边缘计算中基于深度Q网络的物理层假冒攻击检测方法

针对边缘计算中边缘计算节点与终端设备之间的通信容易受到假冒攻击的安全问题，提出了一种基于深度Q网络（DQN）的物理层假冒攻击检测算法。首先，构建边缘计算网络中的假冒攻击模型，接收端基于物理层信道状态信息（CSI）建立假设检验，并将当前测量得到的CSI和上次记录的CSI之间的欧氏距离作为检验统计量；其次，利用DQN算法以接收端回报最大化为目标自适应地为边缘计算动态网络环境筛选出当前最优检测阈值；最后，通过对比检验统计量与检测阈值来判断当前发送端是否为假冒攻击者。仿真结果表明，信干噪比（SINR）和信道增益比对检测算法性能有一定的影响，但在信道增益相对变化不超过0.2时，误报率、漏检率和平均错误率低于5%，因此该检测算法能够自适应边缘计算动态变化的网络环境。     

边缘计算中基于深度Q网络的物理层假冒攻击检测方法

针对边缘计算中边缘计算节点与终端设备之间的通信容易受到假冒攻击的安全问题,提出了一种基于深度Q网络（DQN）的物理层假冒攻击检测算法。首先,构建边缘计算网络中的假冒攻击模型,接收端基于物理层信道状态信息（CSI）建立假设检验,并将当前测量得到的CSI和上次记录的CSI之间的欧氏距离作为检验统计量;其次,利用DQN算法以接收端回报最大化为目标自适应地为边缘计算动态网络环境筛选出当前最优检测阈值;最后,通过对比检验统计量与检测阈值来判断当前发送端是否为假冒攻击者。仿真结果表明,信干噪比（SINR）和信道增益比对检测算法性能有一定的影响,但在信道增益相对变化不超过0.2时,误报率、漏检率和平均错误率低于5%,因此该检测算法能够自适应边缘计算动态变化的网络环境。     

A study on the efficiency of hardware Trojan detection based on path-delay fingerprinting

Hardware Trojan horses (HTHs) are among the most challenging treats to the security of integrated circuits. Path-delay fingerprinting has shown to be a promising HTH detection approach. However, previous work in this area incurs a large hardware cost or requires expensive testing techniques. Moreover, the relation between technology mapping and the efficiency of delay-based HTH detection have not yet been studied. In this paper, we present a HTH detection method which uses an effective test-vector selection scheme and a path-delay measurement structure. Furthermore, we demonstrate the large impact of technology mapping on the effectiveness of delay-based HTH detection. We also show that delay-based detection methods are highly scalable. In case of choosing an area-driven design strategy, the average HTH detection probability of our approach is about 63%, 78% and 90% if false alarm rate is 0%, 2% and 16%, respectively. However, with modifications in the technology mapping, the results show improvements to 85%, 94% and 99%, at the cost of about 20% area overhead. In addition, the efficiency of our method would not decrease for large benchmarks with thousands of gates.     

缓存侧信道攻击与防御

近年来,随着信息技术的发展,信息系统中的缓存侧信道攻击层出不穷.从最早利用缓存计时分析推测密钥的想法提出至今,缓存侧信道攻击已经历了10余年的发展和演进.研究中梳理了信息系统中缓存侧信道攻击风险,并对缓存侧信道攻击的攻击场景、实现层次、攻击目标和攻击原理进行了总结．系统分析了针对缓存侧信道攻击的防御技术,从缓存侧信道攻击防御的不同阶段出发,分析了攻击检测和防御实施2部分研究工作,并基于不同防御原理对防御方法进行分类和分析.最后,总结并讨论了互联网生态体系下缓存侧信道攻击与防御的研究热点,指出缓存侧信道攻击与防御未来的研究方向,为想要在这一领域开始研究工作的研究者提供参考.

