects.]]></description>
<pubDate>2024/9/11 14:15:50</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[AI Mingchao,FENG Huamin,FU Yuxia,HUANG Qingjia,JIA Xiaoqi,YU Ze,ZHANG Yuan,ZHOU Qihang]]></author>
</item>
<item>
<title><![CDATA[Malware Analysis Based on Knowledge Graph: A Survey]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202211180000002&flag=2]]></link>
<description><![CDATA[With the escalation of network security attack and defense confrontation, complex and changeable malware poses new challenges to the detection and analysis of network security threats. With its unique capacity to capture and integrate the  information about malware features, the structured representation of graphs, especially knowledge graphs, showing great potential in the malware research field. At the same time, with the help of algorithms such as graph matching, graph embedding or graph neural networks, the attribute information of nodes and the topological relationship between them can be processed by the technology of knowledge graph, which shows a great prospect in the field of malware detection and analysis. At present, the research on knowledge-graph-based malware analysis can be divided into two aspects: one is the research on the construction of malware knowledge graph, including the unified definition, the instantiated extraction of knowledge representation and the ontology model. The other is the structure characteristics of graph obtained by comprehensive malware analysis, using the correlation graph algorithm technology to detect and analyze the upper-layer malware. Starting from the development trend of malware, this paper first introduces the research progress of the representation, creation and application of knowledge graph, summarizes the advantages and limitations of the existing analysis methods using dynamic and static characteristics and artificial intelligence models, thus draw forth the important research interests of the combination of knowledge graph and malware. Then analyzes the definition and representation of the malware knowledge graph that integrates multi-structure data, as well as the models using different methods, including entity recognition, relationship extraction and so on. After that, expounds the exploration and application of graph computing in the scene of malware detection and analysis, and the results show that the graph correlation technology is effective in detection, identification and comprehensive analysis of malware. Finally, on the basis of discussions such as the difficulty of unifying the definition of the malware knowledge graph mode, the insufficiency of the mining and utilization of graph information, and the vulnerability of graph analysis models, this paper proposed the solutions for reference and projected directions of the research.]]></description>
<pubDate>2024/9/11 14:15:11</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[JiangZhengWei,JingRongQi,LingChen,LiuQiXu,WangQiuYun,WangShuWei]]></author>
</item>
<item>
<title><![CDATA[Research on Transient Execution Attacks and Their Impact on Security Enhanced Software Cryptographic Implementation Schemes]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202209250000001&flag=2]]></link>
<description><![CDATA[Modern processors generally employ a variety of optimization techniques to improve their performance, including out-of-order execution and speculative execution. However, transient execution attacks represented by Meltdown and Spectre can take advantage of the transient execution effects caused by these features to change the microarchitecture state, and further conduct unauthorized access to secret data through the cache covert channel. Transient execution at-tacks have developed dozens of attack variants, affecting a large number of processors, operating systems and cloud ser-vice providers, seriously threatening the security of sensitive data in computer systems, especially the cryptographic key in software cryptographic implementations. Before the outbreak of the transient execution attacks, in order to deal with the traditional threats of various memory information disclosure attacks faced by software cryptographic implementa-tions, researchers have already proposed various forms of security enhanced software cryptographic implementation schemes. These schemes rely on different processor components or hardware characteristics to effectively protect sensi-tive data such as cryptographic keys against memory disclosure attacks. However, the effectiveness of these security enhancement schemes against the novel transient execution attacks have not received much enough attention. Therefore, we aim to study the impact and challenges of transient execution attacks on security enhanced software cryptographic implementation schemes in this paper. We firstly survey the transient execution attack, introduces its vulnerability caus-es, attack methods and specific attack instances. Then, we summarize various security enhanced software cryptographic implementation schemes, and clarify their fundamental security mechanism. Finally, we comprehensively discuss and analyze the effectiveness of the security enhanced software cryptographic implementation schemes against each transient execution attack instance, and put forward some suggestions from the perspective of hardware vulnera-bility defense and security enhancement scheme design, so as to reduce the threat of transient execution attacks on software cryptographic implementation.]]></description>
<pubDate>2024/9/11 14:14:02</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Lang Fan,Lin Jingqiang,Meng Lingjia,Wang Mingyu,Zheng Fangyu]]></author>
</item>
<item>
<title><![CDATA[A Bayesian Game Approach for Intrusion Response Detection Model in Mobile Edge Computing]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202110290000001&flag=2]]></link>
<description><![CDATA[The technology of Mobile Edge Computing (MEC) has been paid more and more attention due to the maturity and commercial application of 5G mobile network. MEC can better realize real-time and delay-sensitive applications by migrating computing storage capacity and business service ca-pacity to network edge close to data source. However, it also faces new security challenges. This pa-per presents an intrusion response decision-making model for Mobile Edge Computing environment, based on the wide distribution, complex network environment and limited resources characteristics of edge nodes. In this model, the resource state of the system, the cost of intrusion response, the de-tection and false negative rates of the prevention system are considered synthetically, so that the loss of the MEC system is minimized while facing external intrusion, and the time delay of the whole MEC network is small, which can satisfy the requirements of the network for real-time performance and reliability. This paper first analyzes the characteristics of network attack and defense in Mobile Edge Computing environment, and simulates it with a mathematical model based on Dynamic Bayesian Game. Then, according to the results of the game model, the optimal invasion strategy for intruder and the optimal response strategy for defense system are obtained so that the edge nodes can make targeted response on intrusion behavior. Moreover, a practical application framework of the model is given, which is composed of an intrusion detection system that observes the actions of nodes and an intrusion prevention system that takes defense measures, which can effectively reduce network load and save energy cost. Finally, the simulation results show that the model can generate more energy-saving defense strategy for the defender, and improve the overall detection capability of the system, which plays a crucial role in ensuring network security and pushing forward the imple-mentation of Mobile Edge Computing.]]></description>
<pubDate>2024/9/10 13:55:22</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fan Wei,Peng Chen,Wang Yuqing,Zhang Shunliang,Zhu Dali]]></author>
</item>
<item>
<title><![CDATA[TouchAuth：An Implicit Continuous User Identity Au-thentication Mechanism based on Touch Screen Behavior]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202101260000001&flag=2]]></link>
<description><![CDATA[With the increasing popularity of mobile terminals, it has become an urgent problem to protect private data and sensitive information in mobile terminals from being illegally viewed by others. User identification authentication mechanism is usually used for privacy information protection in mobile terminals. However, the traditional authentication methods cannot provide continuous protection after the user passes the initial authentication, which leads to privacy leakage. This paper proposes an implicit continuous identity authentication mechanism--TouchAuth. Based on the feature sampling method proposed in this paper, TouchAuth samples the user''s touch screen behavior data and judges its legitimacy by employing typical machine learning approaches. To improve the stability and accuracy of TouchAuth, we introduce the decision steps mechanism, which determines the legitimacy of users by comprehensively judging the legitimacy of multi-ple touch screen behaviors in the decision steps. The experimental results on the public data set show that TouchAuth can detect the attacker with an average EER of 10.1%, based on data from seven touches as defined in this paper. Moreover, TouchAuth overcomes the following problems: firstly, the authentication efficiency is limited to a certain kind of scenario or application. Secondly, the authentication efficiency cannot be guaranteed when the operations in the session are sparse.]]></description>
<pubDate>2024/9/4 17:08:47</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Feng Weimiao,Ma Luping,Ma Yuchen,Peng Shumin,Zhang Shunliang,Zhang zhujun,Zhu Dali]]></author>
</item>
<item>
<title><![CDATA[High-dimensional Data Publishing with Differential Privacy Protection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109240000003&flag=2]]></link>
<description><![CDATA[The popularization of IoT and big data technology has greatly facilitated people"s life, and thus produced a large amount of high-dimensional data. Through the analysis of the published high-dimensional data, the implicit value and knowledge of data can provide guidance for the government or enterprises and institutions in the decision-making process. However, because high-dimensional data often contains personal sensitive information, its direct publish will pose a serious threat to personal privacy. Differential privacy is a privacy protection framework with strict formal definition for data publishing and analysis without revealing personal sensitive information. However, the existing differential privacy high-dimensional data publishing methods have the problems that the relationship between data cannot be fully captured in the process of data dimensionality reduction and the definition of the data distribution model is inaccurate. To solve the above problems, this paper proposes a differential privacy high-dimensional data publishing method based on Gaussian generative model. First, we use the maximum information coefficient and Dvoretzky"s theorem to preprocess high-dimensional data, filter out the useless or missing value sparse attributes in the original data and reduce the impact of additional disturbance errors introduced by data sparsity on the level of privacy protection. Then the preprocessed data is subjected to projection transformation, so that the projection of the high-dimensional data on the low-dimensional space is conformed to the Gaussian distribution. Finally, the projection data is used to train the differential privacy Gaussian generative model, and the synthetic data is generated by the model to replace the original high-dimensional data for publishing. By designing a preprocessing method suitable for high-dimensional data, this method optimizes the differential privacy high-dimensional data publishing method based on Gaussian generative model, and solves the problem of low utility of high-dimensional data publishing results due to unknown data distribution or inaccurate model definition on the basis of retaining multiple functional relationships of the original data. Theoretical analysis and experimental results show that the proposed algorithm has better utility than similar algorithms.]]></description>
<pubDate>2024/6/13 11:17:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[shenbo,zhangrui]]></author>
</item>
<item>
<title><![CDATA[Research on Application of Homomorphic Encryption in Privacy Preserving Machine Learning]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202204030000001&flag=2]]></link>
<description><![CDATA[With the development and maturity of cloud computing and big data, the value of data is widely recognized. Data has become a new production factor permeating all walks of life, and the importance of data is increasing day by day. With the enhancement of users" awareness of privacy protection and the regulation of sensitive and confidential data by poli-cies and regulations, the issue of data privacy and security has become one of the key factors restricting the development of big data and artificial intelligence.At the beginning of the machine learning system design, privacy and security issues are not taken into account. Training data, model parameters, gradient information, and user data all risk privacy leakage. Compared with the traditional encryption scheme, homomorphic encryption is computable after data encryption, which functionally fits the application requirements of privacy-preserving machine learning. This paper first analyses the private data in machine learning systems and the corresponding attack methods. Then a formal definition of privacy-preserving machine learning, a security target, an adversary model and a security level are given. We compare the advantages and disadvantages of homomorphic encryption with privacy-preserving mechanisms such as secure multi-party computation and differential privacy. Next, we summarise the development history, classification, characteristics and engineering im-plementation of homomorphic encryption schemes; then, we analyze why the approximate substitution of activation functions is needed and what approximate schemes are available. We comb through the research progress of homomorphic encryption applications in cryptographic machine learning, machine learning as a service, and federation learning. We have analyzed and summarised the homomorphic encryption schemes in terms of their usage, adversary models and secu-rity levels, privacy-preserving goals, hybrid defense mechanisms and other dimensions. Finally, we summarize the realis-tic challenges of homomorphic encryption applied to machine learning privacy protection and provide an outlook on future research directions regarding the number of participants, data division patterns, feature sparsity problems, and de-neutrality.]]></description>
<pubDate>2024/5/31 9:35:02</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Wang He,WANG Li ming,Yao Pan,ZHENG Chao]]></author>
</item>
<item>
<title><![CDATA[Studying the Air Interface of Mobile Communication Networks to Identify Abnormal Uplink Traffic Utilizing Time-Frequency Occupancy Distribution Characteristics]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202210170000001&flag=2]]></link>
<description><![CDATA[The use of mobile communication networks to carry out unlawful location tracking, eavesdropping, and other attacks has the advantages of high camouflage, low cost, and difficulty in being discovered. In this paper, a method based on time-frequency occupancy distribution characteristics is proposed for identifying abnormal uplink traffic on the air interface of mobile communication networks. Gather the mobile communication net-work"s uplink frequency band signals, create a time-frequency resource map in accordance with the protocol"s time-frequency granularity specifications, and employ the ResNet18 network model to precisely count the number of mobile terminals in a given area and the uplink traffic of the air interface to detect location tracking, eavesdropping, and other spying techniques. Compared to conventional detection techniques based on network layer, downlink traffic analysis, and a pseudo base station, this paper"s algorithm does not require any prior knowledge and does not infringe on users" privacy, the fact that this article utilizes the uplink signal, which en-ables precise identification and localization of illicit uplink air interface activity in a given area, is more sig-nificant. This research develops a classification and identification method based on the properties of the signal physical layer and the network subcontracting mechanism for the identification of the number of terminals and service types. The method first accomplishes the identification of the number of terminals by combining the physical properties of the signal with the grayscale property of the image, and then realizes the separation of mixed services on this basis. Each communication service is identified, and then, using an adaptive adjustment algorithm, the results of each layer of tasks" identification are fed back and altered to guarantee the veracity and legitimacy of the findings. Using Universal Software Radio Device, the method suggested in this work is tested in its entirety in the context of the actual channel environment. The communication service identification accuracy rate reaches 96%, while the terminal number identification accuracy rate reaches 98%.]]></description>
<pubDate>2024/5/27 15:10:00</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huangweiqing,jifei,lijing,weidong,zhanghang,zhuangliqi]]></author>
</item>
<item>
<title><![CDATA[ITS：A Vulnerability Detecting Approach Based on Implicit Taint Source Identification for Embedded Devices]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202208090000004&flag=2]]></link>
<description><![CDATA[With the popularity of embedded devices such as routers and web cameras, security issues have become increasingly prominent. A general threat model for embedded devices is to use untrusted user input to construct malicious web requests or data packets, which consequently lead to denial of service or command injection attacks. Static vulnerability detection approaches based on taint analysis has been widely applicated in the security analysis of embedded devices in recent years as they are not dependent on physical devices or dynamic inputs. Unfortunately, when locating taint sources in the back-end binaries, existing techniques usually leverage explicit data identifications, such as common keywords between the front-end files and the back-end binaries of the same device firmware or constant network-encoding strings, resulting in false positives and false negatives in vulnerability detection. There are some locations in the back-end code of embedded device firmware which can acquire and handle input data but have no explicit identification information with the front-end code. We refer to these locations as the implicit taint sources. By analyzing and summarizing the binary code features of the implicit taint sources in the process of acquiring and handling input data, we design and implement a static vulnerability detecting approach based on implicit taint source identification (abbr. ITS). The prototype of ITS now supports detection of buffer overflow and command injection vulnerabilities. It also provides preliminary judgments on the conditions of vulnerability exploitations, which can be used as priority guidance for vulnerability patching without sacrificing the accuracy of vulnerability detection. We evaluated ITS on 10 embedded firmwares collected from 5 popular vendors. Comparing to the state-of the-art work SaTC, ITS improve the accuracy of vulnerability detection from 34.29% to 70.65%. Its false positive rate is similar to SaTC while its efficiency is increased by 1.53x. We have also discovered 6 unknown vulnerabilities.]]></description>
<pubDate>2024/5/27 15:08:49</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[duyuejin,huowei,lifeng,xulili,zhoujianhua]]></author>
</item>
<item>
<title><![CDATA[A survey of Malicious Entities Detection through DNS Data Analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202203240000003&flag=2]]></link>
<description><![CDATA[Domain Name System (DNS) is one of the most critical components of Internet. Given the infrastructure role DNS plays in the Internet, it is not surprising that it has been widely abused by attackers to supply various malicious activities. For example, attackers register typo squatting domains to launch phishing attacks, leverage algorithm genera- tion domains to communicate with compromised host, contaminate records in DNS servers and lead clients to malicious websites, and etc. In order to identify security threats existing in DNS activities, in recent years, researchers tend to de- tect malicious entities by analyzing DNS data. However, existing review works have certain limitations. Most works hardly comprehensively cover the malicious entity type since they usually use the attack type as classification criteria. In order to resolve this problem, we summarize research works during the past ten years and provide a comprehensive re- view from the perspective of malicious entities. In this paper, we first classify malicious entities involved in DNS activi- ties into three categories: malicious domain names, compromised hosts and networks, and compromised DNS services. For each category, we briefly explain its definition and further introduce their relevant attack scenarios. Secondly, we investigate DNS data that commonly used in researches and make a systemic introduction from four dimensions: basic data, supplemental data, labeled data, and data collection. Then, we take the malicious entity as the research object and summarize existing researches from three dimensions: malicious domains detection, compromised hosts and networks detection and compromised DNS services detection. We review these works systematically, discuss their methods, ana- lyze their advantages and disadvantages, and further point out existing problems. Finally, we look forward to the future direction of malicious entity detection through analyzing DNS data. In summary, this paper makes a comprehensive re- view and analysis of malicious entity detection, aiming to provide inspiration and reference for future research.]]></description>
<pubDate>2024/5/27 15:05:03</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[liyixin,Song Chen,Wang Liming,Xu Zhen]]></author>
</item>
<item>
<title><![CDATA[A Survey of Cellular Protocol Vulnerability Discovery]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202207210000001&flag=2]]></link>
<description><![CDATA[Mobile cellular networks, such as LTE and 5G/NR, have promoted the development of many important applications and services such as smart home, unmanned driving, telemedicine and so on. As the foundation of cellular network, there are various vulnerabilities in cellular protocol implementations and specifications, which may cause serious security problems. Compared with traditional network protocols such as DNS and TLS, cellular network protocols are composed of several sub-protocols across multiple layers that are inter-dependent and stateful in nature. The message type, state and state migration of the cellular protocol are more complex. These characteristics make it difficult to discovery the vulnerabilities of cellular protocol. This paper summarizes the systematic vulnerability discovery methods for cellular protocol in the past ten years.We first summarize the challenges in this field, then divide them into three categories: the analysis and extraction technology of protocol design knowledge, the vulnerability discovery technology for cellular protocol specification, and the vulnerability discovery technology for the cellular protocol stack implementation. Through statistical analysis of the differences of these technologies in analysis objectives, supported vulnerability types, manual participation and domain knowledge requirements, the advantages and disadvantages of each technology are compared and evaluated. Finally, the current problems in this field are discussed and the future research directions are prospected.]]></description>
<pubDate>2024/5/27 15:03:36</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Huo Wei,Li Feng,Liu Yiming]]></author>
</item>
<item>
<title><![CDATA[A coverless image steganography method using deep learning with feature distribution optimization]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201280000001&flag=2]]></link>
