Journal of Information Security Reserach

Select

ChatGPT’s Applications, Status and Trends in the Field of Cyber Security

Journal of Information Security Reserach 2023, 9 (6): 500-.

Abstract （983）

PDF （2555KB）（765）

Save

ChatGPT, as a large language model technology, demonstrates extremely strong language understanding and text generation capabilities. It has not only attracted tremendous attention across various industries but also brought new transformations to the field of cybersecurity. Currently, research on ChatGPT in the cybersecurity field is still in its infancy. To help researchers systematically understand the research status of ChatGPT in cybersecurity, this paper provides the first comprehensive summary of ChatGPT’s applications in the field of cybersecurity and potential accompanying security issues. The article first outlines the development of large language model technologies and briefly introduces the technology and features of ChatGPT. Then, it discusses the enabling effects of ChatGPT in the cybersecurity field from two perspectives: assisting attacks and assisting defense. This includes vulnerability discovery, exploitation and remediation, malicious software detection and identification, phishing email generation and detection, and potential use cases in security operations scenarios. Furthermore, the article delves into the accompanying risks of ChatGPT in the cybersecurity field, including content risks and prompt injection attacks, providing a detailed analysis and discussion of these risks. Finally, the paper looks into the future of ChatGPT in the cybersecurity field from the perspectives of security enablement and accompanying security, pointing out the direction for future research on ChatGPT in the cybersecurity domain.

Reference | Related Articles | Metrics

Select

Malicious Client Detection and Defense Method for Federated Learning

Journal of Information Security Reserach 2024, 10 (2): 163-.

Abstract （975）

PDF （806KB）（283）

Save

Federated learning allows participating clients to collaborate in training machine learning models without sharing their private data. Since the central server cannot control the behavior of clients, malicious clients may corrupt the global model by sending manipulated local gradient updates, and there may also be unreliable clients with low data quality but some value. To address the above problems, this paper proposes FedMDD,a defense approach for malicious client detection and defense for federated learning, to process detected malicious and unreliable clients in different ways based on local gradient updates, while defending against symbol flipping, additive noise, single label flipping, multilabel flipping, and backdoor attacks. Four baseline algorithms are compared for two datasets, and the experimental results show that FedMDD can successfully defend against various types of attacks in a training environment containing 50% malicious clients and 10% unreliable clients, with better results in both improving model testing accuracy and reducing backdoor accuracy.

Related Articles | Metrics

Select

Research on the Application of Commercial Cryptography in 5G Network

Journal of Information Security Reserach 2023, 9 (4): 331-.

Abstract （740）

PDF （1197KB）（400）

Save

As a new generation of mobile communication network infrastructure, 5G application scenarios run through all aspects of production and life, such as industrial Internet, energy industry, transportation, medical industry and education. However, unprecedented security risks have been brought to 5G networks, including massive terminal access, largescale network deployment, and massive data aggregation. 5G security has gradually become a worldwide research trend in recent years since it is crucial to social development, economic operation, and even national security. Cryptography is the core technology and basic support to assure network and information security. After more than ten years of development, national commercial cryptographic algorithms ZUC, SM4, SM3, SM2, whose independent intellectual property rights are available, have gradually exerted more indispensable effects in maintaining the security of national cyberspace. Starting from the 5G network architecture and interfaces, this paper analyzes the underlying security risks faced by the 5G networks and proposes a corresponding solution as an example in terms of the commercial cryptography application practices of the 5G network.

Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach 2023, 9 (E1): 105-.

Abstract （710）

PDF （1450KB）（390）

Save

Reference | Related Articles | Metrics

Select

A Survey of SQL Injection Attack Detection and Defense Technology

Journal of Information Security Reserach 2023, 9 (5): 412-.

