Behavior Measurement Model Based on Prediction and Control of Trusted Network

In order to construct the trusted network and realize the trust of network behavior,a new multi-dimensional behavior measurement model based on prediction and control is presented.By using behavior predictive equation,individual similarity function,group similarity function,direct trust assessment function,and generalized predictive control,this model can guarantee the trust of an end user and users in its network.Compared with traditional measurement model,the model considers different characteristics of various networks.The trusted measurement policies established according to different network environments have better adaptability.By constructing trusted group,the threats to trusted group will be reduced greatly.Utilizing trusted group to restrict individuals in network can ensure the fault tolerance of trustworthiness of trusted individuals and group.The simulation shows that this scheme can support behavior measurement more efficiently than traditional ones and the model resists viruses and Trojans more efficiently than older ones.

A Trusted Measurement Scheme Suitable for the Clients in the Trusted Network

The trusted network connection is a hot spot in trusted computing field and the trust measurement and access control technology are used to deal with network security threats in trusted network.But the trusted network connection lacks fine-grained states and real-time measurement support for the client and the authentication mechanism is difficult to apply in the trusted network connection,it is easy to cause the loss of identity privacy.In order to solve the abovedescribed problems,this paper presents a trust measurement scheme suitable for clients in the trusted network,the scheme integrates the following attributes such as authentication mechanism,state measurement,and real-time state measurement and so on,and based on the authentication mechanism and the initial state measurement,the scheme uses the realtime state measurement as the core method to complete the trust measurement for the client.This scheme presented in this paper supports both static and dynamic measurements.Overall,the characteristics of this scheme such as fine granularity,dynamic,real-time state measurement make it possible to make more fine-grained security policy and therefore it overcomes inadequacies existing in the current trusted network connection.

Development of Trusted Network and Challenges It Faces

As the information network plays a more and more important role globally, the traditional network theories and technologies, especially those related to network security, can no longer meet the network development requirements. Offering the system with secure and trusted services has become a new focus in network research. This paper first discusses the meaning of and aspects involved in the trusted network. According to this paper, the trusted network should be a network where the network’s and users’ behaviors and their results are always predicted and manageable. The trustworthiness of a network mainly involves three aspects: service provider, information transmission and terminal user. This paper also analyzes the trusted network in terms of trusted model for network/user behaviors, architecture of trusted network, service survivability and network manageability, which is designed to give ideas on solving the problems that may be faced in developing the trusted network.

A Distributed Trust Based Secure Communication Framework for Wireless Sensor Network

The wireless sensor network is an emerging technology, which is used to sense and monitor the environment. As the nodes are deployed in an open environment, the security is one of the essential factors. The cryptography techniques can ensure confidentiality, integrity and authentication. However, wireless sensor network also needs to deal with inside and outside attackers. To deal with outside attackers, attacks by compromised or malicious nodes, trust management system is suggested by many researchers in the area of wireless sensor network. Trust management system can be implemented in various applications for security management such as secure data aggregation, secure cluster head selection, trusted routing, access control, etc. Many researchers provide different kind of solutions for these secure applications based on trust management. However, to incorporate, all such applications on a single sensor node in the network, it is essential to design and develop a trust management system, which considers various aspects and applications of wireless sensor network. As a result, in this paper, we would like to propose a parameter and trust factor based secure communication framework and design a trust management system for wireless sensor networks. Our main contribution is to identify various parameters and trust factors which influences on trust in wireless sensor network and developing a framework for a trust management system based on various parameters and trust factors. The working of the proposed model is shown by simulation experiments conducted in MATLAB for the application of secure communication, data aggregation and intrusion detection in wireless sensor networks.

Real-Time Multi Fractal Trust Evaluation Model for Efficient Intrusion Detection in Cloud

Handling service access in a cloud environment has been identified as a critical challenge in the modern internet world due to the increased rate of intrusion attacks.To address such threats towards cloud services,numerous techniques exist that mitigate the service threats according to different metrics.The rule-based approaches are unsuitable for new threats,whereas trust-based systems estimate trust value based on behavior,flow,and other features.However,the methods suffer from mitigating intrusion attacks at a higher rate.This article presents a novel Multi Fractal Trust Evaluation Model(MFTEM)to overcome these deficiencies.The method involves analyzing service growth,network growth,and quality of service growth.The process estimates the user’s trust in various ways and the support of the user in achieving higher service performance by calculating Trusted Service Support(TSS).Also,the user’s trust in supporting network stream by computing Trusted Network Support(TNS).Similarly,the user’s trust in achieving higher throughput is analyzed by computing Trusted QoS Support(TQS).Using all these measures,the method adds the Trust User Score(TUS)value to decide on the clearance of user requests.The proposed MFTEM model improves intrusion detection accuracy with higher performance.

