网络加密流量侧信道攻击研究综述

网络加密流量侧信道攻击通过分析、提取网络应用通信过程中泄露的数据包长度、时间等侧信道信息,能够识别用户的身份和行为,甚至还原用户输入的原始数据.基于信息论建立了网络加密流量侧信道攻击模型,使用统一的模型框架分析了代表性的指纹攻击、击键攻击和语音攻击的方法和效果,讨论了基于隐藏数据包长度和时间信息的防御方法,结合技术发展...     

结合多特征识别的恶意加密流量检测方法

随着加密流量的广泛使用,越来越多恶意软件也利用加密流量来传输恶意信息,由于其传输内容不可见,传统的基于深度包分析的检测方法带来精度下降和实时性不足等问题.本文通过分析恶意加密流量和正常流量的会话和协议,提出了一种结合多特征的恶意加密流量检测方法,该方法提取了加密流量会话的包长与时间马尔科夫链、包长与时间分布及包长与时间...     

Wavelet packet energy, Tsallis entropy and statistical parameterization for support vector-based and neural-based classification of mammographic regions

This work develops a support vector and neural-based classification of mammographic regions by applying statistical, wavelet packet energy and Tsallis entropy parameterization. From the first four wavelet packet decomposition levels, four different feature sets were evaluated using two-sample Kolmogorov-Smirnov test (KS-test) and, in one case, principal component analysis (PCA). Feature selection was performed applying a hybrid scheme integrating non-parametric KS-test, correlation analysis, a logistic regression (LR) model and sequential forward selection (SFS). The top selected features (depending on the selected wavelet decomposition level) produced the best classification performances in comparison to other well-known feature selection methods. The classification of the data was carried out using several support vector machine (SVM) schemes and multi-layer perceptron (MLP) neural networks. The new set of features improved significantly the classification performance of mammographic regions using conventional SVMs and MLPs.     

基于深度学习的加密流量分类研究综述

近年来,为保护公众隐私,互联网上的很多流量被加密传输,传统的基于深度包检测、机器学习的方法在面对加密流量时,准确率大幅下降。随着深度学习自动学习特征的应用,基于深度学习算法的加密流量识别和分类技术得到了快速发展,本文对这些研究进行综述。首先,简要介绍基于深度学习的加密流量检测应用场景。然后,从数据集的使用和构建、检测模型和检测性能3个方面对已有工作进行总结和评价,其中检测技术重点论述数据的预处理、不平衡数据集的处理、神经网络构建、实时检测等方法。最后,讨论当前研究中出现的问题和未来发展方向和前景,为该领域的研究人员提供一些借鉴。     

基于双注意力多层特征融合的视觉情感分析

为获得更具判别性的视觉特征并提升情感分类效果,构建融合双注意力多层特征的视觉情感分析模型。通过卷积神经网络提取图像多通道的多层次特征,根据空间注意力机制对多通道的低层特征赋予空间注意力权重,利用通道注意力机制对多通道的高层特征赋予通道注意力权重,分别强化不同层次的特征表示,将强化后的高层特征和低层特征进行融合,形成用于训练情感分类器的判别性特征。在3个真实数据集Twitter Ⅰ、Twitter Ⅱ和EmotionROI上进行对比实验,结果表明,该模型的分类准确率分别达到79.83%、78.25%和49.34%,有效提升了社交媒体视觉情感分析的效果。     

Bi-directional LSTM with multi-scale dense attention mechanism for hyperspectral image classification

Feature representation has always been the top priority of research in the field of hyperspectral image (HSI) classification. Efficient analysis of those features extracted from HSI massively depends on the way how features are represented. In this paper, we propose a bi-directional long short-term memory network (Bi-LSTM)-based multi-scale dense attention framework, namely MBDA-Net. In this framework, we develop a new multi-scale dense attention module (MCDA) that uses different sizes of convolution kernels to obtain multi-scale features. Then, we perform feature selection by using a multi-layer attention mechanism that assigns different weight coefficients to the extracted multi-scale features. Specifically, we use the bi-directional LSTM to obtain contextual semantic information. The extensive experiments conducted on three hyperspectral datasets demonstrate the effectiveness of our method in identifying hyperspectral images.

