In order to solve the problem of worse recognition performance under the multi-classification scenarios of existing cryptosystem identification, this paper proposes a block cryptosystem recognition scheme based on Hamming weight distribution. A feature extraction method based on Hamming weight distribution is designed to extract the cipher text features, and the cryptosystem is further described. XGBoost-RFE feature selection algorithm is proposed to filter invalid features. In order to better adapt to the characteristics of complex ciphertext data and difficult fitting in multi classification scenarios, XGB-LGBM ensemble learning model with multi-layer fusion structure is designed to further improve the accuracy and generalization of recognition. The experiment carried out mixed identification of 10 common block cipher algorithm, and the overall recognition accuracy reached 89.65%.

In the education archive sharing system, when performing homomorphic ciphertext retrieval on the storage server, there are problems such as low security of shared data, confusing parameter management, and weak access control. This paper proposes an Education Archives Sharing and Access Control (EduASAC) system to solve these problems. The system research goal is to realize the sharing of security parameters, the execution of access control, and the recording of system behaviors based on the blockchain network, ensuring the legitimacy of shared membership and the security of education archives. At the same time, the system can be combined with most homomorphic ciphertext retrieval schemes running on the storage server, making the homomorphic ciphertext retrieval mechanism controllable. This paper focuses on the blockchain access control framework and specifically designs smart contracts that conform to the business logic of the EduASAC system. The former adopts a dual-mode access control mechanism combining Discretionary Access Control (DAC) and Mandatory Access Control (MAC) and improves the tagging mode after user permission verification based on the Authentication and Authorization for Constrained Environments (ACE) authorization framework of Open Authorization (OAuth) 2.0; the latter is used in the system to vote on nodes to join requests, define access control policies, execute permission verification processes, store, and share system parameters, and standardize the behavior of member nodes. Finally, the EduASAC system realizes the encryption, storage, retrieval, sharing, and access control processes of education archives. To verify the performance of the system, simulation experiments were conducted. The results show that the EduASAC system can meet the high security needs of education archive sharing and ensure the system's high throughput, low latency, fast decision-making, and fine-grained access control ability

In recent years, Advanced Persistent Threat (APT) attacks against sensors have emerged as a prominent security concern. Due to the low level of protection provided by sensors, APT attack organizations are able to develop intrusion schemes that allow them to infiltrate, attack, lurk, spread, and steal information from the target over an extended period of time. Through extensive research on the APT attack process and current defense mechanisms, it has been found that analyzing Domain Name Server (DNS) traffic in the communication control phase is an effective way of detecting APT attacks. However, analyzing APT attacks based on traffic usually involves the detection of a vast amount of DNS traffic, and current data preprocessing methods do not scale down data effectively, leading to low detection efficiency. In previous work, most efforts have been focused on calculating the features of request messages or corresponding messages without considering the association between request messages and corresponding messages. To address these issues, we propose a sketch-based APT attack traffic detection scheme. The scheme leverages the sketch structure to count and compress network traffic, improving the efficiency of APT detection. Our work also analyzes the limitations of traditional sketches in network traffic and proposes an improved sketch scheme. In addition, we propose several effective features for detecting APT attacks. We validate and evaluate our solution using 1,088,280 DNS traffic from a lab network and APT suspicious traffic from netresec and contagio, using eight machine learning models. The experimental results show that for the ExtraTrees model, our solution has a processing time of 0.0638 s and an accuracy of 0.97920, reducing the processing time by approximately 50 times and improving detection accuracy by a small margin compared to a dataset without sketch processing.

通过对现有的密钥存储方案、密钥更新方案进行研究分析,针对云环境下海量密钥存储与用户动态密钥更新需求,设计了一种基于密钥矩阵派生的密钥存储管理方案.其中,主要考虑了密钥矩阵派生过程、可扩展的密钥交换协议以及基于中国剩余定理的密钥更新方案3个部分.方案将文件加解密计算设置在私有云上实施,公有云负责提供存储和查询密文数据的服务.通过矩阵派生方法,由根密钥直接派生文件加密密钥,用户只需存储管理密钥矩阵配置及根密钥即可动态生成文件加密密钥.最后通过实验验证,与相关文献的密钥存储方案进行对比,并进行安全性分析和性能分析,证明该方案可有效降低云环境下的密钥存储开销和计算开销,节省密钥更新成本.

