车联网隐私保护研究综述

车联网是一种通过在车辆、行人、路边单元等通信实体之间构建一个网络拓扑来提供高效、安全的信息服务的网络,车联网能够有效满足人们对交通环境日益增长的需求,但由于车联网具有移动性和开放性的特点,容易遭受攻击。在众多的威胁中,车联网用户的隐私泄露可能会造成不可弥补的损失,因此车联网的隐私保护被研究者广泛关注。针对车联网的隐私保护问题展开研究,根据车联网的体系结构总结出车联网需要具备的四个基本性质,并对现有的车联网攻击模型加以分析;通过对近些年车联网隐私保护方案的调查总结对现有研究中常用的方法加以归类,然后将车联网的隐私保护研究依照保护对象分为三类,并对各方案进行了分析评价。最后对现有研究的看法和面临的挑战进行了总结,给出了对未来研究的展望。     

Traffic video‐based intelligent traffic control system for smart cities using modified ant colony optimizer

Road traffic congestion is a serious problem in today's world and it happens because of urbanization and population growth. The traffic reduces the transport efficiency in the city, increases the waiting time and travel time, and also increases the usage of fuel and air pollution. To overcome these issues this papers propose an intelligent traffic control system using the Internet of Vehicles (IoV). The vehicles or nodes present in the IoV can communicate between themselves. This technique helps in determining the traffic intensity and the best route to reach the destination. The area of study used in this paper is Vellore city in Tamilnadu, India. The city map is separated into many segments of equal size and Ant Colony Algorithm (AOC) is applied to the separated maps to find the optimal route to reach the destination. Further, Support Vector Machine (SVM) is used to calculate the traffic density and to model the heavy traffic. The proposed algorithm performs better in finding the optimal route when compared to that of the existing path selection algorithms. From the results, it is evident that the proposed IoV‐based route selection method provides better performance.     

基于区块链的联邦学习研究进展

联邦学习（FL）是一种能够实现用户数据不出本地的新型隐私保护学习范式。随着相关研究工作的不断深入,FL的单点故障及可信性缺乏等不足之处逐渐受到重视。近年来,起源于比特币的区块链技术取得迅速发展,它开创性地构建了去中心化的信任,为FL的发展提供了一种新的可能。对现有基于区块链的FL框架进行对比分析,深入讨论区块链与FL相结合所解决的FL重要问题,并阐述了基于区块链的FL技术在物联网（IoT）、工业物联网（IIoT）、车联网（IoV）、医疗服务等多个领域的应用前景。     

基于区块链与云-边缘计算混合架构的车联网数据安全存储与共享方案

针对车联网（IoV）中云计算的高时延、数据泄漏和恶意车辆节点篡改数据等问题,提出了一种基于区块链与云-边缘计算混合架构的IoV数据安全存储与共享方案。首先,采用联盟链-私有链的双链去中心化存储结构来保障通信数据的安全;然后,利用基于身份的数字签密算法和基于离散中心二项分布的环签名方案来解决通信过程中的安全性问题;最后,提出了基于动态分层和信誉值评估的实用拜占庭容错机制（DRPBFT）,并将边缘计算技术与云计算技术相结合,从而解决了高时延问题。安全性分析结果表明,所提方案在信息共享过程中保证了数据的安全性和完整性。实验仿真和性能评估结果表明,DRPBFT的时延在6 s内,且有效地提高了系统的吞吐量。所提IoV方案有效地促进了车辆数据共享的积极性,使IoV系统更加高效稳定地运行,达到了IoV实时、高效的目的。     

基于隐私保护联邦学习与区块链的图像分类方案

传统的中心化图像分类方法受制于数据隐私问题和计算资源限制,无法满足实际需求。现有的联邦学习框架依赖中心服务器,存在单点故障和数据中毒攻击等安全挑战。为解决这些问题,提出了一种面向隐私保护联邦学习与区块链的图像分类方案,通过将联邦学习与区块链技术相结合,实现在分布式环境下进行图像分类任务的可靠性和安全性。图像分类模型通过联邦学习进行训练,并上传至区块链网络进行验证和共识;在分类阶段,模型通过加权组合得到最终分类结果。实验结果表明,该方案在确保用户隐私的同时提高了图像分类的准确度,本方法为解决图像分类中的数据隐私和安全问题提供了一种有效途径,并为提高分类准确性作出了积极探索。     

