With growing volumes of anomaly traffic and increasingly stealthy attack types, anomaly detection becomes more challenging due to unclear inter-class boundaries and imbalanced intra-class characteristics. To address these issues, we propose DAMA, an effective network traffic anomaly detection framework based on Dimension-Aware Multi-view Alignment. Specifically, our method first partitions network traffic into seven expert-defined dimensions, then utilizes LLMs to generate both flow-level and dimension-level semantic summaries for comprehensive understanding of traffic features. Secondly, we adopt contrastive learning to align network traffic representations between feature space and semantic space, thus enhancing inter-class separability. Finally, dimension-aware prior guidance provides per-dimension supervision by highlighting key features during alignment, which effectively mitigates intra-class bias. Extensive experimental results on two benchmark datasets demonstrate that our proposed method significantly outperforms baselines in both accuracy and F1-score, while providing interpretable insights for traffic anomaly patterns.

Data connectors are key components for enabling controllable data exchange in data marketplaces and constitute one of the foundational technologies for realizing data sovereignty. To support controllable data exchange in lightweight data connectors, it is crucial to design an efficient and scalable access control mechanism. However, user-space access control suffers from high decision latency, whereas kernel-space access control is limited by constrained policy capacity and inflexible policy updates. To address these challenges, we propose an efficient user–kernel access control scheme for lightweight data connectors. The scheme leverages extended Berkeley Packet Filter (eBPF) to load high-frequency access control rules into the kernel while retaining low-frequency rules in user space. To further improve access control efficiency, we design a Bloom-filter-based kernel admission filter to block invalid requests before they enter the policy decision point (PDP). To prevent long-tail requests from polluting the kernel cache, we develop a set-associative, access-frequency-aware cache replacement mechanism. To determine the optimal memory allocation between these two kernel-side components, we model access control decisions as an M/D/1 queueing system, and analyze the relationship between end-to-end policy decision latency and cache miss probability to guide the memory partitioning between the two kernel-side components. We implement a prototype based on eBPF. Experimental results show that, under the same policy set size, our system reduces the average service time by approximately 25 10^6 policies, it reduces the average service time by up to 85.6 γ > 80% , the proposed design reduces latency by up to 65

Enterprises face security threats from internal anomalous behaviors in dynamic network environments. Existing rule-generation approaches often rely heavily on large amounts of labeled data and are particularly sensitive to data scarcity. In Small and Medium-sized Enterprises (SMEs), limited resources and the imbalance between positive and negative samples make it difficult to obtain sufficient labeled data for detecting anomalous behaviors. This challenge often leads to poor detection performance. To address this issue, this paper proposes an adaptive behavior rule-generation approach that combines Chain-of-Thought (CoT) reasoning and few-shot learning, eliminating the need for large-scale labeled data. In this approach, we employ CoT to perform step-by-step reasoning on user behavior, generating personalized anomalous behavior detection rules based on limited data. To enhance the adaptability and accuracy of the approach, we integrated few-shot learning, enabling the system to learn from a small number of examples and generate effective rules. Experimental results demonstrate that the proposed method achieved an accuracy of 97.56

With the evolution of next-generation network technologies, ubiquitous networks have developed rapidly, and heterogeneous integrated architectures, particularly satellite networks, have significantly enhanced information service capabilities. However, open network environments have introduced security risks such as device identity spoofing and data link hijacking, which posed severe challenges to trusted access in satellite networks. Traditional authentication schemes have been constrained by complex certificate management mechanisms and reliance on third-party key distribution centers. To address these issues, a cross-domain device authentication framework based on certificateless public key cryptography (CL-PKC) was proposed. The framework achieved system optimization through three key technical breakthroughs. First, a key parameter splitting mechanism was introduced to eliminate single-point failure risks in traditional key centers. Second, a cross-domain identity mapping protocol was developed to resolve trusted identity migration across heterogeneous networks. Third, dynamic anonymous identification technology was applied to enhance privacy protection throughout the key lifecycle management process. Experimental evaluations demonstrate that compared to traditional PKI solutions, the proposed scheme could resist multiple typical security threats. In resource-constrained satellite network scenarios, while maintaining equivalent security strength, the computational cost of the scheme remains within acceptable levels, indicating its significant engineering applicability.

