Secure Network Coding Against Intra/Inter-Generation Pollution Attacks

By allowing routers to combine the received packets before forwarding them,network coding-based applications are susceptible to possible malicious pollution attacks.Existing solutions for counteracting this issue either incur inter-generation pollution attacks(among multiple generations)or suffer high computation/bandwidth overhead.Using a dynamic public key technique,we propose a novel homomorphic signature scheme for network coding for each generation authentication without updating the initial secret key used.As per this idea,the secret key is scrambled for each generation by using the generation identifier,and each packet can be fast signed using the scrambled secret key for the generation to which the packet belongs.The scheme not only can resist intra-generation pollution attacks effectively but also can efficiently prevent inter-generation pollution attacks.Further,the communication overhead of the scheme is small and independent of the size of the transmitting files.

Request pattern change-based cache pollution attack detection and defense in edge computing

Through caching popular contents at the network edge,wireless edge caching can greatly reduce both the content request latency at mobile devices and the traffic burden at the core network.However,popularity-based caching strategies are vulnerable to Cache Pollution Attacks(CPAs)due to the weak security protection at both edge nodes and mobile devices.In CPAs,through initiating a large number of requests for unpopular contents,malicious users can pollute the edge caching space and degrade the caching efficiency.This paper firstly integrates the dynamic nature of content request and mobile devices into the edge caching framework,and introduces an eavesdroppingbased CPA strategy.Then,an edge caching mechanism,which contains a Request Pattern Change-based Cache Pollution Detection(RPC2PD)algorithm and an Attack-aware Cache Defense(ACD)algorithm,is proposed to defend against CPAs.Simulation results show that the proposed mechanism could effectively suppress the effects of CPAs on the caching performance and improve the cache hit ratio.

Understanding pollution dynamics in large-scale peer-to-peer IPTV system

With the great commercial success of several IPTV (internet protocal television) applications, PPLive has received more and more attention from both industry and academia. At present, PPLive system is one of the most popular instances of IPTV applications which attract a large number of users across the globe; however, the dramatic rise in popularity makes it more likely to become a vulnerable target. The main contribution of this work is twofold. Firstly, a dedicated distributed crawler system was proposed and its crawling performance was analyzed, which was used to evaluate the impact of pollution attack in P2P live streaming system. The measurement results reveal that the crawler system with distributed architecture could capture PPLive overlay snapshots with more efficient way than previous crawlers. To the best of our knowledge, our study work is the first to employ distributed architecture idea to design crawler system and discuss the crawling performance of capturing accurate overlay snapshots for P2P live streaming system. Secondly, a feasible and effective pollution architecture was proposed to deploy content pollution attack in a real-world P2P live streaming system called PPLive, and deeply evaluate the impact of pollution attack from following five aspects:dynamic evolution of participating users, user lifetime characteristics, user connectivity-performance, dynamic evolution of uploading polluted chunks and dynamic evolution of pollution ratio. Specifically, the experiment results show that a single polluter is capable of compromising all the system and its destructiveness is severe.

Prediction of the impact of air pollution on rates of hospitalization for asthma in Shiraz based on air pollution indices in 2007-2012

Objectives: This study was designed to determine the effects of air pollutants on emergency admissions for asthma, and to forecast the disease burden in Shiraz, Iran. Methods: The average daily concentrations of fine particles (PM10), nitrogen dioxide (NO2), sulfur dioxide (SO2), carbon monoxide (CO) and ozone (O3) were calculated from data reported by two air quality monitoring stations in Shiraz from the beginning of 2007 to mid-2012. Results: The numbers of patients admitted with asthma attack during this period were collected from four main university-affiliated hospitals. Admissions correlated strongly with the levels of PM10, SO2, CO and O3 during warm seasons (P<0.001), and with NO2 level during cold seasons (P<0.001). We forecast increasing trends in air pollutants and patient admissions in the year 2015. Conclusion: Our findings are further evidence of the effects of air pollutants on asthma exacerbations.

