基于ARP协议的攻击原理分析

文章详细介绍了ARP协议的功能、分组格式和工作原理，分析了当前ARP协议所存在的安全性问题。重点讨论了利用ARP协议自身的安全缺陷进行网络攻击的多种实现方法以及这些攻击所带来的危害，其中包含了简单的IP地址冲突、窜改ARP缓冲等攻击方法和较为复杂的交换网络下的嗅探、截获连接、广泛的DOS等。最后，结合实际管理，给出了一些有效的安全防范措施并简单说明了它们的优缺点。     

New lightweight Anti-SAT block design and obfuscation technique to thwart removal attack

Logic locking has emerged as a prominent technique to protect an integrated circuit from piracy, overbuilding, and hardware Trojans. Most of the well-known logic locking techniques are vulnerable to satisfiability (SAT) based attack. Though several SAT-resistant logic locking techniques such as Anti-SAT block (ASB) are reported that increase the time to decipher the secret key, the existing techniques are either vulnerable to signal probability skew (SPS) based removal attack or require significant design overhead. Therefore, a new lightweight ASB design and obfuscation technique is proposed that effectively integrate and obfuscates the ASB in the design to thwart removal attack. We first propose a new ASB design/integration approach that effectively thwarts the structural/functional analysis based removal attack with minimum overhead. Further, we also propose an ASB obfuscation approach that shifts the inverter deep in the circuit using De Morgan's law and replaces an ASB gate with a key-gate to thwart SPS based removal attack. Moreover, a new algorithm is proposed that inserts the ASB in the locked design to achieve desired output corruptibility. Finally, a new INV/BUFF key-gate is proposed that constructs the ASB with reduced overhead over the XOR/XNOR. Experimental evaluation on ISCAS-85 benchmarks shows that our ASB design and obfuscation approaches, on an average, reduce area overhead by 25.5% and 22% respectively, and effectively prevent removal attack without reducing any security.     

Evaluating the web‐application resiliency to business‐layer DoS attacks

A denial‐of‐service (DoS) attack is a serious attack that targets web applications. According to Imperva, DoS attacks in the application layer comprise 60% of all the DoS attacks. Nowadays, attacks have grown into application‐ and business‐layer attacks, and vulnerability‐analysis tools are unable to detect business‐layer vulnerabilities (logic‐related vulnerabilities). This paper presents the business‐layer dynamic application security tester (BLDAST) as a dynamic, black‐box vulnerability‐analysis approach to identify the business‐logic vulnerabilities of a web application against DoS attacks. BLDAST evaluates the resiliency of web applications by detecting vulnerable business processes. The evaluation of six widely used web applications shows that BLDAST can detect the vulnerabilities with 100% accuracy. BLDAST detected 30 vulnerabilities in the selected web applications; more than half of the detected vulnerabilities were new and unknown. Furthermore, the precision of BLDAST for detecting the business processes is shown to be 94%, while the generated user navigation graph is improved by 62.8% because of the detection of similar web pages.     

Cryptanalysis and improvement of 2 mutual authentication schemes for Session Initiation Protocol

Recently, Chaudhry et al and Kumari et al proposed an advanced mutual authentication protocol for Session Initiation Protocol on the basis of the protocol of Lu et al. The authors claimed that their schemes can be resistant to various attacks. Unfortunately, we observe some important flaws in their respective schemes. We point out that their schemes are prone to off‐line password guessing and privileged insider attacks. To remedy their protocols's drawbacks, in this paper, we present a new improved authentication scheme keeping apart the threats encountered in the design of the schemes of Chaudhry et al and Kumari et al. Furthermore, the security analysis illustrates that our proposed scheme not only removes these drawbacks in their schemes but also can resist all known attacks and provide session key security. We give a heuristic security analysis and also provide the security analysis of the proposed scheme with the help of widespread Burrows‐Abadi‐Needham Logic. Finally, our scheme is compared with the previously proposed schemes on security and performance.     