In order to develop a distributed storage system that adapts to Chinese software and hardware, build a cloud computing platform that is independently usable, safe and reliable, data utilization is more concentrated and intelligent, and service integration is more unified and efficient. This paper designed and implemented a distributed storage system that supports Chinese software and hardware, which is compatible with Chinese mainstream CPU, operating system, database, middleware and other software and hardware environments. After a lot of experiments and tests, it is confirmed that the system has high availability and high reliability.

The wide application of mobile terminals that makes the software and hardware of mobile platforms gradually become the important target of malicious attackers. In response to the above problems, this paper proposes a vulnerability mining scheme based on Fuzzing. In this scheme, many methods are used to generate a large number of test cases. After the application receives the corresponding test cases, it analyzes the output results and the exceptions thrown. The experimental results show that the scheme can effectively excavate the vulnerabilities of mobile office software on the Android platform, and has certain reliability.

针对云存储在存储性能和存储安全方面日益增长的需求,在研究私有云平台最新存储技术及政务云需求分析的基础上,结合云密码服务,设计一套基于Ceph的私有云平台加密存储方案.其中,私有云存储以Ceph为核心组件,并在与Swift的对比测试中显示出Ceph的强大动力;密钥管理模块以云服务密码机为基础,结合门限共享思想、分割思想,设计多级密钥保护机制;数据加密存储模块以Ceph组件为支撑、多级密钥保护机制为基础,利用国密SM4算法实现政务私有云文件安全存储.通过分析或部件测试发现,该方案具有良好的可行性以及安全性,适用于小文件突出的政务私有云平台的安全保障.

Due to the open-source and versatility of the Android operating system, Android malware has exploded, and the malware detection of Android IoT devices has become a research hotspot in recent years. Static analysis technology cannot effectively analyze obfuscated malware. Without decomposing, the existing detection methods are mainly based on grayscale images and single files without analyzing and verifying their anti-obfuscation performance. In addition, the current detection of Android malware using deep learning is concentrated in the field of binary classification. This paper proposes a multi-classification method of the Android malware family based on multi-class feature files and RGB images to solve these problems. The method proposed in this paper does not need to decompile the Android APK installation package. However, it extracts the DEX file and XML file in batch from the APK installation package. Then, it converts the file into an RGB image using the conversion algorithm that converts Android software into images. Finally, the deep neural network automatically obtains the RGB image texture features to realize the multiple classifications of the Android malware family. Experimental data show that the proposed method has high detection performance, and the accuracy of multiple classifications of the Android malware family is as high as 99.84%. In addition, the method based on RGB image is better than the grayscale image in detection accuracy, and the effect of RGB image combined with DEX and XML is better than that of separate DEX file image and separate XML file image. Therefore, the method proposed in this paper can effectively detect the obfuscated Android malware, and the detection accuracy of 99.23% can be achieved for the obfuscated sample data. Furthermore, this method has good anti-obfuscation ability. The proposed method is compared with those based on Multi-Layer Perceptron, Long Short-Term Memory, bidirectional Long Short-Term Memory and Deep Belief Network. The experimental results show the proposed method’s effectiveness and high generalization performance.

This paper designs and implements a private cloud platform deployed on an office system that supports domestic software and hardware. With the rapid development of cloud computing, more and more enterprises and users choose cloud platform as a vital Internet resource. At present, most private cloud technologies rely on mature foreign commercial applications and frameworks, and it isn’t easy to achieve compatibility between Chinese software and hardware. Therefore, it is urgent to design a private cloud platform that supports Chinese software and hardware. The key private cloud technology of the cloud platform designed in this paper is the key technology of private cloud that supports independent and controllable Chinese software and hardware. The cloud platform uses virtual computing, virtual storage, virtual network, and other technologies to complete the virtualization of computing resources, storage resources, and network resources. Users can centrally schedule and manage virtual resources.

针对量子密钥分发网络中量子密钥资源均衡应用问题,设计了一种路由改进方案,采用分段路由技术减少QKD网络密钥中继节点的流表开销,同时改进Yen算法的K最短路径,加入链路密钥剩余量和路由跳数路由参数,均衡密钥资源负载.经过仿真实验,验证了分段路由方案和改进的路由选择算法的合理性和可行性.