     

Effect of ARP poisoning attacks on modern operating systems

Modern operating systems (OSs) are expected to be more secure as they integrate robust security measures to ensure that users can perform their daily tasks reliably. In this article, through extensive experimentation, we evaluate how today’s most common OSs fare against the typical Address Resolution Protocol (ARP) poisoning attack in a local area network (LAN). We test some common variants of Linux along with two variants of Mac OS X and one variant of Windows, and observe that they are not impervious to ARP poisoning. Also, we conclude that Mac OS X is the most vulnerable of all the OSs tested, whereas the tested variants of Linux and Windows show the same resilience toward attack, even though Windows is believed to be less secure than the others.     

区块链资产窃取攻击与防御技术综述

自中本聪提出比特币以来,区块链技术得到了跨越式发展,特别是在数字资产转移及电子货币支付方面。以太坊引入智能合约代码,使其具备了同步及保存智能合约程序执行状态,自动执行交易条件并消除对中介机构需求,Web3.0 开发者可利用以太坊提供的通用可编程区块链平台构建更加强大的去中心化应用。公链系统具备的特点,如无须中央节点控制、通过智能合约保障交互数据公开透明、用户数据由用户个人控制等,使得它在区块链技术发展的过程中吸引了更多的用户关注。然而,随着区块链技术的普及和应用,越来越多的用户将自己的数字资产存储在区块链上。由于缺少权威机构的监管及治理,以太坊等公链系统正逐步成为黑客窃取数字资产的媒介。黑客利用区块链实施诈骗及钓鱼攻击,盗取用户所持有的数字资产来获取利益。帮助读者建立区块链资产安全的概念,从源头防范利用区块链实施的资产窃取攻击。通过整理总结黑客利用区块链环境实施的资产窃取攻击方案,抽象并归纳威胁模型的研究方法,有效研究了各类攻击的特征及实施场景。通过深入分析典型攻击方法,比较不同攻击的优缺点,回答了攻击能够成功实施的根本原因。在防御技术方面,针对性结合攻击案例及攻击实施场景介绍了钓鱼检测、代币授权检测、代币锁定、去中心化代币所属权仲裁、智能合约漏洞检测、资产隔离、供应链攻击检测、签名数据合法性检测等防御方案。对于每一类防御方案,给出其实施的基本流程及方案,明确了各防护方案能够在哪类攻击场景下为用户资产安全提供防护。     

Robust content fingerprinting algorithm based on invariant and hierarchical generative model

Content fingerprinting has been widely used for protecting the copyright of on-line digital media. By aggregating the perceptual attributes of digital media into an invariant digest, content fingerprinting enables user-generated-contents (UGC) networks to identify the unauthorized distribution of copyrighted contents. In this paper, we propose an image fingerprinting algorithm based on invariant generative model. The proposed work formulates fingerprinting algorithm as a hierarchy of parametric models. For better generalization performance, we first train the models to learn generic visual patterns from local image structures, which is accomplished by fitting the statistical distribution of local patches. The learned models are then fine-tuned to address the robustness and discriminability requirements of content fingerprinting. Moreover, our training scheme also regularizes the norm of gradients to force the models to learn visual features that are insensitive to distortion. The learned models are cascaded with a pooling operation to form the building block of fingerprinting algorithm. Considering the security requirement of copyright protection, we also develop a key-dependent scheme to randomize fingerprint computation. Experimental results validate that the proposed work can withstand a wide variety of distortions and achieve a higher content identification accuracy than competing algorithms.     

A physical hash for preventing and detecting cyber-physical attacks in additive manufacturing systems

Cyber-physical security is a major concern in the modern environment of digital manufacturing, wherein a cyber-attack has the potential to result in the production of defective parts, theft of IP, or damage to infrastructure or the operator have become a real threat that have the potential to create bad parts. Current cyber only solutions are insufficient due to the nature of manufacturing environments where it may not be feasible or even possible to upgrade physical equipment to the most current cyber security standards, necessitating an approach that addresses both the cyber and the physical components. This paper proposes a new method for detecting malicious cyber-physical attacks on additive manufacturing (AM) systems. The method makes use of a physical hash, which links digital data to the manufactured part via a disconnected side-channel measurement system. The disconnection ensures that if the network and/or AM system becomes compromised, the manufacturer can still rely on the measurement system for attack detection. The physical hash ensures protection of the intellectual property (IP) associated with both process and toolpath parameters while also enabling in situ quality assurance. In this paper, the physical hash takes the form of a QR code that contains a hash string of the nominal process parameters and toolpath. It is manufactured alongside the original geometry for the measurement system to scan and compare to the readings from its sensor suite. By taking measurements in situ, the measurement system can detect in real-time if the part being manufactured matches the designer’s specification.In this paper, the overall concept and underlying algorithm of the physical hash is presented. A proof-of-concept validation is realized on a material extrusion AM machine, to demonstrate the ability of a physical hash and in situ monitoring to detect the existence (and absence) of malicious attacks on the STL file, the printing process parameters, and the printing toolpath.     

