基于Stacking融合模型的Web攻击检测方法

随着计算机技术与互联网技术的飞速发展,Web应用在人们的生产与生活中扮演着越来越重要的角色。但是在人们的日常生活与工作中带来了更多便捷的同时,却也带来了严重的安全隐患。在开发Web应用的过程中,大量不规范的新技术应用引入了很多的网站漏洞。攻击者可以利用Web应用开发过程中的漏洞发起攻击,当Web应用受到攻击时会造成严重的数据泄露和财产损失等安全问题,因此Web安全问题一直受到学术界和工业界的关注。超文本传输协议(HTTP)是一种在Web应用中广泛使用的应用层协议。随着HTTP协议的大量使用,在HTTP请求数据中包含了大量的实际入侵,针对HTTP请求数据进行Web攻击检测的研究也开始逐渐被研究人员所重视。本文提出了一种基于Stacking融合模型的Web攻击检测方法,针对每一条文本格式的HTTP请求数据,首先进行格式化处理得到既定的格式,结合使用Word2Vec方法和TextCNN模型将其转换成向量化表示形式;然后利用Stacking模型融合方法,将不同的子模型(使用配置不同尺寸过滤器的Text-CNN模型搭配不同的检测算法)进行融合搭建出Web攻击检测模型,与融合之前单独的子模型相比在准确率、召回率、F1值上都有所提升。本文所提出的Web攻击检测模型在公开数据集和真实环境数据上都取得了更加稳定的检测性能。     

基于时间序列分析的Web服务器DDoS攻击检测

摘要: 分布式拒绝服务攻击(Distributed Denial of Service, DDoS)的目标是破坏网络服务的有效性,是当前Web服务安全的主要威胁之一。本文提出了一种基于时间序列分析的DDoS攻击检测方法。该方法利用网络流量的自相似性,建立Web流量时间序列变化的自回归模型,通过动态分析Web流量的突变来检测针对Web服务器的DDoS攻击。在此基础上,通过对报警数据的关联分析,获得攻击的时间和位置信息。实验结果表明：该方法能有效检测针对Web服务器的DDoS攻击。     

基于时间序列分析的应用层DDoS攻击检测

根据正常用户和攻击者在访问行为上的差异,提出一种基于IP请求熵(SRE)时间序列分析的应用层分布式拒绝服务(DDoS)攻击检测方法。该方法通过拟合SRE时间序列的自适应自回归(AAR)模型,获得描述当前用户访问行为特征的多维参数向量,并使用支持向量机(SVM)对参数向量进行分类来识别攻击。仿真实验表明,该方法能够准确区分正常流量和DDoS攻击流量,适用于大流量背景下攻击流量没有引起整个网络流量显著变化的DDoS攻击的检测。     

Web服务中基于流量监控的DDoS攻击防范机制

提出一种基于流量监控的针对Web服务的DDoS攻击防范机制。使用Linux内核的安全选项、Linux虚拟服务器、iptables防火墙以及基于类的排队等技术搭建防范DDoS攻击的Web服务器系统环境,设计、实现了流量监控器和分析工具来检测可能发生的DDoS攻击,并降低其危害。实际测试表明,该机制能有效检测和防范常见的针对Web服务的DDoS攻击。     

物联网服务发现初探:传统SOA的可行性和局限性

基于SOA(service-oriented architecture)的物联网(Internet of things,IoT)把设备的功能服务化,以一种统一和通用的接口向外界提供服务。由于物联网中设备的海量性、移动性和资源高度受限性,以及无线网络自身的不可靠性,设备服务与传统的Web服务相比具有不同的特点,现有的Web服务发现方法不能有效地满足物联网中服务发现的需求。从Web服务发现体系结构和匹配策略两个方面对典型的Web服务发现方法进行了分析;结合物联网中服务提供的特点,从可扩展性、资源有限性、异构性和环境的动态变化性四个方面,分析了将Web服务发现方法应用于物联网服务提供中所面临的问题,并讨论了可能的解决思路;探讨了物联网中服务发现需要解决的问题。     

