基于SAT的安全协议惰性形式化分析方法

提出了一种基于布尔可满足性问题的安全协议形式化分析方法SAT-LMC,通过引入惰性分析的思想优化初始状态与转换规则,提高了安全性的检测效率。另一方面,通过在消息类型上定义偏序关系,SAT-LMC能够检测出更丰富的类型缺陷攻击。基于此方法实现了一个安全协议分析工具,针对Otway-Rees协议检测出了一种类型缺陷攻击;针对OAuth2.0协议,检测结果显示对现实中存在的一些应用场景,存在一种利用授权码截取的中间人攻击。     

Formal Analysis and Verification of OAuth 2.0 Protocol Improved by Key Cryptosystems

The reasons which take huge losses to en-terprises and users are: Open authorization (OAuth) 2.0 protocol is excessively dependent on Hyper text transfer protocol over secure socket layer (HTTPS) to transmit data and ignores per-message encryption, and the trans-mission efficiency of HTTPS is too low to work well un-der poor network. The improved OAuth 2.0 modified by Hyper text transfer protocol (HTTP), public key system and private key signature is proposed. With verifying the security of OAuth 2.0 by model checking technology, an improved protocol of higher security is acquired. Compar-ing different protocol modeling optimized by three combi-nation optimization strategies which involve technologies such as type checking, static analysis and syntactic reorder-ing, an optimal security verification model of the improved protocol is obtained. Program enumeration is presented to compute the repository of attacker. The modeling method of attacker above can effectively reduce the complexity of attacker modeling, consequently those methods can be ap-plied to analyze and validate multi-principal protocols.     

云应用程序编程接口安全研究综述:威胁与防护

云时代,云应用程序编程接口(API)是服务交付、能力复制和数据输出的最佳载体。然而,云API在开放服务和数据的同时,增加了暴露面和攻击面,攻击者通过数据劫持和流量分析等技术获取目标云API的关键资源,能够识别用户的身份和行为,甚至直接造成背后系统的瘫痪。当前,针对云API的攻击类型繁多,威胁与防护方法各异,缺乏对现有攻击和防护方法的系统总结。该文梳理了云API安全研究中云API面临的威胁和防护方法,分析了云API的演化历程和类别划分;讨论了云API的脆弱性以及云API安全研究的重要性;提出了云API安全研究框架,涵盖身份验证、云API分布式拒绝服务(DDoS)攻击防护、重放攻击防护、中间人(MITM)攻击防护、注入攻击防护和敏感数据防护6个方面相关研究工作综述。在此基础上,探讨了增加人工智能(AI)防护的必要性。最后给出了云API防护的未来挑战和发展趋势。     

基于OAuth单点登录系统的安全性分析和评估

现今,不少用户使用QQ、微信、微博帐号登录第三方网站,其中大多数服务器供应商都采用了OAuth 2.0安全协议,但该协议是基于单点登录的,因此存在不少安全隐患。为了进一步提高系统安全性,文中通过测试第三方网站帐号登录、登出的HTTP流量状况,模拟了网站被攻击过程,从中提取日志并分析结果,对基于OAuth 2.0安全协议的资源提供方和第三方网站的安全性进行了评估。文中针对不同的问题提出了相应的对策。     

基于非对称QKD的股票交易数据库隐私查询协议

证券交易所的股票交易数据库中包含大量敏感信息,用户查询该数据库时保障账户及数据库的隐私十分重要.分析了非对称量子密钥分配(QKD)及其优良特性,提出了一种基于非对称QKD的不经意集合元素映射判定协议.该协议在查询数据库时保证了用户和数据库的隐私.安全性分析结果表明,该协议能有效抵抗量子存储攻击、伪造量子态攻击和纠缠测量攻击,具有很高的信道损耗容忍度.     

面向进程控制流劫持攻击的拟态防御方法

为了防御进程控制流劫持攻击,从漏洞利用的角度对攻击过程建立了威胁模型,提出了截断关键漏洞利用环节的"要塞"防御.在研究拟态防御原理的基础上提出了进程的拟态执行模型,并对该模型进行了分析与有效性证明,拟态执行能够有效截断控制流劫持的攻击实施过程;实现了拟态执行的原型系统MimicBox,并对MimicBox进行了有效性验...     

Research on DDoS detection in multi-tenant cloud based on entropy change

An attacker compromised a number of VMs in the cloud to form his own network to launch a powerful distrib-uted denial of service (DDoS) attack.DDoS attack is a serious threat to multi-tenant cloud.It is difficult to detect which VM in the cloud are compromised and what is the attack target,especially when the VM in the cloud is the victim.A DDoS detection method was presented suitable for multi-tenant cloud environment by identifying the malicious VM at-tack sources first and then the victims.A distributed detection framework was proposed.The distributed agent detects the suspicious VM which generate the potential DDoS attack traffic flows on the source side.A central server confirms the real attack flows.The feasibility and effectiveness of the proposed detection method are verified by experiments in the multi-tenant cloud environment.     