针对Web-mail邮箱的跨站网络钓鱼攻击的研究

客户端脚本植入攻击是近年来攻击者常用的一种攻击手段,给Web应用程序带来了相当大的安全隐患。介绍了跨站脚本攻击和网络钓鱼攻击的原理及防御。分析了两种攻击在获取用户信息时的不全面,从而提出了一种针对Web-mail邮箱的跨站网络钓鱼攻击方法。这种攻击方法结合了跨站脚本攻击和网络钓鱼攻击,不仅能够获取用户邮箱的cookie、账号及密码,而且还可以获取用户的个人相关信息。最后,针对提出的攻击方法给出了防御措施。     

无线传感器网络节点复制攻击和女巫攻击防御机制研究

在无线传感器网络(WSNs)中,节点复制攻击和女巫攻击可扰乱数据融合和阈值选举等网络操作.发起这两种攻击需先通过邻居发现认证过程.考虑到在WSNs中发起邻居认证是不频繁的,提出了一种基于单向密钥链的ID认证防御机制(OKCIDA),降低攻击者在任何时间段发起这两种攻击的可能性.然后基于椭圆曲线离散对数问题,构造对称参数,并组合OKCIDA和利用节点邻居关系,提出了一种无需位置的邻居认证协议(LFNA),以阻止复制节点和女巫节点成功加入网络.最后给出了安全性证明和分析,并在安全和开销方面将LFNA与已有典型防御方案进行了比较,结果表明该方案具有一定的优势.     

低层网络攻击及检测方法

常规的探作系统因缺乏充足的审计教据使基于主机的入侵检测系统无法检测到低层网络攻击。基于网络的入侵检测系统因只依靠网上教据流而不能检测到所有攻击。本文分析了几种低层IP攻击，在分析的基础上，提出在探作系统的审计记录中添加部分审计教据，使基于主机的入侵检测系统能检测到低层网络攻击。     

A cost‐effective attack matrix based key management scheme with dominance key set for wireless sensor network security

To guarantee the proper functionality of wireless sensor network even in the presence of the potential threats, a well‐designed key management scheme is very important. The assumptions about attackers critically influence the performance of security mechanisms. This paper investigates the problem of node capture from adversarial view point in which the adversary intelligently exploits the different vulnerabilities of the network to establish a cost‐effective attack matrix. To counteract such attacks, the defender or the network designer constructs similar attack matrix. The defender will identify a set of critical nodes and use the key compromise relationship to assign a key dominance rank to each node of the network. The key dominance rank quantifies the possibility of attack on a particular node. It is used to determine the hash chain length. It is also used to improve the security of path key establishment as well as rekeying of the proposed scheme. The performance of the proposed scheme is analyzed with other existing schemes, and it is shown that it outperforms with increased resilience against node capture, reduced number of hash computations, reduced key compromise probability of proxy nodes, and reduced number of revoked links during rekeying process.     

新网络环境下应用层DDoS攻击的剖析与防御

针对新网络环境下近两年新出现的应用层分布式拒绝服务攻击,本文将详细剖析其原理与特点,并分析现有检测机制在处理这种攻击上的不足.最后,本文提出一种基于用户行为的检测机制,它利用Web挖掘的方法通过Web访问行为与正常用户浏览行为的偏离程度检测与过滤恶意的攻击请求,并通过应用层与传输层的协作实现对攻击源的隔离.     

IP通信网络安全攻击与防范

随着移动通信和互联网络的融合、演进,IP通信网络发展日益迅速,网络安全问题日趋复杂。详细分析了IP通信网络存在的典型安全攻击方式及表现形式,如各种形式的拒绝服务攻击,并对RIP、OSPF、ISIS三大路由协议的攻击进行了分析,最后给出了网络安全管理的防范措施建议和组网安全保障措施。     

Evaluation of Hypervisor Stability towards Insider Attacks

Virtualization technology plays a key role in cloud computing. Thus, the security issues of virtualization tools (hypervisors, emulators, etc.) should be under precise consideration. However, threats of insider attacks are underestimated. The virtualization tools and hypervisors have been poorly protected from this type of attacks. Furthermore, hypervisor is one of the most critical elements in cloud computing infrastructure. Firstly, hypervisor vulnerabilities analysis is provided. Secondly, a formal model of insider attack on hypervisor is developed. Consequently, on the basis of the formal attack model, we propose a new methodology of hypervisor stability evaluation. In this paper, certain security countermeasures are considered that should be integrated in hypervisor software architecture.     

