BC-BLPM:A Multi-Level Security Access Control Model Based on Blockchain Technology

Traditional multi-level security(MLS)systems have the defect of centralizing authorized facilities,which is difficult to meet the security requirements of modern distributed peer-to-peer network architecture.Blockchain is widely used in the field of access control with its decentralization,traceability and non-defective modification.Combining the blockchain technology and the Bell-LaPadula model,we propose a new access control model,named BCBLPM,for MLS environment.The“multi-chain”blockchain architecture is used for dividing resources into isolated access domains,providing a fine-grained data protection mechanism.The access control policies are implemented by smart contracts deployed in each access domain,so that the side chains of different access domains storage access records from outside and maintain the integrity of the records.Finally,we implement the BC-BLPM prototype system using the Hyperledger Fabric.The experimental and analytical results show that the model can adapt well to the needs of multi-level security environment,and it has the feasibility of application in actual scenarios.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security Ⅱ:Implementation

This paper is a continuation of our last paper [1] which describes the theory of Virt-BLP model. Based on Virt-BLP model,this paper implements a mandatory access control(MAC) framework applicable to multi-level security(MLS) in Xen. The Virt-BLP model is the theoretical basis of this MAC framework,and this MAC framework is the implementation of Virt-BLP model. Our last paper focuses on Virt-BLP model,while this paper concentrates on the design and implementation of MAC framework. For there is no MAC framework applicable to MLS in virtual machine system at present,our MAC framework fills the blank by applying Virt-BLP model to Xen,which is better than current researches to guarantee the security of communication between virtual machines(VMs) . The experimental results show that our MAC framework is effective to manage the communication between VMs.

A Mandatory Access Control Framework in Virtual Machine System with Respect to Multi-level Security I： Theory

At present,there are few security models which control the communication between virtual machines (VMs).Moreover,these models are not applicable to multi-level security (MLS).In order to implement mandatory access control (MAC) and MLS in virtual machine system,this paper designs Virt-BLP model,which is based on BLP model.For the distinction between virtual machine system and non-virtualized system,we build elements and security axioms of Virt-BLP model by modifying those of BLP.Moreover,comparing with BLP,the number of state transition rules of Virt-BLP is reduced accordingly and some rules can only be enforced by trusted subject.As a result,Virt-BLP model supports MAC and partial discretionary access control (DAC),well satisfying the requirement of MLS in virtual machine system.As space is limited,the implementation of our MAC framework will be shown in a continuation.

Literature Review of Multi-illar Multi-level Old-age Security System

Since the 1970s, according to the international pension system reform trend for old-age social security system, no single institutional arrangement can ensure the functions of endowment security system to achieve the optimal.Therefore,how to based on the present situation of development, and to accurately, thus promote the resources integration, comprehensive build multi-level old-age security system, has important policy and practice significance.

应用WEMLS的安全数据集成模型

针对现有的安全域存在许多异构安全数据需要集成的问题,引入多级安全策略(MLS)的思想,提出一种应用扩展权值MLS策略(WEMLS)的安全数据集成模型。定义可信权值的概念,建立进程授权机制和信任计算机制。应用结果表明,该模型能使可信进程更灵活地访问客体。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,采用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,在本文中用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

MLS评价法在安全评价中的应用

在化工领域常用的安全评价方法有很多,在本文中用MLS评价法对化工厂进行安全评价,建立具体模型,并对某一化工厂单元安全现状进行了评价。

基于XML的数据客体与安全标记绑定方法

安全标记与数据客体的绑定,是制约多级安全真正走向网络实用化的关键问题。针对这一问题,在深入分析XML的基础上,描述了XML客体安全标记及其约束规则,提出了安全标记与数据客体的绑定方法,讨论了安全标记查询、客体内容裂解等相关操作,给出了基于XML安全标记的安全通信实施机制。该绑定方法不仅能够满足多级信息系统间安全通信的需要,而且能够实施粒度更细的访问控制,提高信息客体的利用率。

基于数据包头序列的物联网恶意流量检测

现有的基于机器学习(ML)的恶意流量检测方法,通常以高维的流量特征作为输入,并采用复杂模型,在实践中产生高误报率且资源占用较高。更重要的是,加密协议的广泛使用,使得数据包有效载荷特征很难被访问。幸运的是,物联网(IoT)设备的网络行为通常是有规律和周期性的,该特征反映在通信数据包序列上,每个数据包一定程度上描述了一次网络事件。基于此,本文提出了基于数据包头序列的恶意流量检测方法。它将流量序列转换为网络事件序列,并计算一组特征(即序列性、频率性、周期性和爆发性)来描述网络行为。实验环境包含一组真实的物联网设备,并将提出的方法部署在树莓派模拟的网关上。实验结果表明,与最新的检测方法相比,本文提出的方法能够在复杂网络环境下保持高准确性和低误报率,并提升了处理速率。

