Table of Content

10 November 2024, Volume 10 Issue 11

Previous Issue   

A Review of Fuzz Testing Techniques for Autonomous Driving Systems

2024, 10(11):  982. 

Asbtract ( )   PDF (1389KB) ( )  

References | Related Articles | Metrics

Autonomous driving is the future development trend of the automotive industry, while autonomous vehicles heavily rely on interconnected systems and software that control their operation. System software vulnerabilities lead to serious safety hazards for vehicles. Therefore, automatic driving safety test is an important link to further improve the safety of autonomous vehicle. Fuzz testing, as an automated vulnerability testing technology, exhibits outstanding vulnerability exploration capabilities when dealing with complex software systems. It holds significant potential for widespread application in autonomous driving systems. This paper provides a systematic summary of widely used opensource fuzz testing tools. Through an indepth analysis of the characteristics of autonomous driving systems, the study identifies key challenges currently faced by research in this field, including: 1) difficulty in comprehensively considering input dimensions; 2) challenges in uncovering issues related to multifunctional collaborative concurrency; 3) mismatch of security issue categories. In response to these challenges, the research proposes corresponding recommendations, providing guidance for future related research.

Research on Hybrid Malicious Node Detection Method in Wireless  Sensor Networks

Chen Jiawang, Liu Beishui, Liu Guodong, Wu Peng, and Sun Yue

2024, 10(11):  990. 

Asbtract ( )   PDF (1562KB) ( )  

References | Related Articles | Metrics

The application of wireless sensor networks (WSN) in various fields such as environmental monitoring and healthcare is gradually becoming widespread. However, sensor nodes in WSN are vulnerable to security threats, especially dishonest recommendation attacks initiated by malicious nodes, which may compromise communication integrity. Therefore, detecting malicious nodes in WSN is particularly important. In recent years, several malicious node detection approaches based on trust management were proposed to protect the WSN against dishonest recommendation attacks. However, the existing approaches ignore data consistency and reevaluation of participating nodes in trust evaluation, which seriously undermine their effectiveness. To address these limitations, we propose a hybrid malicious node detection techniquefor WSN based on the fuzzy trust model (FTM) algorithm and the Bayesian belief estimation (BBE) approach. The key idea in the proposed approach is to determine direct trust values through the FTM algorithm using the correlation of data collected over time and ascertain the trustworthiness of indirect trust values from recommendation nodes via the BBE approach. The results of simulations conducted to evaluate the effectiveness of our approach show that our model can effectively detect malicious nodes in WSN better than the previous approaches.

Research on Safety and Security Assurance Architecture for  Digital Twin City Infrastructure

2024, 10(11):  997. 

Asbtract ( )   PDF (1706KB) ( )  

References | Related Articles | Metrics

Digital twin city represents a new model of city digital transformation driven by information technology, fostering the modernization of cities. With the continuous concentration of urban data and information resources, the integration between digital twin cities and real cities has deepened, amplifying the security challenges facing digital twin city infrastructure. This paper addresses various difficulties confronting digital twin city infrastructure, including the complex security issues of heterogeneous systems, lack of theoretical model guidance, difficulties in assessing the impact of network attacks and optimizing security management strategies, and new technology security risk response. In response, we propose a safety and security assurance architecture tailored for digital twin city infrastructure, which encompasses management, technology, exercise, and operation systems. Additionally, we discuss some key technologies and platforms aligned with this assurance architecture, aiming to provide reference for the safety and security construction of digital twin city infrastructures.

Keytarget Face Recognition Scheme Based on Homomorphic  Encryption and Edge Computing

2024, 10(11):  1004. 