DDoS攻击恶意行为知识库构建

针对分布式拒绝服务（distributed denial of service,DDoS）网络攻击知识库研究不足的问题,提出了DDoS攻击恶意行为知识库的构建方法。该知识库基于知识图谱构建,包含恶意流量检测库和网络安全知识库两部分：恶意流量检测库对 DDoS 攻击引发的恶意流量进行检测并分类;网络安全知识库从流量特征和攻击框架对DDoS 攻击恶意行为建模,并对恶意行为进行推理、溯源和反馈。在此基础上基于DDoS 开放威胁信号（DDoS open threat signaling,DOTS）协议搭建分布式知识库,实现分布式节点间的数据传输、DDoS攻击防御与恶意流量缓解功能。实验结果表明,DDoS攻击恶意行为知识库能在多个网关处有效检测和缓解DDoS攻击引发的恶意流量,并具备分布式知识库间的知识更新和推理功能,表现出良好的可扩展性。     

WDPF系统中认证授权流程的设计与实现

WDPF（Wireless Digital Picture Frame,无线数码相框平台）系统是一个平台与终端紧密结合的新型业务。安全性是所有可以用来对资源或信息进行保护和验证的机制。认证授权处于业务核心层,用于识别用户身份,允许特定用户访问特定资源或信息,起访问控制作用,保证系统资源和信息的安全。该文介绍了业务平台中不同模块采用不同认证方式,重点介绍基本认证、摘要认证和OAuth认证在业务平台中的设计与实现。     

A comprehensive survey of AI-enabled phishing attacks detection techniques

In recent times, a phishing attack has become one of the most prominent attacks faced by internet users, governments, and service-providing organizations. In a phishing attack, the attacker(s) collects the client’s sensitive data (i.e., user account login details, credit/debit card numbers, etc.) by using spoofed emails or fake websites. Phishing websites are common entry points of online social engineering attacks, including numerous frauds on the websites. In such types of attacks, the attacker(s) create website pages by copying the behavior of legitimate websites and sends URL(s) to the targeted victims through spam messages, texts, or social networking. To provide a thorough understanding of phishing attack(s), this paper provides a literature review of Artificial Intelligence (AI) techniques: Machine Learning, Deep Learning, Hybrid Learning, and Scenario-based techniques for phishing attack detection. This paper also presents the comparison of different studies detecting the phishing attack for each AI technique and examines the qualities and shortcomings of these methodologies. Furthermore, this paper provides a comprehensive set of current challenges of phishing attacks and future research direction in this domain.

     

A provable and secure mobile user authentication scheme for mobile cloud computing services

The mobile cloud computing (MCC) has enriched the quality of services that the clients access from remote cloud‐based servers. The growth in the number of wireless users for MCC has further augmented the requirement for a robust and efficient authenticated key agreement mechanism. Formerly, the users would access cloud services from various cloud‐based service providers and authenticate one another only after communicating with the trusted third party (TTP). This requirement for the clients to access the TTP during each mutual authentication session, in earlier schemes, contributes to the redundant latency overheads for the protocol. Recently, Tsai et al have presented a bilinear pairing based multi‐server authentication (MSA) protocol, to bypass the TTP, at least during mutual authentication. The scheme construction works fine, as far as the elimination of TTP involvement for authentication has been concerned. However, Tsai et al scheme has been found vulnerable to server spoofing attack and desynchronization attack, and lacks smart card‐based user verification, which renders the protocol inapt for practical implementation in different access networks. Hence, we have proposed an improved model designed with bilinear pairing operations, countering the identified threats as posed to Tsai scheme. Additionally, the proposed scheme is backed up by performance evaluation and formal security analysis.     

Smart card–based password authenticated key agreement protocol using chaotic maps

In 2015, Lee proposed time stamp–based and nonce‐based password authenticated key agreement protocols based on the Chebyshev chaotic map to enhance the security of relevant schemes. However, in this paper, we demonstrate that Lee's protocols are vulnerable to user impersonation and stolen verifier attacks. To overcome these security problems, we thus provide an improved version using a smart card. Security analysis and comparisons show that the proposed protocol is more secure and maintains better performance. Furthermore, we perform a formal verification of the proposed protocol using the widely accepted AVISPA tool for error detection.     

Improvement of the Hash-Based RFID Mutual Authentication Protocol

Radio frequency identification (RFID) is a popular kind of automatic identification technologies that uses radio frequencies. Many security and privacy problems my be raised in the using of RFID due to its radio transmission nature. In 2012, Cho et al. (Comput Math Appl, 2012. doi:10.1016/j.camwa.2012.02.025) proposed a new hash-based RFID mutual authentication protocol to solve these problems. However, this protocol was demonstrated to be vulnerable to DOS attack. This paper further shows that Cho et al.’s protocol is vulnerable to traffic analysis and tag/reader impersonation attacks. An improved protocol is also proposed which can prevent the said attacks.     

