Hidden and under control

Network covert channels are policy-breaking and stealthy communication channels in computer networks. These channels can be used to bypass Internet censorship, to exfiltrate data without raising attention, to allow a safe and stealthy communication for members of political oppositions and for spies, to hide the communication of military units at the battlefield from the enemy, and to provide stealthy communication for today’s malware, especially for botnets. To enhance network covert channels, researchers started to add protocol headers, so-called micro-protocols, to hidden payload in covert channels. Such protocol headers enable fundamental features such as reliability, dynamic routing, proxy capabilities, simultaneous connections, or session management for network covert channels—features which enrich future botnet communications to become more adaptive and more stealthy than nowadays. In this survey, we provide the first overview and categorization of existing micro-protocols. We compare micro-protocol features and present currently uncovered research directions for these protocols. Afterwards, we discuss the significance and the existing means for micro-protocol engineering. Based on our findings, we propose further research directions for micro-protocols. These features include to introduce multi-layer protocol stacks, peer auto-configuration, and peer group communication based on micro-protocols, as well as to develop protocol translation in order to achieve inter-connectivity for currently separated overlay networks.     

Two types of new subliminal channels

Two types of new subliminal channels are constructed respectively based on provable secure public key cryptosystems and identity recognition in some network applications. Research shows that there are some new characteristics which are in favor of covert communication in our constructions. It is hard to make the subliminal channels free, and the channels have large capacity and high transmission efficiency. We also point out that the hardness to make the channels free is disadvantageous to the warden who tries to thwart the covert communication.     

基于对比权限模式的安卓恶意软件检测方法(英文)

As the risk of malware is sharply increasing in Android platform,Android malware detection has become an important research topic.Existing works have demonstrated that required permissions of Android applications are valuable for malware analysis,but how to exploit those permission patterns for malware detection remains an open issue.In this paper,we introduce the contrasting permission patterns to characterize the essential differences between malwares and clean applications from the permission aspect Then a framework based on contrasting permission patterns is presented for Android malware detection.According to the proposed framework,an ensemble classifier,Enclamald,is further developed to detect whether an application is potentially malicious.Every contrasting permission pattern is acting as a weak classifier in Enclamald,and the weighted predictions of involved weak classifiers are aggregated to the final result.Experiments on real-world applications validate that the proposed Enclamald classifier outperforms commonly used classifiers for Android Malware Detection.     

MIMO雷达次优检测器

在理想条件下,MIMO雷达分集路径完全独立;而在实际工程中,空间分集路径总是不完全独立,即存在一定的相关性。文章研究了相关路径下Fishler检测器的检测性能及该条件下系统的最优检测性能,分析了Fishler检测器和最优检测器的信号处理方式的本质区别。理论分析和数值仿真证明Fishler检测器可作为空间分集MIMO雷达系统工程实用的次优检测器。     

基于Android的流量监控白名单策略

Android安全问题是制约Android应用发展的一个重要因素,分析了目前Android流量监控系统存在的安全缺陷,针对Android恶意软件吸费问题,提出了一种基于白名单的流量监控改进策略.该策略实施在协议层,通过建立白名单数据库实现对应用进程的联网访问控制.实验结果表明,改进后的流量监控系统在当前网络环境下,加强了对应用联网的约束,能有效降低流量损失,增强系统安全性.     

An 802.11 MAC layer covert channel

For extremely sensitive applications, it may be advantageous for users to transmit certain types of data covertly over the network. This provides an additional layer of security to that provided by the different layers of the protocol stack. In this paper we present a covert side channel that uses the 802.11 MAC rate switching protocol. The covert channel provides a general method to hide communications within currently deployed 802.11 LANs. The technique uses a one‐time password (OTP) algorithm to ensure high‐entropy randomness of the covert messages. We investigate how the covert side channel affects network throughput under various rate‐switching conditions with UDP‐based and TCP‐based application traffic. We also investigate the covertness of the covert side channel using standardized entropy. The theoretical analysis shows that the maximum covert channel bandwidth is 60 bps. The simulation results show that the impact on network throughput is minimal and increases slightly as the covert channel bandwidth increases. We further show that the channel has 100% accuracy with minimal impact on rate switching entropy for scenarios where rate switching normally occurs. Finally, we present two applications for the covert channel: covert authentication and covert WiFi botnets. Copyright © 2010 John Wiley & Sons, Ltd.     