Asbtract ( )   PDF (2205KB) ( )  

References | Related Articles | Metrics

With the promotion of China’s comprehensive national strength and international status, more and more major international events are held in China’s firsttier cities, such as the 31st Chengdu Universiade and the 19th Hangzhou Asian Games. The huge flow of people and complex crowd categories have caused considerable security pressure on the security team. Because the traditional face recognition system realizes face recognition in the central server in plaintext state and relies on the traditional state secret algorithm to ensure security, the computational efficiency and security of the whole system cannot be fully guaranteed. Therefore, based on the CKKS homomorphic encryption scheme and Insightface face recognition algorithm, this paper proposes a keytarget face recognition scheme supporting edge computing. Firstly, the key face features are encrypted by the CKKS homomorphic encryption scheme, and the ciphertext data are distributed to each frontend monitoring device. After that, the frontend monitoring device is responsible for extracting the face features of the scene crowd and calculating the matching degree with the ciphertext database. Finally, the ciphertext calculation results are returned to the central server and decrypted. Experimental results show that the recognition accuracy of the proposed scheme is 98.2116% when the threshold is 1.23 on LFW data sets, which proves the reliability of the proposed scheme.

Abnormal Traffic Detection in the Internet of Things Based on Imbalanced Data

2024, 10(11):  1012. 

Asbtract ( )   PDF (2015KB) ( )  

References | Related Articles | Metrics

In order to deal with the problem of data category imbalance, which puts forward the low performance of the abnormal traffic detection model of the Internet of things, this paper proposes an abnormal traffic detection method based on category imbalance. Firstly, the Kmeans SMOTEENN algorithm based on MD (Mahalanobis distance) is used to generate noisefree data to effectively achieve balanced data sample distribution. Secondly, aiming at the low performance of the abnormal traffic detection model, a model combining the CNN (convolutional neural network) and the BiLSTM (Bidirectional long shortterm memory) is constructed. By extracting the local convolution features and key features of abnormal traffic. Finally, classification is performed through the fully connected layer and Softmax classifier. Experimental results show that compared with existing abnormal traffic detection methods, the proposed method achieved significant improvements in evaluation indicators such as accuracy, recall, precision and F1 value. The model can accurately identify abnormal behaviors in traffic with an accuracy rate as high as 99.43%.

Research on Safety Strategies of Multisource Vehicle Information Functions  for Autonomous Driving

2024, 10(11):  1020. 

Asbtract ( )   PDF (2645KB) ( )  

References | Related Articles | Metrics

To enhance the security of Ethernet communication involving multisource vehicle information in automated driving, a hybrid functional safety strategy based on endtoend (E2E) and secure onboard communication (SecOC) is proposed. Based on the characteristics of the vehicle electronic and electrical architecture, and in accordance with the AUTOSAR security specification, the strategy firstly employs virtual LAN domain isolation division technology to construct a multidomain and layered network security architecture from the outside to the inside; Secondly, a secure onboard Ethernet communication protocol reliant on the IEE802.1Q and SecOC policies is designed. An improved method of slidingwindow payload updating is also proposed; Finally, authentication, encryption, and secure onboard communication are implemented on sensitive data of the Ethernet network. Sensitive data to implement information security functions such as authentication, encryption and decryption operations and freshness value synchronization management. The test results demonstrate that the implementation of this strategy realizes the data tampering prevention and replay prevention attack during the interdomain Ethernet communication of multisource vehicle information, and makes the sensitive data have multilevel protection features from access restriction, information encryption and protection to identity uniqueness, which further provides a strategy idea for the interdomain Ethernet information security of selfdriving vehicles.

Research Progress on Large Language Models in the Generation of  Threat Intelligence

2024, 10(11):  1028. 