LEO satellite non-terrestrial networks (NTN) utilize satellites in Low Earth Orbit (LEO) to dynamically establish global communication service and own significant promise. The dynamic nature of LEO satellite NTN necessities efficient handover authentication protocols. However existing schemes cannot be directly applied in LEO satellite NTN because of their low efficiency and security. To address these problems, we propose a handover authentication protocol to quickly and securely authenticate the user’s identity during the handover process. In our scheme, we incorporate an implicit session-bound random challenge to facilitate mutual authentication and key agreement between the User Equipments (UEs) and satellites. To improve authentication efficiency, we propose a batch handover mechanism to transfer the necessary security contexts, largely reducing the handover authentication cost. We verify our protocol’s security using BAN logic and Tamarin prover. The performance evaluation shows that SEHAP outperforms other schemes in both communication and computational efficiency in LEO satellite NTN.

In response to the demand for collaborative computation of multi-cryptographic jobs in cryptographic on-demand services within a cloud environment, a multi-cryptographic job collaborative scheduling algorithm was proposed. This algorithm effectively addressed new challenges in cloud environments, such as a variety of cryptographic algorithm types, high concurrency demands, random cross-job interactions, and sudden increases in workloads. Considering the dependencies among jobs, makespan of jobs and computational power of computing units, the scheduling problem for multi-cryptographic job collaborative service was modeled as a multi-objective optimization workflow scheduling problem. A two-stage “select-sort” scheduling algorithm was proposed. In the selection stage, the improved NSGA-III algorithm was employed to select computing units for cryptographic computing jobs, and in the sorting stage, the execution order was determined based on the urgency of jobs. Simulation results demonstrate that the proposed algorithm outperforms traditional scheduling algorithms in terms of energy consumption, migration costs, and adaptability to transient surges in loads.

Existing works have demonstrated that machine learning models may leak sensitive information of the training set to adversaries who launch the membership inference attacks (MIAs). Most of the existing studies on MIAs focus on improving the accuracy of attacks and relaxing assumptions about adversaries, and lack systematical evaluation on the impact of adversarial factors on MIAs. In this paper, we implement several recent attacks and compare their performance to study the importance of seven typical factors, including four background knowledge and three attack parameters. Specifically, we classify these factors according to the target model, the shadow model and the attack model. In our experiments, we use five datasets, CIFAR-100, CIFAR-10, MNIST, Purchase and Location to evaluate the performance of different MIAs with varied factors. Results indicate that factors about the shadow model structure, training data distribution and the target model output exert the dominant impact on the attack performance. We further explore and interpret how these dominant factors affect the success rate of MIAs through experimental analysis.

The satellite Internet of Things (satellite IoT) has the characteristics of large space-time span and highly open communication links. While effectively expanding the spatial capability of the traditional Internet of Things, it will face security threats such as impersonation, replay, tampering and eavesdropping of the traditional Internet of Things and satellite communication. In this paper, an SM2-based certificateless integrated signature and encryption scheme (SM2-CL-ISE) is proposed for satellite IoT with key optimization and conditional anonymity. Then incorporating Geostationary Earth Orbit (GEO) satellite, a Low Earth Orbit (LEO) satellite authentication protocol and a static terminal device authentication protocol are designed. In addition, we prove the security of SM2-CL-ISE under the formal security model, and further discuss how the proposed authentication schemes can satisfy those essential security requirements. To evaluate the effectiveness of our proposed protocols, we conducted several experiments and compared their performance with that of existing protocols. The experimental results show that our scheme achieves more efficient performance with a slightly increased communication overhead on authentication.