数字电视网络隐蔽信道技术研究

目前针对隐蔽信道的研究工作大部分都基于互联网协议,在数字电视中实现隐蔽通信是信息隐藏技术的一个新方向。论文在隐蔽信道信息传递框架的基础上,阐明了数字电视网络中隐蔽信道存在的可能性和必然性。本文提出了基于TS包的填充域与PCR域保留位的信息隐藏方法,并实现仿真,然后对两种隐藏方案的性能进行了分析与比较。研究工作对在数字电视网络中构建隐蔽信道有一定的指导意义。     

Cross-Compiling Android Applications to iOS and Windows Phone 7

Android is currently leading the smartphone segment in terms of market share since its introduction in 2007. Android applications are written in Java using an API designed for mobile apps. Other smartphone platforms, such as Apple’s iOS or Microsoft’s Windows Phone 7, differ greatly in their native application programming model. App developers who want to publish their applications for different platforms are required to re-implement the application using the respective native SDK. In this paper we describe a cross-compilation approach, whereby Android applications are cross-compiled to C for iOS and to C# for Windows Phone 7. We describe different aspects of our cross-compiler, from byte code level cross-compilation to API mapping. A prototype of our cross-compiler called XMLVM is available under an Open Source license.     

一种基于行为链的Android应用隐私窃取检测方法

本文针对Android应用中普遍存在的用户隐私窃取问题,提出了基于行为链的应用隐私窃取行为检测方法,该方法能细粒度地定位Android应用中存在的信息泄露源和信息泄露点,利用WxShall算法快速计算信息泄漏源和信息泄露点之间的可达性,自动化地追踪Android应用中存在的隐私信息传递路径,实现了对Android应用中隐私窃取行为的完整检测和分析.对1259款应用检测结果表明,本方法正确性超过95.1%,算法复杂度仅为WarShall算法的5.45%,检测效果优于Androgurad 和Kirin.     

Identification of DNS covert channel based on improved convolutional neural network

In order to effectively identify the multiple types of DNS covert channels,the implementation of different sorts of DNS covert channel software was studied,and a detection based on the improved convolutional neural network was proposed.The experimental results,grounded upon the campus network traffic,show that the detection can identify twenty-two kinds of data interaction modes of DNS covert channels and is able to identify the unknown DNS covert channel traffic.The proposed method outperforms the existing methods.     

基于DNS的隐蔽通道流量检测

为提出一种有效检测各类型DNS隐蔽通道的方法,研究了DNS隐蔽通信流量特性,提取可区分合法查询与隐蔽通信的12个数据分组特征,利用机器学习的分类器对其会话统计特性进行判别。实验表明,决策树模型可检测训练中全部22种DNS隐蔽通道,并可识别未经训练的新型隐蔽通道。系统在校园网流量实际部署中成功检出多个DNS隧道的存在。     

Design and Implementation of a Toolkit for Usability Testing of Mobile Apps

The usability of mobile applications is critical for their adoption because of the relatively small screen and awkward (sometimes virtual) keyboard, despite the recent advances of smartphones. Traditional laboratory-based usability testing is often tedious, expensive, and does not reflect real use cases. In this paper, we propose a toolkit that embeds into mobile applications the ability to automatically collect user interface (UI) events as the user interacts with the applications. The events are fine-grained and useful for quantified usability analysis. We have implemented the toolkit on Android devices and we evaluated the toolkit with a real deployed Android application by comparing event analysis (state-machine based) with traditional laboratory testing (expert based). The results show that our toolkit is effective at capturing detailed UI events for accurate usability analysis.     

一种基于深度学习的强对抗性Android恶意代码检测方法

针对现有Android恶意代码检测方法容易被绕过的问题,提出了一种强对抗性的Android恶意代码检测方法.首先设计实现了动静态分析相结合的移动应用行为分析方法,该方法能够破除多种反分析技术的干扰,稳定可靠地提取移动应用的权限信息、防护信息和行为信息.然后,从上述信息中提取出能够抵御模拟攻击的能力特征和行为特征,并利用一个基于长短时记忆网络（Long Short-Term Memory,LSTM）的神经网络模型实现恶意代码检测.最后通过实验证明了本文所提出方法的可靠性和先进性.     

可生存性MLS/DBMS中基于隐蔽通道的 恶意事务检测

 多级安全数据库系统(MLS/DBMS)中并发控制协议并不能彻底消除所有的隐蔽通道.在隐蔽通道无法避免的情况下,已渗透的恶意事务可以利用隐蔽通道泄漏和篡改机密信息.为提高数据库的可生存性,首先分析了MLS/DBMS系统中的隐蔽通道,通过对真实情况的参数模拟和实验分析,结合恶意事务特征和隐蔽通道带宽的异常改变,给出可生存DBMS中的同谋事务和恶意事务的检测,并提出了同谋用户造成隐蔽通道传递性的机理以及恶意噪声事务对其的影响.     