Quorum systems for intrusion-tolerance based on trusted timely computing base

Quorum systems have been used to solve the problem of data consistency in distributed fault-tolerance systems. But when intrusions occur, traditional quorum systems have some disadvantages. For example, synchronous quorum systems are subject to DOS attacks, while asynchronous quorum systems need a larger system size （at least 3f＋1 for generic data, and f fewer for self-verifying data）. In order to solve the problems above, an intrusion-tolerance quorum system （ITQS） of hybrid time model based on trust timely computing base is presented （TTCB）. The TTCB is a trust secure real-time component inside the server with a well defined interface and separated from the operation system. It is in the synchronous communication environment while the application layer in the server deals with read-write requests and executes update-copy protocols asynchronously. The architectural hybridization of synchrony and asynchrony can achieve the data consistency and availability correctly. We also build two kinds of ITQSes based on TTCB, i.e., the symmetrical and the asymmetrical TTCB quorum systems. In the performance evaluations, we show that TTCB quorum systems are of smaller size, lower load and higher availability.

A Compact Trust Computation and Management Approach for Defending against Derailed Attacks for Wireless Sensor Networks and Its Applications

One of the most effective measurements of intercommunication and collaboration in wireless sensor networks which leads to provide security is Trust Management. Most popular decision making systems used to collaborate with a stranger are tackled by two different existing trust management systems: one is a policy-based approach which verifies the decision built on logical properties and functionalities;the other approach is reputation-based approach which verifies the decision built on physical properties and functionalities of WSN. Proofless authorization, unavailability, vagueness and more complexity cause decreased detection rate and spoil the efficacy of the WSN in existing approaches. Some of the integrated approaches are utilized to improve the significance of the trust management strategies. In this paper, a Compact Trust Computation and Management (CTCM) approach is proposed to overcome the limitations of the existing approaches, also it provides a strong objective security with the calculability and the available security implications. Finally, the CTCM approach incorporates the optimum trust score for logical and physical investigation of the network resources. The simulation based experiment results show that the CTCM compact trust computation and management approach can provide an efficient defending mechanism against derailing attacks in WSN.

面向铁路信息网络的可信计算安全机制探讨

铁路系统对国家安全与社会稳定至关重要.尽管铁路信息系统已按国家规定进行网络安全防护,但面临着新兴技术应用带来的风险,包括潜在的病毒、木马、APT等网络攻击.可信计算技术是当前备受关注的解决方案,致力于在计算过程中实施全方位安全防护,以确保行为结果符合预期,保持计算全程可控可测且不受外部干扰.这标志着对传统被动防御技术的革新,强调不再只是被动应对攻击.本文深入剖析了铁路信息系统所面临的安全挑战,介绍了可信计算技术的研究和应用状况,结合铁路信息系统的特点提出了可信计算技术的应用建议,以供铁路网络安全工作参考.

零信任安全体系的设计与实现

阐述数据安全时代下传统网络安全失效原因,包括互联网业务普及度高、社交网络泛滥、数据价值无限提高。建立“零信任”安全体系设计模型,提出设计思路、总体架构和逻辑结构,并探讨“零信任”安全体系设计路径。“零信任”安全体系可用于构建虚拟动态边界安全架构。

新型电力系统网络安全零信任技术应用研究

为了提高电力系统网络的安全性、保障电力系统的稳定运行,提出了一种新型电力系统网络安全零信任技术。首先,分析新型电力系统网络环境图和状态转移图,以感知网络安全态势。然后,计算电力系统网络安全态势值,并根据所得结果将零信任安全组件嵌入防火墙和主机入侵检测设备,以构建零信任技术下新型电力系统网络安全防护框架体系。同时,结合电力系统的安全需求,实现差异化定制,达到对新型电力系统网络安全防护的目的。最后,通过试验验证了所提技术可有效检测到网络环境中的各类攻击,误检率和漏检率较低。该技术能够实现精准、高效的安全防护。

基于零信任理念的广播电视网络安全架构设计与应用

在传统范式下,网络边界固定,网络协议存在原生漏洞,严重依赖边界安全设备防护,且执行“先连接后验证”,这种传统防护理念与技术架构已不能阻止当下越发高端的网络攻击。本文对传统边界防护理念、技术架构的局限性进行深度分析,同时阐述零信任理念、分析其优势,并设计广电零信任SDP(软件定义边界)技术架构。通过应用零信任SDP架构执行“先验证后连接”,能实现细粒度访问控制与动态策略管控,不断缩小信任域与暴露面,隐藏核心资产和设施。该技术架构持续演变进化的免疫力,能有效防御横向纵向流量攻击,能有力应对未来复杂多变的安全威胁。

