Hardware Trojans pose a significant security risk in space-ground integrated network (SGIN) devices. It is widely accepted in academia and industry that detecting hardware Trojans at an early stage, typically in register transfer-level (RTL) hardware design, can effectively protect the SGIN device. However, the few hardware Trojan samples dedicated to SGIN (called sHT) make it difficult to detect them using deep learning. To obtain more sHT samples automatically and quickly, this article proposes a lightweight automatic sample augmentation framework for hardware Trojan (HT-ASAF). In our scheme, we first designed a lightweight neural network called variational autoencoder for hardware Trojan (HT-VAE) to achieve high-generation quality without a large amount of training data. Further, we develop the positional state tree (PST) and introduce a node tuple representation for interconversion between PST and sequence to capture the intricate semantic features of concurrent operations in hardware design to enhance the performance of HT-VAE. To automatically verify the effectiveness of the augmented samples, we established an experimental platform incorporating cluster mapping (CLM), which can reduce the verification complexity. In our experiments, to obtain a small number of the training hardware Trojan samples for SGIN, we added activation mechanisms, such as velocity or altitude, to the existing RTL hardware Trojans samples to simulate the hardware Trojan threats faced by orbit devices. The set of the obtained samples is called sHT dataset. Experimental results on the obtained sHT dataset demonstrate that HT-ASAF can automatically and efficiently augment hardware trojan sample compared to existing augmentation schemes, and it performs well in the downstream task of hardware Trojan detection on SGIN devices.

LEO satellite non-terrestrial networks (NTN) utilize satellites in Low Earth Orbit (LEO) to dynamically establish global communication service and own significant promise. The dynamic nature of LEO satellite NTN necessities efficient handover authentication protocols. However existing schemes cannot be directly applied in LEO satellite NTN because of their low efficiency and security. To address these problems, we propose a handover authentication protocol to quickly and securely authenticate the user’s identity during the handover process. In our scheme, we incorporate an implicit session-bound random challenge to facilitate mutual authentication and key agreement between the User Equipments (UEs) and satellites. To improve authentication efficiency, we propose a batch handover mechanism to transfer the necessary security contexts, largely reducing the handover authentication cost. We verify our protocol’s security using BAN logic and Tamarin prover. The performance evaluation shows that SEHAP outperforms other schemes in both communication and computational efficiency in LEO satellite NTN.

In response to the demand for collaborative computation of multi-cryptographic jobs in cryptographic on-demand services within a cloud environment, a multi-cryptographic job collaborative scheduling algorithm was proposed. This algorithm effectively addressed new challenges in cloud environments, such as a variety of cryptographic algorithm types, high concurrency demands, random cross-job interactions, and sudden increases in workloads. Considering the dependencies among jobs, makespan of jobs and computational power of computing units, the scheduling problem for multi-cryptographic job collaborative service was modeled as a multi-objective optimization workflow scheduling problem. A two-stage “select-sort” scheduling algorithm was proposed. In the selection stage, the improved NSGA-III algorithm was employed to select computing units for cryptographic computing jobs, and in the sorting stage, the execution order was determined based on the urgency of jobs. Simulation results demonstrate that the proposed algorithm outperforms traditional scheduling algorithms in terms of energy consumption, migration costs, and adaptability to transient surges in loads.

Satellite internet of things (satellite IoT) has been utilized to achieve the integration of space-ground, human-thing connection, and information interaction through the satellite communication network and various types of spaceborne and ground terminal devices. It possesses advantages that are boundless in air and unobstructed on ground, as well as characteristics such as large-scale coverage, highly open links, dynamically changing topologies, limited terminal resources, and long communication latency. In order to achieve the safe and efficient utilization of satellite IoT resources, a trust evaluation-based terminal authentication method for satellite IoT was proposed, which could optimize the authentication strategy by evaluating the trust of terminal devices. A trust evaluation mechanism for satellite IoT terminals was proposed for two scenarios: terminals that had recently undergone strong authentication and had been granted credit by strongly authenticated nodes. A dynamically adjusted trust measurement and evaluation model was characterized based on direct trust and indirect trust. Secondly, a trust evaluation-based access authentication protocol for satellite IoT was designed, which adopted a matching authentication mechanism according to the trust degree of the device. This allowed for the simplification of the subsequent authentication process for high-trust devices and provided differential authentication services for different terminal devices under the same authentication strategy framework. The security of the protocol was comprehensively analyzed using non-formal methods and Tamarin formal tools, and the effectiveness of the protocol was verified by experiments. The protocol was shown to be capable of reducing the overall authentication overhead and simplifying the authentication process with trust.