IoTGuardEye:一种面向物联网服务的Web攻击检测方法

在包括物联网(Internet of Things,IoT)设备的绝大部分边缘计算应用中,基于互联网应用技术(通常被称为Web技术)开发的应用程序接口(Application Programming Interface,API)是设备与远程服务器进行信息交互的核心。相比传统的Web应用,大部分用户无法直接接触到边缘设备使用的API,使得其遭受的攻击相对较少。但随着物联网设备的普及,针对API的攻击逐渐成为热点。因此,文中提出了一种面向物联网服务的Web攻击向量检测方法,用于对物联网服务收到的Web流量进行检测,并挖掘出其中的恶意流量,从而为安全运营中心(Security Operation Center,SOC)提供安全情报。该方法在对超文本传输协议(Hypertext Transfer Protocol,HTTP)请求的文本序列进行特征抽取的基础上,针对API请求的报文格式相对固定的特点,结合双向长短期记忆网络(Bidirectional Long Short-Term Memory,BLSTM)实现对Web流量的攻击向量检测。实验结果表明,相比基于规则的Web应用防火墙(Web A...     

A secure re‐encryption scheme for data services in a cloud computing environment

Cloud computing as a promising technology and paradigm can provide various data services, such as data sharing and distribution, which allows users to derive benefits without the need for deep knowledge about them. However, the popular cloud data services also bring forth many new data security and privacy challenges. Cloud service provider untrusted, outsourced data security, hence collusion attacks from cloud service providers and data users become extremely challenging issues. To resolve these issues, we design the basic parts of secure re‐encryption scheme for data services in a cloud computing environment, and further propose an efficient and secure re‐encryption algorithm based on the EIGamal algorithm, to satisfy basic security requirements. The proposed scheme not only makes full use of the powerful processing ability of cloud computing but also can effectively ensure cloud data security. Extensive analysis shows that our proposed scheme is highly efficient and provably secure under existing security model. Copyright © 2015 John Wiley & Sons, Ltd.     

车联网仿真测试评价技术研究综述

智能化和网联化是汽车发展的重要方向,车联网技术作为智能网联汽车体系架构的重要组成部分,近年来成为业界的研究热点之一。车联网的大规模部署及其在智能汽车领域的广泛应用前需要对其性能及功能进行全面、深入的测试评价,然而在真实环境下进行车联网的测试与评估存在成本高、难度大的问题,因此通过仿真手段对其进行评价分析是当前的主流测试手段。本文总结了主流的网络仿真器和交通仿真器,对现有车联网仿真平台进行了分类,研究并对比分析了典型的车联网仿真平台;针对车联网的应用特性,研究并归纳了影响车联网仿真性能的车辆移动模型、信道传播模型及驾驶员行为等;从网络仿真指标、车联网应用相关指标归纳了车联网功能及性能测试的典型评价指标。     

SDN/NFV security framework for fog-to-things computing infrastructure

Currently, core networking architectures are facing disruptive developments, due to emergence of paradigms such as Software-Defined-Networking (SDN) for control, Network Function Virtualization (NFV) for services, and so on. These are the key enabling technologies for future applications in 5G and locality-based Internet of things (IoT)/wireless sensor network services. The proliferation of IoT devices at the Edge networks is driving the growth of all-connected world of Internet traffic. In the Cloud-to-Things continuum, processing of information and data at the Edge mandates development of security best practices to arise within a fog computing environment. Service providers are transforming their business using NFV-based services and SDN-enabled networks. The SDN paradigm offers an easily programmable model, global view, and control for modern networks, which demand faster response to security incidents and dynamically enforce countermeasures to intrusions and cyberattacks. This article proposes an autonomic multilayer security framework called Distributed Threat Analytics and Response System (DTARS) for a converged architecture of Fog/Edge computing and SDN infrastructures, for emerging applications in IoT and 5G networks. The major detection scheme is deployed within the data plane, consisting of a coarse-grained behavioral, anti-spoofing, flow monitoring and fine-grained traffic multi-feature entropy-based algorithms. We developed exemplary defense applications under DTARS framework, on a malware testbed imitating the real-life DDoS/botnets such as Mirai. The experiments and analysis show that DTARS is capable of detecting attacks in real-time with accuracy more than 95% under attack intensities up to 50 000 packets/s. The benign traffic forwarding rate remains unaffected with DTARS, while it drops down to 65% with traditional NIDS for advanced DDoS attacks. Further, DTARS achieves this performance without incurring additional latency due to data plane overhead.     

