The TCP protocol’s inherent lack of built-in security mechanisms has rendered it susceptible to various network attacks. Conventional defense approaches face dual challenges: insufficient line-rate processing capacity and impractical online deployment requirements. The emergence of P4-based programmable data planes now enables line-speed traffic processing at the hardware level, creating new opportunities for protocol protection. In this context, we present MARS -a data plane-native TCP abuse detection and mitigation system that synergistically combines the Beaucoup traffic monitoring algorithm with artificial neural network (ANN) based anomaly detection, enhanced by adaptive heuristic mitigation rules. Through comprehensive benchmarking against existing TCP defense mechanisms, our solution demonstrates 12.95% higher throughput maintenance and 25.93% improved congestion window recovery ratio during attack scenarios. Furthermore, the proposed framework establishes several novel evaluation metrics specifically for TCP protocol protection systems.

Software-Defined Networking (SDN) is a promising architecture that disentangles the control plane from the data plane. A mainstream southbound protocol for controller-to-switch communication in SDN is OpenFlow. In an OpenFlow-enabled network, SDN switches are connected to the logically centralized control plane, which issues control messages to direct packet forwarding and processing in the data plane. Given that the finite capacity of physical flow tables of switches, typically implemented with ternary content addressable memory (TCAM), attackers have the ability to carry out Denial-of-Service (DoS) attacks aimed at depleting the TCAM's resources and causing an overflow of the flow table. In this paper, we propose FTODefender, a method combining eviction and cut-off attack sources to detect Low-rate Flow Table Overflow (LFTO) attacks and mitigate this kind of attacks in time. FTODefender consists of two modules: Detector and Mitigator. Detector periodically examines the flow table and extract four specific detection features. It then employs the trained CRITIC weights to calculate the detection score based on these extracted features to verify if the LFTO attack has happened. Mitigator computes the features for each flow and utilizes the LightGBM-LR classification model to identify attack flows among all flows. Then, the module evicts the malicious rules to mitigate attacks. Finally, Mitigator counts the occurrence of each source IP address in the eviction list, determines the attacker IP based on a predefined threshold, and issues a flow rule to drop all packets originating from the attacker's IPs to sever the attack sources. Simulations show the effectiveness of FTODefender in mitigating the LFTO attacks, which proves that FTODefender is a practical solution to flow table overflow attacks.

The Low -rate denial of service (LDoS) attack is a variant of denial of service (DoS) attack that exploits low overhead to render target services unreachable for legitimate users. Unlike legacy networks, software -defined networking (SDN) separates the behavior of controlling and forwarding, providing excellent programmability to achieve real-time defense against LDoS attacks. Leveraging the potential of SDN's programmability, we propose a real-time anomaly defense framework tailored for SDN, named ERT-EDR. This framework is capable of detecting and mitigating TCP-targeted LDoS Attacks and comprises three modules: (1) The Information Collection Module. It periodically samples the traffic statistics for analysis. (2) The LDoS Attack Detection Module. It combines six features of traffic statistics and utilizes the Extremely Randomized Trees (ERT) algorithm to detect. (3) LDoS Attack Mitigation Module. It locates attacked ports with the Edit Distance on Real sequence (EDR) algorithm and installs flow table entries to filter attack traffic. Extensive experiments are conducted under various background traffic scenarios to validate the effectiveness and scalability of ERT-EDR. The results demonstrate that ERT-EDR can effectively detect TCP-targeted LDoS attacks with 96.4667% accuracy and 96.4977% F 1 score . Furthermore, it accurately identifies the attacked port and successfully mitigates attacks.

Low-rate denial of service (LDoS) attacks are a variant of denial of service (DoS) attacks that render target services unreachable for legitimate users at a lower cost. Unlike legacy networks, software-defined networking (SDN) separates the behavior of controlling and forwarding, providing excellent programmability to achieve real-time defense against LDoS attacks. Leveraging the potential of SDN’s programmability, we propose a real-time anomaly defense framework tailored for SDN, named ERT-EDR. This framework is capable of detecting and mitigating TCP-targeted LDoS Attacks and comprises three modules: (1) The Information Collection Module. It periodically samples the traffic statistics for analysis. (2) The LDoS Attack Detection Module. It combines six features of traffic statistics and utilizes the Extremely Randomized Trees (ERT) algorithm to detect. (3) LDoS Attack Mitigation Module. It locates attacked ports with the Edit Distance on Real sequence (EDR) algorithm and installs flow table entries to filter attack traffic.Extensive experiments are conducted under various background traffic scenarios to validate the effectiveness and scalability of ERT-EDR. The results demonstrate that ERT-EDR can effectively detect TCP-targeted LDoS attacks with 96.4667% accuracy and 96.4977% F1score. Furthermore, it accurately identifies the attacked port and successfully mitigates attacks.

