The reliance on Network Function Virtualization (NFV) and Software-Defined Network (SDN) introduces a wide variety of security risks in Service Function Chain (SFC), necessitating the implementation of automated security measures to safeguard ongoing service delivery. To address the security risks faced by online SFCs and the shortcomings of traditional manual configuration, we introduce Intent-Based Networking (IBN) for the first time to propose an automatic security enhancement method through embedding Network Security Functions (NSFs). However, the diverse security requirements and performance requirements of SFCs pose significant challenges to the translation from intents to NSF embedding schemes, which manifest in two main aspects. In the logical orchestration stage, NSF composition consisting of NSF sets and their logical embedding locations will significantly impact the security effect. So security intent language model, a formalized method, is proposed to express the security intents. Additionally, NSF Embedding Model Generation Algorithm (EMGA) is designed to determine NSF composition by utilizing NSF capability label model and NSF collaboration model, where NSF composition can be further formulated as NSF embedding model. In the physical embedding stage, the differentiated service requirements among SFCs result in NSF embedded model obtained by EMGA being a multi-objective optimization problem with variable objectives. Therefore, Adaptive Security-aware Embedding Algorithm (ASEA) featuring adaptive link weight mapping mechanism is proposed to solve the optimal NSF embedding schemes. This enables the automatic translation of security intents into NSF embedding schemes, ensuring that both security requirements are met and service performance is guaranteed. We develop the system instance to verify the feasibility of intent translation solution, and massive evaluations demonstrate that ASEA algorithm has better performance compared with the existing works in the diverse requirement scenarios.
Boomerang attack serves as a potent cryptanalytic tool for assessing the security of block ciphers. Over the past few years, various automatic search models for boomerang distinguishers have been proposed for block ciphers with different structures. This paper presents improved Mixed-Integer Linear Programming (MILP)-based search models for both single-key and related-key boomerang distinguishers. In the single-key scenario, we propose a method for dynamic allocation of active S-boxes. Our search model for single-key boomerang distinguishers characterizes the distinguisher probability more accurately, addressing the suboptimality issue caused by non-fixed weight assignments in prior models. In the related-key scenario, a search model for related-key boomerang distinguisher is proposed for block ciphers with bit-level key schedule algorithms, where the probability of the boomerang switch is ensured to be 1. To validate the effectiveness of our models, we apply them to the lightweight block cipher LILLIPUT based on Extended Generalized Feistel Networks (EGFN), conducting a comprehensive security analysis against boomerang attacks. Using our models, we successfully derive single-key boomerang distinguishers for 8 to 13 rounds and a 15-round related-key boomerang distinguisher. Notably, the data complexity required for 13-round single-key distinguishing attack is reduced by 2^ 3.172 , and the 15-round related-key boomerang distinguisher with a probability of 2^ - 58 is currently the longest-round distinguisher among all known distinguishers for LILLIPUT. The application results fully demonstrate the capability of our models in evaluating the security of block ciphers. This research not only provides new insights and methods for the design and analysis of lightweight block ciphers, but also deepens the understanding of the security characteristics for LILLIPUT.
With the continuous evolution of cyberattack techniques, Advanced Persistent Threats (APTs) establish covert Command and Control (C2) channels for long-term infiltration, posing severe security risks. Existing C2 detection methods heavily depend on metadata from the encryption handshake stage, rendering them vulnerable to evasion techniques such as mimicking legitimate TLS fingerprints or randomizing handshake parameters. Additionally, these methods are susceptible to network noise and lack of cross-protocol generalization. To address these challenges, we propose C2Detector, an interaction-enhanced and semantic-aware detection method. By shifting the focus from potentially unreliable handshake metadata to the semantics of the data transmission stage, C2Detector reconstructs network sessions into protocol-independent interaction-state transition sequences. This approach eliminates underlying noise and captures high-level interaction semantics. A spatio-temporal neural network is then employed to learn complex behavioral patterns from these sequences. In complex mixed-traffic environments, C2Detector achieves an F1-score of 0.989. Importantly, in a zero-shot generalization test, the model trained exclusively on TCP traffic successfully identified unseen DNS and ICMP C2 channels, achieving F1-scores of 0.931 and 0.826, respectively. These results suggest the method’s potential advantages in both accuracy and generalization.
This paper presents a Multi-scale Semantic and Topology Enhanced YOLOv8 (MSTE-YOLOv8) for thermal power plant facility detection in high-resolution remote sensing imagery. The model introduces three key modules: a Multi-scale Feature Refinement Module that optimizes hierarchical feature extraction through wavelet-based downsampling, a multi-semantic spatial attention mechanism that enhances discriminative feature learning while suppressing background interference and a Topology Enhanced Loss function that explicitly models spatial relationships between facilities. Evaluated on a dataset of 1130 Google Earth satellite images containing nine facility categories, MSTE-YOLOv8 achieves a mean average precision of 0.888, surpassing all compared models. Comprehensive ablation studies reveal the progressive performance enhancement when integrating modules sequentially, and the full integration of all three modules surpasses the baseline YOLOv8 with mAP of 0.021. This study provides an effective solution for automated power plant monitoring, with potential applications in facility management, maintenance planning and safety inspection.
Network failures, whether due to random disruptions or malicious attacks, pose significant challenges for uncrewed aerial vehicle (UAV) swarm networks. One critical concern is determining which failed UAVs to recover or replace under limited resource conditions to enhance the robustness of their communication networks. Current research primarily considers static structural characteristics of the network and struggles to uncover deep features that influence network robustness, and the efficiency cannot meet the real-time needs in UAV swarm scenarios. To address these issues, we introduce a Prioritized Recovery strategy for failed nodes based on graph reinforcement learning (PRGRL). This approach integrates a random SAmpling neighbor method with a multihead attention mechanism to create a novel graph convolutional kernel (SAGCK). This kernel is designed to extract global structural information and relative positional information of nodes within the graph. Additionally, we develop a deep policy network (DPN) that explores the intricate relationships between graph-level and node embedding features, enabling the assessment of nodes' impact on overall robustness. PRGRL's network parameters are automatically updated and optimized using scalable deep reinforcement learning. Importantly, PRGRL prioritizes the recovery of boundary nodes within connected components to enhance network robustness further. Our experiments, conducted on both simulated and real-world networks, demonstrate that PRGRL outperforms existing methods of robustness enhancement across various recovery ratios, attack strategies, and network sizes while delivering superior real-time performance.