云环境下基于SOAP的Web服务应用层DoS攻击检测系统

针对云计算环境中的Web服务应用层容易遭受攻击的问题,提出一种用于Web服务应用层的基于SOAP的检测XML和HTTP层分布式拒绝服务(DDoS)攻击的防御系统。首先,从属于特定简单对象访问协议(SOAP)正常操作中提取数据集的特征值,构建相应的高斯请求模型;然后,对Web服务的网络服务描述语言(WSDL)中的一些属性进行设置,实现对攻击的初步过滤;再后,对服务请求的HTTP头部和XML内容进行检查,并与模型数据比较,进一步实现攻击检测。实验结果表明,该系统能够有效的预防多种DDoS攻击,且消耗较少的响应时间。     

面向不平衡样本的物联网入侵检测方法

随着设备的迭代,网络流量呈现指数级别的增长,针对各种应用的攻击行为越来越多,从流量层面识别并对这些攻击流量进行分类具有重要意义。同时,随着物联网设备的激增,针对这些设备的攻击行为也逐渐增多,造成的危害也越来越大。物联网入侵检测方法可以从这些海量的流量中识别出攻击流量,从流量层面保护物联网设备,阻断攻击行为。针对现阶段各类攻击流量检测准确率低以及样本不平衡问题,提出了基于重采样随机森林（RF,random forest）的入侵检测模型——Resample-RF,共包含3种具体算法：最优样本选择算法、基于信息熵的特征归并算法、多分类贪心转化算法。在物联网环境中,针对不平衡样本问题,提出最优样本选择算法,增加小样本所占权重,从而提高模型准确率;针对随机森林特征分裂效率不高的问题,提出基于信息熵的特征归并算法,提高模型运行效率;针对随机森林多分类精度不高的问题,提出多分类贪心转化算法,进一步提高准确率。在两个公开数据集上进行模型的检验,在 IoT-23 数据集上 F1 达到0.99,在Kaggle数据集上F1达到1.0,均具有显著效果。从实验结果中可知,提出的模型具有非常好的效果,能从海量流量中有效识别出攻击流量,较好地防范黑客对应用的攻击,保护物联网设备,从而保护用户。     

Web应用安全监测系统设计与应用

针对Web应用的攻击种类繁多、变化多样,基于静态规则库的旧的防护体系已经很难适应当前Web应用安全的新状况,提出了将无指导学习方法与合法规则检测模型相结合的Web应用安全防护新思路,设计了基于Web应用结构分析和流程分析的安全监测算法,并进行了系统实现.实现的Web应用安全监测系统现已应用于清华大学网络学堂,很好地实现了对Web应用访问请求信息的安全分析与监测.     

基于多特征融合的Webshell恶意流量检测方法

Webshell是针对Web应用系统进行持久化控制的最常用恶意后门程序,对Web服务器安全运行造成巨大威胁。对于 Webshell 检测的方法大多通过对整个请求包数据进行训练,该方法对网页型 Webshell 识别效果较差,且模型训练效率较低。针对上述问题,提出了一种基于多特征融合的Webshell恶意流量检测方法,该方法以Webshell的数据包元信息、数据包载荷内容以及流量访问行为3个维度信息为特征,结合领域知识,从3个不同维度对数据流中的请求和响应包进行特征提取;并对提取特征进行信息融合,形成可以在不同攻击类型进行检测的判别模型。实验结果表明,与以往研究方法相比,所提方法在正常、恶意流量的二分类上精确率得到较大提升,可达99.25%;训练效率和检测效率也得到了显著提升,训练时间和检测时间分别下降95.73%和86.14%。     

Lightweight and Secure Mutual Authentication Scheme for IoT Devices Using CoAP Protocol

Internet of things enables every real world objects to be seamlessly integrated with traditional internet. Heterogeneous objects of real world are enhanced with capability to communicate, computing capabilities and standards to interoperate with existing network and these entities are resource constrained and vulnerable to various security attacks. Huge number of research works are being carried out to analyze various possible attacks and to propose standards for securing communication between devices in internet of things (IoT). In this article, a robust and lightweight authentication scheme for mutual authentication between client and server using constrained application protocol is proposed. Internet of things enables devices with different characteristics and capabilities to be integrated with internet. These heterogeneous devices should interoperate with each other to accumulate, process and transmit data for facilitating smart services. The growth of IoT applications leads to the rapid growth of IoT devices incorporated to the global network and network traffic over the traditional network. This scheme greatly reduces the authentication overhead between the devices by reducing the packet size of messages, number of messages transmitted and processing overhead on communicating devices. Efficiency of this authentication scheme against attacks such as DoS (denial of service), replay attacks and attacks to exhaust the resources are also examined. Message transmission time reduced upto 50% of using proposed techniques.     