<description><![CDATA[In recent studies, selection-based coverless steganography using deep learning has made some new progress. How-ever, these methods only take the deep neural network as a tool to establish the mapping relationship between mes-sage codewords and images, and do not consider how to improve the performance of steganography schemes by improving the model and optimizing the feature distribution. As a result, their performance in key indicators such as resist attack, communication capacity and completeness are difficult to meet the requirements of practical commu-nication. Therefore, starting with the design of mapping rules, this paper proposes a selection-based coverless ste-ganography method Feadio based on optimized neural network feature embedding, which is complete. Secondly, the distribution relationship between original images and attacked images in the embedding space is explored. In order to improve the resist attack and communication capacity of Feadio, and shorten the feature embedding distance between the attacked images and the original images that belong to the same class, the better representation effect is obtained by optimizing the embedded feature distribution in the hypersphere space. Finally, by introducing the ArcFace Loss into the model, the distance of the same class features is effectively reduced and the distance of dif-ferent class features is increased, making the feature distribution learned by the model in Feadio more discrimina-tive. The experimental results show that Feadio can not only ensure 100% completeness and the most advanced communication capacity, but also achieve 100% resist attack in the face of most geometric and noise attacks, and obtain the excellent performance of correctly extracting 11997 messages for 12000 attacked images in the real communication. In addition, this paper proposes a benchmark dataset OSNA-Face to evaluate the ability of resist attack of coverless steganography method for the first time, which measures the resist attack ability of the method from a more objective and realistic point of view. The source code of Feadio and OSNA-Face dataset can be ob-tained from the authors" website (https://ndsiiecas.github.io/) to verify the effectiveness of this paper and the authenticity of the experimental results.]]></description>
<pubDate>2024/5/16 8:53:08</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[WU Bin,XUE Rui]]></author>
</item>
<item>
<title><![CDATA[Overview of Advanced Persistent Threats Detection Technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202203020000001&flag=2]]></link>
<description><![CDATA[In recent years, the rapid development of network technology has brought great changes to the society. At the same time, all kinds of attacks in the network are increasing, especially the advanced persistent threats (APT) are increasing significantly, which has attracted extensive attention from the industry and academia. APT is a targeted, organized, covert and highly sophisticated attack, which is difficult to detect than normal attacks. Therefore, how to detect APT attack quickly and accurately is an urgent problem to be solved at present. Researchers have put forward a large number of solutions and tried to detect APT attack from different aspects. This paper collects and summarizes these existing researches. Firstly, this paper introduces the basic concept of APT and common attack models, and divides the stages of APT attack from the perspective of detection and defense. This paper also introduces the detection carriers that can be used to detect APT attacks, such as malicious files, network traffic, logs and external knowledge. Then, this paper classifies the APT detection methods from the point of view of attack stages, and divides APT attack detection methods into specific stage detection methods and overall collaborative detection methods. This paper introduces the corre-sponding detection methods in detail and analyzes their advantages and disadvantages. Among them, the specific stage detection is used to detect each stage of APT. It includes detection of reconnaissance preparation stage, detection of external penetration stage, detection of command and control stage, detection of lateral movement stage and detection of data leakage stage. The overall collaborative detection is combined with a variety of data for the whole process of APT detection. Finally, the limitations and challenges of existing detection methods are discussed, and the future re-search directions are prospected. This paper hopes to provide some useful references for the research of APT detection technology.]]></description>
<pubDate>2024/5/16 8:52:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[hanxueying,jiangbo,liurunshi,liusong,luzhigang,wangzehui]]></author>
</item>
<item>
<title><![CDATA[A Survey on Attribute Identification Techniques of the IoT Devices in the Cyberspace]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202204020000002&flag=2]]></link>
<description><![CDATA[The Internet of Things (IoT) has a wide variety of devices, including security monitoring, printers, industrial control, smart wear, smart buildings and so on. These devices can interconnect various physical, logical and user layer resources through various forms of IoT protocols such as ZigBee, MQTT and BLE. Therefore, IoT devices are important physical resources in cyberspace. To facilitate remote access by users, a huge number of IoT devices are directly connected into the cyber-space. Compared to traditional IT devices such as servers and personal hosts, IoT devices have limited computing and storage resources, which prevent them from being implemented with the same security measures. However, these IoT de-vices, which lack adequate security protection, have been exposed to a large number of security vulnerabilities. Attacks against IoT devices are increasing day by day, posing a serious challenge to cyberspace security. As a result, IoT devices have become the main target of cyberspace mapping. Among them, the identification of network, product, system, secu-rity and other attributes of IoT devices is the core of the technical architecture of cyberspace mapping, thus becoming a research hotspot in the field of cyberspace security in recent years. First, this paper studies and analyzes the technical ar-chitecture of attribute identification of IoT devices in cyberspace, and explains the core role of attribute identification in the technical architecture. Then, this paper divides the development of IoT device attribute recognition technology into three stages according to the types of recognition attributes and the characteristics of recognition technology. Finally, this paper synthesizes the research progress of IoT device attribute recognition technology from three key aspects of recogni-tion technology: feature extraction, fingerprint identification and classification identification, and discusses and outlooks possible future research directions of IoT device recognition. This paper hopes to provide reference and reference for re-searchers in this field.]]></description>
<pubDate>2024/5/16 8:52:22</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LI Hong,LI Zhi,SUN Limin,WANG Jinfa,YAN Zhaoteng,ZHU Hongsong]]></author>
</item>
<item>
<title><![CDATA[Research on Cloud Cryptographic Resource Service Architecture]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202205100000002&flag=2]]></link>
<description><![CDATA[Driven by cloud computing technology, traditional cryptography is transforming into cloud cryptographic services. At present, cloud cryptographic service is still in its infancy, and most of the existing studies are cloud cryptographic functional services oriented to a certain application scenario, and there is a lack of research on cloud cryptographic re-source services. Through the analysis of the existing cloud cryptographic service schemes and combined with the cloud requirements of cryptographic service, this paper proposes a new cloud cryptographic resource service architec-ture-CryptCRS, which can dynamically schedule cryptographic service and elastically expand cryptographic operation, and provides users with the cryptographic service generated in the cloud platform. Specifically, CryptCRS realizes the vir-tualization of cryptographic hardware resources based on shared memory, virtualizes a PCIe cryptographic card into mul-tiple virtual cryptographic cards, and then encapsulates it as a virtual cipher machine for users; By designing a high-security key management system, the whole life cycle security management of the key is realized; The user data key is protected by double encryption, and realize the security isolation of the key at the user level; Realize that the key is only circulated in the form of ciphertext between cryptographic facilities, which enhances the security of the key; To further ensure the security of key transmission, this paper designs a security authentication and key agreement protocol between the key management system and the card based on the PUF feature of the card and uses the physical fingerprint generated by the card as the trusted root, and the BAN logic is used to prove the security of the protocol. Finally, this paper implements a cloud cryptographic resource service prototype system based on the OpenStack open source cloud platform and conducts an experimental analysis of the system. The experimental results show that the performance of CryptCRS is better than the existing cryptographic card software virtualization methods, and its higher cloud cryptographic resource service capability can fully meet the requirements of high-availability and high-concurrency cryptographic applications.]]></description>
<pubDate>2024/5/15 14:46:20</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Feng Yanchang,Kang Ying,Li Chen,Tu Bibo,zhangkun]]></author>
</item>
<item>
<title><![CDATA[The Defenses of Use-After-Free Vulnerabilities: A Survey]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202204280000001&flag=2]]></link>
<description><![CDATA[With the development of system security attack and defense technology, the importance of memory security issues has become increasingly prominent. Therefore, it is of great practical significance to explore the attack methods and defense measures of memory security vulnerabilities. As an important type of memory security vulnerability, the number of use-after-free vul-nerabilities exposed in recent years has been on the rise, involving important system software such as operating systems and various common user applications. The use-after-free attack is one of the root causes of control-flow hijacking, data-flow hijacking and information leakage attacks. Therefore, how to efficiently defend against use-after-free vulnerabilities has gradually become a research hotspot. This paper summarizes and analyzes the common attack steps of use-after-free attacks with the example. After investigating the existing defense mechanisms for use-after-free attacks, this paper divides them into three categories according to the attack steps they target, including checking or clearing dangling pointers before freeing memory chunks, restricting the reallocation of freed memory blocks and checking whether the pointer and memory block metadata match before accessing memory. According to the different defense methods, this paper further subdivides these categories of mechanisms and summarizes the development of the related works on different defense methods. Then this paper summarizes the different concerns of related research works, including performance overhead, memory overhead, security, compatibility, tunability, software-hardware co-design and so on. According to these characteristics, this paper systematically compares the advantages and disadvantages of various kinds of use-after-free defense mechanisms and analyzes the challenges and existing solutions of various types of characteristics when implementing defense mechanisms. Finally, this paper proposes future research directions worthy of attention, including the design of use-after-free defense mechanisms for IoT devices and operating system kernels, the compatibility of different types of defense mechanisms for different kinds of memory management libraries, and issues needing attention for future software-hardware co-design and so on.]]></description>
<pubDate>2024/5/15 14:45:47</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Rui Hou,Dan Meng,Ying Jiameng,Shijun Zhao]]></author>
</item>
<item>
<title><![CDATA[Overview of Defense Technologies for Augmented Reality Security]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201070000002&flag=2]]></link>
<description><![CDATA[Augmented reality(AR) utilizes virtual information to enhance users" perception of the real world and provides a fantastic experience of virtual reality integration. In recent years, with the development of 5G and edge intelligence, AR technology has been developed rapidly and its industrial applications are increasing progressively. Under the development tide of the metaverse, AR technology, which is an important part of the metaverse, still has broad space to develop in the future. Different from the traditional wearable technology in Internet of Things(IoT), AR has the characteristics of virtual-reality superposition, multi-application architecture and multi-user interaction, which introduces a series of new security problems and faces severe challenges in display, interaction and content processing, etc. In order to avoid the restriction of these security problems on the further development of AR technology, the research on security defense technology in AR has become a research hotspot in academia and industry. Focused on the cutting-edge researches of security defense technology in AR, this paper systematically summarizes and discusses the technical principles and defensive effects of the existing work. Specifically, this paper introduces the core concepts and background knowledge of AR firstly, and then briefly analyzes the AR architecture and presents the security problems of AR. Secondly, from the perspective of dealing with the intrinsic and associated security risks of AR, this paper summarizes and analyzes the existing security defense technologies. Among them, the countermeasures to the intrinsic security risks of AR are mainly related to sensors, displays and interactions, while those to the associated security risks are mainly introduced by computing offloading and content processing. For the classic work in each category, we conducted a comprehensive analysis. Finally, this paper discusses the security challenges of AR, and provides an outlook for the future research direction in this field.]]></description>
<pubDate>2024/5/15 14:45:13</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LIU Jinxia,LIU Yanwei,WANG Fengchao,WANG Liming,XU Zhen]]></author>
</item>
<item>
<title><![CDATA[Cheating Behavior Detection Based on Image and Text Similarity of WriteUp]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201200000002&flag=2]]></link>
<description><![CDATA[Cybersecurity issues emerge in endlessly and cybersecurity talents’ gap is huge. How to ensure the fairness and justice of cybersecurity talents evaluation and select qualified cybersecurity talents have become a top priority. For the cheating in cybersecurity competitions and the difficulty of many WriteUps checking, this paper proposes a cheating behavior de-tection method. It checks the cheating across two dimensions: image similarity and text similarity. Three algorithms are adopted to compute the image similarity by using histogram, mean hash and length-width ratio. Word frequency similar-ity and word transferring probability similarity are used to compute the text similarity. Through 30 WriteUps with con-tent analysis, the cheating detection method could identify cheating behaviors in competitions, which verifies feasibility and effectiveness of the method. Meanwhile, the cheating source could be traced according to flags’ submission time. The corresponding flags are obtained by solving competition questions. The detection method proposed in this paper can be applied to other cybersecurity talents evaluation.]]></description>
<pubDate>2024/5/15 14:44:43</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CUI Xiang,LIU Baoxu,LIU Qixu,LIU Xinyu,ZHANG Fangjiao,ZHAO Jianjun]]></author>
</item>
<item>
<title><![CDATA[A Chaos-Based Secret Key Generation Scheme from Phys-ical Layer Characteristics of Wireless Channel]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202203170000002&flag=2]]></link>
<description><![CDATA[The wireless communication is vulnerable to eavesdropping due to its inherent open and broadcast nature. Therefore, the security issue of the wireless communication has attracted great attention. In the past few decades, scholars mainly focus on the upper layer encryptions, and the traditional encryption mechanism is usually employed on the upper layer. How-ever, the introduced resource consumption is relatively high in the upper layer encryption. And the security provided by the upper encryption is limited with the improvement of the computing capability and algorithm technology. Faced with the problems brought by the upper layer encryption, the physical layer encryption can be a good solution. And the physi-cal layer security is based on the information security theory. It is worthy to note that the chaotic systems are featured as high sensitivity to the initial value, pseudo-randomness and ergodicity. These features conform to the relevant character-istics of cryptography, and they have provided a good solution for the physical layer security. Secret key generation from the physical layer characteristics of wireless channel is an important research direction among physical layer security technology. A chaos-based secret key generation scheme from physical characteristics of wireless channel is proposed. The characteristics of chaotic systems, such as high sensitivity to the initial value, pseudo-randomness is made full use. The chaotic system is employed as the key generation extension system. The initial keys are obtained from the indices of the channel frequency response in the OFDM system, and then they are transformed into the initial value of the chaotic system. In the end, the final keys are generated from the chaotic system. The corresponding simulation results reveal that good key generation rate, key disagreement rate and key randomness can be obtained in the proposed scheme. This re-search provides important theoretical guidance for the application of the chaos-based secret key generation from the physical layer characteristic of wireless channel.]]></description>
<pubDate>2024/5/15 14:42:04</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Lijing,Zhang Shunliang,zhangxiaohui]]></author>
</item>
<item>
<title><![CDATA[Intent-based dynamic generating security policy for software-defined perimeter]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202203240000001&flag=2]]></link>
<description><![CDATA[Since the inception of cloud computing, it had become the most mainstream computing platform, for its flexible, dynamic and scalable new service model was favored by the industry. However, with the constant enlargement in network scale and the rapid development of cloud computing, the  network management was becoming extremely complex, the shared underlying infrastructure in the cloud，as well as the virtualization of the network perimeter and other features made the cloud environment more and more vulnerable to be attacked. The security issues of cloud had become increasingly prominent. The traditional method was based on fixed perimeter and static configuration of security policies，thus it was difficult to respond to cloud security protection requirements. In order to alleviate this problem, an intent-based method of dynamic generation of software-defined perimeter security policies was proposed. Under the software-defined network architecture, made use of software-defined perimeter technology to build a cloud security management framework, which separate security policy management from perimeter control points. Then decoupled the security policy from the underlying network through “intent” to achieve dynamic adjustment and timely response of security policies with network changes. First of all, the knowledge graph of cloud security policy elements was constructed. To the second, a professional descriptive language of security policy was provided to express the intention with ignoring the bottom implementation details, and the network entities in the intent expressions were identified through intent parsing. Then, a decision diagram was used to translate the intent into a mid-level policy. Finally, the mid-level policy was combined with a knowledge graph of security elements to guide the dynamic generation of the underlying network configuration policy. The experimental results showed that the proposed schemes were valid and accurate. The methods could be used for reference to realize dynamic and adaptive protection services for security policies in the cloud.]]></description>
<pubDate>2024/5/15 14:41:29</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[sunruina,tubibo,xiahaojun,youruibang]]></author>
</item>
<item>
<title><![CDATA[AI-Powered Cyber Threats: A Survey]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202204120000001&flag=2]]></link>
<description><![CDATA[In recent years, the threat of artificial intelligence (AI) in cyber attacks has been continuously increasing. In order to help researchers quickly understand the relevant principles and conduct research on defense methods, it is necessary to analyze the characteristics of AI and the principles of AI-powered cyber threats and sort out relevant cases. To this end, we analyzed the capabilities of artificial intelligence and the nature of the neural network model and divided the roles of artificial intelligence in cyber threats into five categories: forgery and deception, stealth and anonymity, perception and decision-making, targeting hand customization, and scale and automation. On this basis, the influence of the characteristics of artificial intelligence on the five roles is analyzed, and the enabling matrix of artificial intelligence to cyber threats is formed. Then, we collected the existing AI-powered cyber threat works and classified the cases into 18 categories. Combined with the cyber kill chain, an AI-powered cyber threat framework is formed, and the cases of AI-powered cyber threats are introduced based on the three stages of an attack: preparation, intrusion, and execution. The principles, effects, and progress of representative works in each category are included, as well as their strength and limitation. Subsequently, we analyzed the effectiveness and limitations of existing defense methods from the perspective of the capabilities of attackers and defenders, pointed out the differences between AI-powered cyber threats and other threats, and put forward the possible defense measures targeted at AI from three dimensions of scenario, technology, and system. Combined with the evolution of AI technology and cyber threats and the deficiencies and constraints of AI-powered cyber threats, we discussed the effectiveness of AI in cyber threats and prospected the future trends of AI-powered cyber threats. We hope this paper will help defend against AI-powered cyber threats in the future.]]></description>
<pubDate>2024/5/15 14:40:54</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Cui Xiang,Liu Chaoge,Liu Qixu,Wang Xutong,Wang Zhi,Yin Jie]]></author>
</item>
<item>
<title><![CDATA[A Survey of RFID Security Risk Analysis and Countermeasures]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201260000002&flag=2]]></link>
<description><![CDATA[Radio Frequency Identification (RFID) technology is a non-contact, automatic identi?cation technology by using radio frequency signals. It has increasingly attracted people"s attention with its portability and low cost, and has gradually en-tered the industrial field and our daily life. On the one hand, RFID technology has become one of the key infrastructures affecting security, such as access control, anti-counterfeiting and other applications. On the other hand, it is also being used to improve key industries and applications such as military, medical and logistics. Once there are security flaws and security loopholes in these applications, it is bound to cause more serious adverse effects, and even affect social devel-opment and national security. However， the communication between the tag and the reader is carried out over an inse-cure wireless channel. The attacker can eavesdrop, relay, man-in-the-middle, and replay the communications between readers and tags. For tags, low cost and portability also limit security. They are vulnerable to reverse engineering, re-moval, tampering, cloning and other attacks. In addition, with the emergence of new RFID applications, the proposed countermeasures constantly show limitations in terms of effectiveness, efficiency, security, privacy or applicability. The countermeasures therefore need to evolve to stay ahead of the curve. According to the components of the RFID system, this survey focuses on the primary attack methods and countermeasures faced by the RFID system in recent years from the three aspects of physical threat, channel threat and terminal threat. We focus on analyzing the research progress of related attacks and countermeasures at various levels and comparing their advantages and disadvantages of them in prac-tical applications. Finally, we summarize the main trends of RFID system security research at the current stage and look forward to the future development direction. We hope that this survey can act as a reference and inspiration and can pro-vide ideas for future researchers.]]></description>