一种面向车联网通信的条件隐私保护认证协议

车联网可有效提高交通的效率和安全性,但通信过程中存在的隐私泄露问题严重阻碍了其应用落地。提出一种面向车联网V2X通信的条件隐私保护认证协议。针对现有协议大多仅支持车辆认证的局限性,基于用户身份和车辆身份信息生成车与用户绑定的生物密钥,使协议支持单车多用户或单用户多车认证。在保护用户和车辆身份的条件下完成对消息发送方的身份认证,并在特定情况下追溯车辆和用户的真实身份,从而实现对车辆和用户的条件隐私保护。同时,在协议中添加批量验证功能以提高验证效率。形式化的安全性分析和性能评估结果表明,该协议是安全且高效的。     

基于协作反馈控制算法的车联网行车安全动态强化模型

针对车联网（IoV）环境下,单车的信息采集和处理能力不足以满足时间敏感的行车安全应用需求,需要通过多车协作增强车间信息共享和信道接入能力等问题,提出一种基于协作反馈控制算法的行车安全动态强化模型。首先,提出虚拟车队协作模型,提升交通信息的采集精度,扩大采集范围,建立车间的稳定协作关系,在形成协作虚拟车队的同时降低信道拥塞;然后,实现一个针对消息传输和驾驶控制的联合优化模型,通过异构交通数据的深度融合最大化IoV的安全效用;最后,在对车流量时空变化进行预测的基础上,提出自适应的反馈控制模型实时调整驾驶安全策略。仿真结果表明,所提出的行车安全动态强化模型在各种车流分布模型下,均能够取得良好的性能指标,可以有效支持驾驶辅助控制系统,在保障行车安全的同时降低信道拥塞。     

基于区块链的车联网安全通信策略

为完善车联网信任评估机制并建立车辆间的信任关系,提出一种基于区块链技术的车联网安全通信策略。利用椭圆曲线加密算法进行车辆身份注册与验证,结合基于Beta分布的直接信任值与基于PageRank算法的推荐信任值求得车辆综合信任值。通过智能合约技术对车辆综合信任值及交互信息进行管控,实现车辆综合信任值的上链、更改与更新。仿真结果表明,该策略能够有效抵御车联网内部与外部攻击,保证数据传输的安全性,且满足车联网车辆在高速移动环境下的高吞吐量及低时延通信需求。     

Characterizing DDoS attacks and flash events: Review,research gaps and future directions

A Distributed Denial of Service (DDoS) attack is an austere menace to network security. Nowadays in a technological era, DDoS attacks pose a severe threat to widely used Internet-based services and applications. Disruption of these services even for a fraction of time lead to huge financial losses. A Flash event (FE) is similar to a DDoS attack wherein a large number of legitimate users starts accessing a particular service concurrently leading to the denial of service. Both of these events cause overloading of network resources such as bandwidth, CPU, Memory to legitimate users and result in limited accessibility. Nowadays most of the DDoS attacks use the logical semantics of HTTP protocol to launch a similar kind of attack traffic as that of legitimate traffic which makes the distinction between the two very challenging. Many researchers have tried to discriminate these two types of traffic, but none of them has been able to provide any effective solution yet. This paper systematically reviews 40 such prominent research papers from 2002 to till date for providing insight into the problem of discriminating DDoS and FEs. This article dowries and deliberates the list of traffic feature rationales and detection metrics used by the fellow researchers at both macro and micro level. Such a pragmatic list of rationales would surely be helpful to provide more robust and efficient solutions. The paper also highlights open issues, research challenges and future directions in this area.     

基于网络效用最大化的车联网功率控制算法

针对车联网（IoV）中车流密度增加到一定程度时,即使无线信道中只有信标消息,信道拥塞也会发生的问题,提出一种分布式加权公平功率控制（D-WFPC）算法。首先,考虑车联网的实际信道特性,采用Nakagami-m衰落信道模型建立随机信道模型;然后,考虑车联网中节点的移动性,基于网络效用最大化（NUM）模型建立功率控制优化问题,控制本地信道负载在阈值之下,从而避免拥塞;最后,通过对偶分解和迭代法解决该问题,设计分布式算法,每辆车根据周围环境的邻居车辆的信标消息,动态调整发射功率。仿真实验中,与固定发射功率方案相比,随着车流密度增大,D-WFPC算法能有效降低时延和丢包率,最高降幅分别达到24%和44%;与公平分布式发射功率拥塞控制（FCCP）算法相比,D-WFPC算法全程性能占优,时延和丢包率的最高降幅分别达到10%和4%。仿真结果表明,D-WFPC算法能快速收敛,保证车联网中消息的低时延、高可靠传输。     

机器学习安全攻击与防御机制研究进展和未来挑战

机器学习的应用遍及人工智能的各个领域,但因存储和传输安全问题以及机器学习算法本身的缺陷,机器学习面临多种面向安全和隐私的攻击.基于攻击发生的位置和时序对机器学习中的安全和隐私攻击进行分类,分析和总结了数据投毒攻击、对抗样本攻击、数据窃取攻击和询问攻击等产生的原因和攻击方法,并介绍和分析了现有的安全防御机制.最后,展望了...     