“Cryptography-as-a-Service” provides convenience for users to request cryptographic computing resources according to their needs. However, it also brings challenges for resource management, such as the constantly changing load, large numbers of users, and complex resource topologies. To address those issues, this paper proposes a load-predicted-based resource allocation algorithm for cryptographic computing resources. Firstly, we propose a load-based cryptographic computing resource allocation model that can clearly describe the dynamic status of resources. Then, we design a load predictor using time series analysis and a random forest model, which can quickly predict the load of cryptography service requests during service time. Finally, we develop a load-predicted-based greedy algorithm for cryptographic computing resource allocation. Experimental results show that energy consumption is reduced by about 20% at most compared to the baseline allocation algorithm.

Aiming at the problem that current schemes mostly let the latter signer to verify the multiple signatures of the previous signer, and the message is signed and then passed to the next signer, leading to the efficiency problem of long overall signature time.A sequential aggregate signature scheme based on bilinear pairs was proposed.The aggregate signatures of documents were generated by multiple users in a certain order, and only the final signature was needed to be verified to confirm the correct order of signatures and the legitimacy of multiple user signatures.The complexity of verifying the multi-user sequential signature was effectively reduced and the offline verification of the authenticity of signature was realized when the user was offline or in a delay-tolerant network with limited node caching capacity and network resources.It is shown that the proposed scheme is existential unforgeability against chosen-message attacks under adversary adaptive selection messages in the random oracle model.

Objective: The popularity of network technology makes more and more enterprises and individuals join the wave of the Internet, and data presents an explosive exponential growth trend.With the increasing demand for data security transmission and fine-grained authentication, the use of cryptographic services in various applications is becoming more frequent. How to deal with random cross and large peak difference cryptographic service requests has gradually become a bottleneck problem restricting various network security applications.A model of cryptographic service scheduling system is proposed to explore the differential dynamic on-demand scheduling of cryptographic service resources. Methods: Optimized entropy method and cryptographic resource reconstruction technology were used to provide dynamic and extensible cryptographic service resources for users and devices accessing service system. Firstly, the evaluation method of cryptographic device service ability is proposed. By obtaining the operating state information such as the utilization rate of cryptographic resources and network throughput of cryptographic devices,the optimized entropy method is used to process the data. Combined with the cryptographic resource allocation of cryptographic devices, the cryptographic service ability provided by cryptographic devices is described,which provides support for cryptographic job scheduling.Then, an efficient on-demand cryptographic job scheduling strategy is proposed, and the cryptographic service request expectation is proposed. By calculating the load distance of the cryptographic device to determine whether to meet the requirements of the cryptographic service, the cryptographic job scheduling strategy is generated. In addition,the cryptographic devices can be reconstructed according to the scheduling algorithm to meet the differentiated needs of cryptographic services in terms of service quality and service efficiency. Results:The enhanced Min-Min load balancing algorithm,the cluster load balancing algorithm based on dynamic consistent hashing and the proposed on-demand scheduling algorithm are used for comparison. By sending cryptographic service requests, the maximum completion time of cryptographic operations, the number of serviceable requests per unit time and the average load of FPGA(field programmable gate array)cryptographic computing unit of the three scheduling algorithms are tested respectively.Fig.7 shows that when the number of cryptographic service requests is small,the difference among the three scheduling algorithms is not obvious.However, with the increase of the number of cryptographic service requests,the load of FPGA computing unit gradually increases. The other two scheduling algorithms do not consider the migration of cryptographic jobs and the dynamic configuration of FPGA computing unit, and the queuing time of cryptographic jobs increases significantly, and the gap between the other two scheduling algorithms and the on-demand scheduling algorithm is getting bigger and bigger.Fig.8 shows that when the number of cryptographic service requests is small, the difference of the three scheduling algorithms is not obvious,which can meet most of the cryptographic service requests. However, with the increase of the number of cryptographic service requests, the number of service requests per unit time of the three scheduling algorithms reaches the peak.Because the on-demand scheduling algorithm realizes the cryptographic job migration and the dynamic configuration of FPGA computing units, the number of service requests per unit time is higher than the other two scheduling algorithms.Fig. 9 shows that under the premise of minimizing the migration of cryptographic operations and the reconstruction of FPGA computing units, the on-demand scheduling algorithm prioritizes the cryptographic operations to the same FPGA computing unit.Therefore,only one FPGA computing unit has load when the number of cryptographic service requests is small, and with the increase of the number of cryptographic service requests, the number of FPGA computing units working also increases. Figs. 10 – 11 show that the FPGA load of the other two algorithms is relatively balanced.When the number of cryptographic service requests is large, the load of each FPGA is high.When the new cryptographic service request arrives,the residual calculation ability of FPGA calculation unit is insufficient to meet the cryptographic service demand because the migration of cryptographic jobs and the dynamic configuration of FPGA calculation unit are not considered. Conclusions: An efficient on-demand scheduling scheme for cryptographic service resources is proposed. The description and dynamic monitoring of cryptographic service capability are realized by using the normalized evaluation model of cryptographic devices based on optimized entropy method. At the same time, a cryptographic job scheduling strategy suitable for different requirements is proposed, and combined with the cryptographic resource reconstruction strategy,the differential configuration and scheduling of cryptographic resources are realized. The dynamic and extensible cryptographic service resources are provided to users and devices of any access service system.