基于零信任体系的数字身份安全平台设计与研究

高校在统一身份认证和访问控制方面的防控仍较薄弱,面对层出不穷的网络安全威胁显得力不从心。为此,提出基于零信任体系的数字身份安全平台解决方案。引入零信任SDP技术搭建高校零信任安全架构,重构统一身份认证与访问授权平台,按功能划分DMZ微隔离区,实现用户身份统一管理、平台多因素多维认证、服务端口和设备信息对外动态隐藏、访问链接动态授权。结合四网融合场景分析校内外5G用户、校内Wi-Fi用户、校园网用户和校外互联网用户访问数字身份安全平台的准入方式。研究成果极大地丰富了智慧校园研究内容,也为高校重构和升级统一身份认证和访问授权平台提供一种全新的解决思路。

A Trusted Host’s Authentication Access and Control Model Faced on User Action

The conception of trusted network connection （TNC） is introduced, and the weakness of TNC to control user＇s action is analyzed. After this, the paper brings out a set of secure access and control model based on access, authorization and control, and related authentication protocol. At last the security of this model is analyzed. The model can improve TNC＇s security of user control and authorization.

A Trusted NUMFabric Algorithm for Congestion Price Calculation at the Internet-of-Things Datacenter

The important issues of network TCP congestion control are how to compute the link price according to the link status and regulate the data sending rate based on link congestion pricing feedback information.However,it is difficult to predict the congestion state of the link-end accurately at the source.In this paper,we presented an improved NUMFabric algorithm for calculating the overall congestion price.In the proposed scheme,the whole network structure had been obtained by the central control server in the Software Defined Network,and a kind of dual-hierarchy algorithm for calculating overall network congestion price had been demonstrated.In this scheme,the first hierarchy algorithm was set up in a central control server like Opendaylight and the guiding parameter B is obtained based on the intelligent data of global link state information.Based on the historical data,the congestion state of the network and the guiding parameter B is accurately predicted by the machine learning algorithm.The second hierarchy algorithm was installed in the Openflow link and the link price was calculated based on guiding parameter B given by the first algorithm.We evaluate this evolved NUMFabric algorithm in NS3,which demonstrated that the proposed NUMFabric algorithm could efficiently increase the link bandwidth utilization of cloud computing IoT datacenters.

Implicit Trust Based Context-Aware Matrix Factorization for Collaborative Filtering

Matrix factorization （MF） has been proved to be a very effective technique for collaborative filtering （ CF）, and hence has been widely adopted in today＇s recommender systems, Yet due to its lack of consideration of the users＇ and items＇ local structures, the recommendation accuracy is not fully satisfied. By taking the trusts among users＇ and between items＇ effect on rating information into consideration, trust-aware recommendation systems （TARS） made a relatively good performance. In this paper, a method of incorporating trust into MF was proposed by building user-based and item-based implicit trust network under different contexts and implementing two implicit trust-based context-aware MF （]TMF） models. Experimental results proved the effectiveness of the methods.

零信任网络及其关键技术综述

在网络安全威胁日趋严峻、安全防御手段日益复杂的情况下,零信任网络能够对传统边界安全架构进行全新的评估和审视。零信任强调不要永远信任,而且要持续验证,而零信任网络不以位置标识身份,所有访问控制严格执行最小权限,所有访问过程被实时跟踪和动态评估。首先,给出了零信任网络的基本定义,指出了传统边界安全暴露出的主要问题,并描述了零信任网络模型;其次,分析了软件定义边界(SDP)、身份和访问管理、微隔离、自动配置管理系统(ACMS)等零信任网络中的关键技术;最后,对零信任网络进行了总结,并展望未来发展。

零信任在医院信息系统中的设计与应用

目的通过对零信任网络安全架构进行分析,构建医院零信任场景化分析模型。方法结合远程运维、互联互通、医院内网、医院物联网安全现状,全面解读医院在各种应用场景下,采用零信任网络安全架构,全面提升医院网络安全性。结果实现了基于零信任的网络安全架构与医院原有安全设备高度集成和互补。结论零信任网络安全架构使得医院安全防护体系增强,值得在医院不同场景中应用。