Enhanced IDS with Deep Learning for IoT-Based Smart Cities Security

Cyberattacks against highly integrated Internet of Things (IoT) servers, apps, and telecoms infrastructure are rapidly increasing when issues produced by IoT networks go unnoticed for an extended period. IoT interface attacks must be evaluated in real-time for effective safety and security measures. This study implements a smart intrusion detection system (IDS) designed for IoT threats, and interoperability with IoT connectivity standards is offered by the identity solution. An IDS is a common type of network security technology that has recently received increasing interest in the research community. The system has already piqued the curiosity of scientific and industrial communities to identify intrusions. Several IDSs based on machine learning (ML) and deep learning (DL) have been proposed. This study introduces IDS-SIoDL, a novel IDS for IoT-based smart cities that integrates long shortterm memory (LSTM) and feature engineering. This model is tested using tensor processing unit (TPU) on the enhanced BoT-IoT, Edge-IIoT, and NSL-KDD datasets. Compared with current IDSs, the obtained results provide good assessment features, such as accuracy, recall, and precision, with approximately 0.9990 recording time and calculating times of approximately 600 and 6 ms for training and classification, respectively.

Multi-level access control model for tree-like hierarchical organizations

An access control model is proposed based on the famous Bell-LaPadula （BLP） model.In the proposed model,hierarchical relationships among departments are built,a new concept named post is proposed,and assigning security tags to subjects and objects is greatly simplified.The interoperation among different departments is implemented through assigning multiple security tags to one post, and the more departments are closed on the organization tree,the more secret objects can be exchanged by the staff of the departments.The access control matrices of the department,post and staff are defined.By using the three access control matrices,a multi granularity and flexible discretionary access control policy is implemented.The outstanding merit of the BLP model is inherited,and the new model can guarantee that all the information flow is under control.Finally,our study shows that compared to the BLP model,the proposed model is more flexible.

An Online Fake Review Detection Approach Using Famous Machine Learning Algorithms

Online review platforms are becoming increasingly popular,encouraging dishonest merchants and service providers to deceive customers by creating fake reviews for their goods or services.Using Sybil accounts,bot farms,and real account purchases,immoral actors demonize rivals and advertise their goods.Most academic and industry efforts have been aimed at detecting fake/fraudulent product or service evaluations for years.The primary hurdle to identifying fraudulent reviews is the lack of a reliable means to distinguish fraudulent reviews from real ones.This paper adopts a semi-supervised machine learning method to detect fake reviews on any website,among other things.Online reviews are classified using a semi-supervised approach(PU-learning)since there is a shortage of labeled data,and they are dynamic.Then,classification is performed using the machine learning techniques Support Vector Machine(SVM)and Nave Bayes.The performance of the suggested system has been compared with standard works,and experimental findings are assessed using several assessment metrics.

A QoS Mobicast-based dynamic clustering secure multicast scheme for large-scale tracking sensornets

Most of the existing security Mobicast routing protocols are not suitable for the monitoring applications with higher quality of service （QoS） requirement. A QoS dynamic clustering secure multicast scheme （QoS-DCSMS） based on Mobicast and multi-level IxTESLA protocol for large-scale tracking sensornets is presented in this paper. The multicast clusters are dynamically formed according to the real-time status of nodes, and the cluster-head node is responsible for status review and certificating management of cluster nodes to ensure the most optimized QoS and security of multicast in this scheme. Another contribution of this paper is the optimal QoS security authentication algorithm, which analyzes the relationship between the QoS and the level Mofmulti-level oTESLA. Based on the analysis and simulation results, it shows that the influence to the network survival cycle （＇NSC） and real-time communication caused by energy consumption and latency in authentication is acceptable when the optimal QoS security authentication algorithm is satisfied.

A Multi-Level Authorization Based Tenant Separation Mechanism in Cloud Computing Environment

Separation issue is one of the most important problems about cloud computing security. Tenants should be separated from each other based on cloud infrastructure and different users from one tenant should be separated from each other with the constraint of security policies. Learning from the notion of trusted cloud computing and trustworthiness in cloud, in this paper, a multi-level authorization separation model is formally described, and a series of rules are proposed to summarize the separation property of this model. The correctness of the rules is proved. Furthermore, based on this model, a tenant separation mechanism is deployed in a real world mixed-critical information system. Performance benchmarks have shown the availability and efficiency of this mechanism.

