APU-D* Lite: Attack Planning under Uncertainty Based on D* Lite

With serious cybersecurity situations and frequent network attacks,the demands for automated pentests continue to increase,and the key issue lies in attack planning.Considering the limited viewpoint of the attacker,attack planning under uncertainty is more suitable and practical for pentesting than is the traditional planning approach,but it also poses some challenges.To address the efficiency problem in uncertainty planning,we propose the APU-D*Lite algorithm in this paper.First,the pentest framework is mapped to the planning problem with the Planning Domain Definition Language(PDDL).Next,we develop the pentest information graph to organize network information and assess relevant exploitation actions,which helps to simplify the problem scale.Then,the APU-D*Lite algorithm is introduced based on the idea of incremental heuristic searching.This method plans for both hosts and actions,which meets the requirements of pentesting.With the pentest information graph as the input,the output is an alternating host and action sequence.In experiments,we use the attack success rate to represent the uncertainty level of the environment.The result shows that APU-D*Lite displays better reliability and efficiency than classical planning algorithms at different attack success rates.

MPHM:Model poisoning attacks on federal learning using historical information momentum

Federated learning(FL)development has grown increasingly strong with the increased emphasis on data for individuals and industry.Federated learning allows individual participants to jointly train a global model without sharing local data,which significantly enhances data privacy.However,federated learning is vulnerable to poisoning attacks by malicious participants.Since federated learning does not have access to the participants’training process,i.e.,attackers can compromise the global model by uploading elaborate malicious local updates to the server under the guise of normal participants.Current model poisoning attacks usually add small perturbations to the local model after it is trained to craft harmful local updates and the attacker finds the appropriate perturbation size to bypass robust detection methods and corrupt the global model as much as possible.In contrast,we propose a novel model poisoning attack based on the momentum of history information(MPHM),that is,the attacker makes new malicious updates by dynamically crafting perturbations using the historical information in the local training,which will make the new malicious updates more effective and stealthy.Our attack aims to indiscriminately reduce the testing accuracy of the global model with minimal information.Experiments show that in the classical defense case,our attack can significantly corrupt the accuracy of the global model compared to other advanced poisoning attacks.

基于自治域协同的域间路由信誉模型

域间路由系统自治域间的交互缺乏可信认证,建立针对自治域行为模式的信誉模型可为域间路由管理提供约束与激励,提高整体安全水平.由于域间路由系统分布自治、局部路由信息不完整,现有信誉评价方法无法从全局视角感知自治域行为,难以准确反映自治域可信程度及其变化.本文提出一种基于自治域协同的域间路由信誉模型.首先通过分析自治域路由行为统计特征,建立基于贝叶斯(Bayes)后验概率分析的自治域信誉量化指标,用于对目标自治域进行本地信誉评价;然后通过研究自治域属性与本地路由信息完整程度的关系,设计信誉加权聚合算法,采用多域协同方式计算目标自治域的全局信誉评价;最后设计信誉动态更新方法,以对连续恶意行为的自治域进行惩罚.基于真实安全事件的实验结果表明,该模型能够有效聚合各自治域本地信誉评价,捕捉自治域行为在不同时间阶段的细微变化,可为域间路由系统中异常路由抑制、安全事件溯源和供应商选取提供参考.

Automatic protocol reverse engineering for industrial control systems with dynamic taint analysis

Proprietary(or semi-proprietary)protocols are widely adopted in industrial control systems(ICSs).Inferring protocol format by reverse engineering is important for many network security applications,e.g.,program tests and intrusion detection.Conventional protocol reverse engineering methods have been proposed which are considered time-consuming,tedious,and error-prone.Recently,automatical protocol reverse engineering methods have been proposed which are,however,neither effective in handling binary-based ICS protocols based on network traffic analysis nor accurate in extracting protocol fields from protocol implementations.In this paper,we present a framework called the industrial control system protocol reverse engineering framework(ICSPRF)that aims to extract ICS protocol fields with high accuracy.ICSPRF is based on the key insight that an individual field in a message is typically handled in the same execution context,e.g.,basic block(BBL)group.As a result,by monitoring program execution,we can collect the tainted data information processed in every BBL group in the execution trace and cluster it to derive the protocol format.We evaluate our approach with six open-source ICS protocol implementations.The results show that ICSPRF can identify individual protocol fields with high accuracy(on average a 94.3%match ratio).ICSPRF also has a low coarse-grained and overly fine-grained match ratio.For the same metric,ICSPRF is more accurate than AutoFormat(88.5%for all evaluated protocols and 80.0%for binary-based protocols).

Mechanistic insights into the novel glucose-sensitive behavior of P(NIPAM-co-2-AAPBA)

A glucose-sensitive polymer,poly(N-isopropylacrylamide-co-2-acrylamidophenylboronic acid)(P(NIPAM-co-2-AAPBA)),was synthesized by reversible addition fragmentation chain transfer(RAFT)copolymerization.Addition of glucose results in reduced solubility and hence increased turbidity,rather than the normal increase in solubility(decreased turbidity)observed for other PBA-based glucose-sensitive polymers.The novel glucose-sensitive behavior is explained by a new mechanism,in which glucose acts as an additive and depresses the lower critical solution temperature(LCST)of the polymer,instead of increasing solubility by increasing the degree of ionization of the PBA groups.Experimental and theoretic analysis for the influence of glucose on the thermal behavior of P(NIPAM-co-2-AAPBA)reveals that glucose depresses the LCST of P(NIPAM-co-2-AAPBA)copolymers in a two-stage manner,a fast decrease at low glucose concentrations followed by a slow decrease at high glucose concentrations.For low glucose concentrations,the binding of glucose with PBA groups on the polymer chain increases the number of glucose molecules proximal to the polymer which influences the thermal behavior of the polymer,causing a rapid decrease in LCST.Importantly,the transition occurs at a glucose concentration equal to the reciprocal of the binding constant between PBA and glucose,thus providing a novel method to determine the binding constant.Other saccharides,including mannose,galactose and fructose,also depress the LCST of P(NIPAM-co-2-AAPBA)copolymer in the same way.