Abstract （649）

PDF （2612KB）（403）

Save

In the era of “Internet+”, data is the most valuable resource of the Internet. Attackers often use SQL injection attacks to destroy the database in order to obtain important data information in the database. The threat to database security is becoming more and more serious. At present, the research on SQL injection attacks mostly focuses on traditional SQL injection attacks, but lacks the cognition of new advanced SQL injection technology with stronger concealment and higher risk, and the research on related detection and defense technology. In response to this phenomenon, this paper analyzes and evaluates traditional and advanced SQL injection attack technologies and their technical characteristics based on the classification of SQL injection technologies; summarizes existing detection and defense technologies, and evaluates the advantages and disadvantages of these methods for defense effectiveness; finally The problems existing in the current research field are sorted out, and suggestions for future research directions are put forward.

Reference | Related Articles | Metrics

Select

Research on the Progress of Crossborder Data Flow Governance

Journal of Information Security Reserach 2023, 9 (7): 624-.

Abstract （643）

PDF （1036KB）（201）

Save

While promoting the sharing of global data resources, the crossborder data flow will inevitably threaten data sovereignty and national security. The competition for the right to speak in international data with crossborder data flow governance as the game will become the focus of competition in the international community in the future. This paper introduces the background knowledge and constraints of crossborder data flow, investigates and compares the crossborder data flow governance models of the United States, the European Union, Russia, Japan, and Australia, and analyzes the current policy status and challenges of crossborder data flow governance in our country, on this basis, countermeasures and suggestions are proposed for the governance of crossborder data flow in our country from the perspective of data sovereignty, including promoting the classification supervision of crossborder data flow, innovating and developing crossborder data flow governance models, improving countermeasures against extraterritorial “longarm jurisdiction”, and actively participating in and leading the formulation of international governance rules.

Reference | Related Articles | Metrics

Select

On the Exploration and Prospect of the Development Path of Cyberspace Trusted Identity in China

Journal of Information Security Reserach 2022, 8 (12): 1236-.

Abstract （635）

PDF （1941KB）（159）

Save

Reference | Related Articles | Metrics

Select

Research on Content Detection Generated by Large Language Model and the Mechanism of Bypassing

Journal of Information Security Reserach 2023, 9 (6): 524-.

Abstract （634）

PDF （1924KB）（392）

Save

In recent years, there has been a surge in the development of large language models. AI robots like ChatGPT, although they have a largescale security confrontation mechanism inside, attackers can still elaborate questionandanswer patterns to bypass the mechanism, with their help to automatically produce phishing emails and carry out network attacks. In this case, how to identify the text generated by AI robots has also become a hot issue. In order to carry out LLMgenerated content detection experiment, our team collected a certain number of questionandanswer data samples from an Internet social platform and ChatGPT platform, and proposed a series of detection strategies according to different conditions of AI text availability. It includes text similarity analysis based on online controllable AI samples, text data mining based on statistical differences under offline conditions, adversarial analysis based on the LLM generation method under the condition that AI samples are not available, and AI model analysis based on building a classifier by finetuning the target LLM model itself. We calculated and compared the detection capabilities of the analysis engine in each case. On the other hand, we give some antikill techniques against AI text detection engines based on the characteristics of detection strategies, from the perspective of network attack and defense.

Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach 2024, 10 (E2): 105-.

Abstract （588）

PDF （929KB）（340）

Save

Reference | Related Articles | Metrics

Select

Application of Penetration Testing for Industrial Control System Terminals

Journal of Information Security Reserach 2023, 9 (4): 313-.

Abstract （575）

PDF （3070KB）（228）

Save

The security of industrial control system terminals is getting crucial with the development of the industrial Internet. How to conduct effective safety tests for industrial control system terminals has become a key problem to be studied and solved urgently. In this paper, the general process of penetration testing is firstly introduced, then the application of penetration testing for industrial control system terminals is examined using improper input validation vulnerability as an example. The method starts from information collection and penetration tools to deeply understand the system input verification. Then, during the stage of the vulnerability discovery, the modeling of the vulnerability to sensitive input is proposed, as well as the seed mutation pattern for the industrial control programs is designed. The experiment demonstrates the effectiveness of the proposed method and the vulnerability widely existed in the industrial control systems. This method also discovers the security threats such as data tampering, denial of service, permission access and malicious script injection caused by the input validation vulnerability. At last, this work provides security suggestions for industrial control network security protection and equipment protection.