TVIDS: Trusted Virtual IDS With SGX

Network functions such as intrusion detection systems (IDS) have been increasingly deployed as virtual network functions or outsourced to cloud service providers so as to achieve the scalability and agility, and reducing equipment costs and operational cost. However, virtual intrusion detection systems (VIDS) face more serious security threats due to running in a shared and virtualized environment instead of proprietary devices. Cloud service providers or malicious tenants may illegally access and tamper with the policies, packet information, and internal processing states of intrusion detection systems, thereby violating the privacy and security of tenant’s networks. To address these challenges, we use Intel Software Guard Extensions (SGX) to build a Trusted Virtual Intrusion Detection System (TVIDS). For TVIDS, to prevent cloud service providers from accessing sensitive information about the users’ network, we build a trusted execution environment for security policy, packets processing, and internal state so that cloud service providers and other malicious tenants can’t access the protected code, policy, processing states, and packets information of the intrusion detection system. We implemented TVIDS on the basis of the Snort which is a famous open-source IDS and evaluated its results on real SGX hardware.The results show that our method can protect the security of the virtual IDS and brings acceptable performance overhead.

Dynamic Cluster Key Management Scheme on Wireless Sensor Networks

Wireless sensor networks are open architectures, so any potential threat can easily intercept, wiretap and counterfeit the information. Therefore, the safety of WSN is very important. Since any single key system cannot guarantee the security of the wireless sensor network for communications, this paper introduces a hierarchical key management scheme based on the different abilities of different sensor nodes in the clustered wireless sensor network. In this scheme, the nodes are distributed into several clusters, and a cluster head must be elected for each cluster. Private communication between cluster heads is realized through the encryption system based on the identity of each head while private communication between cluster nodes in a same cluster head is achieved through the random key preliminary distribution system. Considering the characteristics of WSN, we adopt dynamic means called dynamic cluster key management scheme to deal with master key, so master key will be updated according to the changed dynamic network topology. For cluster head node plays a pivotal role in this scheme, a trust manage-ment system should be introduced into the election of the cluster head which will exclude the malicious node from outside the cluster, thus improve the whole network security.

用于社交推荐的增强影响扩散模型

随着网络上创建连接、协作、共享的全新变革方式的出现,互联网上丰富的社交行为现象引起了研究者和实践者的关注.近年来,随着社交网络平台的普及与推广,基于社交网络的推荐系统也成为了个性化推荐领域的研究热点之一,社交推荐系统可以利用社交网络来缓解传统的推荐算法中数据稀疏性问题.在社交网络中,社交关系影响起着重要作用,而用户信任是社交关系形成的基础,每一个用户会受到其信任的用户影响,这些被信任的用户也会被自己的社交关系所影响,这就表明了联系在一起的用户会相互影响,导致社交联系之间的用户偏好具有相似性.用户的信任关系影响着用户偏好的推断,同时用户受到其信任用户的社交关系影响,而这些社交关系影响在社交网络中递归传播和扩散.因此,基于社交推荐算法研究的关键就在于信任信息的挖掘和利用.在基于社交网络的推荐领域中,比较有代表性的模型为DiffNet,该模型未充分考虑到信任问题,同时,在递归计算长距离的社交关系时,有额外的噪声,影响推荐预测的质量.本文提出了基于DiffNet改进的社交推荐模型-EIDNet.首先,该模型在模拟社交关系影响扩散过程时,通过用户对物品的历史交互记录建立用户间的信任关系,并融合到递归社交动态建模中,以获得不同用户面向不同物品的不同信任关系.其次,在计算社交影响力时,提出增加残差连接的方式,减少长距离社交关系产生的噪声.同时,为了解决同阶领域权重分配问题,提出使用注意力机制,学习用户朋友关系向量,针对不同的用户计算不同的权重,适应地衡量用户朋友间的社交影响力.最终,将三个部分融合在一个统一的框架中,以相互增强,并建立一个更好的扩展模型.最后,结合用户与物品的历史交互行为和社交关系来预测用户未来的行为和偏好.本文的主要贡献包括:(1)将基于用户与物品的历史交互记录的信任融合到递归社交动态建模中,以解决不同用户因信任关系而面向不同物品进行推荐的问题;(2)在递归计算长距离的社交关系时,提出残差连接的方式来减少噪声影响;(3)引入了注意力机制,为社交网络中的用户给予不同的重要性,以解决同阶领域权重分配问题.实验结果表明,EIDNet与DiffNet最好的性能结果相比,在Yelp上的表现提升了10.61%,在Flickr上的表现提升了24.98%,结果证实了本文提出的改进模型可以提升社交推荐模型的推荐性能.