     

Unsupervised feature selection based on decision graph

In applications of algorithms, feature selection has got much attention of researchers, due to its ability to overcome the curse of dimensionality, reduce computational costs, increase the performance of the subsequent classification algorithm and output the results with better interpretability. To remove the redundant and noisy features from original feature set, we define local density and discriminant distance for each feature vector, wherein local density is used for measuring the representative ability of each feature vector, and discriminant distance is used for measuring the redundancy and similarity between features. Based on the above two quantities, the decision graph score is proposed as the evaluation criterion of unsupervised feature selection. The method is intuitive and simple, and its performances are evaluated in the data classification experiments. From statistical tests on the averaged classification accuracies over 16 real-life dataset, it is observed that the proposed method obtains better or comparable ability of discriminant feature selection in 98% of the cases, compared with the state-of-the-art methods.

     

Traffic analysis attacks on Skype VoIP calls

Skype is one of the most popular voice-over-IP (VoIP) service providers. One of the main reasons for the popularity of Skype VoIP services is its unique set of features to protect privacy of VoIP calls such as strong encryption, proprietary protocols, unknown codecs, dynamic path selection, and the constant packet rate. In this paper, we propose a class of passive traffic analysis attacks to compromise privacy of Skype VoIP calls. The proposed attacks are based on application-level features extracted from VoIP call traces. The proposed attacks are evaluated by extensive experiments over different types of networks including commercialized anonymity networks and our campus network. The experiment results show that the proposed traffic analysis attacks can greatly compromise the privacy of Skype calls. Possible countermeasure to mitigate the proposed traffic analysis attacks are analyzed in this paper.     

A genetic algorithm-based method for feature subset selection

As a commonly used technique in data preprocessing, feature selection selects a subset of informative attributes or variables to build models describing data. By removing redundant and irrelevant or noise features, feature selection can improve the predictive accuracy and the comprehensibility of the predictors or classifiers. Many feature selection algorithms with different selection criteria has been introduced by researchers. However, it is discovered that no single criterion is best for all applications. In this paper, we propose a framework based on a genetic algorithm (GA) for feature subset selection that combines various existing feature selection methods. The advantages of this approach include the ability to accommodate multiple feature selection criteria and find small subsets of features that perform well for a particular inductive learning algorithm of interest to build the classifier. We conducted experiments using three data sets and three existing feature selection methods. The experimental results demonstrate that our approach is a robust and effective approach to find subsets of features with higher classification accuracy and/or smaller size compared to each individual feature selection algorithm.     

An SVM-based machine learning method for accurate internet traffic classification

Accurate and timely traffic classification is critical in network security monitoring and traffic engineering. Traditional methods based on port numbers and protocols have proven to be ineffective in terms of dynamic port allocation and packet encapsulation. The signature matching methods, on the other hand, require a known signature set and processing of packet payload, can only handle the signatures of a limited number of IP packets in real-time. A machine learning method based on SVM (supporting vector machine) is proposed in this paper for accurate Internet traffic classification. The method classifies the Internet traffic into broad application categories according to the network flow parameters obtained from the packet headers. An optimized feature set is obtained via multiple classifier selection methods. Experimental results using traffic from campus backbone show that an accuracy of 99.42% is achieved with the regular biased training and testing samples. An accuracy of 97.17% is achieved when un-biased training and testing samples are used with the same feature set. Furthermore, as all the feature parameters are computable from the packet headers, the proposed method is also applicable to encrypted network traffic.     

结合概率图模型与DNN的DDoS攻击检测方法

从传统网络到物联网,分布式拒绝服务攻击一直是网络安全的隐患。为提高分布式拒绝服务攻击的检测率,提出基于概率图模型与深度神经网络的DDoS攻击检测方案。该检测方案由数据预处理阶段和攻击检测阶段组成,在数据预处理阶段,研究了正常数据包与攻击包的区别,分别从TCP、UDP以及IP数据包包头信息提取出较高维的统计特征,根据随机森林计算的特征重要性因子,保留了前22个特征用于流量检测。22个统计特征通过概率图模型的隐马尔科夫算法进行聚类,然后将聚类结果通过检测阶段的深度神经网络对网络数据进行进一步的检测。在CICDoS数据集上进行验证性实验,结果表明,该检测方法的准确率最高可达99.35%,最低检测误报率和漏警率分别可达0.51%和0.12%。     

