Network Log-Based SSH Brute-Force Attack Detection Model

The rapid advancement of IT technology has enabled the quick discovery,sharing and collection of quality information,but has also increased cyberattacks at a fast pace at the same time.There exists no means to block these cyberattacks completely,and all security policies need to consider the possibility of external attacks.Therefore,it is crucial to reduce external attacks through preventative measures.In general,since routers located in the upper part of a firewall can hardly be protected by security systems,they are exposed to numerous unblocked cyberattacks.Routers block unnecessary services and accept necessary ones while taking appropriate measures to reduce vulnerability,block unauthorized access,and generate relevant logs.Most logs created through unauthorized access are caused by SSH brute-force attacks,and therefore IP data of the attack can be collected through the logs.This paper proposes a model to detect SSH brute-force attacks through their logs,collect their IP address,and control access from that IP address.In this paper,we present a model that extracts and fragments the specific data required from the packets of collected routers in order to detect indiscriminate SSH input attacks.To do so,the model multiplies a user’s access records in each packet by weights and adds them to the blacklist according to a final calculated result value.In addition,the model can specify the internal IP of an attack attempt and defend against the first 29 destination IP addresses attempting the attack.

A CALCULATING METHOD OF THE KILL PROBABILITY ATTACK AREA FOR AAM

This paper provides a calculating method which can be used in calculation of the kill probability attack area for every AAM. At first, attack area of AAM and kill probability of every characteristic point are obtained by combining trajectory calculation with kill probability calculation. Then, coordinates of a fire point relative to standard kill probability value in terms of standardization method are found. At last, equivalent kill probability curve equations are formulated by means of curve fitting method.

XMAM:X-raying models with a matrix to reveal backdoor attacks for federated learning

Federated Learning(FL),a burgeoning technology,has received increasing attention due to its privacy protection capability.However,the base algorithm FedAvg is vulnerable when it suffers from so-called backdoor attacks.Former researchers proposed several robust aggregation methods.Unfortunately,due to the hidden characteristic of backdoor attacks,many of these aggregation methods are unable to defend against backdoor attacks.What's more,the attackers recently have proposed some hiding methods that further improve backdoor attacks'stealthiness,making all the existing robust aggregation methods fail.To tackle the threat of backdoor attacks,we propose a new aggregation method,X-raying Models with A Matrix(XMAM),to reveal the malicious local model updates submitted by the backdoor attackers.Since we observe that the output of the Softmax layer exhibits distinguishable patterns between malicious and benign updates,unlike the existing aggregation algorithms,we focus on the Softmax layer's output in which the backdoor attackers are difficult to hide their malicious behavior.Specifically,like medical X-ray examinations,we investigate the collected local model updates by using a matrix as an input to get their Softmax layer's outputs.Then,we preclude updates whose outputs are abnormal by clustering.Without any training dataset in the server,the extensive evaluations show that our XMAM can effectively distinguish malicious local model updates from benign ones.For instance,when other methods fail to defend against the backdoor attacks at no more than 20%malicious clients,our method can tolerate 45%malicious clients in the black-box mode and about 30%in Projected Gradient Descent(PGD)mode.Besides,under adaptive attacks,the results demonstrate that XMAM can still complete the global model training task even when there are 40%malicious clients.Finally,we analyze our method's screening complexity and compare the real screening time with other methods.The results show that XMAM is about 10–10000 times faster than the existing methods.

Research on Detection Method of Interest Flooding Attack on Content Centric Network

To improve the attack detection capability of content centric network(CCN),we propose a detection method of interest flooding attack(IFA)making use of the feature of self-similarity of traffic and the information entropy of content name of interest packet.On the one hand,taking advantage of the characteristics of self-similarity is very sensitive to traffic changes,calculating the Hurst index of the traffic,to identify initial IFA attacks.On the other hand,according to the randomness of user requests,calculating the information entropy of content name of the interest packets,to detect the severity of the IFA attack,is.Finally,based on the above two aspects,we use the bilateral detection method based on non-parametric CUSUM algorithm to judge the possible attack behavior in CCN.The experimental results show that flooding attack detection method proposed for CCN can not only detect the attack behavior at the early stage of attack in CCN,but also is more accurate and effective than other methods.