WSN中防御Sybil病毒攻击的密钥预分配方案

无线传感器网络是一门前沿技术,具有非常广泛的应用前景,特别是在军事、环境科学、医疗健康、空间探索和灾难拯救等众多领域.作为一种网络,其安全问题显得很重要,而Sybil病毒攻击在传感器网络(wsn)中是比较突出的.针对这一问题,探讨了几种基于密钥预分配来防御sybil攻击的方案.分析表明:多空间成对密钥分配技术是其中最好的.     

GreyFan:一种Wi-Fi隐蔽信道攻击框架

针对现实网络中诸如侧信道攻击、HID 攻击等传统的物理攻击，物理隔离被认为是一种较为彻底的抵御网络攻击的安全防护手段。2018 年，业界首次提出了一种物理隔离环境下的 Wi-Fi 隐蔽信道方法——Ghost Tunnel，即在Wi-Fi尚未连接的状态下，无线AP可成功将数据传给发起连接请求的计算机。提出了一种基于Ghost Tunnel方法的攻击框架—— GreyFan，利用该攻击框架攻击者可以对未连接Wi-Fi的用户实施无感知攻击，如文件隐蔽传输、任意代码执行等，并分析了相应的防御技术。     

SDN跨层回环攻击的检测与防御

软件定义网络（Software Define Network,SDN）将控制层和数据层进行分离,给网络带来灵活性、开放性以及可编程性.然而,分离引入了新的网络安全问题.我们发现通过构造特定规则可以构造跨层回环攻击,使得数据包在控制器和交换机之间不断循环转发.跨层回环会造成控制器拥塞,并导致控制器无法正常工作.现有的策略一致性检测方案并不能检测跨层回环攻击.为此,本文提出了一种实时检测和防御跨层回环的方法.通过构造基于Packet-out的转发图分析规则路径,从而快速检测和防御回环.我们在开源控制器Floodlight上实现了我们提出的回环检测和防御方案,并在Mininet仿真器上对其性能进行了评估,结果表明本方案能够实时检测并有效防御跨层回环攻击.     

嵌入式系统抗缓冲区溢出攻击的硬件防御机制研究

嵌入式系统设计时由于成本和功耗等方面的考虑而较少重视安全性,而一般采用的软件防御方式无法满足嵌入式系统在实时性和可靠性上的要求,缓冲区溢出作为最常见的软件安全漏洞对嵌入式系统安全构成严重威胁.文中构建了一种基于细粒度指令流监控(FIFM)的硬件防御机制,通过虚拟执行单元虚拟执行程序,在攻击发生之前检测攻击行为.实验结果表明FIFM能很好的防御典型的缓冲区溢出攻击,而且FIFM不需要修改程序,不破坏流水线完整性,对系统的性能影响小,本文的防护机制可以应用于其他嵌入式系统设计中以动态防御缓冲区溢出攻击.     

Performance evaluation of mobile ad hoc networks under flooding‐based attacks

A mobile ad hoc network (MANET) is an open wireless network that comprises a set of mobile, decentralized, and self‐organized nodes. Its properties render its environment susceptible to different types of attacks, which can paralyze the mobile nodes in MANET. A particularly dangerous type of attack is run primarily under flooding bogus packet mechanisms, such as hello floods, routing table overflows, exploitation of node penalizing schemes, and resource consumption attack (RCA). Flooding‐based attacks impose severe effects because they are intended to consume MANET resources, such as bandwidth, node memory, and battery power. Therefore, identifying such effects facilitates the development of countermeasures against the intrusions. In this paper, we introduce a simulation‐based study on the effects of RCA on MANET. Qual Net v5.0.2 is used to examine the severity of the effects on MANET performance metrics in terms of throughput, end‐to‐end delay, energy consumption, and routing overhead. The effects of RCA are also monitored under two combinations of four factors: we first vary the number of attackers and attackers' positions, and then modify the attackers' radio range and flooding rate. We also examine the effect of flooding mechanism on the energy consumed by resource consumption attackers. Copyright © 2013 John Wiley & Sons, Ltd.     