Reference | Related Articles | Metrics

Select

Research on Privacy Protection Technology in Federated Learning

Journal of Information Security Reserach 2024, 10 (3): 194-.

Abstract （550）

PDF （1252KB）（323）

Save

In federated learning, multiple models are trained through parameter coordination without sharing raw data. However, the extensive parameter exchange in this process renders the model vulnerable to threats not only from external users but also from internal participants. Therefore, research on privacy protection techniques in federated learning is crucial. This paper introduces the current research status on privacy protection in federated learning. It classifies the security threats of federated learning into external attacks and internal attacks.Based on this classification, it summarizes external attack techniques such as model inversion attacks, external reconstruction attacks, and external inference attacks, as well as internal attack techniques such as poisoning attacks, internal reconstruction attacks, and internal inference attacks. From the perspective of attack and defense correspondence, this paper summarizes data perturbation techniques such as central differential privacy, local differential privacy, and distributed differential privacy, as well as process encryption techniques such as homomorphic encryption, secret sharing, and trusted execution environment. Finally, the paper analyzes the difficulties of federated learning privacy protection technology and identifies the key directions for its improvement.

Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach 2024, 10 (E1): 236-.

Abstract （539）

PDF （796KB）（374）

Save

Reference | Related Articles | Metrics

Select

Safety Management of Electronic Display Screen in Public Areas

Journal of Information Security Reserach 2023, 9 (4): 397-.

Abstract （533）

PDF （629KB）（187）

Save

Reference | Related Articles | Metrics

Select

Research on Network Security Governance and Response of Largescale AI Model

Journal of Information Security Reserach 2023, 9 (6): 551-.

Abstract （529）

PDF （1101KB）（477）

Save

With the continuous development of artificial intelligence technology, largescale AI model technology has become an important research direction in the field of artificial intelligence. The publication of ChatGPT4.0 and ERNIE Bot has rapidly promoted the development and application of this technology. However, the emergence of largescale AI model technology has also brought new challenges to network security. This paper will start with the definition, characteristics and application of largescale AI model technology, and analyze the network security situation under largescale AI model technology. The network security governance framework of largescale AI model is proposed, and the given steps can provide reference for network security work of largescale AI model.

Reference | Related Articles | Metrics

Select

A Federated Learning Privacy Protection Method for Multikey Homomorphic Encryption in the Internet of Things

Journal of Information Security Reserach 2024, 10 (10): 958-.

Abstract （506）

PDF （1704KB）（213）

Save

With federated learning, multiple distributed IoT devices can jointly train a global model by updating the transmission model without leaking raw data. However, federated learning systems are susceptible to model inference attacks, resulting in compromised system robustness and data privacy. A federated learning privacy protection method for multikey homomorphic encryption in the Internet of Things is proposed to address the issues of existing federated learning solutions being unable to protect the confidentiality of shared gradients and resisting collusion attacks initiated by clients and servers. This method utilizes multikey homomorphic encryption to achieve gradient update confidentiality protection. Firstly, by using proxy reencryption technology, the ciphertext under different public keys is converted into encrypted data under the public key, ensuring that the cloud server can decrypt the gradient ciphertext. Then, IoT devices use their own public key and random secret factor to encrypt local gradient data, which can resist collusion attacks initiated by malicious devices and servers. Secondly, an identity authentication method based on hybrid cryptography was designed to achieve realtime verification of the identities of participants in federated modeling. In addition, in order to further reduce client computing costs, some decryption calculations are coordinated with trusted servers for computation, and users only need a small amount of computation. A comprehensive analysis was conducted on the proposed solution to evaluate its safety and efficiency. The results indicate that the proposed scheme meets the expected security requirements. Experimental simulation shows that compared to existing schemes, this scheme has lower computational overhead and can achieve faster and more accurate model training.

Reference | Related Articles | Metrics

Select

Data Security Governance Practices

Journal of Information Security Reserach 2022, 8 (11): 1069-.