一种适合3G移动的微支付方案

本方案提出利用改进后3G入网认证机制中密钥和随机数,结合AES算法生成安全性高的一次性签名,且计算量和存储量很少,具有不可否认性,还利用了登录第三方网站后生成的用户临时标识,具有很好的匿名性和不可跟踪性。其中商家受到第三方的监视和管理,防止用户和商家的欺诈,用户收到商品后对商家的信用进行评价,具有公平性。该方案交易灵活、效率高,适合3G用户实行微支付交易。     

Supervised learning‐based DDoS attacks detection: Tuning hyperparameters

Two supervised learning algorithms, a basic neural network and a long short‐term memory recurrent neural network, are applied to traffic including DDoS attacks. The joint effects of preprocessing methods and hyperparameters for machine learning on performance are investigated. Values representing attack characteristics are extracted from datasets and preprocessed by two methods. Binary classification and two optimizers are used. Some hyperparameters are obtained exhaustively for fast and accurate detection, while others are fixed with constants to account for performance and data characteristics. An experiment is performed via TensorFlow on three traffic datasets. Three scenarios are considered to investigate the effects of learning former traffic on sequential traffic analysis and the effects of learning one dataset on application to another dataset, and determine whether the algorithms can be used for recent attack traffic. Experimental results show that the used preprocessing methods, neural network architectures and hyperparameters, and the optimizers are appropriate for DDoS attack detection. The obtained results provide a criterion for the detection accuracy of attacks.     

Open API standardization for the NGN platform - [ITU-T kaleidoscope]

Next-generation networks promise to provide a richer set of applications for the end user, creating a network platform that enables the rapid creation of new services. Significant progress has been made in the standardization of NGN architecture and protocols, but little progress has been made on open APIs. This article outlines the importance of open APIs and the current achievements of the standards bodies. It concludes with a brief set of issues that standards bodies must resolve in relation to these APIs.     

新网络环境下应用层DDoS攻击的剖析与防御

针对新网络环境下近两年新出现的应用层分布式拒绝服务攻击,本文将详细剖析其原理与特点,并分析现有检测机制在处理这种攻击上的不足.最后,本文提出一种基于用户行为的检测机制,它利用Web挖掘的方法通过Web访问行为与正常用户浏览行为的偏离程度检测与过滤恶意的攻击请求,并通过应用层与传输层的协作实现对攻击源的隔离.     

Security Flaws in Authentication Protocols with Anonymity for Wireless Environments

The emerging wireless networks require the design of new authentication protocols due to their dynamic nature and vulnerable‐to‐attack structure. Recently, Wu and others proposed a wireless authentication protocol which is claimed to be an improvement of the authentication protocol proposed by Lee and others which provides user anonymity. In this letter, we show that these protocols have a common flaw and that these protocols fail to provide user anonymity. We also propose a modification method to solve this problem.     

Detection method of LDoS attack based on ACK serial number step-length

Low-rate denial of service (LDoS) attack is a potential security threat to big data centers and cloud computing platforms because of its strong concealment.Based on the analysis of network traffic during the LDoS attack,statistical analysis was given of ACK packets returned by the data receiver to the sender,and result reveals the sequence number step had the characteristics of volatility during the LDoS attack.The permutation entropy method was adopted to extract the characteristics of volatility.Hence,an LDoS attack detection method based on ACK serial number step permutation entropy was proposed.The serial number was sampled and the step length was calculated through collecting the ACK packets that received at the end of sender.Then,the permutation entropy algorithm with strong time-sensitive was used to detect the mutation step time,and achieve the goal of detecting LDoS attack.A test-bed was designed and built in the actual network environment for the purpose of verifying the proposed approach performance.Experimental results show that the proposed approach has better detection performance and has achieved better detection effect.     

新的车辆远程诊断授权协议

诊断主体授权问题是车辆远程故障诊断中的关键问题。针对当前车辆远程诊断授权协议（PVAUDS）中存在的问题,提出了新的车辆远程诊断授权协议（PVAUDS+）。在保证原协议安全目标的前提下,为诊断主体提供双向认证和票据新鲜性验证,并保证发送票据的可信第三方能够有效抵御拒绝服务攻击。使用安全协议证明工具ProVerif对PVAUDS+协议的安全属性进行自动化证明,通过增加发起代价的机制解决对可信第三方的拒绝服务攻击问题,从而说明PVAUSD+协议能够满足提出的安全目标。定量分析结果说明本协议具有较好的可行性。