Asbtract ( )   PDF (1171KB) ( )  

References | Related Articles | Metrics

In the expansive realm of computational language processing, a revolutionary entity known as large language models has emerged, garnering attention for its profound ability to comprehend intricate language patterns and generate consistent, contextually relevant responses. Large language models, a type of artificial intelligence, have evolved into powerful tools for various tasks, including natural language processing, machine translation, and questionanswering. In the practical application of threat intelligence, these models exhibit exceptional performance, particularly showcasing significant advantages in critical tasks such as entity recognition, event analysis, and relation extraction. Their contextual understanding capabilities enable them to navigate complex threat scenarios effectively, while hierarchical representation learning allows them to capture diverse structural layers within the text. Furthermore, large language models enhance their adaptability to different domains and specific tasks by leveraging knowledge acquired through transfer learning from general language understanding tasks to threat intelligence tasks. This research trend not only propels technological innovation in the field of threat intelligence but also opens new possibilities for more intelligent and efficient threat analysis and response. However, as research advances, challenges such as data heterogeneity and privacy protection need to be addressed to better facilitate the sustainable development of large language models  in the threat intelligence domain.

A Blockchainbased Privacypreserving Carbon Accounting Model

2024, 10(11):  1036. 

Asbtract ( )   PDF (1524KB) ( )  

References | Related Articles | Metrics

Carbon accounting helps guide governments in formulating emission reduction policies, promoting lowcarbon economic development, and fostering international cooperation to address climate change challenges. Currently, the carbon accounting mechanism faces issues such as underreporting, concealment, and falsification of corporate carbon emission data to reduce the cost of carbon quota clearance, as well as insufficient regulatory efforts among participants, leading to a lack of authenticity and accuracy in accounting, and difficulty in protecting corporate data privacy. To address these issues, this paper proposes a privacyprotecting carbon accounting model based on blockchain technology. Firstly, by integrating with blockchain, data is made public, transparent, and traceable by uploading it onto the chain. Secondly, to address privacy concerns of data on the chain, this paper employs a homomorphic encryption system to encrypt the data. Additionally, digital signature technology is introduced to allow multiple participants to sign the data for mutual confirmation. Finally, this paper designs a ciphertextbased comparison protocol, expanding the auxiliary functions of the carbon accounting management system, and providing a secure data comparison function between enterprises. Theories and experiments demonstrate that this solution can efficiently and securely achieve carbon accounting.

Research on Security Verification of RFID Authentication Protocol #br# Based on Model Checking#br#

2024, 10(11):  1043. 

Asbtract ( )   PDF (1273KB) ( )  

References | Related Articles | Metrics

RFID technology, as the core technology of the Internet of Things, has been widely used in various fields. Currently, RFID systems frequently face security threats, mainly due to the wireless communication used by the readers and tags in RFID systems. RFID security authentication protocols, as an important means to ensure communication security in RFID systems, are crucial for their inherent security. Formal methods have become a major technical approach for enhancing the inherent security of protocols.A general modeling method is proposed for the typical ultralightweight mutual authentication RCIA protocol. Using this method, an SMV (symbolic model verification) model is established for the RCIA protocol, and security property verification is conducted on this model using NuSMV. Experimental results confirm the existence of security flaws in the consistency aspect of the RCIA protocol. Further analysis of the verification results is provided, along with corresponding attack paths for the flaws. A general solution is proposed for this flaw, and its feasibility is evaluated.

Optimization Method for Fuzz Testing Cases of WiFi Protocol  Based on Weight Feedback#br#

2024, 10(11):  1049. 

Asbtract ( )   PDF (1273KB) ( )  

References | Related Articles | Metrics

With the widespread application of wireless networks and the rapid development of Internet of Things, the security of WiFi protocol has become an important concern in the field of network security. Fuzz testing, as an effective method for detecting software vulnerabilities, has been widely used in the security testing of WiFi protocols. However, traditional fuzz testing methods have certain limitations in the generation and optimization of testing cases, resulting in low efficiency and unsatisfactory accuracy in vulnerability mining. This paper first analyzes the characteristics of the WiFi protocol and the strategy of fuzz testing, and then proposes a configuration tree model for the weight of the testing cases suitable for the WiFi protocol and a calculation matrix of weight based on critical values. By introducing a multiround mechanism of fuzz testing and realtime weight feedback, the dynamic adjustment of the weight of the testing cases are realized, and testing cases that are more likely to trigger exceptions are screened out. The experimental results show that the method proposed in this paper can significantly improve the effectiveness of fuzz testing cases of WiFi protocol and the accuracy of vulnerability mining.