Abstract （498）

PDF （5897KB）（379）

Save

Data security governance has been written into the Data Security Law of the People’s Republic of China. At the same time, data security governance is also one of the key points in the construction of systematic network security. This paper analyzes the data security governance concepts of Gantner and Microsoft, combines enterprise architecture, stakeholder theory, data flow security assessment, maturity security assessment and other methodologies, forms a set of data security governance concepts, and designs a data security management and operation platform for dynamic supervision and data security operation of data security governance indicators. Since 2018, this methodology and platform have been put into practice in the project to solve the construction and optimization of users’ data management and defense system.

Reference | Related Articles | Metrics

Select

Key Points and Practice of Compliance Assessment for Government Data Security

Journal of Information Security Reserach 2022, 8 (11): 1050-.

Abstract （485）

PDF （719KB）（406）

Save

With the development of digital government, the security of government data has become a crucial task. The state attaches great importance to the security risk prevention of government data, and has issued a series of laws, regulations and policy documents, which put forward clear requirements for strengthening the security management of government data. Based on the requirements of government data security compliance, this article proposes the evaluation method and index system of compliance assessment for government data security, which will provide reference for the manager of government data to carry out government data security compliance assessment.

Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach 2024, 10 (E1): 246-.

Abstract （454）

PDF （1562KB）（282）

Save

Reference | Related Articles | Metrics

Select

Survey of Network Intrusion Detection Based on Deep Learning

Journal of Information Security Reserach 2022, 8 (12): 1163-.

Abstract （430）

PDF （2421KB）（289）

Save

The rapid development of the Internet not only brings great convenience to users, but also causes many security incidents. With the increasing number of network attacks such as zeroday vulnerabilities and encryption attacks, the network security situation is becoming more and more serious. Intrusion detection is an important means of network attack detection. In recent years, with the continuous development of deep learning technology, intrusion detection system based on deep learning is gradually becoming a research hotspot in the field of network security. This paper introduces recent work on network intrusion detection using deep learning technology based on extensive investigation of literature. Firstly, it briefly summarizes the current network security situation and traditional intrusion detection technologies. Then, several deep learning models commonly used in network intrusion detection system are introduced. Then it summarizes the commonly used data preprocessing techniques, data sets and evaluation indicators in deep learning. Then from the perspective of practical application, it introduces the specific application of deep learning model in network intrusion detection system. Finally, the problems in the current research process are discussed, and the future development direction is put forward.

Reference | Related Articles | Metrics

Select

Federated Foundation Model Finetuning Based on Differential Privacy#br#

#br#

Journal of Information Security Reserach 2024, 10 (7): 616-.

Abstract （427）

PDF （1752KB）（238）

Save

As the availability of private data decreases, large model finetuning based on federated learning has become a research area of great concern. Although federated learning itself has a certain degree of privacy protection, privacy security issues such as gradient leakage attacks and embedding inversion attacks on large models still threaten the sensitive information of participants. In the current context of increasing awareness of privacy protection, these potential privacy risks have significantly hindered the promotion of large model finetuning based on federated learning in practical applications. Therefore, this paper proposes a federated large model embedding differential privacy control algorithm, which adds controllable random noise to the embedded model of the large model during efficient parameter finetuning process through a global and local dual privacy control mechanism to enhance the privacy protection ability of federated learning based large model parameter finetuning. In addition, this paper demonstrates the privacy protection effect of this algorithm in large model finetuning through experimental comparisons of different federation settings, and verifies the feasibility of the algorithm through performance comparison experiments between centralization and federation.

Reference | Related Articles | Metrics

Select

Research on the Application of Commercial Cryptography to Cloud Computing

Journal of Information Security Reserach 2023, 9 (4): 375-.

Abstract （417）

PDF （3447KB）（343）

Save

Cloud computing, as a new information processing method, enables users to access information and communication resource services through the network, and it has become an inevitable trend in the development of information technology industry. Users, data, and information resources are highly concentrated, highly dependent on the continuity of cloud platform services, and the scalability of virtualized resources bring inevitable security risks to cloud computing., and the scalability of virtualized resources bring inevitable security risks to cloud computing. Therefore, how to eliminate the security risks of cloud computing by using commercial cryptography technology has become the current research hotspot. This paper starts from the cloud computing network architecture, anlyzes the cryptography application requirements of cloud computing. The paper proposes the corresponding commercial cryptography application scheme for cloud computing scenarios on this basis. The research results provide a theoretical guidance and reference for the application practice of commercial cryptography in cloud computing scenarios, and are expected to solve the key problems of cloud computing security.