Efficient and low‐cost defense against distributed denial‐of‐service attacks in SDN‐based networks

Distributed are common threats in many networks, where attackers attempt to make victim servers unavailable to other users by flooding them with worthless requests. These attacks cannot be easily stopped by firewalls, since they forge lots of connections to victims with various IP addresses. The paper aims to exploit the software‐defined networking (SDN) technique to defend against DDoS attacks. However, the controller has to handle lots of connections launched by DDoS attacks, which burdens it with a heavy load and degrades SDN's performance. Therefore, the paper proposes an efficient and low‐cost DDoS defense (ELD) mechanism for SDN. It adopts a nested reverse‐exponential data storage scheme to help the controller efficiently record the information of packets in the limited memory. Once there are many packets with high IP variability sent to a certain server and this situation lasts for a while, then a DDoS attack is likely happening. In this case, the controller asks switches to block malicious connections by installing flow rules. Experimental results verify that the ELD mechanism rapidly recognizes protocol‐based DDoS attacks and stops them in time, including TCP SYN flood, UDP flood, and ICMP flood, and also greatly reduces the overhead for the controller to defend against attacks. Moreover, ELD can distinguish DDoS flows from legitimate ones with similar features such as elephant flows and impulse flows, thereby eliminating false alarms.     

Revised anonymous authentication protocol for adaptive client‐server infrastructure

Rapid evolution in information and communication technologies has facilitated us to experience mobile communication in our daily routine. Mobile user can only avail the services from the server, once he/she is able to accomplish authentication process successfully. In the recent past, several researchers have contributed diverse authentication protocols for mobile client‐server environment. Currently, Lu et al designed two‐factor protocol for authenticating mobile client and server to exchange key between them. Lu et al emphasized that their scheme not only offers invincibility against potential security threats but also offers anonymity. Although this article reveals the facts that their protocol is vulnerable against client and server impersonation, man‐in‐the‐middle, server key breach, anonymity violation, client traceability, and session‐specific temporary attacks, therefore, we have enhanced their protocol to mitigate the above mention vulnerabilities. The enhanced protocol's security strength is evaluated through formal and informal security analysis. The security analysis and performance comparison endorses the fact that our protocol is able to offer more security with least possible computation complexity.     

Mutual Information Analysis for Three‐Phase Dynamic Current Mode Logic against Side‐Channel Attack

To date, many different kinds of logic styles for hardware countermeasures have been developed; for example, SABL, TDPL, and DyCML. Current mode–based logic styles are useful as they consume less power compared to voltage mode–based logic styles such as SABL and TDPL. Although we developed TPDyCML in 2012 and presented it at the WISA 2012 conference, we have further optimized it in this paper using a binary decision diagram algorithm and confirmed its properties through a practical implementation of the AES S‐box. In this paper, we will explain the outcome of HSPICE simulations, which included correlation power attacks, on AES S‐boxes configured using a compact NMOS tree constructed from either SABL, CMOS, TDPL, DyCML, or TPDyCML. In addition, to compare the performance of each logic style in greater detail, we will carry out a mutual information analysis (MIA). Our results confirm that our logic style has good properties as a hardware countermeasure and 15% less information leakage than those secure logic styles used in our MIA.     

Identity-based key management in mobile ad hoc networks: techniques and applications [dependability in the ubiquitous wireless access]

Security is one of the major issues in MANETs. Their natural characteristics make them vulnerable to numerous severe attacks. It is widely acknowledged that cryptography provides a set of strong techniques against most vulnerabilities. Several cryptographic mechanisms for MANETs can be found in the literature. Among them, identity-based cryptographic mechanisms and key management schemes are proposed to simplify key management and to reduce the memory storage cost. This article presents the most important ID-based key management schemes, discussing their approaches, strengths, and weaknesses, and comparing their main features. It also presents the main IDbased key management application fields on MANETs. In this way it can be useful for users and researchers as a starting point on ID-based key management and its possible uses in MANETs.