<pubDate>2024/5/15 14:40:08</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[caoziwen,fengyue,huangweiqing,jiangshang@iie.ac.cn,wangsiye,zhangyanfang]]></author>
</item>
<item>
<title><![CDATA[Towards Non-independence of Modular Addition in Dif-ferential Cryptanalysis of ARX-based Ciphers]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202202110000001&flag=2]]></link>
<description><![CDATA[ARX-based ciphers, constructed by modular addition, rotation and XOR operations, have been receiving more and more attentions in the design of lightweight symmetric ciphers in recent years. In the current framework of differential crypta-nalysis and Rotational-XOR (RX) cryptanalysis of such kinds of ciphers, the independence assumption is often adopted, that is, the propagation of differentials or RX differentials through different modular addition operations in a cipher are often assumed to be independent. However, when there are consecutive or parallel modular additions in the cipher, this assumption does not necessarily hold. In this paper, we study the non-independence of modular additions in the propaga-tion of differentials and RX differentials. By deriving the differential equations of a modular addition under these two kinds of differentials, we find the influence of non-independence can be described by relationships between the differen-tial constraints on the inputs and output of the modular addition. Based on this, we introduce a SAT-based method to ver-ify the validity of differential and RX characteristics and apply it to three typical ARX ciphers with consecutive or parallel modular additions. For SipHash, which consists consecutive modular additions in the round function, we find the differen-tial characteristics and RX differential characteristics found by Xin et al. at CANS 2019 are all invalid due to incompatible differential constraints of consecutive modular additions. For Ballet-128/128, which consists parallel modular additions in the round function, we find the valid optimal differential characteristic of 7 rounds and extend it to a valid 9 round char-acteristic with probability 2-52. In addition, we construct a new ARX cipher, the core component of whose round functions is adopted from the nonlinear diffusion function designed by Liu et al. in DCC 2018, which is composed of four parallel modulo additions. We give elementary analysis of its security under differential attacks with the consideration of non-independence of modular additions.]]></description>
<pubDate>2024/5/15 14:13:28</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Qinhaiwen,WuBaoFeng]]></author>
</item>
<item>
<title><![CDATA[Computer Recognition Based on Convolutional Neural Network]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201210000001&flag=2]]></link>
<description><![CDATA[Information equipment will inadvertently emit electromagnetic radiation during work, and electromagnetic radiation signals can be intercepted and restored to obtain sensitive information processed by the information equipment, posing a threat to national and personal information security. In addition, the radiation may reveal the hardware information of the computer, which is more important for some attackers, protectors and security inspection workers. It is critical to detect the electromagnetic leakage signal, track down the source of the leakage, and implement targeted information security protection. The purpose of this research is to present a new method of computer individual identification based on an examination of the characteristics of electromagnetic leakage signals from various computer equipment. Drawing on feature extraction methods in speaker recognition research and introducing deep learning technology, this method, which is based on Short Time Energy (STE) and Linear Prediction Coefficient (LPC), Extract shallow features of electromagnetic leakage signals. Then use Convolutional Neural Network (CNN) to identify the computers individually Convolutional neural network effectively combines feature extraction and classifier into one framework, learns the essential characteristics of data from samples, and realizes the approximation of complex functions. This paper mainly uses convolutional neural network to complete automatic deep feature extraction and classification and recognition. The extraction of signal features and the classification of two originally separated tasks are combined to simplify the operation of manual feature extraction and effectively improve the scalability and environmental adaptability of computer individual recognition. Experimental validation shows that in our experiment environment the model provided in this paper has a recognition accuracy of 97.8 percent on the verification set, which shows that our model has good computer individual recognition capabilities and can identify computers accurately through electromagnetic radiation. At the same time, we evaluates the performance of the model under different signal-to-noise ratio conditions through experimental simulation, which verifies the robustness of the method.]]></description>
<pubDate>2024/5/15 14:12:49</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HUANG Weiqing,XU Yanyun,ZHENG Xueqi]]></author>
</item>
<item>
<title><![CDATA[Physical Layer Authentication Based on Channel Polarization Response in Time-invariant Channels]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201140000002&flag=2]]></link>
<description><![CDATA[Authentication is a key requirement for secure communication in modern wireless systems. Compared with the upper-layer authentication scheme based on encryption technology, physical layer authentication has the advantages of low computational complexity, high security, and good compatibility, since it exploits intrinsic and unique features of the physical layer to authenticate the transmitter. At present, the researches on physical layer authentication mainly focus on the schemes based on channel impulse response (CIR) and channel frequency response (CFR). However, those schemes have three limitations. First, the authentication performance depends on and is proportional to the length and density of the pilot signal, but increasing the length and density of the pilot signal to improve the authentication performance will bring large communication overhead. Second, the received signal needs to be synchronized and demodulated before authentication. When the received signal comes from an illegal transmitter, it will bring unnecessary resource overhead. Third, the CIR and CFR reflect the spatial distribution of scatterers in the channel. In this paper, we propose a physical layer authentication scheme based on channel polarization response (CPR) to effectively overcome the aforementioned limitations. The CPR represents the essential physical properties of the scatterer and depicts finer channel information than CIR and CFR. In addition, CPR can be directly estimated from the polarization state of the received signal without synchronization and demodulation. Using statistical signal processing, matrix analysis and hypothesis test, we establish a CPR based authentication model in time invariant channel, and theoretically deduce the false alarm probability, detection probability, optimal threshold, and computational complexity of the scheme. Through extensive simulation experiments, the theoretical correctness and effectiveness of the proposed scheme in time-invariant channel are verified. Simulation results show that under the same channel, the proposed scheme has higher authentication accuracy and lower computational complexity than CFR based schemes, and can still achieve high authentication accuracy under low SNR.]]></description>
<pubDate>2024/5/15 11:29:44</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HUANG Weiqing,LI Jing,WEI Dong,WU Yuemei,ZHANG Qiaoyu]]></author>
</item>
<item>
<title><![CDATA[Integrated Risk Assessment Algorithm for Functional Safety and Information Security of Industrial Control Systems]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201130000001&flag=2]]></link>
<description><![CDATA[The deep integration of informatization and industrialization has broken the closed network boundaries of industrial con-trol systems, leading to the penetration of traditional information system network attack threats into the industrial control system networks. Industrial control systems not only need to consider traditional functional safety risks in them, but also need to pay attention to their information security risks. This paper proposes an integrated risk assessment algorithm for functional safety and information security of industrial control systems. The algorithm includes three steps, safety and security integration risk data collection, risk analysis and risk evaluation. This algorithm starts from the perspective of the source of risk data, collects functional safety and information security risk data at the same time, generates the extended attack tree model which can analysis cyber-physical coordinated attack paths in the risk analysis step, and considers the functional safety loss and information security loss caused by safety events and security events when calculating event risks, etc., so as to realize the integrated risk assessment of functional safety and information security. This paper intro-duces the integrated risk assessment model and algorithm for functional safety and information security of industrial control systems, verifies the effectiveness of the risk assessment algorithm in the built gas pipeline network test system, and then compare the result with the evaluation results of existing risk assessment methods such as fault tree, attack tree, attack tree and bow-tie combination (AT-BT) method. The experimental result shows that the safety and security integra-tion risk assessment algorithm proposed in this paper can not only analyze the most likely safety events and security events in the system, but also solve the problem that the existing risk assessment methods cannot identify the type of safety and security risks when the physical domain and the information domain interact with each other to some extent.]]></description>
<pubDate>2024/5/15 11:24:15</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DING Yunjie,LIU Puzhuo,LV Shichao,MA Yetong,PAN Zhiwen,SUN Limin]]></author>
</item>
<item>
<title><![CDATA[A Context-Sensitive System for Restructured Cloning Vulnerability Detection in Solidity Smart Contract]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202112220000003&flag=2]]></link>
<description><![CDATA[With the development of blockchain, smart contracts are very popular. We have observed that smart contract programmers tend to copy and paste code to quickly duplicate some functionality, which can introduce clone-related vulnerabilities into new smart contract. With the fact that nearly 90% of smart contracts on Ethereum are clones, the harmfulness of cloning-related vulnerability has been magnified. Even worse, programmers may modify the copied source code across functions, which poses a huge challenge for detecting such restructured cloning vulnerability. Due to the immutability of blockchain data, it is very difficult to repair the deployed vulnerability smart contracts. Therefore, it is urgent to perform clone vulnerability detection on the code of smart contracts before deploying them. In this paper, to fill this gap, we propose a context-sensitive and scalable method to detect restructured cloning vulnerability in Solidity smart contracts, called Sol-RCVD. It does not require pre-defined vulnerability features, and it can automatically generate two granularities of vulnerability fingerprints based on the existing vulnerability smart contract code, including Function granularity and Line granularity. And we use inter-process program slicing to make the multi-granularity fingerprint context-sensitive, the improved fingerprint contains more contextual information and finer-grained code information. We evaluate our method both in the artificially constructed dataset and Ethereum smart contract dataset, the experiment result shows that Sol-RCVD has much lower false negative rate and lower false positive rate compared with competitive methods. Sol-RCVD outperforms them in terms of both accuracy and scalability (0.37 seconds per contract file), which can help developers detect vulnerabilities efficiently during the smart contract de-velopment stage. We also compare Sol-RCVD with 8 state-of-the-art detection tools that are not focused on clone-related vulnerability, and Sol-RCVD performs best. Based on Sol-RCVD, we have detected hundreds of vulnerable smart contracts in Ethereum that have never been reported before and obtain 4 CVEs.]]></description>
<pubDate>2024/5/15 11:23:38</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[WU Bin,YU Zhengmin,YU Xingxin]]></author>
</item>
<item>
<title><![CDATA[Design and Implementation of a Lightweight and Loss-tolerant Secret Key Splitting Scheme for Mobile Terminals]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202112220000006&flag=2]]></link>
<description><![CDATA[With the development of mobile Internet, mobile terminals have been widely used to deal with sensitive business in recent years. The sensitive business usually relies on the signing mechanism to provide authentication, non-repudiation and integrity protection. However, the complicated mobile operating systems fail to server as a secure execution environment for the signing operations due to the emerging vulnerabilities and malicious applications. SM2 threshold cryptography is one of the important ways to protect the signing procedure and the private key for terminal sensitive applications. However, existing SM2 threshold scheme requires 2t+1 participants to complete the signing procedure, which is inconvenient to use and requires a large amount of communication and calculation. Moreover, it has not well considered the secret key share stealing through physically obtaining the mobile devices, which is more prone to happening in the mobile scenario. Also, existing scheme does not provide mechanisms to update or add new key share. In this paper, we propose an SM2 threshold secret key splitting algorithm, according to the practical application requirements in the mobile scenario. By converting the multiplication operation in the standard SM2 signature algorithm to the addition operation, we could perform signing with t+1 participants. Corre-spondingly, the amount of communication and computation in the signing stage is reduced. In order to tolerate the loss of equipment and key shares, we also analyze and study the private key share updating and adding mechanisms based on the proposed algorithm. Next, we design and implement a (3,5) threshold signature prototype system for the Android platform. In the implementation, we introduce the fingerprint-based authentication and Android Key-Store mechanisms to enhance the security of private key shares during their generating, storing and utilizing phases. Finally, we analyze the security and efficiency of our algorithm, and evaluate the actual performance overhead on the prototype system.]]></description>
<pubDate>2024/5/15 11:08:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CHANG Jiang,KOU Chunjing,LEI Lingguang,WANG Pingjian,WANG Yuewu,ZHOU Quan]]></author>
</item>
<item>
<title><![CDATA[Research on Lightweight Dynamic Authorization Mechanism for BMC System]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202111040000001&flag=2]]></link>
<description><![CDATA[The baseboard management controller-based out-of-band management of servers has become an industry standard for data center operation and maintenance. However, as the core control unit in out-of-band management, the base-board management controller has long been plagued by security risks such as excessive privileges and authorization abuse. Considering that it is an embedded device with constrained computing and storage resources while needing to support multiple types of management protocol interfaces. Directly deploying the existing authorization mecha-nism will significantly increase the system load and cause an abnormal response of some management functions. Besides, each management protocol needs its proprietary scheme, which dramatically increases the authorization mechanism"s complexity. In this paper, we have proposed a lightweight dynamic authorization mechanism consist-ing of a definition rule and a dynamic authority management engine. The definition rule redefined the incompatible management privileges of different protocols into a unified privilege descriptor, achieving the unified and fi-ne-grained division of management privileges. Based on the definition rule, the authority management engine can maintain the life cycle of user privileges, control user access, dynamically modify the user privileges, and audit user operations by intercepting user session requests and management requests. Considering the resource-constrained nature of the baseboard management controller, in order to reduce the complexity of the implemented program, the dynamic authorization mechanism uses the DBus framework that is provided by the system running on the base-board management controller for fast and standardized inter-process communication. The proposed mechanism also uses the Linux Inotify mechanism to cache the required files so as to reduce system-level I/O load. Meanwhile, the access control process is simplified to keep the dynamic authorization mechanism lightweight and efficient. Ex-perimental results show that our proposed mechanism achieves the dynamic management of user privileges. In the meantime, it has a much lower overhead on the system performance and can ensure the timely response of any management functions.]]></description>
<pubDate>2024/5/15 11:07:52</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Liu Hongwei,Tu Bibo,Wang Xiaotong,Xia Haojun]]></author>
</item>
<item>
<title><![CDATA[Processing Technology for Cyber Threat Intelligence: A Survey]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201080000001&flag=2]]></link>
<description><![CDATA[With the continuous development of attack and defense countermeasure technology in cyberspace, the national confrontation in cyberspace has been exposed. Advanced Persistent Threat (APT) has become a crucial way of con-frontation among countries in cyberspace. Attack methods are more diverse and complicated for attackers. Diversi-fied attack entry points, high-level intrusion methods, systematic tools reduce the cost of cyber attacks. It is in-creasingly difficult for defenders to detect and defend against cyber attacks. Traditional security defense mostly relies on security devices such as intrusion detection system and intrusion prevention system. This static defense way cannot effectively deal with new attacks. Under this circumstance, the traditional security solutions are facing severe challenges. However, the emergence of cyber threat intelligence processing technology has brought new possibilities for improving the defense level for the entire cyberspace. At present, cyberspace threat intelligence has become a hot issue in the industry and academia, and continues to attract attention, and is widely used in many scenarios such as threat detection and discovery, attack attribution, threat prediction. Cyber threat intelligence plays an increasingly important role in the entire cyber security defense system. The efficient threat intelligence processing technology is of great significance to the value of threat intelligence. Therefore, this paper firstly briefly describes the definitions of threat intelligence commonly used, three kinds of representative threat intelligence and their contents, and reviews the development and research status of threat intelligence at home and abroad. Then we discusses and summarizes the key technologies of threat intelligence processing around the life cycle of cyber threat intelligence, including threat intelligence collection and fusion, threat intelligence analysis and mining, threat intelligence sharing and exchange, and threat intelligence application and service. By analyzing the advantages and shortcomings of existing solutions, we propose some possible solutions. Finally, the four challenging research di-rections, producing localized threat intelligence, mining hidden threat intelligence, establishing efficient intelli-gence sharing mechanism, extending threat intelligence application scenarios, are prospected.]]></description>
<pubDate>2024/5/15 11:07:12</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DU Xiangyu,FENG Huamin,JIANG Jun,JIANG Zhengwei,LIU Baoxu,MA Chunyan,WANG Shirui,WANG Xuren,ZHANG Zheyu]]></author>
</item>
<item>
<title><![CDATA[Instantiations of Zero Knowledge Proof for ISIS Problem]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202111220000001&flag=2]]></link>
<description><![CDATA[With rapid developments of quantum computation, traditional number-theoretic difficulty assumptions are confronting with challenges, and designing quantum-secure cryptographic primitives to replace the existing number-theoretic versions gradually has been an urgent demand in post-quantum era. As one of popular candidate quantum-secure assumptions, lattice-related difficulty assumption has received much attention and made a good performance in design of post-quantum algorithms. Lattice cryptography has been a main direction in post-quantum cryptography, which enjoys the advantages of quantum resistance, asymptotic efficiency and worst-case difficulty assumption. Inhomogeneous small integer solution (ISIS) is frequently used in lattice cryptography, and zero knowledge proof for ISIS is one of central building blocks in many post-quantum cryptographic protocols. Zero knowledge proof schemes for ISIS are divided into two categories: exact proof and relaxed proof. Though relaxed proof achieves much shorter proof size, exact proof does cover the special demand on exactness better in some application circumstances. The existing exact proofs for ISIS problem include Stern-type schemes and the schemes taking usage of the algebraic structure of cyclotomic fields, where those in the latter hold only for some special restricted modulus q. This paper aims at instantiation of Stern type zero knowledge proof for ISIS. Stern type zero knowledge proof was given by Ling San et al. in PKC 2013 (called LNSW protocol), which can be applicable to any general modulus q. Their protocol preprocessed the secret vector with binary decomposition and then proved the resulting statement by Stern framework obeying the “commit-challenge-response” paradigm. The commitment scheme they use is computationally binding, thus LNSW protocol is zero knowledge argument of knowledge, implying that its knowledge soundness holds only with respect to computationally-bounded malicious prover. In this paper, firstly, we give two instantiations of LNSW protocol: The first one is obtained by constructing an integral LWE-based commitment scheme and embedding it into LNSW protocol, and the second one is implemented by using the existing xLPN-based commitment scheme. They are common in that both of them use perfectly binding commitment scheme and thus have stronger knowledge soundness—computationally-unbounded knowledge soundness and thus the whole protocol turns out to be zero knowledge proof of knowledge. Secondly, we compare these two instantiations from the respect of difficulty assumption and efficiency. At last, taking some concrete application as example, we compare their zero knowledge property and communication efficiency with previous ones and take some concrete application as an example to conclude that our first instantiation has better communication efficiency in this setting.]]></description>
<pubDate>2024/5/15 11:06:35</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[gaohongmin,hulei,huangguifang,wangmengfan]]></author>