Iterative Dichotomiser Posteriori Method Based Service Attack Detection in Cloud Computing

Cloud computing(CC)is an advanced technology that provides access to predictive resources and data sharing.The cloud environment represents the right type regarding cloud usage model ownership,size,and rights to access.It introduces the scope and nature of cloud computing.In recent times,all processes are fed into the system for which consumer data and cache size are required.One of the most security issues in the cloud environment is Distributed Denial of Ser-vice(DDoS)attacks,responsible for cloud server overloading.This proposed sys-tem ID3(Iterative Dichotomiser 3)Maximum Multifactor Dimensionality Posteriori Method(ID3-MMDP)is used to overcome the drawback and a rela-tively simple way to execute and for the detection of(DDoS)attack.First,the pro-posed ID3-MMDP method calls for the resources of the cloud platform and then implements the attack detection technology based on information entropy to detect DDoS attacks.Since because the entropy value can show the discrete or aggregated characteristics of the current data set,it can be used for the detection of abnormal dataflow,User-uploaded data,ID3-MMDP system checks and read risk measurement and processing,bug ratingfile size changes,orfile name changes and changes in the format design of the data size entropy value.Unique properties can be used whenever the program approaches any data error to detect abnormal data services.Finally,the experiment also verifies the DDoS attack detection capability algorithm.

Hybrid hierarchical trajectory planning for a fixed-wing UCAV performing air-to-surface multi-target attack

This paper considers the problem of generating a flight trajectory for a single fixed-wing unmanned combat aerial vehicle （UCAV） performing an air-to-surface multi-target attack （A/SMTA） mission using satellite-guided bombs. First, this problem is formulated as a variant of the traveling salesman problem （TSP）, called the dynamic-constrained TSP with neighborhoods （DCT- SPN）. Then, a hierarchical hybrid approach, which partitions the planning algorithm into a roadmap planning layer and an optimal control layer, is proposed to solve the DCTSPN. In the roadmap planning layer, a novel algorithm based on an updatable proba- bilistic roadmap （PRM） is presented, which operates by randomly sampling a finite set of vehicle states from continuous state space in order to reduce the complicated trajectory planning problem to planning on a finite directed graph. In the optimal control layer, a collision-free state-to-state trajectory planner based on the Gauss pseudospectral method is developed, which can generate both dynamically feasible and optimal flight trajectories. The entire process of solving a DCTSPN consists of two phases. First, in the offline preprocessing phase, the algorithm constructs a PRM, and then converts the original problem into a standard asymmet- ric TSP （ATSP）. Second, in the online querying phase, the costs of directed edges in PRM are updated first, and a fast heuristic searching algorithm is then used to solve the ATSP. Numerical experiments indicate that the algorithm proposed in this paper can generate both feasible and near-optimal solutions quickly for online purposes.

Introduction of firefighting methods in U.S. underground mines

Underground mine fire always exists since the mining activity was practiced.It poses a severe safety hazard to the mine workers and may also cause a tremendous economic loss to the mines.Methods for controlling and extinguishing fires in underground mine have long been studied and there have been significant improvements.In order to know clearly about the firefighting technology used,this paper summarizes most of the underground mine firefighting methods used in the United States the past 150 years.This paper describes not only the accepted firefighting theories,but also the technologies,both direct and indirect attacking,in accordance to regulations or codes,with special attention is given to the indirect attack method and its related technologies.Further research needed is also briefly discussed at the end of this paper.

GPS Spoofing Attack Detection in Smart Grids Based on Improved CapsNet

This paper analyzes the influence of the global positionong system(GPS)spoofing attack(GSA)on phasor measurement units(PMU)measurements.We propose a detection method based on improved Capsule Neural Network(CapsNet)to handle this attack.In the improved CapsNet,the gated recurrent unit(GRU)is added to the front of the full connection layer of the CapsNet.The improved CapsNet trains and updates the network parameters according to the historical measurements of the smart grid.The detection method uses different structures to extract the temporal and spatial features of the measurements simultaneously,which can accurately distinguish the attacked data from the normal data,to improve the detection accuracy.Finally,simulation experiments are carried out on IEEE 14-,IEEE 118-bus systems.The experimental results show that compared with other detection methods,our method is proved to be more efficient.

Multiple attacks on virtualization-based security monitoring

Three kinds of vulnerabilities that may exist in some of current virtualization-based security monitoring systems were proposed： page mapping problem,lack of overall protection,and inherent limitations. Aiming at these vulnerabilities,relative attack methods were presented in detail. Our experiments show that the attack methods,such as page mapping attack,data attack,and non-behavior detection attack,can attack simulated or original security monitors successfully. Defenders,who need to effectively strengthen their security monitors,can get an inspiration from these attack methods and find some appropriate solutions.

COMPUTATION OF FIELD STRUCTURE AND AERODYNAMIC CHARACTERISTICS OF DELTA WINGS AT HIGH ANGLES OF ATTACK

A numerical investigation of the structure of the vortical flowfield over delta wings at high angles of attack in longitudinal and with small sideslip angle is presented. Three-dimensional Navier-Stokes numerical simulations were carried out to predict the complex leeward-side flowfield characteristics that are dominated by the effect of the breakdown of the leading-edge vortices. The methods that analyze the flowfield structure quantitatively were given by using flowfield data from the computational results. In the region before the vortex breakdown, the vortex axes are approximated as being straight line. As the angle of attack increases, the vortex axes are closer to the root chord, and farther away from the wing surface. Along the vortex axes, as the adverse pressure gradients occur, the axial velocity decreases, that is, A is negativee, so the vortex is unstable, and it is possible to breakdown. The occurrence of the breakdown results in the instability of lateral motion for a delta wing, and the lateral moment diverges after a small perturbation occurs at high angles of attack. However, after a critical angle of attack is reached the vortices breakdown completely at the wing apex, and the instability resulting from the vortex breakdown disappears.