An appraisal and design of a multi-agent system based cooperative wireless intrusion detection computational intelligence technique

The deployment of wireless sensor networks and mobile ad-hoc networks in applications such as emergency services, warfare and health monitoring poses the threat of various cyber hazards, intrusions and attacks as a consequence of these networks’ openness. Among the most significant research difficulties in such networks safety is intrusion detection, whose target is to distinguish between misuse and abnormal behavior so as to ensure secure, reliable network operations and services. Intrusion detection is best delivered by multi-agent system technologies and advanced computing techniques. To date, diverse soft computing and machine learning techniques in terms of computational intelligence have been utilized to create Intrusion Detection and Prevention Systems (IDPS), yet the literature does not report any state-of-the-art reviews investigating the performance and consequences of such techniques solving wireless environment intrusion recognition issues as they gain entry into cloud computing. The principal contribution of this paper is a review and categorization of existing IDPS schemes in terms of traditional artificial computational intelligence with a multi-agent support. The significance of the techniques and methodologies and their performance and limitations are additionally analyzed in this study, and the limitations are addressed as challenges to obtain a set of requirements for IDPS in establishing a collaborative-based wireless IDPS (Co-WIDPS) architectural design. It amalgamates a fuzzy reinforcement learning knowledge management by creating a far superior technological platform that is far more accurate in detecting attacks. In conclusion, we elaborate on several key future research topics with the potential to accelerate the progress and deployment of computational intelligence based Co-WIDPSs.     

Internet of Vehicles in Big Data Era

As the rapid development of automotive telematics, modern vehicles are expected to be connected through heterogeneous radio access technologies and are able to exchange massive information with their surrounding environment. By significantly expanding the network scale and conducting both real-time and long-term information processing, the traditional Vehicular AdHoc Networks (VANETs) are evolving to the Internet of Vehicles (IoV), which promises efficient and intelligent prospect for the future transportation system. On the other hand, vehicles are not only consuming but also generating a huge amount and enormous types of data, which is referred to as Big Data. In this article, we first investigate the relationship between IoV and big data in vehicular environment, mainly on how IoV supports the transmission, storage, computing of the big data, and how IoV benefits from big data in terms of IoV characterization, performance evaluation and big data assisted communication protocol design. We then investigate the application of IoV big data in autonomous vehicles. Finally, the emerging issues of the big data enabled IoV are discussed.      

基于假名的智能交通条件隐私保护认证协议

在智能交通、无人驾驶等场景中,车辆节点与路边设施进行数据交换以实现车路协同,有助于提高交通安全、缓解交通拥堵.但该场景下的数据交换面临很多安全问题,隐私泄露是其中的主要安全风险之一.现有智能交通隐私保护方案多涉及复杂度较高的运算或需配置高成本的防篡改设备,效率较低,不能满足无人驾驶等智能交通应用的实时要求.为此,文章提...     

Fuzzy User Access Trust Model for Cloud Access Control

Cloud computing belongs to a set of policies, protocols, technologies through which one can access shared resources such as storage, applications, networks, and services at relatively low cost. Despite the tremendous advantages of cloud computing, one big threat which must be taken care of is data security in the cloud. There are a dozen of threats that we are being exposed to while availing cloud services. Insufficient identity and access management, insecure interfaces and Applications interfaces (APIs), hijacking, advanced persistent threats, data threats, and many more are certain security issues with the cloud platform. APIs and service providers face a huge challenge to ensure the security and integrity of both network and data. To overcome these challenges access control mechanisms are employed. Traditional access control mechanisms fail to monitor the user operations on the cloud platform and are prone to attacks like IP spoofing and other attacks that impact the integrity of the data. For ensuring data integrity on cloud platforms, access control mechanisms should go beyond authentication, identification, and authorization. Thus, in this work, a trust-based access control mechanism is proposed that analyzes the data of the user behavior, network behavior, demand behavior, and security behavior for computing trust value before granting user access. The method that computes the final trust value makes use of the fuzzy logic algorithm. The trust value-based policies are defined for the access control mechanism and based on the trust value outcome the access control is granted or denied.     

基于移动边缘计算的车载CAN网络入侵检测方法

随着车联网技术的快速发展和广泛部署,其在为智能网联汽车提供互联网与大数据分析等智能化服务的同时,引入了网络入侵等安全与隐私问题.传统车载网络的封闭性导致现有的车载网络通信协议,特别是部署最为广泛的控制器局域网络(Controller Area Network,CAN)总线协议,在发布时缺少隐私与安全保护机制.因此,为检...