Intrusion Detection System Through Deep Learning in Routing MANET Networks

Deep learning(DL)is a subdivision of machine learning(ML)that employs numerous algorithms,each of which provides various explanations of the data it consumes;mobile ad-hoc networks(MANET)are growing in promi-nence.For reasons including node mobility,due to MANET’s potential to provide small-cost solutions for real-world contact challenges,decentralized management,and restricted bandwidth,MANETs are more vulnerable to security threats.When protecting MANETs from attack,encryption and authentication schemes have their limits.However,deep learning(DL)approaches in intrusion detection sys-tems(IDS)can adapt to the changing environment of MANETs and allow a sys-tem to make intrusion decisions while learning about its mobility in the environment.IDSs are a secondary defiance system for mobile ad-hoc networks vs.attacks since they monitor network traffic and report anything unusual.Recently,many scientists have employed deep neural networks(DNNs)to address intrusion detection concerns.This paper used MANET to recognize com-plex patterns by focusing on security standards through efficiency determination and identifying malicious nodes,and mitigating network attacks using the three algorithms presented Cascading Back Propagation Neural Network(CBPNN),Feedforward-Neural-Network(FNN),and Cascading-Back-Propagation-Neural-Network(CBPNN)(FFNN).In addition to Convolutional-Neural-Network(CNN),these primary forms of deep neural network(DNN)building designs are widely used to improve the performance of intrusion detection systems(IDS)and the use of IDS in conjunction with machine learning(ML).Further-more,machine learning(ML)techniques than their statistical and logical methods provide MANET network learning capabilities and encourage adaptation to differ-ent environments.Compared with another current model,The proposed model has better average receiving packet(ARP)and end-to-end(E2E)performance.The results have been obtained from CBP,FFNN and CNN 74%,82%and 85%,respectively,by the time(27,18,and 17 s).

A Comprehensive Analysis of Datasets for Automotive Intrusion Detection Systems

Recently,automotive intrusion detection systems(IDSs)have emerged as promising defense approaches to counter attacks on in-vehicle networks(IVNs).However,the effectiveness of IDSs relies heavily on the quality of the datasets used for training and evaluation.Despite the availability of several datasets for automotive IDSs,there has been a lack of comprehensive analysis focusing on assessing these datasets.This paper aims to address the need for dataset assessment in the context of automotive IDSs.It proposes qualitative and quantitative metrics that are independent of specific automotive IDSs,to evaluate the quality of datasets.These metrics take into consideration various aspects such as dataset description,collection environment,and attack complexity.This paper evaluates eight commonly used datasets for automotive IDSs using the proposed metrics.The evaluation reveals biases in the datasets,particularly in terms of limited contexts and lack of diversity.Additionally,it highlights that the attacks in the datasets were mostly injected without considering normal behaviors,which poses challenges for training and evaluating machine learning-based IDSs.This paper emphasizes the importance of addressing the identified limitations in existing datasets to improve the performance and adaptability of automotive IDSs.The proposed metrics can serve as valuable guidelines for researchers and practitioners in selecting and constructing high-quality datasets for automotive security applications.Finally,this paper presents the requirements for high-quality datasets,including the need for representativeness,diversity,and balance.

Artificial intelligence algorithms for cyberspace security applications:a technological and status review

Three technical problems should be solved urgently in cyberspace security:the timeliness and accuracy of network attack detection,the credibility assessment and prediction of the security situation,and the effectiveness of security defense strategy optimization.Artificial intelligence(AI)algorithms have become the core means to increase the chance of security and improve the network attack and defense ability in the application of cyberspace security.Recently,the breakthrough and application of AI technology have provided a series of advanced approaches for further enhancing network defense ability.This work presents a comprehensive review of AI technology articles for cyberspace security applications,mainly from 2017 to 2022.The papers are selected from a variety of journals and conferences:52.68%are from Elsevier,Springer,and IEEE journals and 25%are from international conferences.With a specific focus on the latest approaches in machine learning(ML),deep learning(DL),and some popular optimization algorithms,the characteristics of the algorithmic models,performance results,datasets,potential benefits,and limitations are analyzed,and some of the existing challenges are highlighted.This work is intended to provide technical guidance for researchers who would like to obtain the potential of AI technical methods for cyberspace security and to provide tips for the later resolution of specific cyberspace security issues,and a mastery of the current development trends of technology and application and hot issues in the field of network security.It also indicates certain existing challenges and gives directions for addressing them effectively.

动态多级安全级模型及其应用

针对采用传统MLS模型实现的系统可用性和灵活性较低的问题,提出了一种基于动态安全级的MLS模型Dynamic MLS。模型使用由流入信息最高安全级和流出信息最低安全级组成的动态安全级代替传统BLP模型中的当前安全级,并依此对主体访问客体的行为进行更灵活的控制。模型在BLP模型11条规则的基础上对其中的5条规则进行了改进,并通过形式化方法证明了改进模型的正确性。最后给出了模型在增加linux系统安全性方面的应用。

基于信息客体统一化描述的安全标记绑定研究

安全标记与信息客体绑定,一直是制约多级安全走向网络实用化的关键问题。针对这一问题,提出了一种基于信息客体统一化描述的安全标记绑定方法。通过分析客体类型,给出了基于数据树的多类型客体的统一表示模型,据此基于数据树遍历给出了客体与安全标记绑定算法,并讨论了客体的相关操作及其访问控制机制的实施。该方法不仅可提高安全标记绑定的灵活性,实现多类型信息客体与安全标记绑定的统一,而且可实施更为细粒度的访问控制,解决系统间异构数据交换控制难的问题。