Software-Defined Networking (SDN) is a new paradigm that facilitates network management by enabling programmability and disassociating the control plane from the data plane. SDN places the control plane into one or more controllers that take charge of the entire network. However, the logically centralized controller of SDN makes it subject to some security issues. Denial-of-Service (DoS) attacks are the main threat to SDN that can lead to impaired performance of the entire network. Low-rate Denial-of-Service (LDoS) attack is a variant of DoS attacks with a lower average attack rate and high concealability which is difficult to identify with traditional DDoS/DoS attack detection mechanisms. Additionally, existing LDoS attack detection and defense mechanisms often have weak real-time performance. To address this issue, we propose in this paper PeakSAX, a novel framework that can protect SDN against LDoS attacks in real-time by (1) Attack monitoring, (2) Traffic symbolization, (3) Malicious traffic identifying, (4) Attacker location, and (5) Mitigation strategy deployment. Simulation results show that PeakSAX can quickly identify and mitigate the impact of LDoS attacks about 4s, which improves over 70% compared to existing solutions.

The simplified data plane of Software-Defined Network (SDN) should be able to process packets from the entire network. However, the flow table size constrains the data plane forwarding capacity and may cause malicious attacks. In this paper, we study the slow-rate flow table overflow (SFTO) attack, which causes flow table overflow by sending unmatched packets at a slow rate to trigger flow entry installation, occupying the flow table space. To protect the availability of flow tables and the forwarding efficiency of normal flows, we propose a real-time SFTO attack detection and mitigation system based on rule number prediction and adaptive eviction proportion called SFTO-Guard. The SFTO-Guard consists of three modules: rule prediction module, attack detection module and attack mitigation module. Rule prediction module monitors the rule number in the flow tables and makes real-time predictions. When the predicted value reaches the attack threshold, the module collects the rules in flow tables and extracts features, then starts the attack detection module. When SFTO attack is detected, the attack mitigation module adaptively calculates the rule eviction proportion based on the predicted rule number and the attack detection results, and evicts suspected flow entries to prevent flow table overflow. Experiments on SFTO-Guard show that the proposed system can mitigate SFTO attacks effectively with low system overhead and short response time, it can limit malicious rules in flow tables to less than 10% and it is practicable in SDN deployments.

Software-defined networking (SDN) is a new network architecture that separates the data plane from the control plane and provides network programmability, dynamic deployment, and management of network traffic. However, its security also faces many threats, such as low-rate denial of service (LDoS) attacks. The LDoS attack can use the vulnerability of the TCP congestion control mechanism on the network and requires only a small amount of attack data to achieve the attack effect, which make it harder to detect and mitigate than traditional DoS attacks. In this paper, we propose an LDoS attack detection and mitigation scheme. Our detection scheme collects the features of network traffic and uses the FSS-RSR algorithm to detect LDoS attacks in real time. Our mitigation scheme monitors traffic fluctuations to locate attack source IP addresses and delivers traffic rules to mitigate attacks. The experimental results show that our scheme has high accuracy and low complexity for LDoS attack detection, and a short response time for LDoS attack mitigation of fewer than 8 seconds.

A vehicle detection system is a core ADAS function for automatic driving. However, owing to the low-light environment, nighttime vehicle detection is a big challenge. Current techniques have the limitation of not being able to fully extract the nighttime vehicle features. To solve the problem, this study proposes a nighttime framework, which employs multiple means to enhance nighttime vehicle information. First, multiple image enhancement techniques are used to rich the training datasets, and an improved Bio-Inspired Multi-Exposure Fusion (BIMEF) algorithm is proposed to improve the quality of the nighttime images. Then, the multi-scale salient feature maps of highlight vehicle regions are combined with vehicle visual feature maps to enhance vehicle information during detection. At last, an ensemble algorithm is proposed to combine multiple networks to provide richer vehicle visual features. Experiment results show the effectiveness of our method in terms of accuracy and speed. Additionally, our method is robust in multiple complex night scenes.

With the large-scale application of cloud storage, how to ensure cloud data integrity has become an important issue. Although many methods have been proposed, they still have their limitations. This paper improves some defects of the previous methods and proposes an efficient cloud data integrity verification scheme based on blockchain. In this paper, we proposed a lattice signature algorithm to resist quantum computing and introduced cuckoo filter to simplify the computational overhead of the user verification phase. Finally, the decentralized blockchain network is introduced to replace traditional centralized audit to publicize and authenticate the verification results, which improves the transparency and the security of this scheme. Security analysis shows that our scheme can resist malicious attacks and experimental results show that our scheme has high efficiency, especially in the user verification phase.