Policy-mapping mechanisms can efficiently help to realize the exchange and the sharing of cross-domain information at low cost. However, due to concerns over policy conflicts, if not sufficient incentives, most selfish domains are often disinterested in helping others to implement policy mapping cooperatively. Thus an appropriate incentive mechanism is required. In this paper, we propose an incentive mechanism to encourage selfish domains to take part in policy mapping and resolve policy conflicts. Formulating conflict resolution as a double auction and solving Bayesian Nash equilibrium, we design the optimal asking/bidding price scheme to maximize the benefits of the domains involved. Simulations demonstrate that our approach can efficiently incentivize selfish domains to take part in cooperation.

To transparently encrypt/decrypt data stored in Hadoop Distributed File System (HDFS), the Key Management Server (KMS) has been designed to automatically assign encryption zone keys (EZK) to encryption zones. However, the current key-management scheme suffers from performance bottleneck. In this paper, dividing key files for storing key data into metadata file and material file, we propose a memory-disk coordinated key management architecture for Hadoop EZK to manage massive keys, where a tree structure is designed to index key metadata stored in memory, and the inverted index structure is used to record materials stored on hard disk. Further balance-tree-based management algorithms without Java serialization is designed to efficiently query keys (including metadata and materials). A series of theoretical analysis are conducted to show the upper and lower boundary of metadata query. Finally, we implement the above scheme in the Hadoop KMS without modifying the original key-management interfaces. A series of experiments are carried out on the simulated data. Experimental results show that, our scheme can efficiently manage ten billion keys and perform much better than the existing KMS in Hadoop.

In view of the massive and differentiated computing units and terminal devices in the cloud environment and the Internet of things, the differences in hardware resources and computing capabilities posed new challenges to high reliability and high performance data communication, a data communication mechanism supporting differentiation and negotiation was proposed.A parameters negotiation method was proposed, and parameters were negotiated by the sender according to the difference of the receiver capability to achieve differentiated and negotiable data communication.A retransmission feedback mechanism was designed, and the transmission rate was dynamically adjusted and the data was retransmitted based on the data reception feedback of the receiver by the sender to improve communication efficiency and reliability.The experimental results show that the proposed mechanism can perform dynamic adaptive, efficient and parallel communication according to the difference of the receiver capability.

The characteristics of space-ground network was combed.Against security threats in space-ground network,the security risks faced by measurement control,operation control,terminal access,wireless transmission,transmission,business information system,maintenance management were analyzed.Further,by dividing space-ground network security into four layers:foundation layer,access layer,network layer and application layer,a security architecture to protect space-ground network was proposed.An implement mechanism (including unifi ed security management and security situation aware,entity authentication and access protection,interconnection control,cipher on-demand service,dynamic reconstruction of security service ) was designed to guarantee the security of space-ground network.