物联网无线协议安全综述

近些年来,随着物联网的快速发展,其应用场景涵盖智慧家庭、智慧城市、智慧医疗、智慧工业以及智慧农业.相比于传统的以太网,物联网能够将各种传感设备与网络结合起来,实现人、电脑和物体的互联互通.形式多样的物联网协议是实现物联网设备互联互通的关键,物联网协议拥有不同的协议栈,这使得物联网协议往往能表现出不同的特性.目前应用较广...     

SDN/NFV security framework for fog-to-things computing infrastructure

Currently, core networking architectures are facing disruptive developments, due to emergence of paradigms such as Software-Defined-Networking (SDN) for control, Network Function Virtualization (NFV) for services, and so on. These are the key enabling technologies for future applications in 5G and locality-based Internet of things (IoT)/wireless sensor network services. The proliferation of IoT devices at the Edge networks is driving the growth of all-connected world of Internet traffic. In the Cloud-to-Things continuum, processing of information and data at the Edge mandates development of security best practices to arise within a fog computing environment. Service providers are transforming their business using NFV-based services and SDN-enabled networks. The SDN paradigm offers an easily programmable model, global view, and control for modern networks, which demand faster response to security incidents and dynamically enforce countermeasures to intrusions and cyberattacks. This article proposes an autonomic multilayer security framework called Distributed Threat Analytics and Response System (DTARS) for a converged architecture of Fog/Edge computing and SDN infrastructures, for emerging applications in IoT and 5G networks. The major detection scheme is deployed within the data plane, consisting of a coarse-grained behavioral, anti-spoofing, flow monitoring and fine-grained traffic multi-feature entropy-based algorithms. We developed exemplary defense applications under DTARS framework, on a malware testbed imitating the real-life DDoS/botnets such as Mirai. The experiments and analysis show that DTARS is capable of detecting attacks in real-time with accuracy more than 95% under attack intensities up to 50 000 packets/s. The benign traffic forwarding rate remains unaffected with DTARS, while it drops down to 65% with traditional NIDS for advanced DDoS attacks. Further, DTARS achieves this performance without incurring additional latency due to data plane overhead.     

基于软件定义物联网的分布式拒绝服务攻击检测方法

由于物联网（IoT）设备众多、分布广泛且所处环境复杂,相较于传统网络更容易遭受分布式拒绝服务（DDoS）攻击,针对这一问题提出了一种在软件定义物联网（SD-IoT）架构下基于均分取值区间长度-K均值（ELVR-Kmeans）算法的DDoS攻击检测方法。首先,利用SD-IoT控制器的集中控制特性通过获取OpenFlow交换机的流表,分析SD-IoT环境下DDoS攻击流量的特性,提取出与DDoS攻击相关的七元组特征;然后,使用ELVR-Kmeans算法对所获取的流表进行分类,以检测是否有DDoS攻击发生;最后,搭建仿真实验环境,对该方法的检测率、准确率和错误率进行测试。实验结果表明,该方法能够较好地检测SD-IoT环境中的DDoS攻击,检测率和准确率分别达到96.43%和98.71%,错误率为1.29%。     

Notes on ensembles of IoT,network functions and clouds for service-oriented computing and applications

Many advances have been introduced recently for service-oriented computing and applications (SOCA). The Internet of Things (IoT) has been pervasive in various application domains. Fog/Edge computing models have shown techniques that move computational and analytics capabilities from centralized data centers where most enterprise business services have been located to the edge where most customer’s Things and their data and actions reside. Network functions between the edge and the cloud can be dynamically provisioned and managed through service APIs. Microservice architectures are increasingly used to simplify engineering, deployment and management of distributed services in not only cloud-based powerful machines but also in light-weighted devices. Therefore, a key question for the research in SOCA is how do we leverage existing techniques and develop new ones for coping with and supporting the changes of data and computation resources as well as customer interactions arising in the era of IoT and Fog/Edge computing. In this editorial paper, we attempt to address this question by focusing on the concept of ensembles for IoT, network functions and clouds.     

