Loading...

Table of Content

    06 June 2024, Volume 10 Issue 6
    Intelligent Fuzzy Testing Method Based on Sequence Generative Adversarial Networks
    2024, 10(6):  490. 
    Asbtract ( )   PDF (2426KB) ( )  
    References | Related Articles | Metrics
    The increase in the number of vulnerabilities and the emergence of a large number of highly dangerous vulnerabilities, such as supercritical and highrisk ones, pose great challenges to the state of network security. As a mainstream security testing method, fuzz testing is widely used. Test case generation, as a core step, directly determines the quality of fuzz testing. However, traditional test case generation methods based on pregeneration, random generation, and mutation strategies face bottlenecks such as low coverage, high labor costs, and low quality. Generating highquality, highly available, and comprehensive test cases is a difficult problem in intelligent fuzz testing. To address this issue, this paper proposes an intelligent fuzz testing method based on the sequence generation adversarial network (SeqGAN) model. By combining the idea of reinforcement learning, the test case generation is abstracted as a learning and approximate generation problem for universally applicable variablelength discrete sequence data. Innovatively, a configurable embedding layer is added to the generator part to standardize the generation, and a reward function is designed from the dimensions of authenticity and diversity through dynamic weight adjustment. This ultimately achieves the goal of automatically and intelligently constructing a comprehensive, complete, and usable test case set for flexible and efficient intelligent fuzz testing. This paper verifies the proposed scheme from two aspects of effectiveness and universality. The average test case pass rate of over 95% and the average target defect detection rate of 10% under four different testing targets fully demonstrate the universality of the scheme. The 98% test case pass rate, 9% target defect detection rate, and the ability to generate 20000 usable test cases per unit time under four different schemes fully demonstrate the effectiveness of the scheme.
    Prediction of Industrial Control System Vulnerability Exploitation Relationships Based on Knowledge Graphreasoning
    2024, 10(6):  498. 
    Asbtract ( )   PDF (1255KB) ( )  
    References | Related Articles | Metrics
    With the rapid growth in the number of vulnerabilities in Industrial Control Systems, the time and economic costs required for manual analysis of vulnerability exploitation are constantly increasing, and current reasoning methods have many deficiencies such as insufficient utilization of information and poor interpretability. To address these problems, a prediction method for exploitation relationships of ICS vulnerabilities is proposed, which is based on knowledge graph reasoning. First, a path filtering algorithm is utilized to minimize the vulnerability exploitation paths. Then, path information is obtained by aggregating key relation paths, and neighbor information is acquired by integrating neighbor relation information. Finally, the exploitation relationships of vulnerabilities are predicted. An experiment on predicting exploit relationships was conducted using a knowledge graph for ICS security, which was built based on security knowledge data and ICS scenario data, and consisted of 57333 entities. The results indicate that the proposed method can assist in predicting the exploitability of ICS vulnerabilities with an accuracy rate of 99.0%.
    A Secure and Efficient Method of Fully Anonymous Vertical Federated Learning
    2024, 10(6):  506. 
    Asbtract ( )   PDF (888KB) ( )  
    References | Related Articles | Metrics
    As a key technical paradigm to achieve “data availability and invisibility”, the core process of vertical federated learning is sample alignment based on private set intersection. Although the private set intersection protects the privacy of nonintersected information, it can’t meet the privacy protection requirements of user IDs in the intersected set. This paper proposes a fully anonymous vertical federated learning framework based on anonymous alignment to ensure that no private information of each holder set will be disclosed during the whole process. An implementation framework based on secure multiparty computation is proposed for fully anonymous joint modeling. The high performance and low error characteristics of the framework are verified through experiments, indicating it can be better applied in practice.
    Homomorphic Encryption Scheme Based on Commercial Cryptography SM9#br#
    #br#
    2024, 10(6):  513. 
