URL and DNS are two common attack vectors in malicious network activities; thus, detection for malicious URL and DNS is crucial in network security. In this paper, we propose an online detection scheme based on character-level deep neural networks. Specifically, this scheme maps the URL and DNS strings into vector form using some natural language processing methods. The CNN (Convolutional Neural Network) network framework is then designed to automatically extract the malicious features and train the classifying model. Experimental results on real-world URL and DNS datasets show that proposed method outperforms several state-of-art baseline methods, in terms of efficiency and scalability.

Visualizing massive network traffic flows or security logs can facilitate network forensics, such as in the detection of anomalies. However, existing visualization methods do not generally scale well, or are not suited for dealing with large datasets. Thus, in this paper, we propose a visualization scheme, where an attribute-oriented induction-based frequent-item mining algorithm (AOI-FIM) is used to extract attack patterns hidden in a large dataset. Also, we leverage the hypergraph to display multi-attribute associations of the extracted patterns. An interaction module designed to facilitate forensics analyst in fetching event information from the database and identifying unknown attack patterns is also presented. We then demonstrate the utility of our approach (i.e. using both frequent item mining and hypergraphs to deal with visualization problems in network forensics).

Distributed Denial of Service (DDoS) has been one of the most critical threats to internet applications and web services. Especially with the current advances in network technology, many attackers resort to application layer DDoS (ALDDoS) which utilizes legitimate requests to overwhelm the victim servers. Under this kind of attack, the single request content can be highly similar to normal ones, and this renders previous traffic features-based detectionmethods void. In this paper, we are addressing two common issues in ALDDoS detection methods: the inaccuracy of traffic feature based detecting algorithms, and the time and space complexity of user behavior-based detecting algorithms. Different from the existing detection pattern for each request, the detection pattern used in this paper is for a time window. We extract instances of traffic and user behaviors from web server logs, and propose a hybrid traffic-user behavior detection method for ALDDoS. Neutral network is adopted for further cluster analysis. Experimental results on the recent public dataset CICIDS2017 indicate that the proposed method can achieve high detection accuracy while reducing 90% of time cost.

Recent high profile data breaches have highlighted the importance of insider threat detection research for cyber security. Anomaly based insider detection approaches are generally associated with high false positives; thus, there has been increased focus on including prediction of user psychology and attack motivations. However, data relating to psychological profile and personality trait of employees are challenging to collect, and do not generally adequately capture attack motivations such as disgruntlement (e.g. towards certain behavior). Therefore, in this paper, we demonstrate how one can build a user psychological profile based on the sentiment analysis of their network browsing and email content. We then evaluate our approach using real-world datasets, and the findings suggest that our approach can proactively and accurately detect malicious insiders with extreme or negative emotional tendencies. This is the first work to build user profile and predict insider threats using sentiment analysis of their browsing and email content.

The collection and identification of digital evidence is an essential procedure in file forensics, which contains manual retrieval, traditional hash techniques and query by keywords techniques etc. For the vulnerability of electronic documents, it is easy to be changed or tampered with. So looking for files similar with target files becomes important for forensic. However, the traditional forensic system is usually based on searching for keywords or just scan the entire files, both lack of high enough speed and accuracy to support nowadays forensic tasks. Considering the fuzzy hash algorithm is of great value to calculating the similarity rate between files, in this paper, we analyzed the process and the improvement of the fuzzy hash algorithm, and verified the accuracy and efficiency of the improved algorithm, we innovatively applied fuzzy hash technology to the field of file forensic and designed a set of more adaptable and more accurate files forensic system, which follows the process of the acquisition of storage media, the collection of evident files, and the preservation of evident files, combined with text mining, data recovery technology, text clustering, classification, and some other technologies We believed that this system is a breakthrough of existing problems in file forensics field such like large manual workload and low accuracy.

In the paper, we modelling for information theft Trojan based on Stochastic Game Nets (SGN), a novel modelling method which good at multirole game problem described, and has been applied in many fields of networks with interactive behaviors. Combination the SGN and practical problem, we present an algorithm for solving the equilibrium strategy to computer the model of SGN. Finally we analyse our research paper with some indicators, such as the probability of a successful theft and the average time of a successful theft. The results of the paper can also offer some consultations for user.

云计算平台提供的资源高效利用与可伸缩性等优势吸引越来越多的企业或组织把业务与数据迁移到云计算平台中。伴随而来的是网络犯罪的增长和在云环境下数字取证需求的出现。本文通过分析目前的数字取证过程模型在云环境下的可行性,讨论了云环境下数字取证所面临的挑战,并展望了未来的研究方向。

保密技术检查中发现的一些涉嫌严重违规问题都需要依靠电子证据来认证,保密技术检查中发现问题性质的认定关键在于提取电子证据。但是,由于电子证据具有易删除、易伪造、易篡改和篡改后易消除痕迹等特点,不规范的取证操作不仅会破坏证据的法律效力,还极易造成证据的毁坏、丢失,甚至被覆盖。针对这一关键问题,本文作者从电子证据的脆弱性及取证过程中的证据保护两方面进行了深入探讨。

<正>1引言随着计算机网络的发展和普及,社会生活中的计算机犯罪行为不断出现。计算机犯罪行为是一种新兴的高技术犯罪,其很多犯罪证据都以数字形式通过计算机或网络进行存储和传输,包括记录、文件、源代码、程序等,即所谓的电子证据。电子证据十分脆弱,易于篡改、销毁,且与海量的正常数据混杂,难以提取。本文分析了计算机取证的现状、原则,研究了取证的流程及技术手段。