Multi-image steganography and authentication using crypto-stego techniques

It is a necessity to protect sensitive information in digital form from an adversary who may indulge in cyber-crimes such as modification, masquerading, and replaying of data. Security systems designed to counter such attacks must keep abreast of the adversary. In this paper, we have proposed a novel multi-image crypto-stego technique using Rabin cryptosystem and Arnold transform that provides a mechanism to hide digital data in the form of text, image, audio, and video. The proposed technique is a novel approach for (n,n) secret sharing that prevents attack by an intruder impersonating as a shareholder. In the proposed technique, the header information is created to retrieve data in the correct order. Randomized encrypted data and partial header information are camouflaged in the edges of multiple images in an adaptive manner. Minimal and distribution sequence keys distribute data in shares. Experimental results yield high values of PSNR and low values of MSE for the audio, image, video signals. Further, as the entropy values for original cover image coincide with the crypto-stego image up to the third place of decimal, the secret message will go unnoticed. Sensitivity analysis reveals that even a minor variation in a single share makes the recovery of the secret message infeasible. Comparison with the state of the art techniques indicates that the proposed technique either scores over its competitors or performs equally well in terms of standard evaluation metrics.

     

An image copyright protection scheme by encrypting secret data with the host image

In this paper, a zero-watermarking based copyright protection scheme is proposed. The secret watermark image is not embedded in the host image rather it is encrypted with the host image. The proposed scheme is making use of discrete cosine transform and singular value decomposition to extract robust features of the host image. Further the selected robust features are used to encrypt the secret image. The secret image is encrypted with the host image by generating two shares namely master share and ownership share. The master share is generated by differential classification of features extracted. The ownership share is generated with the help of master share and the secret image. The two shares separately don’t give any clue of the secret image but when stacked together the encrypted secret image is revealed. Experimental study is conducted to evaluate the robustness of the algorithm against various signal processing and geometrical attacks.     

基于特征融合卷积神经网络的端到端加密流量分类

针对现有人工神经网络方法在网络加密流量分类应用中结构复杂且计算量大的问题,首次提出了一种基于特征融合的轻量级网络模型Inception-CNN,用于端到端加密流量的分类,在显著提高分类结果准确性的同时,大大降低了网络计算复杂度。利用Inception模块1×1卷积进行降维,减少了计算参数;从不同的感受野中做到不同级别上的特征提取,将多种不同尺寸滤波器卷积的特征进行融合,从而在原始数据中提取到更加丰富的特征自动学习原始输入和预期输出之间的非线性关系;利用池化操作没有参数的特性,防止产生过拟合。选择使用国际公开ISCX VPN-nonVPN数据集作为实验数据,采用softmax作为分类器,实现了对加密流量的准确分类。实验结果表明,该模型分类准确率达到97.3%、精确率达到97.2%、召回率达到97.7%、F1-score达到97.5%,并且对不同类别的加密流量识别效果也更加均衡。     

A new hybrid intelligent system for accurate detection of Parkinson's disease

Elderly people are commonly affected by Parkinson's disease (PD) which is one of the most common neurodegenerative disorders due to the loss of dopamine-producing brain cells. People with PD's (PWP) may have difficulty in walking, talking or completing other simple tasks. Variety of medications is available to treat PD. Recently, researchers have found that voice signals recorded from the PWP is becoming a useful tool to differentiate them from healthy controls. Several dysphonia features, feature reduction/selection techniques and classification algorithms were proposed by researchers in the literature to detect PD. In this paper, hybrid intelligent system is proposed which includes feature pre-processing using Model-based clustering (Gaussian mixture model), feature reduction/selection using principal component analysis (PCA), linear discriminant analysis (LDA), sequential forward selection (SFS) and sequential backward selection (SBS), and classification using three supervised classifiers such as least-square support vector machine (LS-SVM), probabilistic neural network (PNN) and general regression neural network (GRNN). PD dataset was used from University of California-Irvine (UCI) machine learning database. The strength of the proposed method has been evaluated through several performance measures. The experimental results show that the combination of feature pre-processing, feature reduction/selection methods and classification gives a maximum classification accuracy of 100% for the Parkinson's dataset.     