Reference | Related Articles | Metrics

Select

Research on the Integration of Full Lifecycle Data Security Management and Artificial Intelligence Technology#br#

Journal of Information Security Reserach 2023, 9 (6): 543-.

Abstract （408）

PDF （1143KB）（282）

Save

With data becoming a new production factor, China has elevated data security to a national strategic level. With the promotion of a new round of technological revolution and the deepening of digital transformation, the artificial intelligence technology has increasing development potential, and gradually empowers the field of data security management actively. Firstly, the paper introduces the concept and significance of data security lifecycle management, analyzes the security risks faced by data in various stages of the lifecycle, and further discusses the problems and challenges faced by traditional data security management technologies in the context of massive data processing and upgraded attack methods. Then, the paper introduces the potential advantages of artificial intelligence in solving these problems and challenges, and summarizes the current mature data security management technologies based on artificial energy and typical application scenarios. Finally, the paper provides an outlook on the future development trends of artificial intelligence technologies in the field of data security management. This paper aims to provide useful references for researchers and practitioners in the field of data security management, and promote the innovation and application of artificial intelligence in the field of data security management technology.

Reference | Related Articles | Metrics

Select

Key Technologies and Research Prospects of Privacy Computing

Journal of Information Security Reserach 2023, 9 (8): 714-.

Abstract （400）

PDF （1814KB）（289）

Save

Privacy computing, as an important technical means taking into account both data circulation and privacy protection, can effectively break the “data island” barriers while ensuring data security, it enables open data sharing, and promotes the deep mining and use of data and crossdomain integration. In this paper, the background knowledge, basic concepts and architecture of privacy computing were introduced, the basic concepts of three key technologies of privacy computing, including secure multiparty computation, federated learning and trusted execution environment were elaborated, and studies on the existing privacy security was conducted, a multidimensional comparison and summarization of the differences of the three key technologies were made. On this basis, the future research direction of privacy computing is prospected from the technical integration of privacy computing with blockchain, deep learning and knowledge graph.

Reference | Related Articles | Metrics

Select

A Review of Adversarial Attack on Autonomous Driving Perception System

Journal of Information Security Reserach 2024, 10 (9): 786-.

Abstract （399）

PDF （1560KB）（281）

Save

The autonomous driving perception system collects surrounding environmental information through various sensors and processes this data to detect vehicles, pedestrians and obstacles, providing realtime foundational data for subsequent control and decisionmaking functions. Since sensors are directly connected to the external environment and often lack the ability to discern the credibility of inputs, the perception systems are potential targets for various attacks. Among these, adversarial example attack is a mainstream attack method characterized by high concealment and harm. Attackers manipulate or forge input data of the perception system to deceive the perception algorithms, leading to incorrect output results by the system. Based on the research of existing relevant literature, this paper systematically summarizes the working methods of the autonomous driving perception system, analyzes the adversarial example attack schemes and defense strategies targeting the perception system. In particular, this paper subdivide the adversarial examples for the autonomous driving perception system into signalbased adversarial example attack scheme and objectbased adversarial example attack scheme. Additionally, the paper comprehensively discusses defense strategy of the adversarial example attack for the perception system, and subdivide it into anomaly detection, model defense, and physical defense. Finally, this paper prospects the future research directions of adversarial example attack targeting autonomous driving perception systems.

Reference | Related Articles | Metrics

Select

A Survey of Data Security Sharing Technology Development and Its Application in Power Domain

Journal of Information Security Reserach 2023, 9 (3): 208-.