基于网络安全风险控制的DDoS攻击防御系统设计分析

本文针对网络安全风险控制的特点,系统的阐述了网络威胁中的分布式拒绝服务攻击（DDoS）的技术原理和分类,从风险控制的角度对构建DDoS攻击防御体系以及所使用的技术和方法进行了设计和分析。     

扩展变换对量化指纹抗合谋攻击性能的影响

以一种量化正交指纹为基础,通过理论分析和仿真实验,研究扩展变换对量化数字指纹抵抗平均合谋攻击能力的影响,并对包含和不包含扩展变换的量化数字指纹进行比较。结果表明,定义为扩展参数和方向参数的比值的扩展变换增益因子对含扩展变换的量化数字指纹抵抗平均攻击的性能有重要影响。在不同的噪声强度下,抗合谋攻击能力随扩展变换增益因子变化的变化方式不同。此外,扩展变换增益因子等于1使得扩展变换量化指纹与对应的非扩展变换量化指纹的抗平均合谋攻击能力相当。     

基于PUF的RFID协议分析与改进?

对一个基于PUF构造的低成本RFID安全协议进行分析,发现该协议不能保护标签的隐私性,即任何一个攻击者通过重放协议消息就可以跟踪同一个标签。并且由于识别标签的时间复杂度和通信复杂度都与标签个数呈线性关系,因此协议不具有扩展性。为此,提出一个改进的RFID协议,使得协议在效率和安全性两方面得到改善。     

射频通信干扰技术的实践应用与分析

文章介绍了广播频段射频干扰的形成机理，干扰的种类以及在工作中遇到不同的干扰采取不同的补救措施。干扰，本质上是指未按频率分配规定的信号占据了合法信号的频率，造成合法信号无法正常工作。因此，对频域的分析过程，就是解决干扰问题的过程，也是广播网络优化工作的重要组成部分。解决干扰问题，不仅要对广播网络常见干扰有深刻的认识，还必须对现有广播制式的频率分配了如指掌。     

Effects of virtual presence and learning outcome using low-end virtual reality systems

Low-cost technology is essential to integrate Virtual Reality (VR) into educative institutions around the world. However, low-cost technology usually refers to low-end technology, which may compromise the level of immersion of the VR system. This study evaluates whether low-end and high-end VR systems achieve a comparable learning outcome regardless their immersion level. We also analyze the relationship between virtual presence and the learning outcome arising from a VR educational experience. An evaluation with 42 participants was conducted. We measured learning outcome and virtual presence under three different configurations, namely: a desktop computer, a low-end VR system, and a high-end VR system. The impact of simulator sickness was also analyzed. Results revealed a lower learning outcome in the less immersive configuration (i.e. desktop) and a similar learning outcome in both low-end and high-end VR systems. Even though low-end VR systems are less immersive and produce a lower level of virtual presence than high-end VR systems, the results support the use of low-end VR systems for educative applications.     

