Data-mining based SQL injection attack detection using internal query trees

Detecting SQL injection attacks (SQLIAs) is becoming increasingly important in database-driven web sites. Until now, most of the studies on SQLIA detection have focused on the structured query language (SQL) structure at the application level. Unfortunately, this approach inevitably fails to detect those attacks that use already stored procedure and data within the database system. In this paper, we propose a framework to detect SQLIAs at database level by using SVM classification and various kernel functions. The key issue of SQLIA detection framework is how to represent the internal query tree collected from database log suitable for SVM classification algorithm in order to acquire good performance in detecting SQLIAs. To solve the issue, we first propose a novel method to convert the query tree into an n-dimensional feature vector by using a multi-dimensional sequence as an intermediate representation. The reason that it is difficult to directly convert the query tree into an n-dimensional feature vector is the complexity and variability of the query tree structure. Second, we propose a method to extract the syntactic features, as well as the semantic features when generating feature vector. Third, we propose a method to transform string feature values into numeric feature values, combining multiple statistical models. The combined model maps one string value to one numeric value by containing the multiple characteristic of each string value. In order to demonstrate the feasibility of our proposals in practical environments, we implement the SQLIA detection system based on PostgreSQL, a popular open source database system, and we perform experiments. The experimental results using the internal query trees of PostgreSQL validate that our proposal is effective in detecting SQLIAs, with at least 99.6% of the probability that the probability for malicious queries to be correctly predicted as SQLIA is greater than the probability for normal queries to be incorrectly predicted as SQLIA. Finally, we perform additional experiments to compare our proposal with syntax-focused feature extraction and single statistical model based on feature transformation. The experimental results show that our proposal significantly increases the probability of correctly detecting SQLIAs for various SQL statements, when compared to the previous methods.     

基于FPGA实现AES的侧信道碰撞攻击

为了解决攻击点在能量迹中具体位置的识别问题,在对侧信道碰撞攻击技术研究的基础上,提出了通过计算能量迹中每个采样点的方差来识别攻击点的方差检查技术。并利用基于相关系数的碰撞检测方法,对一种AES的FPGA实现实施了攻击。实验结果表明,方差检查技术可以有效地识别攻击点在能量迹中的具体位置。     

A genetic tango attack against the David–Prasad RFID ultra‐lightweight authentication protocol

Radio frequency identification (RFID) is a powerful technology that enables wireless information storage and control in an economical way. These properties have generated a wide range of applications in different areas. Due to economic and technological constrains, RFID devices are seriously limited, having small or even tiny computational capabilities. This issue is particularly challenging from the security point of view. Security protocols in RFID environments have to deal with strong computational limitations, and classical protocols cannot be used in this context. There have been several attempts to overcome these limitations in the form of new lightweight security protocols designed to be used in very constrained (sometimes called ultra‐lightweight) RFID environments. One of these proposals is the David–Prasad ultra‐lightweight authentication protocol. This protocol was successfully attacked using a cryptanalysis technique named Tango attack. The capacity of the attack depends on a set of boolean approximations. In this paper, we present an enhanced version of the Tango attack, named Genetic Tango attack, that uses Genetic Programming to design those approximations, easing the generation of automatic cryptanalysis and improving its power compared to a manually designed attack. Experimental results are given to illustrate the effectiveness of this new attack.     

X-ray microtomography (microCT) of the progression of sulfate attack of cement paste

High-resolution X-ray computed tomography (i.e., microCT or microtomography) was used to study the sulfate attack of cylinders of Type I cement paste cast with water-cement (w/c) ratios of 0.45, 0.50 and 0.60. Damage levels in samples exposed to a Na₂SO₄ solution with 10,000 ppm sulfate ion concentration were qualitatively rated from 0 (no damage) to 4 (extreme damage) based upon visual examination of the samples' exteriors and microtomography of the samples' interiors. The greater the w/c ratio, the more rapid the onset of sulfate damage. The corners of the cylinders appeared to be particularly susceptible to spalling, and damage may have continued into the cement paste by formation of subsurface cracks.     

格式化文本水印性能评估基准研究

针对目前没有测试基准对格式化文本水印算法鲁棒性进行评估和比较,提出了格式化文本水印性能评估基准.回顾了水印系统通用的框架,分析并确定了影响水印系统性能的参数和文本文档的视觉质量评级标准.借鉴图像水印性能评估基准的攻击分类,提出了Word特有的去除攻击、几何攻击、密码攻击和协议攻击的攻击分类方法,同时阐述了Word特有的攻击模式.对两种不同的文本水印算法进行了攻击强度—鲁棒性、攻击强度—视觉质量和嵌入数据量—鲁棒性测试,实验结果表明,该系统在文本水印算法评估和设计中具有有效性和实用性.     

轻量级PRESENT加密算法功耗攻击研究

PRESENT密码算法是2007年提出来的一种轻量级分组密码算法, 适合于物联网环境下的安全加密。对PRESENT加密算法结构进行了深入研究, 提出了其适合功耗攻击的两个最佳攻击点, 详细介绍了针对PRESENT加密系统进行功耗分析攻击的设计与实现过程, 实验结果表明未加防护措施的PRESENT加密系统不能抵御一阶差分功耗分析攻击, 从而给PRESENT加密算法的安全改进提供一定的设计参考。     

解决组合公钥共谋攻击和密钥碰撞的新方法

以解决组合公钥体制中共谋攻击和密钥碰撞问题为目的。首先,针对线性共谋攻击,提出了一种新的构造种子矩阵的方法,使得种子密钥和大于基点加法群的阶数,从而使密钥之间不能相互线性表示。其次在密钥的生产过程中,引入系数破坏了层不同和层互斥不同的关系,为解决选择共谋攻击提供了一种有效的方法,同时增强了抵御随机共谋攻击的能力。最后,在密钥产生的流程中,通过公钥对比来避免密钥碰撞,为解决密钥碰撞问题提出了一种新方法。     

改进的可信网络连接机制

针对传统可信网络中存在会话密钥协商过程易受中间人攻击的不足,提出改进的可信网络连接机制。该机制基于椭圆曲线Diffie-Hellman（ ECDH）算法实现会话密钥的安全协商,用户与节点使用私钥和随机数完成会话密钥的计算。分析表明改进的密钥协商协议具有抗中间人攻击、高效性等特点,会话密钥具有前向安全性及较强的新鲜性和保密性。     

两个高效无证书签名方案的替换公钥攻击

对新近提出的两个高效无证书签名方案进行安全性分析,指出这两个签名方案都能受到替换公钥攻击。任意攻击者都可以通过替换签名人的公钥从而达到对任意选择的消息成功伪造签名,分析这两个签名方案能受到替换公钥攻击的根本原因。最后通过这两个攻击总结分析了无证书签名方案设计过程需要注意的要点,这对无证书签名方案的设计具有借鉴意义。     

基于辅助节点的安全协作频谱感知

在认知无线电网络中,恶意用户会占用授权频段,模仿主用户的信号特征发送信号,导致其他认知用户误认为主用户存在。针对该问题,提出一种基于辅助节点的安全感知机制,在网络中部署若干辅助节点,利用链路特征和加密机制对主用户的活动情况进行识别。设计适用于该机制的融合判决算法,不对授权网络做任何形式的改动即能有效识别恶意用户,并在融合时采用信任节点的感知数据,从而提高融合结果的鲁棒性。仿真结果表明,与K秩、And和Or算法相比,在恶意环境下该算法具有较好的检测性能。