Hybridized approach of image segmentation in classification of fruit mango using BPNN and discriminant analyzer

In machine learning, image classification accuracy generally depends on image segmentation and feature extraction methods with the extracted features and its qualities. The main focus of this paper is to determine the defected area of mangoes using image segmentation algorithm for improving the classification accuracy. The Enhanced Fuzzy based K-means clustering algorithm is designed for increasing the efficiency of segmentation. Proposed segmentation method is compared with K-means and Fuzzy C-means clustering methods. The geometric, texture and colour based features are used in the feature extraction. Process of feature selection is done by Maximally Correlated Principal Component Analysis (MCPCA). Finally, in the classification step, severe portions of the affected area are analyzed by Backpropagation Based Discriminant Classifier (BBDC). Proposed classifier is compared with BPNN and Naive Bayes classifiers. The images are classified into three classes in final output like Class A –good quality mango, Class B-average quality mango, and Class C-poor quality mango. Finally, the evaluated results of the proposed model examine various defected and healthy mango images and prove that the proposed method has the highest accuracy when compared with existing methods.

     

A P2P Botnet detection scheme based on decision tree and adaptive multilayer neural networks

In recent years, Botnets have been adopted as a popular method to carry and spread many malicious codes on the Internet. These malicious codes pave the way to execute many fraudulent activities including spam mail, distributed denial-of-service attacks and click fraud. While many Botnets are set up using centralized communication architecture, the peer-to-peer (P2P) Botnets can adopt a decentralized architecture using an overlay network for exchanging command and control data making their detection even more difficult. This work presents a method of P2P Bot detection based on an adaptive multilayer feed-forward neural network in cooperation with decision trees. A classification and regression tree is applied as a feature selection technique to select relevant features. With these features, a multilayer feed-forward neural network training model is created using a resilient back-propagation learning algorithm. A comparison of feature set selection based on the decision tree, principal component analysis and the ReliefF algorithm indicated that the neural network model with features selection based on decision tree has a better identification accuracy along with lower rates of false positives. The usefulness of the proposed approach is demonstrated by conducting experiments on real network traffic datasets. In these experiments, an average detection rate of 99.08 % with false positive rate of 0.75 % was observed.

     

自适应分组长度策略获得最低延迟*

无线网络容易受到干扰、信道质量波动大。为了保证实时性要求较高的应用的延迟要求、减少分组头部开销,通过对网络层以及物理层的联合优化提出了基于符号个数的自适应分组长度策略（简称K-PK策略）。这个策略是将泊松分布到达的符号流中连续到达的k个符号聚合,添加固定长度的分组头部形成分组。仿真与分析表明,在一定信道误码率条件下,存在一个最优k值能获得最低延迟,平衡分组头部开销。K-PK策略相比基于固定时隙组包策略（简称T-PK策略）更能适应信道质量比较差以及波动大的情况,更符合现实的需要。     

基于核函数的软件定义网络DDoS实时安全系统

针对软件定义网络中DDoS攻击的检测准确率与延迟较长的问题,提出了一种基于核函数的软件定义网络DDoS实时安全系统。首先,每个周期提取软件定义网络的报文头信息,并组织成矩阵形式;其次,采用马氏距离分析相邻特征向量的显著变化,设计了两个核函数综合评估攻击行为的流量;最终,采用谱聚类技术与协方差统计信息自动地定位攻击者。基于真实软件定义网络进行了实验,结果显示该安全系统实现了较高的检测准确率,并且实现了理想的处理时间。     

Windows malware detection system based on LSVC recommended hybrid features

To combat exponentially evolved modern malware, an effective Malware Detection System and precise malware classification is highly essential. In this paper, the Linear Support Vector Classification (LSVC) recommended Hybrid Features based Malware Detection System (HF-MDS) has been proposed. It uses a combination of the static and dynamic features of the Portable Executable (PE) files as hybrid features to identify unknown malware. The application program interface calls invoked by the PE files during their execution along with their correspondent category are collected and considered as dynamic features from the PE file behavioural report produced by the Cuckoo Sandbox. The PE files’ header details such as optional header, disk operating system header, and file header are treated as static features. The LSVC is used as a feature selector to choose prominent static and dynamic features from their respective Original Feature Space. The features recommended by the LSVC are highly discriminative and used as final features for the classification process. Different sets of experiments were conducted using real-world malware samples to verify the combination of static and dynamic features, which encourage the classifier to attain high accuracy. The tenfold cross-validation experimental results demonstrate that the proposed HF-MDS is proficient in precisely detecting malware and benign PE files by attaining detection accuracy of 99.743% with sequential minimal optimization classifier consisting of hybrid features.