基于入侵诱骗的网络拓扑污染攻击防御研究

以目标为中心的攻击防御手段检测到攻击后才有所响应,攻击防御不及时,为了提升网络拓扑污染攻击防御能力,提出一种基于入侵诱骗的网络拓扑污染攻击防御方法。通过入侵诱骗系统模拟网络脆弱性,采集攻击模式,并添加到知识库中;通过多个和子空间正交的向量判断知识库内污染信息类型,完成网络拓扑污染攻击类型分类;通过分类结果量化分析网络攻击与防御的成本收益,构建成本收益量化模型;基于攻击图、防御图和博弈论构建攻击防御模型,获取最佳网络拓扑污染攻击防御策略。实验结果表明,所提方法可以有效检测主机位置劫持攻击和链路伪造攻击,提升网络拓扑污染攻击防御效果,且提升了攻击防御的及时性。

A Measurement Study of Polluting a Large-Scale P2P IPTV System

With the rapid development of Peer-to-Peer(P2P) technology,IPTV applications based on that have received more and more attention from both industry and academia. Several applications using the data-driven mesh-pull architectures raised and gained great success commercially. At present,PPLive system is one of the most popular instances of IPTV applications which attract a large number of users from across the globe. At the same time,however,the dramatic rise in popularity makes it more likely to become a vulnerable target. In this paper,we propose an effective measurement architecture,which is based on the peer's nature not only receiving polluted video chunks but also forwarding those to other peers,to measure the video streaming pollution attack and then use a dedicated crawler of PPLive developed by us to evaluate the impact of pollution in P2P live streaming. Specifically,the results show that a single polluter is capable of compromising all the system and its destructiveness is severe.

酸碱盐胁迫环境下水泥固化重金属污染土的长期性能:现状与展望

土壤和地下水常受到工业、农业、海水和生活污水的影响,存在不同种类的腐蚀性离子。采用水泥基材料固化/稳定化修复重金属污染场地时,这些腐蚀性离子会降低水泥基固化土的性能和重金属的固化效果,长期条件下面临二次污染问题。目前采用水泥基材料的土壤固化研究多集中于新型复合固化剂的研发,对环境胁迫下固化体的耐久性问题需要更多关注。针对环境胁迫下因水泥基固化土劣化引起的工程特性和淋滤特性问题,总结国内外研究现状,系统阐述土—水泥—重金属—胁迫环境之间的相互作用机理,明晰基于酸/碱、盐环境胁迫下水泥基固化土性能演化规律及机制,为重金属污染土壤固化修复效果及耐久性提升的研究提供参考。

Homomorphic MAC-Based Scheme against Pollution Attacks in Network Coding

Network coding can improve network throughput in large, but it is vulnerable to the data pollution attacks. In this paper, we propose an efficient homomorphic message authentication code （MAC） scheme with discrete logarithm to detect and locate the malicious nodes. We also prove the security property of the scheme theoretically. Its effectiveness is demonstrated, and overhead is analyzed through extensive experiments.

抗多种攻击的网络编码安全方案

为解决目前网络编码安全方案研究目标不全面,安全性不高等问题,文章提出一种可以同时抵抗多种攻击方式的网络编码安全方案。本方案共有两个阶段分别应对窃听攻击和污染攻击。第一阶段首先选取部分信源消息生成预编码系数矩阵,并通过AES加密系统对其加密。然后用预编码矩阵对剩余的消息线性组合,使本方案可以抵抗网络窃听攻击。第二阶段给第一阶段处理后的消息生成签名,同时引入代标识符以及时间戳两个参数,来抵御无线网络中的代间污染攻击和代内污染攻击以及网络中的重放攻击。结果表明,本方案不仅能抵抗多种攻击,且编码复杂度较低,更加贴合实际应用。