</item>
<item>
<title><![CDATA[An Algorithm for Enhancing the Robustness of DeepFake Detection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202111220000002&flag=2]]></link>
<description><![CDATA[In recent years, face generation and manipulation technology based on deep learning have enabled the creation of sophis-ticated forged facial video, also known as Deepfakes. This kind of forged facial video has a high degree of fidelity and low production cost, which may bring a huge potential threat to the society. Therefore, researchers have developed many algorithms for detecting fake faces based on deep learning. Although these methods have achieved satisfactory results in accuracy, few researchers pay attention to the safety of these detection methods, such as their performance under adver-sarial attack. Studies have shown that Deepfakes detectors are extremely susceptible to interference from adversarial samples, making them unable to correctly identify forged faces. Therefore, this paper proposes an algorithm to improve the adversarial robustness of Deepfake detection, pre-set the non-trainable category center, and explicitly increase the inter-class dispersion. Then the center loss of the fixed center is used to minimize the relative distance between the sam-ple and the center of the class, and the compactness within the class is further improved in the learning process. Since the method proposed in this paper does not use adversarial samples for data augmentation, but only uses raw data for training, it has very high accuracy on clean samples. The center loss of the fixed center maximizes the distance between samples of different categories to the decision boundary in the latent space, which effectively enhances the robustness of the detection model.The experimental results on the FaceForensics++ dataset show that the method proposed in this pa-per not only does not reduce the accuracy of clean samples, but also improves the model"s robustness to FGSM, PGD, APGD, C&W, MI-FGSM and other attack algorithms.]]></description>
<pubDate>2024/5/15 11:05:50</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Peng,Dai Jiao,Han Jizhong,Wang Xi,Zou Shuqiao]]></author>
</item>
<item>
<title><![CDATA[Differential-Linear Cryptanalysis of Speck Cipher]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202201180000003&flag=2]]></link>
<description><![CDATA[Differential-linear cryptanalysis is an efficient method combined with differential and linear cryptanalysis which is widely applied to many kinds of ciphers. When establishing a differential-linear distinguisher, the usual way is to divide a cipher into three parts, i.e., the differential part, linear part and the middle part. The establishment of the middle part and estimation of its correlation is the most important work within the attack. In this paper, we apply the differential-linear cryptanalysis to the ARX-based block cipher Speck. For Speck64, we present a theoretical method to estimate the correlation of the middle part for the first time. The correlation value computed by our method for a special differential-linear characteristic is close to the value estimated by experiments, showing effectiveness of our method. For all versions of Speck, we also build their differential-linear distinguishers by experimentally estimating correlations of their middle parts. It turns out that the differential-linear distinguishers cover more rounds of Speck compared to the classical differential or linear distinguishers.]]></description>
<pubDate>2024/5/15 10:53:58</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Lin Dongdai,Wu Baofeng,Xu Yaqi]]></author>
</item>
<item>
<title><![CDATA[Zero Knowledge Vector Commitment with Good Properties]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202111300000003&flag=2]]></link>
<description><![CDATA[Vector commitment is a commitment scheme to vectors, which allows a specific position of the vector to be opened, and the correctness of the opening can be verified efficiently. The diversity and complexity of practical application scenarios also require that vector commitment schemes have more properties, such as efficiency, transparency, support for batching, zero knowledge and support for "opening to sum      mes are often unsatisfactory in one or more aspects. For example, the current vector commitment schemes with good properties and widely studied and applied often need trusted setup; Zero knowledge can ensure that the information of the unopened location will not leak in the opening process, and most of the existing schemes do not have zero knowledge. In some applications, it is necessary to realize the zero knowledge of vector commitment through the general purpose succinct non-interactive zero knowledge arguments of knowledge protocol, which will bring huge additional computational overhead. In this paper, a vector commitment scheme with efficient computation / communication is proposed, which does not need trusted setup, supports batching, “open to sum” and zero knowledge. The performance evaluation and comparison with the existing schemes are also given.]]></description>
<pubDate>2024/5/15 10:53:21</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DENG Yi,WANG Hailong]]></author>
</item>
<item>
<title><![CDATA[A Hybrid Return Address Protection Mechanism]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202110010000002&flag=2]]></link>
<description><![CDATA[Return-oriented programming(ROP) is a prevalent technique that targets return addresses to hijack control flow. To prevent such attack, researchers mainly focus on either Shadow Stack or MAC-based mechanisms(message code authentication). But Shadow Stack suffers from additional memory overhead and information leakage, while MAC-based mechanisms(e.g. Zipper Stack) impose high runtime overhead for MAC calculations. In this paper, we propose Twine Stack, a hybrid and efficient return address protection mechanism with lightweight hardware extension. It utilizes a tiny hardware shadow stack to realize a new multi-chain Zipper Stack. Specifically, each entry in the shadow stack stores a return address and its MAC in each chain, allowing queueing calculation with just one hash module. At meantime, some return address verifications could be done by comparison with the hardware shadow stack, instead of calculation again. We implemented Twine Stack on RISC-V architecture, and evaluated it on FPGA board. Our experiments show that Twine Stack reduces over 95% hash verifications, and imposes merely 1.38% performance overhead with an area overhead of 974 LUTs and 726 flip flops. The result demonstrates that our hybrid scheme mitigates the drawbacks of each separate scheme.]]></description>
<pubDate>2024/5/15 9:19:37</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chen liwei,cui ningning,li yongyue,mengdan,shi gang,xu qizhen]]></author>
</item>
<item>
<title><![CDATA[Individual Emitter Identification Scheme Based on Polarization Fingerprint]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202111230000001&flag=2]]></link>
<description><![CDATA[For individual emitter with limited resources, Radio Frequency Fingerprint (RFF) is a low cost, high efficiency and high security identification technology. However, currently RFF faces the problems of low fingerprint stability and high application difficulty. In order to solve these problems, we propose an individual emitter identification scheme based on polarization fingerprint (PF). We analyzed the formation of the circular polarization via classic circularly polarized patch antennas and constructed a mathematical model of PF. PF originates from the feature that contains identity information left by the structure and the hardware imperfections of the antenna in the signal polarization, and this feature is reflected in the frequency dependence of the signal polarization state. At the same time, we analyzed the group feature and individual feature of PF. The group feature represents the structural information of the antenna, and its scale is larger, so the ability to resist the influence of noise is stronger. Individual feature represents the identity information of the emitter, and its scale is smaller, so the ability to resist noise is weaker. The two-level template PF database and two-step identification algorithm designed based on these two features enable the scheme to maintain high identification efficiency when facing a large number of devices. Because current communication systems does not modulate the polarization, compared to RFF, PF can exist stably and continuously, which not only makes the scheme easier to implement, but also helps the scheme to obtain more samples. More importantly, by de-riving the false alarm rate and accuracy rate of the scheme, it is proved that increasing the sampling amount can reduce the distortion of PF caused by noise. Finally, we conducted experiments based on wireless Internet of Things (IoT) devices. Results show that under the same condition, the identification scheme based on PF performs better than that based on RFF.]]></description>
<pubDate>2023/9/18 15:51:29</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Huang Weiqing,Wei Dong,Xu Jinlong]]></author>
</item>
<item>
<title><![CDATA[A RLWE-based Three-party Password Authenticated Key Exchange scheme]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202102260000002&flag=2]]></link>
<description><![CDATA[With breakthroughs in quantum theory research, public key cryptosystems based on classical mathematical problems can be cracked in polynomial time. It becomes very urgent to design post-quantum cryptographic algorithms that can resist quantum attacks. Lattice-based cryptographic algorithms can effectively resist quantum computer attacks, has some excellent properties such as strong portability and easy-to-implement characteristics, and has become a current research hotspot. This paper proposes a Three-party Password Authenticated Key Exchange (3PAKE) protocol based on the Ring Learning with Errors (RLWE) problem, which introduces the D4 lattice as reconciliation mechanism, provides identity authentication between the server and two clients through pre-stored passwords, and enables the participants to establish the session key. In the Bellare Pointcheval Rogaway (BPR) model, it is proved that the protocol has mutual authentication security, weak perfect forward secrecy, session key security and resilience to password guessing attacks. Compared with other RLWE-based authenticated key exchange protocols, the implicit authenticatied scheme significantly reduces the number of hash calculations, and the error reconciliation mechanism allows higher error tolerance. After balancing the dimensions, modulus, variance, error rate and selecting appropriate parameters, the error rate is reduced to 2-61 and the modulus is reduced to 12289, which further decreases the amount of calculation and communication complexity. The protocol is implemented in C++ with NFL (NTT-based Fast Lattice) acceleration algorithm. The results in practice show the protocol achieves at most 17x speedup and provides 255-bit quantum security.]]></description>
<pubDate>2023/9/15 10:46:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Gu Xiaozhuo,Ren Peixin,Wang Ziliang]]></author>
</item>
<item>
<title><![CDATA[A Motion-based Seq-bbox Matching Method for Video Object Detection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202103090000004&flag=2]]></link>
<description><![CDATA[The development of deep neural networks has led deep learning-based object detection algorithms to achieve remarkable results. However, the actual detection effect should be improved because of blurring and occlusion deformation of objects in videos. Current algorithms, such as FGFA and Seq-NMS, are unable to simultaneously combine speed and accuracy and deficient in practical applications. This study aims to propose a practical video object detection algorithm to improve the accuracy of detection and guarantee real-time detection. In particular, the current research proposes a post-processing method called Motion-based Seq-bbox Matching, which is based on a single-frame detection algorithm, and introduces inter-frame motion information to enhance the detection results. We use Distance Intersection over Union (DIoU) to rep-resent the inter-frame motion information and propose the idea that the same object between adjacent frames should have similar motion information, and then combine the dynamic confidence averaging method to jointly complete the enhancement of the prediction results. Experimental results show that based on YOLOv5, the proposed algorithm achieves 73.4% mean average precision (mAP) and obtains a 6.2% mAP (67.2%–73.4%) improvement, while detection speed reaches 41 frames per second (fps). Thus, the proposed algorithm achieves excellent results in terms of balancing speed and accuracy. Lastly, this study provides ideas on developing a fast and accurate video object detection algorithm.]]></description>
<pubDate>2023/9/15 10:46:09</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[bairuwen,huangweiqing,huangzihao,jiangmiao,lilinghan,limin,mengbo,renjunxing,yangyang]]></author>
</item>
<item>
<title><![CDATA[Research on Cyberspace Anti-Surveying and Mapping]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202104070000001&flag=2]]></link>
<description><![CDATA[The development of cyberspace surveying and mapping technology has greatly promoted people’s comprehensive understanding of various cyberspace resources and their attributes, while also providing convenience for adversaries to draw the “attack surface map”. Cyberspace Anti-Surveying and Mapping (CASM) is a comprehensive defense process that protects various cyberspace resources and their attributes from being detected, analyzed, and visualized by adversaries. The core idea of CASM is to block the adversaries’ detection and prevent them from correlation analysis of detected data, making it impossible for adversaries to draw a dynamic, real-time, and reliable cyberspace map. Firstly, we give the related concepts and definitions of CASM. Then, we propose the technical architecture of countermeasures technology of cyberspace surveying and mapping. The key technologies are discussed from three levels: detection behavior recognition, detection behavior protection, and surveying analysis deception. Finally, we summarize the current research status and look forward to future research directions.]]></description>
<pubDate>2023/9/15 10:45:30</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[GUO Li,LI Renjie,LIU Qingyun,SHI Fengyuan,ZHONG Youbing,ZHOU Zhou]]></author>
</item>
<item>
<title><![CDATA[A Survey of Multi-step Attack Detection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202104070000002&flag=2]]></link>
<description><![CDATA[As the network becomes more and more complex and the defense capability of the defender improves, multi-step attacks have become the main attack manner. A multi-step attack is a purposeful attack composed of multiple atomic attacks in a logical sequence. Compared with single-step attacks, multi-step attacks are performed during a longer period and in a more concealed way, so they are more harmful. Therefore, the detection of multi-step attacks is particularly important. In this paper, we systematically analyze the definition of multi-step attacks and the technical challenges faced by mul-ti-step attack detection, and summarize the development stages of multi-step attack detection technology, then classify and compare the methods used in current research works. Additionally, we list available datasets so far and put forward possible research opportunities in the future.]]></description>
<pubDate>2023/9/15 10:44:46</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chengzijun,gongxiaorui,wangxiaoyu,zhangxiu]]></author>
</item>
<item>
<title><![CDATA[Overview of Research on USB Attack and USB Detection and Protection Technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202107080000001&flag=2]]></link>
<description><![CDATA[The universal serial bus (USB) interface is widely used due to its hot-swappable, high transmission rate and other ad-vantages. While USB brings us convenience, because the USB protocol lacks an effective security strategy, it brings op-portunities for malicious attackers. With the rapid development of USB attack technology, USB attack incidents have emerged one after another, especially "Stuxnet" and "BadUSB" have brought huge challenges to the security of computer network equipment and big data. The security issues of USB have been paid more and more attention. More security re-searchers have begun to focus on the security of USB connections, but there is currently a lack of systematic research on USB attack technology and detection and protection technology. In this article, we analyzed the enumeration and data transmission process of USB communication, and the principles of USB attack technology and detection and protection technology, and pointed out the protocol vulnerabilities and operating system vulnerabilities used by USB attack technol-ogy. We put forward a new classification method for the first time, sorting out, classifying and analyzing the typical USB attack technology and USB detection and protection technology. Based on the realization principle of USB attack tech-nology and detection and protection technology, the USB attack technology is divided into five types: USB ferry attack technology, USB interface attack technology, USB power surge attack technology, USB software Trojan horse attack technology and USB side channel attack technology. USB detection and protection technology is divided into four cate-gories: USB device management and control technology, USB device authentication technology, USB flow monitoring technology, and USB keystroke feature recognition technology based on keystroke dynamics. At the same time, we have done a comparative study of these technologies and pointed out their advantages and disadvantages. Finally, we dis-cussed the development trend of USB attack technology and detection and protection technology, as well as key issues.]]></description>
<pubDate>2023/9/15 10:43:49</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huangweiqing,lihaiyang,lvzhiqiang,xueyanan,zhangning]]></author>
</item>
<item>
<title><![CDATA[Encrypted DNS: Protocol, Research Status and Future Prospects]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202107140000001&flag=2]]></link>
<description><![CDATA[The Domain Name System (DNS), which provides a user-friendly name associated with an internet source, is one of the most important infrastructure components of the Internet. Almost every activity on the Internet starts with a DNS query. Although DNS is so critical, it can not guarantee transmission security and user privacy due to its inherent protocol vulnerability. Encrypted DNS, which protects user privacy by encrypting DNS data, has developed rapidly in recent years and attracted extensive attention. Using encrypted DNS, instead of plaintext DNS on the client side, has become a noticeable trend. It should be admitted that encrypted DNS is gradually changing the DNS ecosystem. And analyzing its impact on the DNS ecosystem is necessary and important. In order to fully understand the devel-opment of encrypted DNS and the impact on the DNS ecosystem, we conduct a survey on the status of encrypted DNS, concentrating on hot topics. In this paper, we introduce protocol implementations of encrypted DNS first. The state of development for each protocol is summarized in detail. The current five major protocols, DNSCrypt, DNS-over-TLS (DoT), DNS-over-DTLS (DoD), DNS-over-QUIC (DoQ) and DNS-over-HTTPS (DoH), are the most widely attractive. We compare these protocols from aspects of design, usability and maturity. Then, we analyze fo-cused research areas of encrypted DNS in depth. Current status of the research on encrypted DNS can be concluded into four areas: adoption, performance, security and the impact on other Internet applications or services. The re-search progress of each area, which demonstrates the availability of encrypted DNS, is concluded. Finally, based on the current work, we discuss future trends and prospect important issues of encrypted DNS from the perspective of system optimization. Feasible future directions, performance improvement, security enhancement, selection mechanism and service management are proposed. These proposals could help provide a reference for further research.]]></description>
<pubDate>2023/9/15 10:43:11</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Guo Li,Li Baiyang,Liu Qingyun,Sun Yong,Zhang Yuedong,Zhu Yujia]]></author>
</item>
<item>
<title><![CDATA[Study on USB Behavior Recognition Method Based on Electromagnetic Fingerprint Features]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202108110000001&flag=2]]></link>
<description><![CDATA[Electromagnetic information equipment inevitably generates compromising electromagnetic radiation in the process of information transmission and processing. The compromising electromagnetic emissions often contain a lot of useful information. By intercepting electromagnetic signals and analyzing them, information will be restored, which brings potential electromagnetic information security risks. Universal Serial Bus (USB) also produces compromising emanations during data transmission. "USBee", a malicious attack software, transmits con?dential information by controlling the inevitable electromagnetic emissions from USB. USB bus transmits high-speed digital signals during data transmission. From the perspective of frequency, the electromagnetic radiation leakage signal from USB has a wide frequency range and it has a strong correlation with the transmitted data. Meanwhile, the compromising emanations from USB are weak and have a large real-time change in the frequency spectrum. Malicious electromagnetic attack technologies such as "USBee" are based on the conventional USB protocols and data reading and writing behaviors to steal information. They achieve information interception and cause information leakage by enhancing the compromising radiation or intentionally generating controlled electromagnetic emanations, which is considered as a covert channel for information transmission without the demand for Internet connectivity or physical access. They control the intensity of radiated signal to encode the information. It has the characteristics of simple deployment, strong concealment and difficulty in detection, which brings greater challenges to electromagnetic information security risk detection. This paper breaks through the technology of USB electromagnetic leakage signal analysis and detection for USB behaviors based on the compromising electromagnetic emanations from USB. By analyzing the USB protocols and USB transmission signal characteristics, the USB electromagnetic leakage signal detection and the behaviors recognition algorithm based on electromagnetic fingerprint characteristics is proposed, which can realize USB behaviors recognition including data reading, writing and silence of USB. The experimental test results show that the detection and recognition accuracy of the proposed algorithm is higher than 90%. And the proposed method has high practical value for the USB-based electromagnetic safety risk detection of air-gap equipment.]]></description>
<pubDate>2023/9/15 10:42:33</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[guoshaoying,huangweiqing,liubo,xuyanyun]]></author>
</item>
<item>
<title><![CDATA[Range Proof based on Chinese Cryptographic Algorithm Framework]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202108170000001&flag=2]]></link>
<description><![CDATA[Range proof can also be called set membership proof. The meaning of range proof is to prove that an element belongs to a given range or set. The range proof with the property of zero knowledge is that the prover proves to the verifier that a secret information belongs to a given set without disclosing any other information. The range proof with zero knowledge property can realize the function of proving range and protect the privacy of secret information and prover as much as possible. Range proof technology has a wide range of applications in real life, such as cryptocurrency, anonymous electronic voting, anonymous auction and many other scenarios. In this paper, we propose a range proof scheme based on the Chinese cryptographic algorithm framework: the verifier signs the elements in the range and sends them to the prover together with the public key of the signature. The prover blinds the signature of the secret information and sends it to the verifier, and then uses the three rounds sigma-protocol to prove that the signature of the secret information belongs to the above signature set, so as to realize the range proof. The range proof scheme proposed in this paper can also be extended to any subset of the range （0，u^l）, with less communication complexity and computational cost, it is more practical in practical scenarios.]]></description>