Low-rate Denial of Service (LDoS) attack can greatly degrade the performance of the attacked service by exploiting the security vulnerability in the adaptive mechanism of network protocol. This attack is destructive and awfully covert. For the low accuracy and high complexity of the existing algorithms, this paper proposes a method of attack detection based on WPD-EE. When LDoS attack occurs, TCP congestion control is forced to trigger frequently, which causes a large number of packet loss, resulting in strong periodic fluctuations and discrete characteristics of TCP traffic. Based on the characteristics caused by this LDoS attack, wavelet packet decomposition is carried out for TCP traffic sequence analysis, and then the decomposed node coefficients are reconstructed, so that each signal can reflect the information of TCP traffic influencing factors. Through the calculation of the difference of energy entropy to analyze whether the traffic sequence has discrete characteristics, so as to realize the effective detection of LDoS. Due to the advantages of wavelet packet analysis for more detailed high-frequency signal processing, the method proposed in this paper has high accuracy. In this paper, NS-2 experimental platform, WIDE2018 dataset and TestBed are used for multiple experiments. Experiments show that the proposed algorithm has high accuracy and low false positive rate, which has better advantages than the other related algorithms, and can detect LDoS attack effectively.

Low-rate denial-of-service (LDoS) attack reduce the performance of network services by periodically sending short-term and high-pulse packets. The behavior of LDoS attack is indistinguishable from normal traffic due to its low average rate. Many networks do not have an effective mechanism to deal with the threat from LDoS attack, including the emerging Internet of Things. When LDoS attack occurs, multiple features of network will change. It is difficult to describe the state of the whole network by one feature. So it needs many features to precisely represent the state of the network. In this paper, we propose a LDoS attack detection method based on multi-feature fusion and convolution neural network(CNN). In this method, we compute a variety of network features and fuse them into a feature map, which will be used to characterize the state of the network. CNN model is an excellent classification algorithm for image recognition in the field of deep learning. It can distinguish the difference between feature maps and detect the feature maps which contain LDoS attack. We validate and evaluate our method by conducting experiments on NS2 simulation platform and test-bed platform. The experimental results show that our method can detect LDoS attack effectively.

Network and communication security are the focus of attention. Low-rate denial of service (LDoS) attacks exploit deficiencies of TCP protocol to restrain TCP throughput and network quality of links, by sending pulse sequences periodically. It is difficult for the defense against LDoS attacks by the available DoS attacks detection methods, due to the low average rate and prodigious concealment of LDoS attacks, which threats on the network security seriously. In this paper, a new approach for LDoS attacks detection based on the advanced Mean Shift clustering algorithm with weighted Euclidean distance (WEDMS) is proposed. Based on the distinction that the discreteness of network traffic suffering LDoS attacks is more obvious than that of legitimate traffic, network traffic can be clustered by the WEDMS algorithm. After cluster analysis, the existence of LDoS attacks can be validated according to the decision feature of the clustering results. Experiments on detection performance are carried out in NS-2, test-bed, and public datasets such as LBNL, WIDE2006, and WIDE2018. The experimental results illustrate that the presence of LDoS attacks can be identified by the proposed method with higher TPR and lower FPR.

Convolutional neural network (CNN) has lately received great attention because of its good performance in the field of computer vision and speech recognition. It has also been widely used in natural language processing. But those methods for English cannot be transplanted due to phrase segmentation. Those for Chinese are not good enough for poorly semantic retrieving. We propose a Chinese sentiment classification model on the concept of convolution control block (CCB). It aims at classifying Chinese sentences into the positive or the negative. CCB based model considers short and long context dependencies. Parallel convolution of different kernel sizes is designed for phrase segmentation, gate convolution for merging and filtering abstract features, and tiering 5 layers of CCBs for word connection in sentence. Our model is evaluated on Million Chinese Hotel Review dataset. Its positive emotion accuracy reaches 92.58%, which outperforms LR_all and DCN by 2.89% and 4.03%, respectively. Model depth and sentence length are positively related to the accuracy. Gate convolution indeed improves model accuracy.