Access Control Attacks on PLC Vulnerabilities

In Industrial Control Systems (ICS), security issues are getting more and more attention. The number of hacking attacks per year is endless, and the attacks on industrial control systems are numerous. Programmable Logic Controller (PLC) is one of the main controllers of industrial processes. Since the industrial control system network is isolated from the external network, many people think that PLC is a safety device. However, virus attacks in recent years, such as Stuxnet, have confirmed the erroneousness of this idea. In this paper, we use the vulnerability of Siemens PLC to carry out a series of attacks, such as S7-200, S7-300, S7-400, S7-1200 and so on. We read the data from the PLC output and then rewrite the data and write it to the PLC. We tamper with the writing of data to achieve communication chaos. When we attack the primary station, all slave devices connected to the primary station will be in a state of communication confusion. The attack methods of us can cause delay or even loss of data in the communications from the Phasor Data Concentrator (PMU) to the data concentrator. The most important thing is that our attack method generates small traffic and short attack time, which is difficult to be identified by traditional detection methods.

Improvements in a Puzzle Authentication Method

This article discusses improvements in a puzzle authentication method that adopts the interface of the Puzzle and Dragons game [1] and is tolerant against video-recording attacks. A problem that the conventional puzzle authentication methods face is that they are time consuming and have low success rate in authentication. We evaluated improvements of the interface to verify the usability of the improved system. The results suggested that the usability in terms of operation time and authentication success rate attained a level that was comparable with other leading methods in the field.

Resistance against side channel attack for RSA cryptosystem

Based on the structure of the side channel attacks （SCAs） to RSA cryptosystem can resist the fault attack and combine with the randomization method for the message and secret exponent, a new implementation scheme of CRT-based （the Chinese remained theorem） RSA is proposed. The proposed scheme can prevent simple power analysis （SPA）, differential power analysis （DPA） and time attack, and is compatible with the existing RSA-CRT cryptosystem as well. In addition, an improvement for resisting fault attack is proposed, which can reduce extra computation time.

An Effective Classifier Model for Imbalanced Network Attack Data

Recently,machine learning algorithms have been used in the detection and classification of network attacks.The performance of the algorithms has been evaluated by using benchmark network intrusion datasets such as DARPA98,KDD’99,NSL-KDD,UNSW-NB15,and Caida DDoS.However,these datasets have two major challenges:imbalanced data and highdimensional data.Obtaining high accuracy for all attack types in the dataset allows for high accuracy in imbalanced datasets.On the other hand,having a large number of features increases the runtime load on the algorithms.A novel model is proposed in this paper to overcome these two concerns.The number of features in the model,which has been tested at CICIDS2017,is initially optimized by using genetic algorithms.This optimum feature set has been used to classify network attacks with six well-known classifiers according to high f1-score and g-mean value in minimumtime.Afterwards,amulti-layer perceptron based ensemble learning approach has been applied to improve the models’overall performance.The experimental results showthat the suggested model is acceptable for feature selection as well as classifying network attacks in an imbalanced dataset,with a high f1-score(0.91)and g-mean(0.99)value.Furthermore,it has outperformed base classifier models and voting procedures.

Randomized MILP framework for Securing Virtual Machines from Malware Attacks

Cloud computing involves remote server deployments with public net-work infrastructures that allow clients to access computational resources.Virtual Machines(VMs)are supplied on requests and launched without interactions from service providers.Intruders can target these servers and establish malicious con-nections on VMs for carrying out attacks on other clustered VMs.The existing system has issues with execution time and false-positive rates.Hence,the overall system performance is degraded considerably.The proposed approach is designed to eliminate Cross-VM side attacks and VM escape and hide the server’s position so that the opponent cannot track the target server beyond a certain point.Every request is passed from source to destination via one broadcast domain to confuse the opponent and avoid them from tracking the server’s position.Allocation of SECURITY Resources accepts a safety game in a simple format as input andfinds the best coverage vector for the opponent using a Stackelberg Equilibrium(SSE)technique.A Mixed Integer Linear Programming(MILP)framework is used in the algorithm.The VM challenge is reduced by afirewall-based controlling mechanism combining behavior-based detection and signature-based virus detection.The pro-posed method is focused on detecting malware attacks effectively and providing better security for the VMs.Finally,the experimental results indicate that the pro-posed security method is efficient.It consumes minimum execution time,better false positive rate,accuracy,and memory usage than the conventional approach.