<pubDate>2023/9/15 10:41:48</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[DENG Yi,MA Shunli,TAN Taoli]]></author>
</item>
<item>
<title><![CDATA[An identity authentication scheme for high concurrency scenarios based on SM2 collaborative signature algorithm]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109070000001&flag=2]]></link>
<description><![CDATA[With the rapid development of mobile Internet and smart terminals, the volume of mobile business is exploding, and the importance of ensuring the authenticity of user identities in high concurrency scenarios is becoming increasing-ly important. The authenticity of user identity is the primary condition to ensure the secure operation of mobile business, and the industry usually adopts static password schemes to identify the authenticity of users. However, the passwords or their hash values in static password schemes are transmitted and stored on the server side, which ex-poses them to serious risks of Man-In-the-Middle, Drag Attack and Credential Stuffing Attack. To solve the above problems, we propose an SM2 Collaborative Signature Algorithm (SM2-CSA) based on which an identity authenti-cation scheme (HC-IAS) for high concurrency scenarios is proposed, which can meet the needs of high concurrency in mobile services and solve the security problems introduced by storing the password or its hash value on the serv-er side of the static password scheme, so that it can effectively resist threats such as phishing, phishing and man-in-the-middle combination attacks. Finally, this paper designs and implements a prototype SM2 collaborative signature login system based on the proposed scheme, and conducts security and performance tests on it. The test results show that this scheme has better security and ease of use than the existing schemes.]]></description>
<pubDate>2023/9/15 10:36:46</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Tianyu,Jia Shijie,Niu Yingjiao,Qian Wenfei,Wang Pingjian,Zhang Qionglu]]></author>
</item>
<item>
<title><![CDATA[Research Progress on Intent-based Networking Security]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109170000002&flag=2]]></link>
<description><![CDATA[Modern network is faced with a series of security related problems which are brought about by the characteristics of virtu-alization, large scale and amalgamation: the transformation of network security boundary and security policy from static to dynamic, the sharply rising difficulty and cost of network security operation and maintenance, as well as the applica-tion and deployment requirements of a large number of emerging network security technologies and security devices. Software-Defined Security (SDS) has been proposed to deal with the above security problems. However, the current archi-tecture and related implementation of SDS have some defects such as low abstraction, poor efficiency and poor conven-ience. Intent-based Networking (IBN) provides a highly abstract network programming interface and an automated closed-loop processing process, which can bring the automation and convenience of network deployment and manage-ment. Transforming intent into security intent and then applying IBN to network security to practice SDS is considered to be the future direction of network security management and network security service deployment and operation. Firstly, the architecture and closed-loop processing process of IBN are given based on the related definitions, projects and aca-demic research of IBN from all circles. Secondly, the research progress on key technologies that support security intent in the architecture and closed-loop processing process of IBN is summarized, including semantic representation of security intent, verification and processing on the decision making of security intent, validation and processing on the implementa-tion of security intent. And according to the main requirements of network security management, security service de-ployment and operation, the research progress of IBN in practical security applications is summarized, including micro segmentation, service function chain, packet encryption, awareness of data leakage, configuration of network security policies and deployment of security devices. Thirdly, the current challenges of the research on IBN security are analyzed, including the defects of the current research on key technologies of IBN security intent, the requirements for intelligence and automation of IBN in security applications and the security problems of IBN itself, that propose the future research directions so as to provide a useful reference for the subsequent research on IBN security. Finally, the relationship between IBN and SDS in terms of network security is discussed, and the characteristics of IBN in security applications are summa-rized. Furthermore, to address the current challenges of the research on IBN security, an IBN security technical solution is proposed for reference.]]></description>
<pubDate>2023/9/15 10:35:27</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[MA Zixuan,TU Bibo,You Ruibang,ZHANG Kun,ZHANG Yuqi]]></author>
</item>
<item>
<title><![CDATA[Overview of Encrypted Traffic Identification Technology]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202103030000001&flag=2]]></link>
<description><![CDATA[As a key component of network protection and management, traffic identification technology can offer network admin-istrators the ability to stop the spread of malicious behavior and optimize network resources in a timely manner. Cur-rently, with the increasing awareness of data security, network services and applications commonly adopt encryption protocols to secure communication contents. Although this method can effectively enhance the confidentiality of data, it also brings new challenges to network management. After the change of encryption algorithm, the payload no longer has obvious character features, so the traditional traffic identification methods cannot effectively identify the encrypted traf-fic.  For this reason, researchers have conducted a lot of research on encrypted traffic identification techniques. In this paper, we firstly introduce the basic concept of traffic identification, including the research of identification objects and mainstream encryption protocols; then we sort out the current urgent encryption tasks based on the bottom-up perspec-tive of the protocol stack according to different scenarios. Secondly, we summarize and compare the current existing encrypted traffic identification methods, and compare the encrypted traffic identification methods based on deep packet inspection, traditional machine learning, and deep learning. Based on the advantages of multi-dimensional information fusion and the powerful learning ability of deep learning, the multi-modal hybrid method is expected to be a break-through technology for encrypted traffic recognition in the future. Finally, we provides an outlook on the future devel-opment direction of encrypted traffic identification technology based on the current research progress.]]></description>
<pubDate>2023/9/15 10:23:51</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[CUI Susu,DONG Cong,JIANG Bo,LIU Baoxu,LU Zhigang,ZHANG Chen]]></author>
</item>
<item>
<title><![CDATA[Affine linear cryptanalysis of block cipher]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202103110000002&flag=2]]></link>
<description><![CDATA[Affine linear cryptanalysis is a new variant of multidimensional linear cryptanalysis method for block ciphers. Multidimensional linear cryptanalysis uses all nonzero linear approximations in a multidimensional linear subspaces, but it
discards a whole half-space of linear approximations, which contributes little or nothing to multidimensional linear crypt-analysis, and only extracts information from the reserved affine subspace to construct more effective test statistics to attack block ciphers. In order to further improve the efficiency of the attack, Nyberg conjectured that discarding the terms with low scores of affine statistic, and the sum of the remaining terms is also a statistic that follows chi square distribution. This paper proves that the conjecture is correct, and gives an application method of this conjecture. PRESENT and Serpent algorithms are used to verify the validity of the model. We perform 26 and 27 rounds of key recovery attacks against PRESENT by the model, and analyze the data complexity of affine linear cryptanalysis on 4 rounds Serpent.]]></description>
<pubDate>2023/9/15 10:23:15</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Wenqin Cao,Wentao Zhang]]></author>
</item>
<item>
<title><![CDATA[Research on Covert Communication Signal Detection Technology Based on Power Spectrum Entropy]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202103150000001&flag=2]]></link>
<description><![CDATA[Aiming at the problem of electromagnetic space of low-power convert communication signals detection in complex electromagnetic environments, this paper proposes a double-threshold convert communication signal detection algorithm based on the information entropy of the frequency-domain power spectrum. Based on the theoretical derivation of the information entropy model, the information entropy of the power spectrum is used as a test statistic, and a double decision threshold is constructed to realize the blind detection of hidden low-power weak signals under the background of strong interference and low signal-to-noise ratio. Simulation and actual measurement results show that the detection rate of signals is better than other traditional algorithms when SNR=-10dB, which greatly improves the detection rate of low SNR signals. On this basis, a segmented frequency domain information entropy detection method based on spectrum trace line is proposed to realize the estimation of the number of covert communication signals in a large bandwidth and the occupied frequency band. The experimental results show that the method can accurately estimate the number of signals and the occupied frequency band in the wideband range, and the detection rate is greater than 80% under SNR=-5dB.]]></description>
<pubDate>2023/9/15 10:22:39</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[hong zekun,Huang Weiqing,Li Tingting,Xu Yanyun,Yu Chao]]></author>
</item>
<item>
<title><![CDATA[Research Progress of Human Activity Recognition in Videos Based on Deep Learning]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202103160000003&flag=2]]></link>
<description><![CDATA[The mature development of big data, artificial intelligence, mobile Internet, cloud computing and the Internet of Things accelerate automation and intelligence of video surveillance, intelligent video surveillance has gradually replaced traditional surveillance, as an important part of the security in various industries. In intelligent video surveillance systems, recognizing human activities plays an important role in effective discovering potential risk factors, dynamic supervision of scenes, and early warning of abnormal events. However, recognizing human activity in real video surveillance scenarios faces significant challenges. This paper aims to provide a necessary reference for the research of human activity recognition, and provides a comprehensive overview of the research progress of deep activity recognition models in the past six years from three modal data, RGB video, human skeleton and RGB+D video. This paper compares different model architectures based on various data modalities based mainly on the recognition accuracy of the models and taking into account the size, computational efficiency and inference speed of the models, and analyzes the advantages and limitations of various approaches which apply different data to recognize human activities. Finally, it focuses on the challenges of human activity recognition in intelligent video surveillance systems and potential directions for future research.]]></description>
<pubDate>2023/9/15 10:21:55</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[bairuwen,huangzihao,jiangmiao,lifengfa,lilinghan,limin,mengbo,renjunxing,sundegang,yangyang]]></author>
</item>
<item>
<title><![CDATA[Video Steganalysis Considering CAVLC Codewords and the Number of Nonzero QDCT Coefficients]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202105080000002&flag=2]]></link>
<description><![CDATA[In this paper, an effective steganalytic method is proposed to detect QDCT (Quantized Discrete Cosine Transform) Coef-ficient-based H.264 steganography. At present, most of the steganalytic methods pay attention to the changes of QDCT coefficients before and after embedding. Due to the redundant information in the QDCT coefficients, they cannot effec-tively detect the adaptive QDCT Coefficient-based H.264 steganographic methods in recent years. In the H.264, entropy coding is used to perform lossless compression on QDCT coefficients to remove redundant information. CAVLC (Con-text-based Adaptive Variable Length Coding) is one of two forms of entropy coding in the H.264. Compared with another entropy coding method CABAC (Context-based Adaptive Binary Arithmetic coding), CAVLC has low computational complexity and supports all H.264 profiles. Therefore, based on the principle of CAVLC coding, this paper firstly analyzes the influence of embedding modification on the coding process of CAVLC and finally on the CAVLC codewords. Sec-ondly, because there is a correlation between the number of non-zero QDCT coefficients of adjacent blocks, this paper analyzes the impact of modifying the QDCT coefficient on this correlation. Finally, this paper designs a 635-dimensional steganalytic feature set, which includes two types of sub-features. The first sub-feature is the ratio of “1” in the codeword and the ratio of “1” in each bit in the codeword, which is used to describe the CAVLC codeword. The second sub-feature is the probability of the number of non-zero QDCT coefficients in the adjacent block(the blocks to the right of and below the current block) given the number of non-zero QDCT coefficients in the current block, the probability reflects the corre-lation between the number of non-zero QDCT coefficients of adjacent blocks. To evaluate the effectiveness of the pro-posed method, we carry out experiments on videos under different setups. The experimental results have demonstrated that the proposed method outperforms the prior methods of detecting QDCT coefficients modification in H.264 videos, also performs well even at low embedding strengths. The experimental results have verified the rationality of feature de-sign. Moreover, while ensuring the improvement of detection accuracy, the computational complexity of this method is not higher than that of the prior methods.]]></description>
<pubDate>2023/9/15 10:18:11</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[youweike,yujianchang,zhanghong,zhaoxianfeng]]></author>
</item>
<item>
<title><![CDATA[A Survey of Semantic Information Recovery in Binary Programs]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202105170000001&flag=2]]></link>
<description><![CDATA[Semantic information of binary programs, such as variable type, control flow, and functionalities, is the basis of binary program analysis and is essential for improving the accuracy of software vulnerability detection and malicious code detection. However, due to the compilation and stripping processes, and the differences in programming languages, compilers, operating systems and target architectures, the recovery of binary program semantic information can be an extremely challenging task. This paper surveys the technologies for the recovery of binary program semantic information that researchers generally concern about, and summarizes them into three categories: type inference technology based on program data, program structure recognition technology based on code instructions, and program functionality recovery technology based on code understanding. The representative technologies in the recent ten years are presented accordingly. The trends and deficiencies of the above technologies in the benchmarks used, the platforms selected, and the architectures supported are statistically analyzed. Finally, the future research directions are prospected.]]></description>
<pubDate>2023/9/15 10:17:26</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huowei,lifeng,liuyiming,xulili,zhoujianhua]]></author>
</item>
<item>
<title><![CDATA[Context-Aware Anomaly Intrusion Detection Method for Smart Home Automation]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202106070000001&flag=2]]></link>
<description><![CDATA[Smart home IoT devices realize the interconnection and interaction between devices through the automation rules on the IoT platform, which not only brings convenience to users, but also leads to the increase of security threats. In this scenario, the traditional anomaly intrusion detection methods have the problems of low accuracy, high false alarm rate and poor interpretability. This paper proposes a context-aware anomaly intrusion detection method. Firstly, we built the correlation representation model between different devices from the perspectives of device events and device states; Sec- ondly, we comprehensively analyzes the automation rules, device types, device attributes, configuration files and other mul- tiple information, uses natural language processing technology to assist mining correlations, and uses the system event log to verify them; Finally, the system event flow is detected according to the verified correlations. We verify and evaluate the effectiveness of our method in the real smart home environment. Compared with traditional methods, this method has better detection effect.]]></description>
<pubDate>2023/9/15 10:16:22</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LI Hong,LI Ke,LIU Chenrui,SONG Zhanwei,SUN Limin,ZHU Hongsong]]></author>
</item>
<item>
<title><![CDATA[A Survey of Attacks and Detection Techniques on Industrial Control Systems]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202106190000001&flag=2]]></link>
<description><![CDATA[Industrial Control System (ICS) security has become increasingly important as attacks targeting ICSs are more prominent. Attackers are more sophisticated, using sophisticated and advanced attacks, and covert and diverse attack techniques, making the ICS network offensive and defensive situation increasingly severe. These well-designed attacks may cause the ICS system to deviate from the expected operation, causing serious consequences such as damage to key facilities, un-planned shutdowns, and even casualties. Although research work on ICS attack and detection technology has continu-ously emerged in recent years at home and abroad, there is still no review article that comprehensively summarizes and discusses the current status and trends of technology development at home and abroad. The research scope of this paper is not to discuss various application scenarios, nor to focus on heterogeneous and diverse ICS devices, but to locate the threat analysis of the process control layer, field control layer, and field device layer in the typical architecture of industrial control system. From the perspective of ICS attack and detection, this research first conducts an in-depth analysis of the typical architecture of ICS, the operating mechanism of key control equipment, the vulnerability of security protection, and the challenges of security technology; then, it analyzes the ICS attack technology from the network, logic, firmware, and perception levels. Classify, analyze attack principles, avoidance strategies, and the observable phenomena that at-tacks may bring; secondly, summarize the detection technology system for ICS attacks at all levels, analyze the scientific principles and strategies of detection technology, and discuss detection methods and solutions for different types of at-tacks. Summarize the existing advanced ICS attack detection and evaluation indicators; finally, summarize the ad-vantages and disadvantages of existing detection technologies, and propose future trends and prospects for the research of ICS attack detection technologies to promote differences in computer science, cybernetics, information security, cyber physics, etc. Interaction between researchers in the discipline.]]></description>
<pubDate>2023/9/15 10:15:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenxin,lishijie,liujunjiao,lvfei,panzhiwen,sunlimin,sunyiting,xinmingfeng,zhuhongsong]]></author>
</item>
<item>
<title><![CDATA[Software Optimized Implementations of KNOT Authenticated Encryption Algorithms]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202106240000001&flag=2]]></link>
<description><![CDATA[KNOT is a family of lightweight authenticated encryption algorithms and hash algorithms, which is a second-round candidate in the ongoing National Institute of Standards and Technology (NIST) Lightweight Cryptography Standardization Process (LWC). Security and the performance of hardware and software implementation are important criteria of a cryptographic algorithm. In this paper, we focus on the performance criteria of software implementation of KNOT. We use different software optimized implementations of KNOT on 32-bit microcontrollers and 64-bit high-end computers. We also analyze the software performance of KNOT by the public software performance benchmarking. Specifically, the main work of this paper contains two parts. (i) KNOT is optimized by bit-interleaving and implemented by C and assembly for ROM or speed on 32-bit microcontrollers. We analyze the performance improvement of KNOT on five 32-bit microcontrollers of two microcontroller benchmarking: Micro-controller Benchmarking by NIST (NIST Benchmarking) and AVR/ARM/RISC-V Microcontroller Benchmarking by Renner (las3 Benchmarking). Comparing with C implementation, bit-interleaving can improve the speed of KNOT on almost all microcontrollers. The improvement varies with different microcontrollers. Among the five microcontrollers mentioned above, the speed improvement on Arduino Nano 33 BLE(Cortex-M4) is the largest: the improvement of KNOT-Pair I’ and KNOT-Pair IV’ authenticated encryption algorithm and hash algorithm are 18%, 28%, 20%, and 22%, respectively. (ii) KNOT-Pair IV is optimized by Streaming SIMD Extensions (SSE) on 64-bit processors. Comparing the speed of SSE and C implementation on the 64-bit computer (Inter(R) Core(TM) i9-900 CPU, 3.10GHz), the speed of KNOT-Pair IV’ authenticated encryption algorithm and hash algorithm are 26%, 28% ahead on C implementation. We analyze the speed of KNOT on three different 64-bit high-end processors of SUPERCOP. Through the abovementioned studies, KNOT has great advantages in speed and ROM over other second-round candidate algorithms.]]></description>
<pubDate>2023/9/15 10:14:44</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[zhangwentao,zhaoxuefeng]]></author>
</item>
<item>
<title><![CDATA[Lattice-Based Efficient Zero-Knowledge Proofs]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202107010000001&flag=2]]></link>
<description><![CDATA[Zero-knowledge proof is one of the key primitives of cryptographic protocols, which enables a prover to prove to a verifier the membership or the possession of a witness for some hard language without leaking any additional knowledge. It can be widely used in digital signature, identification, and secure multi-party computation, etc. With the rapid development of quantum computers, designing efficient zero-knowledge proofs secure against quantum attacks has been a popular problem in recent years, wherein the lattice-based such schemes are more attractive because they enjoy a unique combination of favorable features: asymptotic efficiency, resistance against quantum attacks, and much milder hardness assumptions. When designing a high-level cryptographic protocol, some specific problems are concerned and zero-knowledge proofs for them are required as building blocks to provide privacy. Although the existing zero-knowledge proofs for any complete language would provide a universal solution for such requirement, the expensive reduction has a negative influence on efficiency, which makes the solution impractical. Thus, researchers start to design special protocols to prove these specific problems efficiently in zero-knowledge sense. The inhomogeneous small integer solution (ISIS) problem is such an instance. Zero-knowledge proofs for ISIS problem are extensively used in fully homomorphic encryption, Fiat-Shamir type standard signature, and ring signatures, etc.