Abstract （398）

PDF （2019KB）（257）

Save

The circulation, sharing and collaborative application of data elements are the core elements of data element market cultivation in the digital era, and data security sharing technology can effectively realize the secure sharing of data and avoid the phenomenon of “data silos” and privacy leakage. This paper presents a comprehensive review of the latest research achievements and progress of data security sharing technologies in this field. First of all, we outline the development and evolution of data security sharing technologies, and then compare and analyze existing data security sharing solutions in terms of technical features, problem solving, advantages and disadvantages, and summarize the key technologies they rely on and the risks and challenges they face. Secondly, we discuss the application of data security sharing technologies in typical scenarios in the energy and power fields, such as power energy trading, power internet of things, and electric vehicles, providing new ideas and insights for data compliance and governance in the energy and power fields. Finally, the future research directions and development prospects of data security sharing technology applications in the energy and power domain are foreseen.

Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach 2023, 9 (6): 498-.

Abstract （394）

PDF （472KB）（452）

Save

Related Articles | Metrics

Select

Survey of Intelligent Vulnerability Mining and Cyberspace Threat Detection

Journal of Information Security Reserach 2023, 9 (10): 932-.

Abstract （390）

PDF （1093KB）（264）

Save

At present, the threat of cyberspace is becoming more and more serious. A large number of studies have focused on cyberspace security defense techniques and systems. Vulnerability mining technique can be applied to detect and repair vulnerabilities in time before the occurrence of network attacks, reducing the risk of intrusion; while threat detection technique can be applied to threat detection during and after network attacks occur, which can detect threats in a timely manner and respond to them, reducing the harm and loss caused by intrusion. This paper analyzed and summarized the research on vulnerability mining and cyberspace threat detection based on intelligent methods. In the aspect of intelligent vulnerability mining, the current research progress is summarized from several application classifications combined with artificial intelligence technique, namely vulnerability patch identification, vulnerability prediction, code comparison and fuzz testing. In the aspect of cyberspace threat detection, the current research progress is summarized from the classification of information carriers involved in threat detection based on network traffic, host data, malicious files, and network threat intelligence.

Reference | Related Articles | Metrics

Select

Data Sharing Access Control Method for Distribution Terminal IoT #br# Based on Zero Trust Architecture and Least Privilege Principle#br#

Journal of Information Security Reserach 2024, 10 (10): 937-.

Abstract （382）

PDF （1282KB）（106）

Save

To maximize the security of IoT data sharing in distribution terminals, a data sharing access control method for distribution terminal IoT based on zero trust architecture and least privilege principle is proposed. We have developed a zerotrustbased IoT data sharing access control framework, which verifies user identity and access control permissions through identity authentication modules. After user access, IDS modules identify obvious network attack behaviors, while behavior trust measurement proxies in user behavior measurement modules, calculate user trust based on historical user behavior measurement data stored in trust measurement databases, and periodically evaluate user behavior trust levels, identify longterm and highly covert network attack behaviors. These proxies also periodically evaluate user behavior trust levels, identify longterm and highly covert network attack behaviors, and use behavioral trustbased access decision agents to allocate user roles based on the user trust level and the principle of least privilege, formulating and implementing access decisions. The IoT controller dynamically adjusts user resource access permissions based on trust measurement results, and achieves dynamic adjustment of user distribution terminal IoT resource access permissions by sending flow tables. The experimental results show that this method can accurately control the shared access of IoT data, and has more comprehensive performance. It has the least redundant permissions while completing user access tasks, which not only meets user access requirements but also ensures network data security.

Reference | Related Articles | Metrics

Select

Comparison Research on Intrusion Detection Model Based on Machine Learning

Journal of Information Security Reserach 2023, 9 (8): 739-.

Abstract （379）

PDF （942KB）（177）

Save

Nowadays, network threats are constantly evolving and demonstrate increasing invisibility. Studying the performance and characteristics of multiple machine learning models for intrusion detection on modern traffic data is of greater significance to improve the timeliness of intrusion detection systems. This paper explores the use of recent efficient machine learning models, including ensemble learning(Random Forest, XGBoost, LightGBM) and deep learning(CNN, LSTM, GRU, etc) models for intrusion detection tasks on the public dataset UNSWNB15.We elaborate the task flow and experimental configuration, compare and analyze the experimental results of different models, summarize the characteristics of each model in the network intrusion detection task. The experimental results demonstrate that, under a 10% sampled dataset of UNSWNB15, the bestperforming model for the binary classification task among the experimental models is LightGBM, with an F1 score of 0.897, an accuracy of 89.86%, a training time of 1.98s, and a prediction time of 0.11s. In the case of multiclassification tasks, the most comprehensive prediction model among the experimental models is XGBoost, with an overall F1 score of 0.7907, an accuracy of 75.96%, a training time of 144.79s, and a prediction time of 0.21s.