联邦学习中的攻击手段与防御机制研究综述

联邦学习的攻防技术是联邦学习系统安全的核心问题。联邦学习的攻防技术能大幅降低联邦学习系统被攻击的风险,明显提升联邦学习系统的安全性。深入了解联邦学习的攻防技术,可以推进联邦学习领域的研究,实现联邦学习的广泛应用。因此,对联邦学习的攻防技术进行研究具有十分重要的意义。简要地介绍了联邦学习的概念、基本工作流程、类型及可能存在的安全问题;介绍联邦学习系统可能遭受到的攻击,梳理了相关研究;从联邦学习系统有无目标性的防御措施出发,将防御措施分为通用性防御措施及针对性防御措施两类,并对其进行了针对性的总结;对联邦学习安全性未来的研究方向进行了梳理与分析,为相关研究者在联邦学习安全性方面的研究工作提供了参考。

Defence Against Adversarial Attacks Using Clustering Algorithm

Deep learning model is vulnerable to adversarial examples in the task of image classification. In this paper, a cluster-based method for defending against adversarial examples is proposed. Each adversarial example before attacking a classifier is reconstructed by a clustering algorithm according to the pixel values. The MNIST database of handwritten digits was used to assess the defence performance of the method under the fast gradient sign method (FGSM) and the DeepFool algorithm. The defence model proposed is simple and the trained classifier does not need to be retrained.

自杀式恐怖袭击防控探究

自杀式恐怖袭击具有恐怖袭击模式与恐怖袭击手段的多重属性,其运行满足以恐怖主体为核心耦合袭击目标、袭击手段、袭击时间和袭击后果等多维恐怖袭击要素的基本存续结构,亦以袭击主体的消亡带动袭击目标受袭形成袭击手段。为有效认知自杀式恐怖袭击以提升恐怖主义治理效能,从袭击主体、袭击工具和袭击行动的消亡性对其进行剖析,发现基于行为体、承袭体和致损体生成致灾因子、构成致灾机理、形成防控困境,同时也回溯治理逻辑。加强对自杀式恐怖袭击的有效研究,有利于丰富恐怖袭击的研究体系、提升恐怖袭击的应对能力,以期进一步完善恐怖主义的治理工作。

结合图卷积神经网络和集成方法的推荐系统恶意攻击检测

推荐系统已被广泛应用于电子商务、社交媒体、信息分享等大多数互联网平台中,有效解决了信息过载问题。然而,这些平台面向所有互联网用户开放,导致不法用户利用系统设计缺陷通过恶意干扰、蓄意攻击等行为非法操纵评分数据,进而影响推荐结果,严重危害推荐服务的安全性。现有的检测方法大多都是基于从评级数据中提取的人工构建特征进行的托攻击检测,难以适应更复杂的共同访问注入攻击,并且人工构建特征费时且区分能力不足,同时攻击行为规模远远小于正常行为,给传统检测方法带来了不平衡数据问题。因此,文中提出堆叠多层图卷积神经网络端到端学习用户和项目之间的多阶交互行为信息得到用户嵌入和项目嵌入,将其作为攻击检测特征,以卷积神经网络作为基分类器实现深度行为特征提取,结合集成方法检测攻击。在真实数据集上的实验结果表明,与流行的推荐系统恶意攻击检测方法相比,所提方法对共同访问注入攻击行为有较好的检测效果并在一定程度上克服了不平衡数据的难题。

盐渍土环境下考虑耐久性损伤的输电塔风振时程分析

长期服役于盐渍土环境下的输电塔耐久性损伤较为严重,当其材料力学性能退化到一定程度时,在强风作用下,输电塔可能会发生破坏,危害线路的安全运行。基于±800kV天中线特高压直流输电工程直线塔,考虑基础钢筋锈蚀、基础混凝土侵蚀、输电塔杆塔钢材锈蚀以及基础箍筋的约束效应,在ABAQUS有限元软件中建立塔-线-基础耦合模型,研究不同风攻角和材料耐久性损伤对塔身动力响应的影响。结果表明:90°风攻角下塔身顺风向位移最大,为最不利风向基本工况;90°风攻角下输电塔塔顶顺风向位移响应贡献主要以背景分量为主,但共振分量也有一定贡献,主要以输电塔1阶振型频率为主,且随着服役时间的增加,振型频率逐渐降低,相应响应的贡献程度逐渐提高;相同风荷载作用下,随着服役时间的增加,塔身位移逐渐增大,相同服役时间下,随着塔身高度的增加,塔身位移响应峰值增长速度变快,结构振动更加明显,材料耐久性损伤对输电塔的位移响应影响较大。