The distributed dynamic network is vulnerable to scanning attacks due to the openness of wireless channels. Traditional defense systems tend to be passive and exhibit delayed responses. A moving target defense approach, namely Distributed Network Address Shuffling (DNAS), is proposed to thwart attackers’ network scanning through the shuffling of network addresses. To resolve address conflicts resulting from this shuffling, DNAS employs a dynamic diffusion method of allocated addresses before the shuffling process to reduce the probability of conflict generation, and utilizes a passive detection based conflict elimination algorithm after the shuffling process to eliminate any generated conflicts. To select low-risk addresses, DNAS leverages an artificial feature selection based Fully Connected Neural Network (FCNN) to recognize the attacker’s scanning policy, and identifies low-risk addresses based on the scanning range of the policy. Empirical experiments and theoretical analysis indicate that DNAS significantly reduces the probability of address conflict generation at a minimal cost. It effectively eliminates all generated address conflicts within an average conflict resolution time of less than 500ms. Furthermore, DNAS exhibits an accuracy of 99.45% in recognizing scanning policies, surpassing pseudorandom address hopping in diminishing the success rate of sequential, local random, and mixed scanning.

As mobile communications, the Internet, databases, distributed computing, and other technologies continue to develop, the Internet of Things (IoT) has emerged as prevalent technique. However, attacks on security and sensitive data in IoT occur frequently, and these attacks often evade intrusion detection systems strategically by mutating their traffic. To prevent security threats and sensitive data leakage, we propose a game approach based on adversarial deep learning to optimize a dynamic security threshold strategy. We introduce a mobile edge computing framework and utilize a game model to describe the adversarial interaction between the two participants. To solve the complexity of the game problem to gain dynamically randomized adversarial attacks, we present a column generation (CG) framework, which uses a feedforward neural network to quantify data flowing through IoT devices. Considering the limited resources of IoT devices, we calculate an optimal response to cyberattacks via a particle swarm optimization algorithm, aiming to reduce the false alarm rate. The adversarial dynamic threshold (ADT)‐based column generation (CG‐ADT) algorithm generates the set of detection threshold and the probability. Finally, we present the results of experiments conducted to demonstrate the effectiveness and robustness of the proposed dynamic threshold scheme for sensitive data security protection in IoT and its suitability for implementation in production systems.

In order to reduce the impact of increasingly sophisticated cyberattacks on the satellite Internet security, it is necessary to assess the satellite Internet security. Most of existing assessment schemes for network security risk mainly rely on expert knowledge to subjectively weight assessment indicator and quantify security risks, thus leading to results of assessment which are not objective. To address this problem, combining rough set with fuzzy hierarchy analysis, we propose a combination scheme to evaluate the indicator weights for assessing the satellite Internet security. First, from the perspective of IPDR model, we propose IPDR-based evaluation indicator system, and fuzzy hierarchy analysis is designed to fuse the indicator scores of more than one experts into one final value and obtain the subjective weight. Second, rough set theory is adopted to reduce indicators and correct the subjective weight obtained in the first step, thus obtaining the comprehensive weight. Finally, a series of experiments are carried out to validate our scheme.

With the help of satellites, Internet of Things (IoT) applications such as remote monitoring and ocean exploration can be realized. However, the network is vulnerable to malicious attacks due to the limited resources of satellite IoT (S-IoT) terminals and the openness of communication links. Ensuring that legitimate users can only access sensitive data remains a major concern. In this paper, a zero-trust access management model integrated with satellites, network and identity infrastructure, as well as the authentication protocol for S-IoT terminal security, was designed. The protocol adopts the Chinese cryptographic algorithms SM2, SM3, and SM4, combined with the Physical Unclonable Function (PUF) to achieve key agreement and bidirectional authentication. The security of this protocol is further analyzed, and its security, function, and performance are compared with other related protocols. Experimental results show that compared with existing similar schemes, the proposed protocol can more effectively consider the security requirements of S-IoT and reduce communication costs.