Reentrancy Vulnerability Detection Method in Smart Contracts #br# Based on Hybrid Model and Attention Mechanism#br#

2024, 10(11):  1056. 

Asbtract ( )   PDF (2021KB) ( )  

References | Related Articles | Metrics

Addressing the challenges of low efficiency and accuracy in reentrancy vulnerability detection by traditional smart contract vulnerability detection tools and single deep learning models, this paper proposes a reentrancy vulnerability detection method based on hybrid model and attention mechanism (CNNBiLSTMATT). Firstly, data processing is performed using the Word2vec model to obtain feature vectors. Secondly, these vectors undergo processing through a combination of convolutional neural network (CNN) and bidirectional long shortterm memory (BiLSTM) networks to extract features. The attention mechanism then assigns weights to highlight key features. Finally, a fully connected layer and Softmax classifier are utilized to classify the generated results, enabling reentrancy vulnerability detection in smart contracts. The experimental results demonstrate that compared with the traditional tools and deep learning methods, the method based on CNNBiLSTMATT proposed in this paper has been greatly improved in reentrant vulnerability detection. The accuracy, precision, recall rate and F1 value reached 92.53%, 93.27%, 91.73% and 92.5% respectively, confirming the effectiveness of the proposed method.

Dynamic Searchable Encryption Scheme Supporting Fuzzy Multiple Keywords

2024, 10(11):  1064. 

Asbtract ( )   PDF (2035KB) ( )  

References | Related Articles | Metrics

With the development of cloud computing, the convenience and costeffectiveness of cloud storage have caused a large number of users to store personal data on thirdparty cloud servers. While encrypted storage of data in the cloud ensures data security, it also introduces challenges in data retrieval. Dynamic symmetric searchable encryption technology emerged as the times require, which not only effectively protects data privacy but also enables multikeyword joint search functions. Additionally, the fuzzy search introduced by this technology in practical applications enhances the user’s search experience and improves search efficiency. However, the current searchable encryption schemes that supports fuzzy search has certain security risks and do not adequately address potential information leakage issues during dynamic updates. To tacklethese issues, this paper proposes a dynamic searchable encryption scheme that supports fuzzy multikeywords, ensuring information security during dynamic updates, and also supporting multikeyword joint search and fuzzy search. This scheme designs a keyword encoding algorithm and localitysensitive hash function to build a fuzzy index, and uses a Bloom filter encryption algorithm to encrypt the index to achieve fuzzy search. Furthermore, a trusted execution environment is introduced to reduce the communication overhead and computing overhead as well as the number of interactions between users and servers. Finally, the safety and effectiveness of this scheme were verified through experiments.

Blockchainbased Multifactor Crossdomain Authentication Scheme for IoV

2024, 10(11):  1074. 

Asbtract ( )   PDF (4252KB) ( )  

References | Related Articles | Metrics

With the rapid rise in the number and prevalence of vehicular network (IoV) applications and services, the number of users has continuously increased, making the security of the IoV environment a crucial concern. In IoV systems, there is a risk of vehicle information being stolen or tampered with, which further affects the healthy operation of the system. To address this issue, this paper proposes a blockchainbased crossdomain authentication scheme for IoV. By integrating the entire IoV into a consortium blockchain, the trust gap between different domains is effectively resolved. Multifactor authentication of vehicle user information is employed to effectively prevent information leakage and ensure data security. The combination of blockchain and authentication technologies significantly reduces redundant operations in user identity authentication while enabling synchronized queries of IoV information. From a data security perspective, the security analysis demonstrates the feasibility of this scheme.