    In this paper, we aim at zero-knowledge proof for ISIS problem and divide the existing constructions into two categories: the geometrical-feature originated category and the non-geometric-feature orginated category, where constructions in the former are all indirect proofs for ISIS. As for those constructions in the latter, according to the design routes and accuracy of the proofs, we classify them into four types: Stern-exact type, FSwA-relaxed type, S-FS-exact type and other-exact type. Here, FSwA-relaxed type constructions are relaxed proofs for ISIS, designed from FSwA framework which incorporates rejection sampling into Schnorr protocol. The other three types are all exact proofs, with the difference that Stern-exact type constructions are from Stern framework, S-FS-exact type constructions are from a hybrid route between Stern and FSwA, and other-exact type constructions combine some tools such as special homomorphic commitment, number theoretic transform, etc. to improve efficiency. For each type, we deeply analyze every construction from the aspects of communication efficiency, difficulty assumptions and suitable applications, and summarize the advantages and weaknesses. Furthermore, taking the security property and the communication efficiency as measurements, we give detailed comparisons among constructions of the same type, and the optimal constructions of different types.]]></description>
<pubDate>2023/9/15 10:13:58</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[gaohongmin,hulei,huangguifang,wangmengfan]]></author>
</item>
<item>
<title><![CDATA[Anti-spam Technology Based on Computational Cost]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202107280000001&flag=2]]></link>
<description><![CDATA[With the rapid development of information technology, email has become an indispensable way of communication due to its advantages such as low cost, convenience, and high efficiency. On the other hand, the proliferation of spam not only disturbs users, but also consumes a lot of network resources, and even seriously threatens network security. 
In this paper, we study the anti-spam technology based on computational cost, aiming to realize the anti-spam function while fulfilling the needs of honest users to send mass emails. Using the attribute-based access control technique, we first define a new trapdoor cost function, named attribute-based trapdoor cost function (AB-TCF), which satisfies three security properties: negligible computational cost ratio, correctness, and soundness. For AB-TCF, trapdoors are distributed to users in a fine-grained manner, such that any user who meets the attribute requirements can obtain a trapdoor and can compute AB-TCF at comparably low cost; whereas users who do not meet the attribute requirements need to compute AB-TCF at very high cost. Under the integer factorization assumption, we give a formal construction of AB-TCF and prove its security. Then, basing on AB-TCF, we design an anti-spam system, in which all senders are required to compute AB-TCF when sending emails. The negligible computational cost ratio property of AB-TCF ensures that honest users who meet the attribute requirements can easily send mass emails using their trapdoors; whereas malicious spammers have to pay expensive computational costs. In this way, spam emails can be prevented from being sent out at the source, thereby realizing the anti-spam function. Theoretical analysis and experimental results show that our proposed system can greatly reduce the number of spam emails at the sending end, while still running well for honest users to send mass emails. In addition, the compatibility analysis shows that our anti-spam method is compatible with existing email systems, which can further enhance the anti-spam effect when combining with our method.]]></description>
<pubDate>2023/9/15 10:13:13</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Chen Lijiao,Lv Kewei,Yao Gang]]></author>
</item>
<item>
<title><![CDATA[Java Deserialization Vulnerability Detection Method Based on Variable Controllability Search]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109040000001&flag=2]]></link>
<description><![CDATA[In recent years, more and more Java components have been exposed to deserialization vulnerabilities. Since this type of vulnerability is difficult to be detected efficiently and accurately by means of manual auditing, this type of security vul-nerability is still lurking in a large number of components. In this paper, based on the in-depth study of Java deserialization vulnerabilities, we propose that the core of detecting this type of vulnerability is the detection of exploit chains; By sorting out and summarizing the common entry functions and dangerous functions in actual exploit chains, we construct an a priori knowledge base for detecting unknown exploit chains; we propose a Java deserialization vulnerability detection model based on variable controllability search, combined with a bottom-up variable controllability search algorithm . Experimental results show that the detection performance of this system is 60.6% better than that of the gadgetinspector tool, with 19 known exploit chains and 23 unknown exploit chains detected in 107 open source components, one of which has been included in CVE (CVE-2021-39148).]]></description>
<pubDate>2023/9/15 10:12:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[chenwengang,chenxingchen,fengxincheng,liuqixu,wangbaizhu]]></author>
</item>
<item>
<title><![CDATA[Discussion on key technologies of identity authentication in large-scale networks]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109140000002&flag=2]]></link>
<description><![CDATA[With the rapid development of large-scale networks in recent years, many attack methods and accompanying security problems have occurred frequently. Among them, identity authentication technology, as the first line of defense in network security, always faces serious challenges. Many security problems have emerged one after another due to insecure identity authentication processes or improper storage of private information used for authentication. These above issues arouse long-term exploration and attention on identity authentication technology for scholars. How to solve the problem of identity authentication in large-scale networks effectively, choose appropriate and effective identity authentication technology for different scenarios and different business demands, and improve the security of identity authentication in corresponding scenarios have become the problems that need to be solved urgently. This paper analyzes the security problems of identity authentication faced by four common large-scale networks of mobile Internet, Internet of Vehicles, Internet of Things, and cloud computing. And then, we summarize the development of critical technologies for identity authentication and critical application schemes in large-scale networks. Firstly, we analyze the main problems and security requirements faced by large-scale network identity authentication technology. Secondly, based on the analysis of identity authentication protocols and technological theories, we summarized five types of fifteen identity authentication technologies in large-scale networks, simultaneously analyzing and comparing their features, advantages, and disadvantages. Subsequently, we summarize and analyze typical application schemes of identity authentication technologies in four large-scale networks, which are as follows: Continuous authentication based on face recognition, continuous authentication based on touch dynamics, and continuous authentication combined with biometrics and devices for the mobile internet; Authentication based on pseudonyms, authentication based on group signatures, and authentication based on blockchain for the Internet of Vehicles; Anonymity-based authentication, wireless sensor-based lightweight authentication, and hierarchical-based authentication for the Internet of Things; Authentication based on access control, authentication based on biometrics, and authentication based on mobile cloud computing for cloud computing. Based on the above scenarios, we discuss and compare the critical problems that have been solved, security, and performance of identity authentication technologies. Finally, we discuss and look forward to the research hotspots, new challenges, and identity authentication technology development trends in large-scale networks.]]></description>
<pubDate>2023/9/15 10:10:39</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Huang Weiqing,Ji Heming,MAO Rui,SUN Degang,WANG Xiaoyu,WANG Yan]]></author>
</item>
<item>
<title><![CDATA[FRI-VC: A Transparent and Zero-Knowledge Vector Commitment Scheme]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202109150000001&flag=2]]></link>
<description><![CDATA[Vector commitment is a commitment to an ordered sequence of elements (m_1,...,m_d) of length d, and the elements at specific positions can be opened later. The existing vector commitment schemes with relatively complete functions usually need trusted setup and are not transparent. The disclosure of trapdoors in the scheme will enable malicious prover to generate proofs at will, resulting in the scheme becoming very unsafe. In addition to transparency, zero-knowledge and quantum-resistant properties are not considered in most schemes either, which makes the scheme vulnerable to be attacked by adversaries and will face the challenge of quantum computers. In this paper, we present a  transparent, quantum-resistant and honest verifier zero-knowledge vector commitment scheme named FRI-VC based on Fast Reed Solomon Interactive Oracle Proofs of Proximity(FRI) and Lagrange Polynomial Interpolation. In addition to the basic function of vector commitment, FRI-VC can also open and verify at the same time of both elements at multiple  locations in the same vector and elements at multiple locations across different vectors. The proof length required is the same as when opening an element at a certain location of a single vector. In this paper, the security of FRI-VC scheme is proved in detail, and the scheme is also compared with several other typical vector commitment schemes.]]></description>
<pubDate>2023/9/15 10:08:58</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Deng Yi,Yang Liuyu,Zhang Xinxuan]]></author>
</item>
<item>
<title><![CDATA[Survey on the Integration of Safety and Security in Industrial Control Systems]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012110000001&flag=2]]></link>
<description><![CDATA[With the rapid development of industrial Internet, the traditional defense scheme of information security and function safety separation is no longer able to deal with the current threats in industrial control systems. Therefore, the integration of safety and security technology has gradually become a research hotspot. There are great differences in objectives and requirements, and the limited computing, communication and storage resources of the industrial control system bring greater challenges to the research of safety and security integration. This paper analyzes the possibility and necessity of integrating security research from the concepts, terms and mitigation measures involved in the two fields. Then, the research progress of the integration of existing methods and standards in academia and industry is summarized. Finally, the challenges and opportunities of safety and security integration research are analyzed from different perspectives.]]></description>
<pubDate>2023/9/8 11:39:52</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Fang Dongliang,Liu Puzhuo,Lv Shichao,Ma Yetong,Sun Limin,Zhu Hongsong]]></author>
</item>
<item>
<title><![CDATA[A Survey of Insider Threat Analysis and Defense Solutions]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202009240000002&flag=2]]></link>
<description><![CDATA[Insider threat is a challenging cyber security issue, therefore we should pay more attention to the insider threat’s current research findings and evolution trends. In this paper, we study the research category of insider threat, and use grounded theory for rigorous literature review and analysis. We aim to help organizations obtain a panoptic view on this disparate topic and thereby quickly develop solutions according to their actual situation. This paper presents a novel insider threat survey of great significance to the field of insider threat. The main contributions of this survey can be summarized as follows. (1) It summarizes the research scope of insider threat, aiming at establishing the framework of this research. (2) It makes a comprehensive analysis of insider threats from the definition and classification, data sets and events, and proposes a practical and unified taxonomy. (3) It proposes a step-by-step defense solution including deterrence, prevention / mitigation, detection and response, and then summarizes and analyzes the research results. (4) It analyzes the insider threat cases and current research progress, and then discusses the deficiency of existing research and proposes further research directions.]]></description>
<pubDate>2023/9/4 15:55:09</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LI Meimei,linan,LIU Meichen,and LIU Pengcheng,SHI Zhixin,SUN Degang]]></author>
</item>
<item>
<title><![CDATA[A Survey of VMM Security Reinforcement on Virtualization Platform]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202010020000001&flag=2]]></link>
<description><![CDATA[With the rapid development of cloud computing, virtualization technology has become the focus of attention. As the core pillar of the virtualization platform, the virtual machine monitor has been exposed security problems in recent years due to a large number of codes, a monolithic design and a lack of isolation. The virtual machine monitor controls the normal operation of the entire virtualization platform. Once the virtual machine monitor is attacked, all virtual machines on the cloud platform will be exposed to threats. How to reinforce the security of the virtual machine monitor has become a research hotspot. This paper first analyzes the architecture model and disadvantages of traditional virtual machine monitor. Then, we analyze the domestic and foreign reinforcement researches of the virtual machine monitor in recent years, and put forward four dimensions to evaluate the design of the virtual machine monitor. Finally, this paper prospects the next step of virtual machine monitor security reinforcement.]]></description>
<pubDate>2023/9/4 15:54:47</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Jia Xiaoqi,Jiang Nan,Zhang weijuan,Zhou Qihang]]></author>
</item>
<item>
<title><![CDATA[A Study on Cyber Deception-Based Moving Target Defense]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202010250000001&flag=2]]></link>
<description><![CDATA[Moving Target Defense (MTD) is one of the game-changing revolutionary concepts that surpasses traditional approaches by wresting the asymmetric advantages of the attackers over defenders. The basic idea of MTD is to continuously change the attack surface, thereby increasing the difficulty and complexity of attackers. Choosing the attributes to switch and expanding the switching space of attribute attack surface are critical problems in MTD. Currently diversification, redundancy and deception are the main strategies for constructing the switching space. However, the high cost and system incompatibility issues of the first two strategies, together with the limited attack surface switching space, make the theoretical research and practical application of traditional MTD remain stagnant. Cyber Deception provides an opportunity for this challenging problem. It offers diversified deceptive methods, such as honeypots, honey baits, and breadcrumbs, and has the characters of low cost and easy construction of deceptive properties. Therefore, cyber deception can be used to expand the attack surface switching space, and becomes one of the most important approaches and tools for MTD study. Nevertheless, the research community still lacks understanding towards the role of cyber deception in MTD, and few research works have evaluated its effectiveness. In this paper, we compare the differences between traditional MTD and cyber deception-based MTD, and identify the important value of cyber deception in MTD. Furthermore, we perform a multi-dimension classification towards existing works in cyber deception-based MTD. Finally, we summarize the limitations and challenges of existing solutions, and discuss potential future research directions]]></description>
<pubDate>2023/9/4 15:54:25</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[SUN Xiaoyan,LIU Feng,MA Duohe,ZHANG Yaqin,ZHOU Chuan]]></author>
</item>
<item>
<title><![CDATA[Research on Differential Analysis using Differential Probability Distribution Table]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202010310000001&flag=2]]></link>
<description><![CDATA[Differential cryptanalysis is one of the most effective methods of block cipher cryptanalysis. In this paper we study the differential properties of key-alternating iterated block cipher with bijective round function from a new sight. Differential Distribution Table(DDT) plays an important role in the differential cryptanalysis of iterated block ci-pher. By analogy with DDT, we study the Differential Probability Distribution Table(DPT) of round function, and we find the DPT matrix is a Markov matrix. Then we study the differential properties of block cipher by analyzing the properties of DPT matrix. On one hand, we provide some proofs concerning the differential properties of block ci-pher and we focus on the special case when the round function is involutory. We proved that if the DPT matrix of a block cipher’s round function has only two eigenvalues with value 1, then the block cipher must have no high-probability differential after sufficiently many rounds. However, when the number of DPT matrix’s eigenvalue with value 1 exceeds 2, the block cipher may have a high probability difference for any round. On the other hand, for a practical block cipher, the dimension of its round function’s DPT matrix is so high that storing and computing such matrix is infeasible. To settle this problem, we analyze the byte-oriented truncated differential probability and construct Byte-oriented Truncated Differential Probability Distribution Table(TPT) of iterated block cipher to study the byte-oriented truncated differential properties. For a r-round block cipher the block of which can be divided into 16 bytes or nibbles, it costs c1*2^(32)  in memory and takes c1*2^(37.92) in time to construct TPT, where  c1,c2=O(log r). We can get all the byte-oriented truncated differential information of the whole block cipher with high-performance computer in acceptable time at the present stage.]]></description>
<pubDate>2023/9/4 15:53:17</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[liuhui,yangli]]></author>
</item>
<item>
<title><![CDATA[A non-trapdoor dynamic pseudo-accumulator construction and its application]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202011090000001&flag=2]]></link>
<description><![CDATA[Accumulator is an important cryptographic tool, which plays an important role in membership test, certificate management and other applications. Traditional accumulators based on RSA or bilinear maps need to provide evidence for both membership validation and non-membership validation, which are not necessary for applications that verify validation without evidence. In addition, both types of accumulators have corresponding trapdoors, which makes the security of accumulators depend on the confidentiality of the trapdoors. We first introduce the concept of &amp;amp;amp;amp;quot;dynamic pseudo-accumulator&amp;amp;amp;amp;quot;, which has the functionality of adding and deleting elements dynamicly, supporting the verification of set membership and non-membership without giving corresponding evidence. Then we give a concrete construction of a dynamic pseudo-accumulator which is no trapdoor and there is no need to assume that the accumulator manager is honest, and the accumulator is dynamic, allowing new elements to be added and old elements to be deleted. And we discuss in detail the relationship between the parameters required to construct the accumulator and the upper bound of the accumulative set,  and explain how to choose these parameters in practice. Finally, we introduce how the newly constructed accumulator can construct a hierarchical access control system.]]></description>
<pubDate>2023/9/4 15:52:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[GUAN Cheng,XUE Rui,YUN Kaili]]></author>
</item>
<item>
<title><![CDATA[Modulation Recognition Algorithm based on Time-Frequency Structure Differences of Modulation Parameters and Hierarchical Neural Network]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202011140000002&flag=2]]></link>
<description><![CDATA[The detection and supervision of wireless communication is usually carried out in the scene of unknown communication mode, and the recognition of modulation is the first problem to be solved. Aiming at the problem of automatic recognition for communication signal modulation, this paper uses hierarchical convolutional neural network to learn the time-frequency structure differences of modulation parameters, and uses these differences to realize accurate recognition of communication signals. This method combines the advantages of signal feature extraction method and deep learning recognition method, extracts the modulation parameters such as instantaneous amplitude, instantaneous frequency and instantaneous phase, reduces the redundant information for modulation recognition useless in the signal, and constructs the time-frequency structure image of each modulation parameter. Then, a dedicated convolutional neural network is constructed to learn the unique time-frequency structure of images with different modulation parameters. Finally, the hierarchical neural network architecture is designed to cascade each dedicated convolutional neural network to accurately determine the modulation types. In this paper, a total of 11 kinds of communication signals are automatically recognized. This method can effectively overcome the adverse factors such as noise, frequency offset interference and receiving error, and has high robustness and automaticity. The experimental results show that every identification accuracy of 2ASK, 2FSK, 4FSK, BPSK, QPSK, 8PSK and 16QAM, 32QAM and 64QAM, AM and FM signal is above 80%, in the signal-to-noise ratio of size 12 dB and the presence of interference and frequency offset, is better than that of the same condition of traditional modulation mode recognition method based on signal feature extraction and modulation mode recognition method based on the deep learning alone.]]></description>