Insiders cause serious security threats to organizations. Existing insider threat detection methods mainly mine the users' behaviors or psychological features by analyzing the users' operation logs, and they ignore the associations of behaviors among users and get unappealing performance on the imbalanced samples. In this paper, considering attention mechanism, we propose Generative Adversarial Graph Attention Networks (GAGAN) to detect insider threats. First, we design association rules to construct a graph to associate users' behaviors. Second, to address the imbalanced samples, we adopt graph generator to generate abnormal nodes; A discriminator with graph attention networks is designed to further mine the potential associations of behaviors among users and discriminate real nodes from the generated nodes, also adopted to discriminate anomaly nodes from normal nodes. Experimental results on CERT data set demonstrate that our method can accurately detect abnormal insiders and outperforms several state-of-theart baseline methods.

Accurately constructing dynamic network topology is one of the core tasks to provide on-demand security services to the ubiquitous network. Existing schemes cannot accurately construct dynamic network topologies in time. In this paper, we propose a novel scheme to construct the ubiquitous network topology. Firstly, ubiquitous network nodes are divided into three categories: terminal node, sink node, and control node. On this basis, we propose two operation primitives (i.e., addition and subtraction) and three atomic operations (i.e., intersection, union, and fusion), and design a series of algorithms to describe the network change and construct the network topology. We further use our scheme to depict the specific time-varying network topologies, including Satellite Internet and Internet of things. It demonstrates that their communication and security protection modes can be efficiently and accurately constructed on our scheme. The simulation and theoretical analysis also prove that the efficiency of our scheme, and effectively support the orchestration of protection capabilities.

In the ubiquitous network environment, covert channel bypasses the system’s security strategy to transmit covert information by modifying the system’s shared resources, which poses a serious security threat to the computer and network system.The researches on covert channel in ubiquitous network environment were summarized and analyzed from three aspects of measurement, construction and detection.First, the typical covert channel metrics including the capacity, robustness, anti-detection, regularity and shape were summarized.Second, the construction technologies of covert channel were summarized and analyzed from six aspects of resource sharing, capacity, robustness, anti-detection, advantages and disadvantages in the first time.Third, the detection technologies of covert channel were compared and analyzed from five aspects of the type of covert channel, accuracy, whether it can be blind detection, the advantages and disadvantages.Finally, the development trends of covert channel were summarized and future research directions were prospected.

Policy-mapping mechanisms can efficiently help to realize the exchange and the sharing of cross-domain information at low cost. However, due to concerns over policy conflicts, if not sufficient incentives, most selfish domains are often disinterested in helping others to implement policy mapping cooperatively. Thus an appropriate incentive mechanism is required. In this paper, we propose an incentive mechanism to encourage selfish domains to take part in policy mapping and resolve policy conflicts. Formulating conflict resolution as a double auction and solving Bayesian Nash equilibrium, we design the optimal asking/bidding price scheme to maximize the benefits of the domains involved. Simulations demonstrate that our approach can efficiently incentivize selfish domains to take part in cooperation.

Due to the inaccuracy of threat detection and the scale of response policies, it is very difficult to accurately select response policies.To address the above problem, fuzzy interval decision diagram to quickly match response policy was proposed.Firstly, the response policy was formally and fuzzily defined.Considering threat type, threat level, attack frequency and propagation mode, an algorithm with fuzzy operator was designed to construct interval decision diagram.Further, a fuzzy match algorithm was proposed to quickly select response policies.Experimental results show the efficiency of the proposed approach.

To satisfy the above requirements that due to the dynamic characteristics (e.g., the dynamic variability of threats, and the dynamic changes of protection technology) of space-ground integration information network (SGIIN), the existing security technologies were no longer applicable.Firstly, a security-empowering architecture for SGIIN was designed and formalized, which integrated capability orchestration unit of security service, analysis unit of security situation and the response unit of security threat measure.Then, a double judgment method for the effectiveness of threat measure was proposed.Finally the method is theoretically proved to be credible by using belief mini-entropy.

To address the problem that the existing methods in multi-label learning did not efficiently deal with the problems, the instance structure based multi-label learning scheme with missing labels was proposed.By considering the feature and label structure of instance, the similarity of label vectors were exploit to fill the missing labels and the weight rank loss was exploit to reduce the model bias.Meanwhile, the weight rank loss was also exploit to reduce the model bias.More specially, the manifold structure was capture by forcing the consistency of the geometry similarity of labels and one of the predicted labels.By measuring ranking loss for complete labels and incomplete labels, the relevance of label was distinguish to instance.Experiment results show that the superior performances of the proposed approach compared with the state-of-the-art methods and the accuracy is improved by more than 10% compared with the best comparison scheme under some evaluation criteria.