Reference | Related Articles | Metrics

Select

Research on Identity Authentication Technology Based on Block Chain and PKI

Journal of Information Security Reserach 2024, 10 (2): 148-.

Abstract （365）

PDF （1573KB）（275）

Save

Public key infrastructure (PKI) is a secure system based on asymmetric cryptographic algorithm and digital certificate to realize identity authentication and encrypted communication, operating on the principle of trust transmission based on trust anchor. However, this technology has the following problems: The CA center is unique and there is a single point of failure; The authentication process involves a large number of operations, such as certificate resolution, signature verification, and certificate chain verification. To solve the above problems, this paper builds an identity authentication model based on Changan Chain, and proposes an identity authentication scheme based on Changan Chain digital certificate and public key infrastructure. Theoretical analysis and experimental data demonstrate that this scheme reduces certificate parsing, signature verification and other operations, simplifies the authentication process, and improves the authentication efficiency.

Reference | Related Articles | Metrics

Select

Research on Dynamic Access Control Model Based on Zero Trust

Journal of Information Security Reserach 2022, 8 (10): 1008-.

Abstract （361）

PDF （2191KB）（229）

Save

The traditional access control system can not meet the security requirements of mobile office in ubiquitous access scenarios. This paper firstly proposes an access control model ZTBAC based on the concept of zero trust. This model realizes the dynamic allocation of access rights by continuously evaluating the attributes and behavior information of access subjects, and its trust measurement system considers the dynamic adjustment of permission threshold. The mobile office architecture and simulation experiments based on this model show that ZTBAC model can meet the requirements of access control in mobile office. At the same time, compared with the traditional trustbased access control model, ZTBAC model has significant advantages in authority management and resisting trust attacks.

Reference | Related Articles | Metrics

Select

Research for Zero Trust Security Model

Journal of Information Security Reserach 2024, 10 (10): 886-.

Abstract （349）

PDF （2270KB）（296）

Save

Zero trust is considered a new security paradigm. From the perspective of security models, this paper reveals the deepening and integration of security models in zero trust architecture, with “identity and data” as the main focus. Zero trust establishes a panoramic control object chain with identity at its core, builds defenseindepth mechanisms around object attributes, functions, and lifecycles, and centrally redirects the flow of information between objects. It integrates information channels to achieve layered protection and finegrained, dynamic access control. Finally, from an attacker’s perspective, it sets up proactive defense mechanisms at key nodes in the information flow path. Since zero trust systems are bound to become highvalue assets, this paper also explores the essential issues of inherent security and resilient service capabilities in zerotrust systems. Through the analysis of the security models embedded in zerotrust and its inherent security, this paper aims to provide a clearer technical development path for the architectural design, technological evolution, and selfprotection of zero trust in its application.

Reference | Related Articles | Metrics

Select

A Novel Blockchain Privacy Preserving Scheme Based on Paillier and FO Commitment

Journal of Information Security Reserach 2023, 9 (4): 306-.

Abstract （347）

PDF （934KB）（241）

Save

The blockchain is a shared database with excellent characteristics such as high decentralization and traceability. However, data leakage is still a big problem for blockchain transactions. To order to solve the problem, this paper introduces Paillier homomorphic encryption with variable k (KPH), a privacy protection strategy that hides transaction information by the public key encryption algorithm RSA, performs zeroknowledge proof on the legitimacy of the transaction amount with FO commitment, and updates the transaction amount using the enhanced Paillier semihomomorphic encryption algorithm and verifies the transaction using the FO commitment. Unlike the typical Paillier algorithm, the KPH scheme’s Paillier algorithm includes the variable k and combines the L function and the Chinese remainder theorem to reduce the time complexity from O(|n|2+e) to O(logn), making the algorithm decryption process more efficient.