<pubDate>2023/9/4 15:52:24</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[qiuzhaohua,huangweiqing,wangzhongfang,weidong,yuchengliang]]></author>
</item>
<item>
<title><![CDATA[Implementing quantum circuit of ZUC algorithm]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202011170000002&flag=2]]></link>
<description><![CDATA[In this paper, the stream cipher ZUC is implemented as a quantum circuit based on the “Clifford + Toffoli” quantum gate set. This is the first time that a stream cipher is implemented as a quantum circuit. By constructing this quantum circuit that consumes as few qubits as possible, we give a lower bound on the number of qubits that quantum algorithms can attack the ZUC algorithm. When the number of logical qubits that a quantum computer can support exceeds this lower bound, it may pose a substantial threat to the ZUC algorithm. According to this goal, our circuit design criterion is to consider reducing the consumption of qubits firstly, and on this basis to optimize the consumption of Toffoli gates. we give detailed quantum circuit design for each key component of ZUC, such as the modulo adder over the finite field, the linear feedback shift register over the finite field , and the S-boxes. Based on the quantum circuits of these components, we present the overall quantum circuit design of ZUC. According to the design in this paper, 752 qubits, 109770 Toffoli, 348117 CNOT, and 26912 Pauli X gates are needed for ZUC to complete its initialization process and generate 128-bit keystream.]]></description>
<pubDate>2023/9/4 15:52:05</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huangzhenyu,sunzhuang]]></author>
</item>
<item>
<title><![CDATA[Combinatorial optimization construction of password guessing method based on deep learning]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202011230000002&flag=2]]></link>
<description><![CDATA[The existing password guessing methods based on deep learning have great advantages in the number and diversity of password guessing compared with the statistical password guessing methods. However, the existing password guessing methods based on deep learning generate candidate passwords in a character-by-character or map-sample manner. It is necessary to generate a large number of candidate passwords to get a better guess effect without using the internal structure characteristics of passwords. When the number of candidate passwords is small, the guessing success rate is low. Aiming at the above problems, based on the observation and understanding of the mutual independence between the password structure and the password fragments, this paper proposes a modular construction method to optimize the existing password guessing methods based on deep learning by analysising the characteristics of the password structure and the basic characteristics of the guessing model. In order to obtain a new method with higher guess success rate and better guess efficiency, some appropriate statistical models are introduced into the password guessing process as a basic component. Furthermore, it improves the practicability of password guessing method based on deep learning. The experimental results show that the password guessing success rate of the combined-optimized password guessing method is up to 215.51% and 176.84% higher than that of the existing password guessing methods based on deep learning in the same site and cross-site password guessing scenarios. It shows the effectiveness of combinatorial optimization.]]></description>
<pubDate>2023/9/4 15:51:40</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[fanyikang,liyong,shiruixin,xizhihong,xieziping,zhouyongbin]]></author>
</item>
<item>
<title><![CDATA[Multi-Domain Fake News Detection Fusing Knowledge Information]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012010000001&flag=2]]></link>
<description><![CDATA[Fake news and rumors can spread rapidly with the development of Internet and the popularity of social network, and cause a huge negative impact on the public. Fake news detection is very important to blocking the spread of fake news. Since the wildly used of multi-media content in addition to text in posts, recent approaches had paid more attention to how to extract the feature representations of text and vision by using deep neural network. However, they ignored the verification of facts and knowledge information contained in news. In the early fact-checking articles, researchers usually matched the entity and relationship in news with the entity relationship in knowledge base, and calculated the credibility of news. This kind of works were based on simple comparison and verification, which were hard to cover large scale multi-media data. However, the idea of using external knowledge for calculation still is worth learning from. In this paper, we propose a knowledge fusion based deep neural network method, which extracts three domains features such as textual, visual and knowledge information in news for fake news detection task. Specifically, we first use the large open knowledge graphs to obtain the relationship between entities in news, and get the entity relationship matrix of news. Then we obtain the knowledge feature representation of news by extracting the features of the relation matrix with convolution neural network. Finally, knowledge features can be integrated with text and visual features to detect fake news. Our method is validated on two large multi-modal datasets: The Chinese dataset collected from Weibo and the English dataset collected from Twitter. Extensive experiments show the significant improvement of using our al-gorithm, and our model achieved the state-of-the-art performance on both two datasets.]]></description>
<pubDate>2023/9/4 15:51:13</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HAN Jizhong,WANG Xi]]></author>
</item>
<item>
<title><![CDATA[Revisiting Construction of Online Cipher in Hash-ECB-Hash Structure]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012020000001&flag=2]]></link>
<description><![CDATA[Online cipher is an important primitive in many cryptographic schemes, such as authenticated encryption schemes. Con-sidering performance and security, the Hash-ECB-Hash structure provides a potential way to construct parallelizable and CCA secure online cipher. In this paper, we start from the online cipher POE, which is the only instantiation of Hash-ECB-Hash structure in the literature. However, the AXU property of hash function in the hash layer cannot guaran-tee the security of POE as it claimed. In order to thwart the attacks to POE, the output-collision probability of the com-ponent function of the hash layer should be negligible. Then we propose a new concept of online universal hash function (OUHF) including online almost universal (OAU) and online almost XOR universal (OAXU) hash function for the hash layer to meet the condition and prove that the Hash-ECB-Hash structure is CCA secure, if the hash layer is online almost universal (OAU) and the underlying block cipher is CCA secure. We also give several concrete constructions of OAU hash functions, including the CFB and CBC modes. We also give a construction, named MCFB, based on finite field multiplication function and a construction named XCH by chaining the operation XOR of input and output. Using secure online cipher, we construct a simple online authenticated encryption schemes, revisit the security notions of online au-thenticated encryption and prove our scheme is secure for its privacy and integrity.]]></description>
<pubDate>2023/9/4 15:50:51</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[liugang,wangpeng,weirong,yedingfeng]]></author>
</item>
<item>
<title><![CDATA[HiveAttacker: A Two-stage Security Detecting Approach for Apache Hive]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012070000002&flag=2]]></link>
<description><![CDATA[Big data has immense value, which makes it one of major targets of cyber-attack. However, in a long period, Hive-represented data warehouse and big data processing engine rely highly on the distributed processing platform. Generally this formulation focuses on the availability and extension in service but ignores security and expose the storage and processing of big data to security risks. In the perspective of Hive data warehouse and query engine on Hadoop platform, we concluded two main attack surfaces Hive faces: (1) during the query compile process and (2) during the interaction process with Hadoop platform or other third-party components. Then we designed a two-stage security detecting approach. In the first stage we custom and extend the traditional fuzzing technology to detect the vulnerabilities that may lead to privilege escalation, authorization bypass etc. in Hive source code. In the second stage we focus on detecting and alerting vulnerabilities that may be triggered by Hive&amp;amp;#39;&amp;amp;#39;s interactions with other components. We implement a prototype tool HiveAttacker based on the above method. A total of 8 authorization vulnerabilities were found in the two historical and latest versions of Hive, including 2 unfixed bugs in the latest version, and 7 security threats resulting from component interactions to verify the effectiveness of the method.]]></description>
<pubDate>2023/9/4 15:50:33</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Bo Defang,Huo Wei,Li Feng,Li Wenchao,Zhou Jianhua]]></author>
</item>
<item>
<title><![CDATA[A Survey of Static Analysis Techniques of Binary Code]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012090000001&flag=2]]></link>
<description><![CDATA[Static analysis techniques, as an important part of the program analysis, has developed very maturely in source code analysis, however, is developing slowly in binary program analysis. With the widespread use of the Internet of Things (IoT), many characteristics of IoT devices, including diverse instruction architectures, different operating systems, limited hardware resources, most C-based development, and closed source code, bring new challenges and demands to binary static analysis. In recent years, vulnerability discovery on IoT firmware images through bi-nary static analysis techniques has gradually attracted researchers’ attention. Based on the basic principles of static analysis, we will introduce and summarize the binary static analysis techniques from aspects of data-flow analysis, alias analysis, symbolic execution, and static taint analysis. Finally, we will discuss the research focus and direction in the future.]]></description>
<pubDate>2023/9/4 15:50:11</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Cheng Kai,Liu Mingdong,Song Zhanwei,Sun Limin,Yu Nan,Zhu Hongsong]]></author>
</item>
<item>
<title><![CDATA[A Novel Hardware Trojan Detection Method based on the Controllability Flow Analysis of the netlist]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012140000001&flag=2]]></link>
<description><![CDATA[With the expansion of modern integrated circuit (IC) scale, it’s inevitable to introduce many intellectual property (IP) cores designed by the third party, leading to the potential insertion of malicious circuits called Hardware Trojans(HT). Thus, HT detections are essential to mitigate the thread of HT which may be inserted during the IC design flow. Existing HT detection methods are usually rely on a particular character of HT, which are easy resisted by novel implicitly designs. In this paper, we propose a general modeling method of designs, which transform the netlist to a Node Controllability Flow Graph (NCFG), and a novel HT detection method based on the controllability flow analysis considering both combinational and sequential logics. The experiment result shows that it has high accuracy to common HT and novel implicitly HT. Moreover, it has advantages to be extended for future stealthier HT features analysis based on NCFG.]]></description>
<pubDate>2023/9/4 15:49:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HUANG Weiqing,LV Zhiqiang,ZHANG Ning,ZHANG Yanlin]]></author>
</item>
<item>
<title><![CDATA[Time-Frequency Characteristics Based Multi-Channel Fusion Leakage Detection]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012180000001&flag=2]]></link>
<description><![CDATA[Leakage detection is an important technology to assess the risk of leakage of cryptographic device, it is to find the evidence of dependency between leakages and sensitive data through hypothesis testing. Various information leakages such as power and electromagnetic are generated during the running of cryptographic devices. Detecting only one specific type of information leakage ignores the inherent correlation between multiple information leakages, so it is difficult to fully characterize the actual security of cryptographic devices. Multi-channel fusion leakage detection is a new direction to overcome this technical defect. This paper proposes time-frequency characteristics based multi-channel fusion leakage detection, the feasibility and applicable scenarios of this method are analyzed from the perspectives of frequency information leakage density, signal-to-noise ratio, dimension, etc. The experimental results show that the false positive rate of the new method proposed in this paper is reduced by 99.33%~99.97% compared with the existing detection methods when the number of sampling points is the same. In the case of specific and non-specific test, compared with the existing detection methods, the number of measures required to detect by the new method in this paper is reduced by 15%~52% and 29%~64% respectively.]]></description>
<pubDate>2023/9/4 15:48:59</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[FENG Qi,MING Jingdian,ZHANG Qian,ZHOU Yongbin]]></author>
</item>
<item>
<title><![CDATA[Chinese Text Recognition in Electromagnetic Emission  Reconstructed Images Based on Domain Adaptive]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012240000001&flag=2]]></link>
<description><![CDATA[Abstract  Electromagnetic emission exists in the process of information transmission and display in computer display system. However, the signal-to-noise ratio of the emitted video signal received by the receiver is very low, and it makes the restored image difficult for effective text recognition. There are few text recognition methods for Chinese text images with low signal-to-noise ratio. In this paper, We propose a CRNN (Convolutional Recurrent Neural Network) text recognition model based on domain adaptation, which uses the unlabeled text images collected in the electromagnetic emission environment as the target domain data, and uses the normal labeled text images as the source domain data. The model combines the Convolutional Neural Network (CNN) with the Domain Discrimination Module(DDM), and then use the semi-supervised learning method to maximize the extraction of the character features that are not related to random noise in the text image by the convolutional neural network, which improves the accuracy of text recognition in images emitted from target computer. Experiments were performed on dataset emitted from target computer consists of public datasets including RCTW17 and CASIA-10k. Result shows that our method outperforms common recognition methods.]]></description>
<pubDate>2023/9/4 15:48:42</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[lihaiyang,lvzhiqiang,yuchao,zhangning]]></author>
</item>
<item>
<title><![CDATA[Survey on Lightweight Virtualization Technology Security]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012240000002&flag=2]]></link>
<description><![CDATA[With the rapid development of lightweight virtualization technology represented by container technology, its position in the cloud computing is becoming more and more important. The high efficient and flexible features of lightweight virtualization technology have brought new technical architectures and operation and maintenance models to the cloud computing industry. Meanwhile, they also introduced new security challenges, which have received widespread attention in both academia and industry. But its security problems lack systematic research. First, this paper introduces the architecture and application scenarios of lightweight virtualization technology. And we classify the attack methods it faces with by the layered model. Then, according to the system level of security solutions, the existing security defense methods and mechanisms are introduced and analyzed. Finally, this survey paper discusses the future work and suggested security research directions of lightweight virtualization technology.]]></description>
<pubDate>2023/9/4 15:48:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[KONG Tong,MA Duohe,WANG Liming,XU Zhen]]></author>
</item>
<item>
<title><![CDATA[Jointly Exploiting Temporal and Structural Features for Rumor Detection on Social Media]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012250000002&flag=2]]></link>
<description><![CDATA[With the rapids development of the social network, more and more people obtain or share information on social network platforms. Unfortunately, the convenient environment of social network platforms also provides rumors a new propaga-tion medium. The existing deep learning-based rumor detection models have been developed based on content character-istics or propagation characteristics including temporal features and structural features. However, most of these models either only model the temporal information in rumor propagation or only focus on the network structure features of rumor propagation to identify rumors, which cannot learn a comprehensive eigenvector representation well and limit the per-formance of rumor detection. Aiming at this problem, we propose a novel rumor detection model, to jointly model both structural features and temporal patterns in the rumor propagation. Accordingly, the model can learn a comprehensive representation of rumor characteristics. In addition, the model can effectively alleviate the time mode distortion caused by pruning. Extensive experiments on three real-world datasets demonstrate that the proposed model can improve the performance of rumor detection.]]></description>
<pubDate>2023/9/4 15:48:00</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[BAO Yinan,HU Dou,HU Songlin,WEI Lingwei,YANG Jinzhu,ZHOU Wei]]></author>
</item>
<item>
<title><![CDATA[Advance in user identity linkage across online social networks]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202012300000001&flag=2]]></link>
<description><![CDATA[Nowadays, online social networks(OSNs) have become popular and diverse. To make better use of the services offered by each OSN, people tend to join a number of OSNs. User identity linkage across OSNs is the task of accurately link accounts corresponding to the same natural person in multiple OSNs. We can deeply understand user interests and greatly enrich user profile by user identity linkage, or use it in digital marketing and recommendation system. In this paper, we classify and analyze the existing user identity linkage methods according to feature type, and discuss existing problems and chal-lenges. We also summarize the datasets and evaluation indicators used by existing methods, then analyze why public agreed datasets are rare. Finally we look forward to the future research trend of user identity linkage. This paper proposes a general definition of user identity linkage, compares and analyzes existing methods of user identity linkage, discusses existing problems and looks forward to future research trend, to analyze and display current situation and future of user identity linkage in a clear and structured way, which is helpful for researchers to form a systematic understanding and grasp of the related research in this domain, so as to further make more in-depth research work.]]></description>
<pubDate>2023/9/4 15:46:51</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[fangjing,sichengxiang,sunbo,xuehui,zhangwei]]></author>
</item>
<item>
<title><![CDATA[Blind Recognition of Scrambled Convolutional Code Based on Calculating Shift Equivalent Codeword Entropy Rate]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202101060000001&flag=2]]></link>
<description><![CDATA[Blind recognition of scrambled codewords is of great significance in non-cooperative communication research. However, the current research on blind recognition of scrambled codewords is mainly aimed at single channel coding blind recognition or scramble code blind recognition, and its algorithm is not suitable for scramble code and channel coding cascade scenarios in actual systems, and the recognition efficiency is low in error scenarios. Therefore, this paper proposes a joint blind recognition algorithm of scramble code and convolutional code based on the shift equivalent codeword entropy rate for the cascading scene of scrambled convolutional codes. Firstly, use the scrambled properties of convolutional codewords to construct shift equivalent codewords, and convert the scramble code blind recognition problem into an equivalent convolu-tional code decision problem; secondly, in view of the fact that using traditional algorithms to determine shift equivalent codewords is too complicated and consumes too much computing resources, this paper proposes a fast judgment method for convolutional codes based on information entropy rate, and derives the relevant parameters required for algorithm realization, which realizes low-complexity and high-efficiency fast joint blind recognition. Numerical simulation experiments show that the proposed method can effectively identify scrambled convolutional codewords with scramble code and convolutional code. With bit error rate less than 6%, the scramble code recognition accuracy rate is higher than 84.5% and the combined recognition rate is higher than 80%, which shows a good anti-noise performance.]]></description>
<pubDate>2023/9/4 15:46:33</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Hu Ke Ke,Huang Wei Qing,Wang Zhong Fang,Wei Dong,Zhai Liu Qun]]></author>
</item>
<item>
<title><![CDATA[A Survey on Adversarial Attacks and Defenses in Text Domain]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202101290000001&flag=2]]></link>
<description><![CDATA[Deep neural networks (DNNs) have achieved remarkable results in fields such as computer vision, speech recogni-tion, and natural language processing. The accuracy rate of DNNs has even surpassed that of humans. However, re-searches in recent years have shown that DNNs are highly vulnerable to adversarial examples which can lead to incorrect predictions by adding small and imperceptible perturbations to the normal inputs. The adversarial attacks and defenses have been well studied in the field of computer vision, but researches in text domain are still insuffi-cient. Many methods in computer vision domain cannot be directly applied to texts. Especially the input space of texts is discrete which makes attacks and defenses more challenging. So there is still lots of research potentials in this field. This article presents a comprehensive introduction of adversarial attacks and defenses in text domain to-gether with some related work. Specifically, we first classify the adversarial attacks and defenses in texts from dif-ferent perspectives, then we present the corresponding works and recent advances. Finally we discuss the existing challenges of adversarial attacks and defenses in text domain and present the possible future research directions in this emerging field.]]></description>