Aiming at the problem of image tampering, a novel detection method is proposed based on the image noise and lacunarity. As there exist differences in image sensor pattern noise and image lacunarity between real image and tampered image, standard deviation of noise, relative frequency lacunarity (RFL), relative frequency mean (RFM) and relative frequency variance (RFV) are extracted from the suspected image to construct feature space. By using LIBSVM classifier, the image is detected if it is tampered or not. Experimental results and analysis show that it can effectively be used for the detection of real image and tampered image, natural image and computer generated graphics. Furthermore, it can be implemented for the detection of artificial blurring in the image with high precision.

Existed privacy security studies focus on privacy and security issues of data,user identity and single service request,and for the privacy leakage problem of multiple cloud service requests causing by multidimensional environment,such as factors logical association and timing series disclosures,there is no complete solution.For such problems,this paper proposes a method for measuring the importance of privacy information for multiple cloud service requests,then makes risk assessment based on D-S evidence theory for this scenario,and finally combines with the improved noise generation and obfuscation strategy to build an effective protection framework for the privacy of multiple cloud service requests.Experimental result shows that the proposed method can ensure the security of multiple cloud service requests without significantly increasing the overhead.

Network intrusion detection based on SVM is the hot topic of network security research, and the existing researches have low detection rate, high false positive rate and other issues. Optimizing particle swarm optimization parameters of SVM is an effective solution, but the PSO algorithm is easy to fall into local optimum and results premature convergence.We propose an improved particle swarm optimization algorithm ICPSO, which use chaos operator ergodicity, randomness, sensitivity to initial conditions and other characteristics and the ICPSO is used to make the chaos into the inertia weight factor parameters and The chaos is applied to the optimization of the RBF kernel function parameter g and the penalty factor C, and to improve the convergence speed and precision of the particle swarm optimization. The experimental results show that: relative to the PSO-SVM algorithm and GA-SVM algorithm, ICPSO-SVM improves the efficiency of intrusion detection, and is an effective intrusion detection model.

With widespread pervasion of Location-Based Service (LBS), location privacy has attracted more and more attention. In the traditional LBSs model, users need to repeatedly send their location information to the provider's servers or an intermediate Anonymizing Server (AS) for service, which has a lot of disadvantages, such as the low reutilization ratio of the information, the high threat of un-trusted service providers and the excessive reliance on AS. The latest cache method gives a new idea, but it does not take users' mobile behavior into account. To address these issues, this paper presents a multi-level location privacy protection method, RuleCache, which combines the users' mobility patterns with cache and utilize the cache content of distributed neighbors to protect location privacy. Moreover, when the user has to send query to the LBS server, we propose a Cloaking Region Generating Algorithm (CRGA) to achieve protection which considers the factor of query probability and data timeliness to increase cache contribution rate and update outdated data in time, respectively. We carry out extensive simulation and evaluation show that our RuleCache have a higher performance than many other methods on communication cost, cache hit ratio and storage cost.

Because of their low cost and adaptability, wireless sensor networks are widely used in civil, military, and commercial fields and other fields. However, since the sensor node in the calculation of the capacity, battery capacity, and storage capacity are restricted by the limitations and inherent characteristics of the sensor networks, compared to traditional networks, which makes wireless sensor networks face more security threats. This paper summarized research progress of sensor network security issues as three aspects, key management, authentication, and secure routing, analyzed and commented on these results advantages and disadvantages and pointed out the future direction of the hot research field.

Current privacy preserving data publishing techniques mostly concentrate on attributes of a single releasing. Nevertheless, most of the practical application may contain multiple release attributes. Directly applying the existing single release attribute to privacy preserving techniques often leads to unexpected private information leakage. This paper is first published by the time sequence introduced to several published data set problems, combined with the published data set Markov chain thought towards preserve data privacy. Experimental results show that the algorithm can effectively prevent the information loss of privacy, and enhance the security of the data release.

In cloud computing environment, service requests usually carry some sensitive information that will be treated as privacy and cloud service request privacy leakage problem has become a hotspot of cloud security research. Existing studies assumed that potential attackers only collected and dealt with the relevant information of single service request sequence, they did not distinguish the emphasis degree of users for these information. When applying directly to the scenes of multiple cloud service requests privacy protection, their strategies couldn't meet the needs of protection due to the limitations of their analytical perspective, and their cost would also increase. In this paper, we propose a method of sensitive information relation description and privacy measurement that caters to multiple cloud service requests, and conduct privacy leakage risk assessment under this scenario based on D-S evidence theory, then give the strategy of obfuscation choice and noise generation for multiple cloud service requests, finally build a cost-aware privacy protection framework for them. The simulation and analysis shows that our approach ensures the security of multiple service requests in cloud environment without significantly increasing the system overhead and saves the noise cost.