Reference | Related Articles | Metrics

Select

Research on Blockchain Anomaly Transaction Detection Technology Based on Stacking Ensemble Learning

Journal of Information Security Reserach 2023, 9 (2): 98-.

Abstract （346）

PDF （4463KB）（179）

Save

In order to efficiently detect abnormal transactions on the blockchain, this paper proposes a method based on Stacking integration learning. Firstly, XGBoost, LightGBM, CatBoost and LCE are used as the base classifier, and MLP is used as the metaclassifier, and the MLP_Stacking integrated learning algorithm is designed. Secondly,SUNDO is used for data augmentation to solve the problem of serious imbalance in data sets; Finally, a multimodel joint feature sorting algorithm is designed to generate an optimal subset of features, and the resulting optimal subset of features is used as the input data set of the MLP_Stacking for classification training to achieve model optimization. This paper experiments at the open source dataset provided by Kaggle platform , and the experimental results show that the SUNDO data generation method can effectively improve the performance of each classifier, and the training effect of the integrated model designed in this paper is obviously better than that of the individual model.

Reference | Related Articles | Metrics

Select

A Review of Algorithmic Risk and Its Governance in China#br#

#br#

Journal of Information Security Reserach 2024, 10 (2): 114-.

Abstract （344）

PDF （1781KB）（201）

Save

In the era of digital intelligence, algorithms pervade every corner of human society. While algorithms drive the transformation towards digitization and intelligence, they also give rise to a series of issues, necessitating effective governance of increasing algorithmic risks. Firstly, algorithmic risks are categorized into four fields: law and justice, politics and governance, information dissemination and business and economy. Then the formation mechanisms of algorithmic risk are analyzed, encompassing algorithm black box, algorithm discrimination and power alienation. Finally, a governance strategy framework is proposed, consisting of three paths: technology regulation, power and responsibility normative, and ecological optimization. The research systematically presents the progress and development trend of algorithmic risk and its governance in China, providing reference for advancing the theoretical research and system construction inalgorithmic risk governance.

Reference | Related Articles | Metrics

Select

Research on Locally Verifiable Aggregate Signature Algorithm Based on SM2

Journal of Information Security Reserach 2024, 10 (2): 156-.

Abstract （342）

PDF （983KB）（191）

Save

The SM2 algorithm is based on the elliptic curve cryptosystem, which was released by the State Cryptography Administration in 2010. At present, it is widely used in egovernment, medical care, finance and other fields. Among them, digital signature is the main application of SM2 algorithm, and the number of signature and verification operations generated in various security application scenarios has increased exponentially. Aiming at the problem that massive SM2 digital signatures occupy a large storage space and the efficiency of verifying signatures one by one is low. This paper proposes a partially verifiable aggregate signature scheme based on the national secret SM2 algorithm, which uses aggregate signatures to reduce storage overhead and improve verification efficiency. On the other hand, when the verifier only needs to verify the specified message and the aggregated signature, it must also obtain the plaintext of all the messages at the time of aggregation. Using partially verifiable signatures, the verifier only needs to specify the message, aggregate signature and short prompt to complete the verification. Analyze the correctness and security of this scheme. Through experimental data and theoretical analysis, compared with similar schemes, this scheme has higher performance.

Reference | Related Articles | Metrics

Select

ChatGPT’s Security Threaten Research

Journal of Information Security Reserach 2023, 9 (6): 533-.

Abstract （341）

PDF （1801KB）（285）

Save

With the rapid development of deep learning technology and natural language processing technology, the large language model represented by ChatGPT came into being. However, while showing surprising capabilities in many fields, ChatgPT also exposed many security threats, which aroused the concerns of academia and industry. This paper first introduces the development history, working mode, and training methods of ChatGPT and its series models, then summarizes and analyzes various current security problems that ChatGPT may encounter and divides it into two levels: user and model. Then, countermeasures and solutions are proposed according to the characteristics of ChatGPT at each stage. Finally, this paper looks forward to developing a safe and trusted ChatGPT and a large language model.

Reference | Related Articles | Metrics

Most Read articles