针对视频监控系统隐蔽式攻击及蜜罐防御

基于视频监控系统网络化和智能化发展带来的风险,研究其隐蔽式网络攻击问题,目的在于调研大量隐蔽式网络攻击案例,总结针对视频监控系统的隐蔽式攻击特异性。结合蜜罐技术在检测网络攻击行为和发现攻击线索等方面的独特优势,梳理针对视频监控系统隐蔽式攻击的蜜罐防御方法。针对监控视频蜜罐在视觉场景部署上的不足,介绍了一种深度场景伪造防御框架,将生成式AI大模型与视频监控蜜罐相结合。最后提出了面向视频监控系统的蜜罐防御技术的发展方向。     

Docker组件间标准输入输出复制的DoS攻击分析

近年来,Docker 技术因其部署灵活、可扩展性强,获得了大规模应用。Docker 采用模块化设计,在降低开发和维护的复杂性的同时引入了针对组件间通信的拒绝服务（DoS）攻击。在Docker容器内频繁进行stdout输出会引起Docker组件消耗大量CPU,造成DoS攻击。经过分析,可发现容器实例中的stdout输出会触发Docker各个组件的goroutine,进行频繁输出复制。为系统化地找出可被DoS攻击的goroutine创建的路径,提出使用静态分析的方法来分析Docker各组件,设计并实现了Docker组件静态分析框架,最后在Docker上进行了测试,成功分析得到了34条此类路径,其中22条路径经验证,可成功被动态触发。     

基于ECC的RFID组证明协议分析及改进

由于无线射频识别(RFID)系统资源的限制,现有组证明协议大多采用对称密码算法,会带来安全和隐私保护方面的问题。为此,将公钥密码算法引入到组证明协议设计中。针对基于椭圆曲线密码(ECC)的组证明协议存在易受跟踪攻击的问题,提出一种改进方案,并对其安全性进行分析。分析结果表明,该协议能够抵抗跟踪攻击、伪造证明攻击、重放攻击和假冒攻击,具有较好的安全性,适合于RFID系统应用。     

基于SIP的VoIP网络中DoS攻击的分析与研究

SIP协议是NGN中的重要协议之一,它在Internet环境下建立并管理会话,正以迅猛的速度改变当今企业及各种机构的沟通方式,因此对SIP协议安全性的研究也就显得格外重要.尽管多年来全球无数网络安全专家都在潜心研究DoS攻击的解决办法,但到目前为止收效不大,因为DoS攻击利用了协议本身的弱点.研究了针对VoIP环境下的DoS攻击,在简单介绍SIP协议和DoS攻击的基础上,详细地描述了基于SIP的VoIP网络环境中的DoS攻击的多种攻击类型,并给出针对这些攻击的网络安全维护对策.     

基于SCA规范的硬件抽象层应用程序接口分析

从接口定义及工作原理两个方面详细阐述了JTRS系统办公室先后发布的MHAL和MOCB硬件抽象层接口标准;同时以DSP处理器为例给出了MHAL和MOCB的实现方案;最后对两个标准的特点、优势及适用条件进行了分析与比较。     

基于AES与NTRU的RFID安全认证协议

对现有的RFID认证协议进行了安全性与算法复杂度分析,提出了一种基于高级加密标准AES与公钥体制NTRU的RFID安全认证协议。该协议可抵抗重传、窃听、篡改、跟踪等多种攻击手段,实现了双向认证与密钥更新,适合安全性能要求高、电子标签用户数多的RFID应用场合。分析了此协议的安全性及算法可行性,并利用BAN逻辑对其安全性进行了证明。     

Prevention of selective black hole attacks on mobile ad hoc networks through intrusion detection systems

A black hole attack on a MANET refers to an attack by a malicious node, which forcibly acquires the route from a source to a destination by the falsification of sequence number and hop count of the routing message. A selective black hole is a node that can optionally and alternately perform a black hole attack or perform as a normal node. In this paper, several IDS (intrusion detection system) nodes are deployed in MANETs in order to detect and prevent selective black hole attacks. The IDS nodes must be set in sniff mode in order to perform the so-called ABM (Anti-Blackhole Mechanism) function, which is mainly used to estimate a suspicious value of a node according to the abnormal difference between the routing messages transmitted from the node. When a suspicious value exceeds a threshold, an IDS nearby will broadcast a block message, informing all nodes on the network, asking them to cooperatively isolate the malicious node. This study employs ns2 to validate the effect of the proposed IDS deployment, as IDS nodes can rapidly block a malicious node, without false positives, if a proper threshold is set.