<pubDate>2023/9/4 15:45:48</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HE Yuanye,LIANG Yuhang,LIN Zheng,WANG Lei,WANG Weiping]]></author>
</item>
<item>
<title><![CDATA[Lateral Movement Detection Using Heterogeneous Graph Network]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202102010000001&flag=2]]></link>
<description><![CDATA[With the rapid development of the Internet, advanced persistent threats have become more frequent. While, lateral movement, as an important part of its attack cycle, usually co-occurs with the destruction of internal networks and the theft of confidential data, causing great harm to enterprises. The high degree of concealment often makes lateral movement attacks difficult to detect and prevent. Therefore, we propose a two-stage approach based on heterogeneous graph network to detect lateral movement attack called HGLM. First, based on the authentication log of the internal network, we construct the User Authentication Graph and Host Path Graph to represent the login behavior between users and hosts, and then perform the two-stage anomaly detection on the graphs. In the first stage, we use a graph model with the goal of maximizing mutual information for unsupervised training to learn a characteristic representation of the user''s authentication behavior among hosts based on the User Authentication Graph, and then detect some abnormal samples through the Local Outlier Factor algorithm. In the second stage, we use Heterogene-ous Graph Attention Network algorithm to train a semi-supervised model which is used to detect lateral movement attacks based on the Host Path Graph and a small number of abnormal samples obtained in the first stage. Furthermore, our approach is evaluated and verified on the dataset CMCS Events. Compared with other methods, our approach has high TPR and low FPR, and does not require labeled samples.]]></description>
<pubDate>2023/9/4 15:45:28</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[dongcong,jiangbo,liusong,luzhigang,tiantian,wangtian]]></author>
</item>
<item>
<title><![CDATA[A Fast Automatic Identification Method of Massive Shortwave Radio Stations Based on Sparse Component Analysis]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202102040000004&flag=2]]></link>
<description><![CDATA[Aiming at the problem of rapid automatic identification of a large number of radio stations in the high frequency band, a fast identification method based on sparse component analysis is proposed. Based on the unique periodicity and sparseness of each station’s transmitted signal in the time domain, the high-speed spectrum scanning data are used to separate and identify multiple radio stations on each channel automatically. In order to separate the radio signals under shortwave time-varying channel fading, a sparse component analysis algorithm based on time feature clustering is proposed, in which clustering is performed with both the time features and the amplitude features to realize the estimation of the mixing matrix. In addition, according to the clustering results, the signals are projected onto the vectors passing through the clustering centers to remove the noise introduced by the time-varying channel fading. In simulation experiments with different broadcast times, different duty cycles, and different periods, the algorithm’s accuracy rate of station identification is 98.1%, which is 7.3% and 16.8% higher than clustering based sparse component analysis and fast independent component analysis, respectively, providing a good solution to the problem of separation and identification of shortwave radio stations.]]></description>
<pubDate>2023/9/4 15:44:21</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[huangweiqing,lijing,wangyuankun,weidong,zhangqiaoyu]]></author>
</item>
<item>
<title><![CDATA[Blockchain-based Crowdsourcing Mechanism]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202102160000001&flag=2]]></link>
<description><![CDATA[Crowdsourcing, as a data collection and task allocation mode based on group intelligence perception technology, can ef-fectively improve the flexibility and diversity of task completion, save operating costs, and has broad application pro-spects in mobile medical, environmental monitoring, intelligent transportation and other fields. The current forms of crowdsourcing include centralized and distributed. Centralized crowdsourcing cloud servers face central trust and security issues, and there are performance problems such as low enthusiasm for crowdsourcing workers and slow task convergence due to the principle of maximizing server benefits, while distributed crowdsourcing faces the problems of reasonable task allocation and distributed data consistency. In response to the above problems, this paper proposes a blockchain-based distributed crowdsourcing mechanism, which is specifically embodied as: (1) Establish a crowdsourcing model based on the blockchain, make full use of the advantages of blockchain decentralization and non-tampering, to solve the problem of trust in the central server, which is suitable for distributed swarm-aware network applications; (2) Research on PBFT-based data synchronization mechanisms to improve consensus efficiency under the premise of ensuring fault tol-erance; (3) Design a service quality scoring algorithm and a reward mechanism based on service quality scoring to max-imize the benefits of contractors, mobilize participants&#39;&#39; enthusiasm, and improve service completion rate and service quality. Through theoretical analysis and simulation experiments, this paper proves that the method proposed in this pa-per is secure and feasible.]]></description>
<pubDate>2023/9/4 11:05:19</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[fan wei,Mi Baoxin,Peng Cheng,zhang zhujun,zhu dali]]></author>
</item>
<item>
<title><![CDATA[A Cyber Kill Chain Based Analysis of PLC Security]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202009240000001&flag=2]]></link>
<description><![CDATA[Programmable Logic Controller(PLC) is the core component of modern industrial control system, and its security  is closely related to the crucial processes in industrial control systems. The differences in system architecture and communication protocol of PLCs lead to the deficiencies in standard framework and procedure for the security analysis. The Cyber Kill Chain model has been well-established for representing the behaviour of intruders. Based on the Cyber Kill Chain model, we present an overview of PLC security to facilitate researchers to understand the latest advances, and provide technical reference for cyber security practitioners. Firstly we elaborates on the basic architecture, operation mechanism and communication protocols of PLC. Then referring to the Cyber Kill Chain model, we conduct a detailed classification on various PLC attack and defence technologies, and make in-depth analysis on the technology details. Finally we discuss about the research trend on PLC security issues.]]></description>
<pubDate>2023/9/4 9:51:22</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[ChenXi,HuangWenjun,SongZhanwei,SunLimin,SunYue,YouJianzhou]]></author>
</item>
<item>
<title><![CDATA[Android malware detection approach based on deep do-main correlation of sensitive features]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202008190000001&flag=2]]></link>
<description><![CDATA[The approaches based on traditional machine learning or deep learning algorithms are popular for Android malware de-tection, however, the majority of existing approaches still lack in-depth analysis of the coordination of sensitive behav-iors, resulting in low accuracy. In this paper, we propose a sensitive feature domain correlation graph to describe the main sensitive behaviors of the app and the domain correlation between sensitive behaviors. First, we define a class or package as a domain, and sensitive features in the same domain have a domain correlation. Through the relative range of the sensitive feature’s domain, we construct various domain correlation weights between the sensitive features, and gen-erate the sensitive feature domain correlation graph. Then, based on the graph, we design a deep representation with graph convolutional neural network to construct the Android malware detection model GCNDroid. In practice, GCNDroid can also be constantly updated using new features, which can adapt to the new sensitive behaviors of mobile apps. Finally, extensive evaluations of GCNDroid have been done, and the results show that GCNDroid achieves high agreement on Android malware detection, in which the recall, f1-score, auc, etc. all exceed 96%.]]></description>
<pubDate>2023/4/4 10:47:54</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Huang Weiqing,Jiang Jianguo,Li Gang,Li Meimei,Li Song,Liu Chao,Yu Min]]></author>
</item>
<item>
<title><![CDATA[Establishing a Comprehensive Evaluation Model for the Competency Assessment of Pentesting Cybersecurity Talents]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202008220000001&flag=2]]></link>
<description><![CDATA[The cultivation and selection of talents are indispensable from a “ruler” for measuring them. Taking the CVSS as an example, an evaluation model with high operability can not just be an abstract model of thinking. Furthermore, there are six essential parts: metric or criterion, weight, method to map the criterion with a corresponding numerical value, computational formula, rating and score. Prior research lacks these parts to varying degrees. Therefore, in the form of multiple rounds of questionnaire surveys, this paper uses a variety of qualitative and quantitative evaluation methods to establish a comprehensive evaluation model with the above six essential parts for the competency assessment of pentesting cybersecurity talents. First, we summarize the criterion structure and definition by literature review combining with the Delphi method. Then, we apply the analytic hierarchy process, the entropy weight method and the combination weighting method to obtain the weight of criteria. Next, we design a method of labelling tasks based on the membership matrix to map the criterion with a corresponding numerical value. Finally, the rating and score are calculated by taking advantage of the computational formula in the fuzzy comprehensive evaluation method.]]></description>
<pubDate>2023/4/4 10:47:47</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[gongxiaorui,liubaoxu,yudongsong,zhangxiu,zhaobeibei]]></author>
</item>
<item>
<title><![CDATA[A Survey of Model Inversion Attack Techniques Based on Neural Networks]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202009230000002&flag=2]]></link>
<description><![CDATA[In the era of big data, model research based on neural network is a mainstream direction in the field of artificial intelli-gence. Compared with other intelligent optimization algorithms, neural network has the advantages of strong self-adaptability and remarkable generalization ability. The inversion attack technology based on neural network model studies how to learn and derive from the output data of neural network model to obtain information about the input data. This paper first introduces the concept of inversion attack technology and common attack scenarios. Then, it discusses the inversion attack challenges faced in the neural network model, including the key issues of original data protection, sensitive data leakage, model training privacy, etc. Then, the techniques of neural network model inversion attack based on gradient optimization and parameter training are reviewed and compared, and typical defense methods are summa-rized. Finally, the paper summarizes the whole paper and discusses the future research directions.]]></description>
<pubDate>2023/4/4 10:47:41</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[HAN Yanni,HU Yanjie,TAN Qian,XU Zhen,ZHANG Huan]]></author>
</item>
<item>
<title><![CDATA[A HEVC Information Hiding Algorithm Based on Motion Vector Modification minimizing the distortion between blocks]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202006240000001&flag=2]]></link>
<description><![CDATA[High Efficiency Video Coding (HEVC) standard can greatly improve compression efficiency, which is widely used. In order to improve the security of HEVC steganography algorithm based on motion vector modification, this paper proposes a HEVC information hiding algorithm based on motion vector modification minimizing the distortion between blocks. Firstly,the algorithm defines the cost of modifying the motion vector for the current Advanced Motion Vector Prediction (AMVP) mode unit and its adjacent Merge mode units. Secondly, we use the Syndrome Trellis Codes (STC) to minimize distortion and then embed the message on the motion vector of prediction units, which utilize AMVP mode. In addition, the motion vector difference is updated. Experimental results show that the proposed method makes the peak signal-to-noise ratio and the bitrate of video sequences fluctuate less. And it also performs well in resisting steganalysis of motion vector domain.]]></description>
<pubDate>2023/3/31 17:06:35</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Ma Yi,tangxiaojing,Yu Jianchang,Zhang Hong,Zhao Xianfeng]]></author>
</item>
<item>
<title><![CDATA[A Survey on Optimizing Intrusion Detection and Response Based on Game Theory]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202006170000001&flag=2]]></link>
<description><![CDATA[The scale of the current network has increased dramatically, and various types of intrusion processes have gradually evolved to become more complex and diverse. The losses caused by cyber-attacks have become more and more increasingly serious. To quickly identify various security incidents and make a certain response, intrusion detection and response technology become more and more important. Whether an intrusion detection system (IDS) can identify complex attack patterns and analyze large amounts of network traffic mainly depends on its accuracy and configuration, which makes intrusion detection and response optimization issues an important requirement for network and system security, and has become an active Research Topics. Existing researches have proposed many methods that can improve the efficiency of intrusion detection and response. Among them, the application of game theory in intrusion detection and response is increasing. Game theory provides a framework to capture the interaction between attackers and defenders, and uses a quantitative method to evaluate the security of the system. In this article, at first, we review the background of intrusion detection and game theory. Secondly, we classify and introduce them based on the types of game theory-based intrusion detection and response control optimization problems, and then discuss the limitations of these solutions in general. Finally, we also proposed future research directions.]]></description>
<pubDate>2023/3/31 17:05:32</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[genliru,liting,liangjie,liuhaitao,liujiqiang,liuyinlong,zhanghangsheng]]></author>
</item>
<item>
<title><![CDATA[A Study of Speed Test Method for Implementations of Block Cipher Algorithms on the x64 Platform]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202006090000001&flag=2]]></link>
<description><![CDATA[The software implementation speed is one of the important criteria of measuring a cryptographic algorithm’s performance. We investigate the research situation at home and abroad,finding that there is no unified test standard on how to test the software implementation speed of cryptographic algorithms on the x64 platform. Taking the speed test of block cipher algorithms as an example, we do experiments to analyze the problems that are easy to occur in the process of software speed test on the x64 platform. We introduce the existing four speed test methods: Matsui’s method, Fog’s method, Supercop method and Gladman’s method. We compare the similarities and differences of the four speed test methods, and analyze the problems of the four methods. Based on the above four methods, we analyze how to obtain stable, reliable and efficient test results. Finally, we give effective methods for testing the minimal and average software implementation speed of block cipher algorithms on the x64 platform. Applying our new testing methods, we evaluate the performance of AES and SM4 on the x64 platform.]]></description>
<pubDate>2023/3/31 17:00:04</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[jifulei,maoyingying,zhangwentao,zhaoxuefeng]]></author>
</item>
<item>
<title><![CDATA[Class Information Recovery Technology for COTS C++ Binary]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202006050000001&flag=2]]></link>
<description><![CDATA[Software written in C++ has always been a difficult challenge in binary reverse analysis. Binary code no longer retains the classes and their information in C++, especially Commercial-Off-The-Shelf (COTS) enables compiler optimization by default, resulting in significant reduction of residual information. It makes COTS C++ binary reverse analysis particularly difficult. At present, the existing research work does not fully consider compilation optimization, resulting in a low recognition rate on recovering classes and class relationships under compiler optimization , and it is difficult to identify complex relationships such as virtual inheritance. Second, the recognition algorithm has low efficiency and cannot meet the reverse analysis of large-scale software.
This paper conducts research on the identification technology of classes and their inheritance in C++ binary under compiler optimization, and makes achievements in three aspects. First, using the inter-procedural static taint analysis to extract the object memory layout from the C++ binary, effectively resisting the impact of compiler optimization (inline constructors); second, introducing four heuristic methods, which can recover lost information in C++ binary files; third, an adaptive CFG (control flow graph) generation algorithm has been developed to greatly improve the efficiency with minimal loss. On this basis, a prototype system RECLASSIFY is implemented, which can effectively identify polymorphic classes and class relationships (including virtual inheritance) from C++ binary.
Experiments show that under both MSVC ABI and Itanium ABI, RECLASSIFY can identify most polymorphic class and recovery class relationships from the optimized binary in a short time. In a data set composed of 15 C++ binaries in real software (O2 compiler optimization), the average recall rate of RECLASSIFY recovering polymorphic classes under MSVC ABI is 84.36%, while the average recall rate of most advanced solution OOAnalyzer is only 33.76%. In addition, compared with OOAnalyzer, the analysis efficiency of RECLASSIFY is improved by three orders of magnitude.]]></description>
<pubDate>2023/3/31 16:58:55</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[GONG Xiaorui,WU Wei,YANG Jin,ZHANG Bolun]]></author>
</item>
<item>
<title><![CDATA[Study on Tweakable Enciphering Schemes Against Simon’s Quantum Algorithm]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202005300000002&flag=2]]></link>
<description><![CDATA[With the rapid development of quantum computing technology, the threat of quantum algorithms to the security of cryptosystems is imminent. Previous research has shown that many symmetric cryptographic schemes are insecure under quantum attacks based on Simon’s algorithm. This paper uses Simon’s algorithm to analyze four tweakable enciphering schemes including HCTR, HEH, PEP and HEH, showing that these four schemes are insecure under the quantum attacks. At the same time, more concise attacks against CMC and TET are given by using the method of variable tweaks. It is shown that the two different quantum attacks with fixed tweaks and variable tweaks have dif-ferent periods, which can be combined to obtain further results. Finally, we summarize a general quantum attacking method against tweakable enciphering schemes.]]></description>
<pubDate>2023/3/31 16:57:52</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[Hu Lei,Mao Shuping,Wang Peng]]></author>
</item>
<item>
<title><![CDATA[A Survey on Neural Machine Reading Comprehension model]]></title>
<link><![CDATA[http://jcs.iie.ac.cn/xxaqxben/ch/reader/view_abstract.aspx?file_no=202005210000001&flag=2]]></link>
<description><![CDATA[With the rapid development of the Internet, the problem of network content security, which is one of the core tasks of network governance, is increasingly severe. Text content is the most pivotal research object of network content security. However, the inherent ambiguous and flexibility of natural language bring great difficulties to public opinion monitoring and network content governance on the internet. Therefore, how to accurately understand the text content is the key issue of network content governance. At present, the core method of text content understanding is based on natural language processing. As a comprehensive task in the field of natural language processing, machine reading comprehension can deeply understand network content and play an important role in network public opinion monitoring and network content governance. In recent years, deep learning technology has made remarkable achievements in many fields, such as image recognition, text classification and natural language processing. Likewise, machine reading comprehension methods based on deep learning have been widely studied. The purpose of this paper is to review various neural machine reading models. Firstly, the development history and research status of machine reading comprehension are introduced. Then, the task definition of machine reading comprehension is expounded, and representative datasets and neural machine reading model are presented. The latest research progress of four new trends is introduced. Finally, the existing problems of the neural machine reading model are put forward, the application of machine reading comprehension in web content security is analyzed, and the future development trend is forecasted.]]></description>
<pubDate>2023/3/31 16:34:45</pubDate>
<category><![CDATA[ChinaSoft 2022人工智能安全]]></category>
<author><![CDATA[LUO Dan,MA Lu,WANG Bin,WANG Lihong,Zhang Peng]]></author>
</item>
</channel>
</rss>