Multi-step attacks have been widely adopted by attackers, resulting in privacy leakage. Although many cost-sensitive approaches have been proposed to respond to the multi-step attacks, most studies have lack global optimization and ignored the fact that attackers may take multiple paths to launch multi-step attacks, which may lead to an over-response or an under-response. To address this problem, we formulate a response to multi-path attacks as an optimization problem and prove it is NP-hard. To obtain a feasible solution to the problem, we first identify suspicious attack paths and evaluate several metrics (i.e., security benefit, deployment cost, and negative impact on the quality of services) of the countermeasures. Specifically, by considering the compositions and cover degrees of atomic attacks, we define Attacks Surface Coverage to accurately evaluate the security benefit of countermeasures. Then, we propose an improved greedy algorithm to select reasonable countermeasures. Experimental results demonstrate the effectiveness and feasibility of our approach. (c) 2020 Elsevier Ltd. All rights reserved.

With limited computing resources and a lack of physical lines of defense, the Internet of Things (IoT) has become a focus of cyberattacks. In recent years, outbreak propagation attacks against the IoT have occurred frequently, and these attacks are often strategical. In order to detect the outbreak propagation as soon as possible, t embedded Intrusion Detection Systems (IDSs) are widely deployed in the IoT. This paper tackles the problem of outbreak detection in adversarial environment in the IoT. A dynamic scheduling strategy based on specific IDSs monitoring of IoT devices is proposed to avoid strategic attacks. Firstly, we formulate the interaction between the defender and attacker as a Stackelberg game in which the defender first chooses a set of device nodes to activate, and then the attacker selects one seed (one device node) to spread the worms. This yields an extremely complex bilevel optimization problem. Our approach is to build a modified Column Generation framework for computing the optimal strategy effectively. The optimal response of the defender’s problem is expressed as mixed-integer linear programming (MILPs). It is proved that the solution of the defender’s optimal response is a NP-hard problem. Moreover, the optimal response of defenders is improved by an approximate algorithm--a greedy algorithm. Finally, the proposed scheme is tested on some randomly generated instances. The experimental results show that the scheme is effective for monitoring optimal scheduling.

天地一体化信息网络由天基骨干网、天基接入网和地基节点网组成,并与地面互联网和移动通信网互联互通,是实现全球互联互通的信息基础设施,具有通信体制多样、星载资源受限以及威胁类型多样等特征。现有静态化网络安全防护技术的效能低,难以应对天地一体化信息网络面临的安全挑战,亟需可扩展的安全动态赋能保障模式。针对该需求,提出了融合安全服务能力编排、安全威胁处置指挥以及安全态势分析于一体的安全动态赋能架构。分析了在动态编排架构、精准采集与按需汇聚、安全态势融合分析、威胁处置与反馈研判等方面需要突破的关键技术,以此有效确保安全功能按需扩展,支撑天地一体化信息网络安全。

To address the problem that as preventing data leakage on Hadoop platform,the existing encryption schemes suffer from several problems (e.g.,single encryption algorithm,complicated key management,low encryption performance) and they cannot protect data stored in Hadoop effectively,a high-performance encryption and key management scheme for Hadoop was proposed.Firstly,a three-level key management system was extended with the domestic commercial cipher algorithm.Then,a new data structure for encryption zone key to reduce time consumption was designed.Finally,the computing process of data stream in parallel was scheduled.The experimental results show that compared with the existing Hadoop schemes,the proposed scheme can improve the efficiency of key management,and can speed up file encryption.

Personalized collect policy is one of the necessary conditions for effectively monitoring threats in the complex network environment.However,differences in security requirements and threat types make it difficult to effectively generate personalized collect policy.To address the above problem,a collection policy automatic refinement method was designed.Firstly,a hierarchical model of collection policy was proposed.Then,by transforming the policy refinement into a nonlinear optimization problem,a genetic algorithm was designed to balance between collection revenue and collection cost.Finally,simulation experiments verify that according to the requirements of high-level monitoring,the acquisition scheme can be automatically generated.