CCN中基于节点状态模型的缓存污染攻击检测算法

针对内容中心网络中的缓存污染攻击问题,以污染内容数量、分布状态和攻击强度3个参数对缓存污染攻击进行定量描述和分析,建立了攻击下的节点缓存状态模型。通过分析节点关键参数的变化,提出了基于节点状态模型的攻击检测原则,并分别以单位时间缓存替换率和请求达到率为观测参数进行算法实例化设计。仿真结果与性能分析表明,所提检测算法在应对分散式攻击与集中式攻击时,可以取得良好的检测性能。

融合时间戳和同态签名的安全网络编码方法

针对无线多跳网络编码的安全性问题,提出了一种融合时间戳和同态签名的安全网络编码方法。在利用基于RSA的同态签名方案抵御污染攻击的基础上,引入时间戳设计新型同态签名方案来抵御网络中的重放攻击,以时间戳为源生成网络编码的随机系数来保证签名的同态性。重点分析了本方案产生随机系数的方式对网络编码解码概率的影响,并建立了攻击模型证明方案可同时抵御网络中的污染攻击和重放攻击。性能分析表明本方案与基于RSA的同态签名方案开销比值接近于1。

内容中心网络中DoS攻击问题综述

"内容中心网络"(Content Centric Networking,CCN)是未来互联网架构体系群中极具前景的架构之一。尽管CCN网络的全新设计使其能够抵御目前网络存在的大多数形式DoS攻击,但仍引发了新型的DoS攻击,其中危害较大的两类攻击是兴趣包泛洪攻击和缓存污染攻击。这两类DoS攻击利用了CCN网络自身转发机制的安全逻辑漏洞,通过泛洪大量的恶意攻击包,耗尽网络资源,并导致网络瘫痪。与传统IP网络中DoS攻击相比,CCN网络中的内容路由、内嵌缓存和接收者驱动传输等新特征,对其DoS攻击的检测和防御方法都提出了新的挑战。本文首先介绍CCN网络的安全设计和如何对抗已有的DoS攻击,然后从多角度描述、比较CCN中新型DoS攻击的特点,重点阐述了兴趣包泛洪攻击和缓存污染攻击的分类、检测和防御方法,以及它们所面临的问题挑战,最后对全文进行总结。

一种高效的安全数据包过滤算法

基于网络编码技术,通过计算收到的数据包的线性相关性来判断其是否为非创新包,并检测它们是否为污染包,以阻止恶意节点的攻击行为,提出一个抗熵攻击和污染攻击的数据包过滤算法.分析和实验结果表明,给出的数据包过滤算法安全,并且能有效减少网络负载、提高传输效率.

基于RSA的多源网络编码签名方案

由于网络编码极易遭受污染攻击的破坏,文中基于RSA问题的难解性提出了一种适用于多源网络编码同态签名方案,以应对污染攻击和重放攻击。该方案能够阻止恶意修改的数据分组,被污染的数据分组会被验证者丢弃,从而保证了系统的安全性。由于方案是为多源网络编码设计的,不需要额外的安全信道,且采用线性计算,大大降低了对结点计算能力的要求,节省了结点的验证时间。此外,通过引入消息代序号,该方案可以防止代间重放攻击。

内容中心网络缓存污染防御技术研究

内容中心网络是下一代互联网体系的研究热点,但其安全性研究国内外均尚处于起步阶段。文中针对内容中心网络如何防御Locality-Disruption和False-Locality两类典型缓存污染攻击的问题,提出了两种缓存污染防御策略:基于稳态内容存储分布的CPDP-SCCD与基于内容请求分布的CPDP-CRD,对比分析了基于内容请求分布以及基于稳态内容存储分布的防御有效性。仿真结果表明:相比较基于内容请求分布类策略仅对于Locality-Disruption攻击有防御效果,CPDP-SCCD的综合性能更佳,可以同时有效控制Locality-Disruption与False-Locality两类攻击。