Collecting security-related data of devices effectively is the foundation of analyzing network threats accurately. Existing data collection methods (full data collection, sampling based data collection and adaptive data collection) do not consider the validity of the collected data and their correlation, which will consume too much collection resources, resulting in low collection yield. To address this problem, considering the factors (relationship between node attributes, network topology relationship, threat status, node resource and node similarity) that impact collection costs and benefits, a rule association method to generate collection policies was designed. In the method, two types of association rules (inter-node association rules and inter-event association rules) were adopted to generate candidate data collection items and reduced the scope of data collection. Then, a multi-objective program was designed to maximize collection benefits and minimize collection costs. Further, a genetic algorithm was designed to solve this program. Proposed method was compared with existing data collection methods. The experimental results show that the number of the collected data records of proposed method is 1 000~3 000 less than that of others per 12 hours, and the validity of the collected data of proposed method is about 4%~10% higher than others, which proves the effectiveness of the proposed method.

Hierarchical management is a typical approach to managing complex information networks (CINs). In hierarchical management, as the only avenue to control information storage, transmission and usage, instruction interaction is often exploited by attackers to threaten CINs security. Now it has become a major challenge to ensure the security of instruction interaction. To address this challenge, in this paper, we propose a security model to manage instruction interaction for the hierarchical management in CINs. First, considering instruction lifecycle, we design five basic instruction operations (i.e., instruction generation, distribution, decomposition, execution, and execution outcome feedback) and formally define their semantics. Then a series of security rules for the basic operations are proposed to monitor and control the instruction interactions. We prove that, through these rules, both controllability and confidentiality can be provided. Finally, case studies demonstrate the feasibility of the proposed model.

Generating fine-grained response policies is a fundamental problem for Intrusion Response Systems (IRSs). Although existing schemes determine countermeasures and defense points efficiently, they ignore the deployment orders and execution durations of the selected countermeasures, which may impact response performance. To address this problem, by considering four attributes (i.e., attack damage, deployment cost, negative impact on QoS, and security benefit), we propose a decisionmaking framework for IRSs to reach fine-grained decisions to balance attack damage and response cost. We formulate decisionmaking as a single-objective optimization problem. To efficiently solve this problem, a Genetic Algorithm with Three-dimensional Encoding (GATE) is proposed to not only select countermeasures and defense points, but also determine deployment orders and execution durations. Simulation results demonstrate the efficiency of our approach.

With wide development of various information technologies, our daily activities are becoming deeply dependent on cyberspace. People often use handheld devices (e.g., mobile phones or laptops) to publish social messages, facilitate remote e-health diagnosis, or monitor a variety of surveillance. However, security insurance for these activities remains as a significant challenge. Representation of security purposes and their enforcement are two main issues in security of cyberspace. To address these challenging issues, we propose a cyberspace-oriented access control model (CoAC) for cyberspace whose typical usage scenario is as follows. Users leverage devices via network of networks to access sensitive objects with temporal and spatial limitations. We generalize subjects and objects in cyberspace and propose scene-based access control. To enforce security purposes, we argue that all operations on information in cyberspace are combinations of atomic operations. If every single atomic operation is secure, then the cyberspace is secure. Taking applications in the browser-server architecture as an example, we present seven atomic operations for these applications. A number of cases demonstrate that operations in these applications are combinations of introduced atomic operations. We also design a series of security policies for each atomic operation. Finally, we demonstrate both feasibility and flexibility of our CoAC model by examples.

Personalized collect policy is one of the necessary conditions for effectively monitoring threats in the complex network environment.However,differences in security requirements and threat types make it difficult to effectively generate personalized collect policy.To address the above problem,a collection policy automatic refinement method was designed.Firstly,a hierarchical model of collection policy was proposed.Then,by transforming the policy refinement into a nonlinear optimization problem,a genetic algorithm was designed to balance between collection revenue and collection cost.Finally,simulation experiments verify that according to the requirements of high-level monitoring,the acquisition scheme can be automatically generated.