JNI在Android系统下串口控制的应用

Android是基于Linux的操作系统,应用程序是由Java语言编写并运行在虚拟机里的,这就造成了Android应用程序很难操作订制的硬件问题.利用Java的JNI机制,使用Android NDK编译环境,使应用程序可以透过Android系统的应用框架层,直接在Linux的文件系统对设备进行操作,解决了上述问题.     

DroidEnemy: Battling adversarial example attacks for Android malware detection

In recent years, we have witnessed a surge in mobile devices such as smartphones, tablets, smart watches, etc., most of which are based on the Android operating system. However, because these Android-based mobile devices are becoming increasingly popular, they are now the primary target of mobile malware, which could lead to both privacy leakage and property loss. To address the rapidly deteriorating security issues caused by mobile malware, various research efforts have been made to develop novel and effective detection mechanisms to identify and combat them. Nevertheless, in order to avoid being caught by these malware detection mechanisms, malware authors are inclined to initiate adversarial example attacks by tampering with mobile applications. In this paper, several types of adversarial example attacks are investigated and a feasible approach is proposed to fight against them. First, we look at adversarial example attacks on the Android system and prior solutions that have been proposed to address these attacks. Then, we specifically focus on the data poisoning attack and evasion attack models, which may mutate various application features, such as API calls, permissions and the class label, to produce adversarial examples. Then, we propose and design a malware detection approach that is resistant to adversarial examples. To observe and investigate how the malware detection system is influenced by the adversarial example attacks, we conduct experiments on some real Android application datasets which are composed of both malware and benign applications. Experimental results clearly indicate that the performance of Android malware detection is severely degraded when facing adversarial example attacks.     

Code acquisition for DS/SS communications in non-Gaussian impulsive channels

In this letter, we propose a new detector for code acquisition systems in non-Gaussian noise channels. Modeling the acquisition problem as a hypothesis testing problem, a detector is derived for non-Gaussian, symmetric /spl alpha/-stable noise, based on the locally optimum detection technique. Numerical results show that the proposed detector can offer robustness and substantial performance improvement over the conventional schemes in non-Gaussian channels.     

Neural networks applications for CDMA systems in non-Gaussian multi-path channels

Non-Gaussian noise is one of the most common noise models observed in wireless channels. This type of noise has severe impact on wireless systems with multiuser detection devices. In this paper, the issue of multiuser detection in non-Gaussian noise multipath channel is addressed. We also pay a close attention to the neural network applications, and propose a new robust neural network detector for multipath impulsive channels. The maximal ratio combining (MRC) technique is adopted to combine the multipath signals. Moreover, we discuss the performance of the proposed multiuser neural network decorrelating detector (NNDD), under class A Middleton model. Furthermore, the performance of the system under power imbalance scenario is shown. We show that the proposed NNDD has magnificent effect on the system performance. The system performance is measured through the bit error rate (BER). It is shown that the proposed robust receiver reduces the impact of the impulsive noise by processing the received signal and clipping the extreme amplitudes.     

A collaborative policy-based security scheme to enforce resource access controlling mechanism

Advances in both telecommunications and Information technology have improved the way users do business online. Android, an open-source mobile operating system, is becoming an attractive target for cyber criminals to exploit due to its predefined permission model. Without classification, the mobile operating system permits installation of mobile applications of all kinds, including Trojans, thus making its trustworthiness into question. In this paper, we present a security system called collaborative policy-based security scheme (CSS) that permits users to customize the access permissions of Android applications during runtime. The proposed CSS security scheme validates the trustworthiness of each application before being installed. The experimental results show that the proposed CSS successfully detects all malicious applications with a run-time overhead of 2.7%.

     

基于无线信道差异的隐蔽通信

本文在背景噪声存在不确定性的无线通信中,研究对于监控方检测最有利条件下的单向隐蔽通信问题。首先,根据接收方检测能力存在极限的事实,利用信道预编码保证在接收方处汇聚的信号功率超过其检测阈值,同时保证在监控方处弥散的信号功率低于检测阈值,进而实现基于信道差异的隐蔽通信。其次,本文推导了平均遍历隐蔽通信速率的闭式解。理论分析和仿真结果表明,虽然在对于监控方检测最有利的场景中,噪声不确定性对隐蔽通信有负面作用,但是通过增加天线数量依旧可以达到正的隐蔽通信速率。