内容中心网络安全技术研究综述

内容中心网络(Content Centric Networking,CCN)属于信息中心网络的一种,是未来互联网体系架构中极具前景的架构之一,已成为下一代互联网体系的研究热点。内容中心网络中的内容路由、内嵌缓存、接收端驱动传输等新特征,一方面提高了网络中的内容分发效率,另一方面也带来了新的安全挑战。本文在分析CCN工作原理的基础上,介绍了CCN的安全威胁、安全需求以及现有的解决方案,并展望了CCN安全技术研究的方向。首先,详细介绍了CCN的原理和工作流程,对比分析了CCN与TCP/IP网络的区别,并分析了CCN面临的安全威胁及需求。其次,对CCN中隐私保护、泛洪攻击、缓存污染、拥塞控制等技术的研究现状进行归纳、分析、总结,并分析了现有方案的优缺点及不足,进而分析可能的解决方案。最后,对CCN安全技术面临的挑战进行了分析与讨论,并展望了未来的研究方向及发展趋势。通过对已有研究工作进行总结与分析,本文提出了CCN安全技术潜在研究方向与关键问题,为CCN安全后续研究提供有益参考。

内容中心网络中基于多样化存储的缓存污染防御机制

针对内容中心网络(CCN)中的缓存污染攻击问题,提出一种基于多样化存储的缓存污染防御机制。对不同业务内容采取差异化缓存从而减小网络受攻击面,将业务划分为三类并采用不同缓存策略:对隐私及实时性业务不予缓存;对流媒体业务以概率推送至网络边缘缓存;对其他文件类内容业务由上游到边缘逐步推送缓存。在不同节点分别配置不同的缓存污染攻击防御手段:对于边缘节点通过内容请求到达概率的变化对攻击进行检测;对于上游节点通过设置过滤规则将请求概率较低的内容排除出缓存空间。仿真结果表明,相比CNN传统缓存策略下的防御效果,该机制使网络平均缓存命中率提高了17.3%,该机制能够有效提升网络对于缓存污染攻击的防御能力。

一种多源网络编码同态签名算法

文章对多源网络编码中的安全性进行深入的分析,提出一种基于同态函数的多源网络编码快速签名算法来预防多源网络中的污染攻击和背叛攻击。与其他签名长度相同的算法相比,本算法对运算和倍点运算次数更少,算法的验证效率要比其他的基于椭圆曲线的算法更高。

基于网络编码的同态HASH抗污染攻击系统研究

文章在已有的同态HASH签名基础上,为了解决网络编码传输过程中容易遭受污染攻击的问题,提出了一种新型的应用同态HASH函数的抗污染攻击系统,网络中的各个节点通过同步同态HASH函数的参数和原始消息分组的HASH值来对所收到的每个分组进行验证,只有通过验证的分组才会转发给下一个节点。该方案结合了针对源节点与目标节点端对端在线验证的安全ACK验证方案,从而能有效抵抗网络编码中的污染攻击。同时,为了有效降低网络编码中各节点的运算时间,文章提出了硬件加速的方法,利用FPGA开发板进行数据分组的验证以及编码操作,以提高系统的运行效率。该系统能够提高整体网络吞吐量,并确保被篡改的数据不会因为编码在整个网络中扩散,对于网络编码环境下的网络传输安全具有重要的作用。

基于声誉机制的网络编码抗污染攻击方案

网络编码在提高网络吞吐量方面有很大的优势,但是它极易受到污染攻击.目前针对此问题的多数解决方案都是针对有中心机制的网络.针对无中心机制的移动自组织网络,考虑移动自组网中节点的移动性和无固定的可信任第三方中心机制,结合已有的声誉机制研究,提出一种基于声誉机制的抗污染攻击方案对抗网络编码中的污染攻击.该方案采用对污染攻击进行检测和定位,在检测污染攻击存在的情况下,通过声誉机制对恶意节点进行定位,从而达到抗污染攻击的目的.通过实验仿真,与已有的方案进行比较,实验结果表明:针对无中心机制的方案在包的接收成功率上有一定提高,并且在多个恶意节点存在的情况下依然可以准确定位出恶意节点并将其隔离.