    Asbtract ( )   PDF (689KB) ( )  
    References | Related Articles | Metrics
    Homomorphic encryption(HE) is considered to be one of the most important cryptographic techniques in privacy protection applications. The SM9 algorithm is a commercial cryptographic algorithm standard published in China, but it does not has the homomorphic property. In this paper, based on the algorithm of SM9, we designs a cryptographic scheme with homomorphic properties based on PKI system. The newly designed algorithm simultaneously possesses the homomorphic properties of addition and multiplication. It satisfy the addition homomorphic property of arbitrary ciphertext and a ciphertext multiplication operation,  Additionally,  the ciphertext still satisfies the addition homomorphic property and scalar multiplication after multiplication operations. This scheme is suitable for privacy calculation: such asquadratic polynomials and provides selective plaintext attack (INDCPA) security.
    Research on Industrial Internet Commercial Cryptography Application System#br#
    #br#
    2024, 10(6):  519. 
    Asbtract ( )   PDF (4066KB) ( )  
    References | Related Articles | Metrics
    The Industrial Internet is an important component of new infrastructure construction, and commercial cryptography is the core technology and basic support for Industrial Internet security. This paper studies and analyzes the security risks associated with the Industrial Internet  and the application requirements for commercial cryptography, and constructs an industrial Internet commercial cryptography application system from three dimensions: technology, management and evaluation. Based on the Industrial Internet commercial cryptography application system, it can form a systematic solution of  “how to build, use, manage, and evaluate” commercial cryptography  in the Industrial Internet applications, which has important reference significance for continuously improving the endogenous security and innovation capabilities of the Industrial Internet based on commercial cryptography  technology. It is of great significance to promote the integrated development of industrialization and informatization across  a  wider scope, deeper extent, and a higher level.
    An Efficient Signcryption Scheme Based on SM2
    2024, 10(6):  526. 
    Asbtract ( )   PDF (978KB) ( )  
    References | Related Articles | Metrics
    A signcryption system combines the functionalities of digital signature and data encryption, significantly reducing computational and communication costs. Most existing signcryption schemes are mainly designed by foreign countries, which does not align with the requirements of independent innovation in core technology and independent and controllable information security. SM2, a Chinese cryptography industry standard for data security, includes both signature and encryption schemes.  It offers high computational and transmission efficiency at the same level of security and has been widely adopted across various sectors. This study proposes the first signcryption scheme based on SM2. The proposed scheme has constantsize public parameters, constantsize public and private keys. Specifically, the private key consists a single integer, while the public key consists of a single group element. The ciphertexts comprises one group element and n bits (n is the total length of signature and plaintext). The security of the proposed scheme relies on ECDH assumption and ECDLP assumption. In the random oracle model, the proposed scheme is proved to be secure. Both theoretical analysis and experimental simulations demonstrate that, compared with the traditional sign and then encrypt processing method, the communication and computational efficiency of the scheme have certain advantages, making it practical for realworld applications.
    Research on Traceability Techniques of Anomalous Behavior Correlation Analysis Attacks for Industrial Internet Devices#br#
    #br#
    2024, 10(6):  532. 
    Asbtract ( )   PDF (1578KB) ( )  
    References | Related Articles | Metrics
    In this paper, an attack tracing detection method based on abnormal behavior correlation analysis mapping is proposed to solve the problem of unclear attack mechanism analysis and jump process in industrial control network side and device side under the industrial Internet scenario. The method is based on similarity comparison of abnormal behavior sequences, mapping analysis of abnormal behavior sequences and attack stages, and constructing a complete attack chain by linking the attack association subgraphs between different devices in series. Finally, the effectiveness of the attack detection and traceability method is verified, through constructing a simulation test environment for industrial intelligent devices and realizing the replay reproduction of common industrial device attack behaviors.
    Research and Practice of 5G Network Security Assessment Technologies
    2024, 10(6):  539. 
    Asbtract ( )   PDF (5554KB) ( )  
    References | Related Articles | Metrics
    With the widespread deployment of 5G networks, establishing effective network security assessment mechanisms has become increasingly important to ensure network safety and mitigate risks. This paper proposes a standardized 5G network security assessment process to address the security risks arising from the complexity of 5G technology, the iterative nature of standards, and the diversity of applications. The approach includes an integrated suite of technical solutions such as a digital twinbased 5G security parallel simulation testing platform, security penetration techniques based on the ATT&CK model, and 5G security fuzz testing. These solutions have been incorporated into a practical 5G security evaluation framework and validated through realworld case studies. The results demonstrate that the proposed assessment process and technologies effectively address emerging security challenges and enhance the overall security of 5G networks.