RSS based multistage statistical method for attack detection and localization in IoT networks

Accurate and reliable positioning of nodes is a must for location-based services (LBS) in the Internet of things (IoT) networks. The LBS are ubiquitous and an easy target for non-cryptographic attacks that traditional security methods cannot address. In this work, we detect the Received Signal Strength (RSS) based attacks that affect the localization of smart devices in the IoT networks and report the attack tolerance of popular IoT protocols. A two-tier ratio metric method and Residue Under Curve (RUC) metric method is utilized to detect the malicious node in the IoT protocols. We propose to use a novel Geometric, and Arithmetic Mean (GM–AM) ratio as a feature to detect the RSS attacks where GM follows strictly Schur-Concavity property and AM follows non-strict concavity property. We evaluate the performance of the proposed method on real-world IoT testbeds with Wireless Fidelity (Wi-Fi), Zigbee, Bluetooth Low Energy (BLE), and Long-Range Wide-Area Network (LoRaWAN) protocols using the RSS values of these opportunistic signals. Also, the effect of RSS attacks on the localization for different protocols is investigated, and we report the method that provides the least localization error under these attacks.     

Design and implementation of the secure compiler and virtual machine for developing secure IoT services

Recent years have seen the development of computing environments for IoT (Internet of Things) services, which exchange large amounts of information using various heterogeneous devices that are always connected to networks. Since the data communication and services occur on a variety of devices, which not only include traditional computing environments and mobile devices such as smartphones, but also household appliances, embedded devices, and sensor nodes, the security requirements are becoming increasingly important at this point in time. Already, in the case of mobile applications, security has emerged as a new issue, as the dissemination and use of mobile applications have been rapidly expanding. This software, including IoT services and mobile applications, is continuously exposed to malicious attacks by hackers, because it exchanges data in the open Internet environment. The security weaknesses of this software are the direct cause of software breaches causing serious economic loss. In recent years, the awareness that developing secure software is intrinsically the most effective way to eliminate the software vulnerability, rather than strengthening the security system of the external environment, has increased. Therefore, methodology based on the use of secure coding rules and checking tools is attracting attention to prevent software breaches in the coding stage to eliminate the above vulnerabilities. This paper proposes a compiler and a virtual machine with secure software concepts for developing secure and trustworthy services for IoT environments. By using a compiler and virtual machine, we approach the problem in two stages: a prevention stage, in which the secure compiler removes the security weaknesses from the source code during the application development phase, and a monitoring stage, in which the secure virtual machine monitors abnormal behavior such as buffer overflow attacks or untrusted input data handling while applications are running.     

A systematic literature review on web service clustering approaches to enhance service discovery,selection and recommendation

With the advancement of web 2.0 and the development of the Internet of Things (IoT), all tasks can be handled with the help of handheld devices. Web APIs or web services are providing immense power to IoT and are working as a backbone in the successful journey of IoT. Web services can perform any task on a single click event, and these are available over the internet in terms of quantity, quality, and variety. It leads to the requirement of service management in the service repository. The well-managed and structured service repository is still challenging as services are dynamic, and documentation is limited. It is also not a piece of cake to discover, select and recommend services easily from a pool of services. Web service clustering (WSC) plays a vital role in enhancing the service discovery, selection, and recommendation process by analyzing the similarity among services. In this paper, with a systematic process total of 84 research papers are selected, and different state-of-the-art techniques based on web service clustering are investigated and analyzed. Furthermore, this Systematic Literature Review (SLR) also presents the various mandatory and optional steps of WSC, evaluation measures, and datasets. Research challenges and future directions are also identified, which will help the researchers to provide innovative solutions in this area.