    Policy Environment and Key Elements of Realworld Data Trading in China:  A Literature Review
    2024, 10(6):  548. 
    Asbtract ( )   PDF (1143KB) ( )  
    References | Related Articles | Metrics
    The comprehensive utilization and exploration of RealWorld Data (RWD) hold significant importance for improving the level of healthcare services and fostering the development of the health industry. In China, the utilization of RWD is not yet fully optimized, leading to the phenomenon of “data islands”. Initiatives such as “20 guidance on data” have created new opportunities for the industry to explore data trading and data circulation methods. This paper analyzes existing Chinese policies and regulations related to realworld data trading in the medical and health field and provides an overview of key elements in realworld data trading, including the data property rights, data trading platforms, data trading patterns, data trading rules, and technologies related to data trading.
    A Traceable Encryption Scheme for Medical Data Based on  Smart Contract and Fog Computing
    2024, 10(6):  554. 
    Asbtract ( )   PDF (1422KB) ( )  
    References | Related Articles | Metrics
    Traditional medical system solves problems such as medical record management, patient information storage, medical resource scheduling, and so on. However, it suffered from shortcomings such as medical privacy breaches, data security concerns, and high loads on end devices when dealing with everincreasing data volumes and complex access control requirements. To solve the above problems, this paper proposes a traceable encryption scheme based on smart contract and fog computing for medical data privacy protection. By introducing authorization mechanisms and revocable attributebased encryption, the privacy of medical data is effectively protected and the abuse of key is avoided. Additionally, data security is further enhanced by embedding user information in private keys. As the participant of access control, smart contract is responsible for the authentication of the user’s authorization, and part of the decryption operation is undertaken by the fog node, thus reducing the load of the terminal device and achieving load balancing. In comparison with other similar schemes, the proposed approach demonstrates higher computing and storage efficiency.

    Research on Cyber Security Threats and Assurance Strategies for  Largescale Sports Events
    2024, 10(6):  561. 
    Asbtract ( )   PDF (1185KB) ( )  
    References | Related Articles | Metrics
    Largescale sports events have become important targets for cyber attacks due to their large scale, wide coverage, strong influence, and high level of informatization. Cyber attacks on sports events exhibit characteristics such as precise attack targets, industrialization of attack teams, and massive attack scale.Based on the characteristics of largescale sports event informatization business, this article takes information systems, venues, user groups, and supply chains as attack surfaces, analyzes the motivations, targets, types, capabilities, and other characteristics of cyber attacks, and combines sports events and cyber attack motivations, targets, and methods to construct threat scenarios. Targeted prematch, duringgame, and postgame support strategies are proposed to effectively prevent and prevent cyber attacks. Which is of great significance to all parties involved in the event.
    Design of Vulnerability Tracking and Disposal Platform Based on  Fine Management of Massive Assets
    2024, 10(6):  568. 
    Asbtract ( )   PDF (1160KB) ( )  
    References | Related Articles | Metrics
    The lack of closedloop vulnerability management for massive information assets may lead to largescale network or data security incidents. A vulnerability tracking and disposal platform for fine management of massive assets is designed. The platform adopts the “N+1+X” architecture (that is, N vulnerability collectors, 1 analysis and management system, X source data sharing). Through frontend, backend, and side distributed cluster deployment, it realizes the functions of massive asset vulnerability collection, vulnerability verification, asset attribute perfection, vulnerability intelligence supplement, vulnerability scheduling and disposal. The experimental environment test verifies the usability and stability of the platform, which can provide an effective solution for dynamic vulnerability management of largescale assets.
     Bottled Data: A New Mechanism for Terminal Data Security  in Extreme Environments
    2024, 10(6):  579. 
    Asbtract ( )   PDF (5650KB) ( )  
    References | Related Articles | Metrics