With the rapid development of the Internet of Things (IoT) industry, the smart home is fully integrated with people’s shelter and transportation, which facilitates people’s daily life. A smart home without a security authentication mechanism will inevitably cause a series of security threats. This is essentially a problem of symmetry model worth solving. In fact, researchers have designed various authentication schemes to verify the identity of users and to ensure smart devices can be legally accessed through authorization in the smart home. In 2021, Yu proposed a three-factor anonymous authentication scheme for smart homes using lightweight symmetric encryption primitives and stated that their scheme is resistant to various known security attacks. However, after careful analysis, we found that Yu’s scheme needs further improvement in node capture attack and offline password guessing attack and that forward security cannot be guaranteed. Therefore, we first design a robust three-factor anonymous authentication scheme for smart homes based on asymmetric encryption Elliptic Curve Cryptography (ECC). Then, we perform formal and informal security analysis in which the formal analysis tools include Burrows-Abadi-Needham (BAN) logic and Scyther simulation tool to prove that the proposed scheme can achieve user anonymity, untraceability, and session key forward security. Meanwhile, mutual authentication is performed, and the scheme is resistant to all known attacks described in this article. Finally, a performance comparison is made in terms of efficiency, which shows that our scheme can have certain advantages with those newly designed schemes, achieve a delicate balance in performance and safety, and is more practical for the real smart home environment.

针对在SDN网络架构下数据流量在线分类问题，提出了一种基于格拉姆角场和卷积神经网络的流量分类方法。该方法利用SDN网络架构收集数据流的前几个数据包的少量统计特征，通过格拉姆角场实现特征的扩展，利用卷积神经网络实现数据流量的智能分类。通过与现有的分类方法对比分析，表明在获取的统计特征较少的情况下，本文提出的方法在分类准确率等方面表现更优。

The rapid development of the explosive growth of the network traffic and new networks, such as cloud computing and IoT have challenged the traditional network measurement techniques with limited memory resources and computational resources. The measurement method based on sketch structure can compress and store massive traffic data by hash calculation, which facilitates statistical analysis in limited memory and has a greater impact on anomalous traffic detection. Current researches show that using sketch structure to store network traffic and combining it with machine learning to detect anomalous traffic in network traffic can solve the above problem effectively. However, the classical sketch structure has some problems such as hash collision and low memory usage, etc., which in turn affect the accuracy of machine learning models for anomalous traffic detection. In this paper, an improved sketch structure is proposed based on the cuckoo hash and CK Sketch structure which replaces the hash function in the classical sketch with the mechanism of cuckoo hash to avoid hash conflict, adds Bloom filter, and can self-adaption allocate the number of Hash buckets. By storing the anomalous traffic data as CK Sketch structure and classical sketch structure respectively, and conducting the anomalous traffic detection comparison experiments with machine learning respectively, the experimental results show that the CK sketch structure proposed in this paper can effectively improve the accuracy of machine learning to determine the anomalous traffic, the utilization rate of hash buckets and the network throughput.

With the widespread use of container cloud, the security issue is becoming more and more critical. While dealing with common security threats in cloud platforms and traditional data centres, there are some new security issues and challenges in the container cloud platform. For example, there are significant challenges in network isolation and resource management. This paper proposes a private container cloud platform PCCP based on Docker supporting domestic software and hardware to solve these security problems. This paper introduces the system architecture and functional architecture of the platform. The system has been tested and confirmed to have high availability and high reliability. The platform gives full play to the value of domestic software and hardware and is better able to serve the information construction of our country.

随着大数据、云计算、5G通信技术的迅速发展,数据传输安全问题日益凸显,密码算法的设计和高效实现变得尤为重要,能高速运行的国产密码算法已成为保护国家安全的关键.与此同时,原本只用于图像计算的硬件GPU,在编程模型CUDA发布后就成为通用的、普及化的算力资源.本文基于通用的计算机平台,提出了利用其本地GPU进行CTR工作模式下SM4算法高速加解密的并行实现和优化方案.实验表明,本文提出的SM4-CTR并行加解密方案能够有效提高SM4算法的运行效率,在通用的计算机平台上,能够达到40倍加速比,加解密速率达到了14.192 Gbps.实验中还分析了线程块划分对GPU并行加速效果的影响,最优线程块大小为128到512,且必须为32的整倍数.最后,基于本文实验的结果与其他团队的优化SM4方案进行对比,包括传统工作模式下利用CPU、GPU优化的方案和利用软件快速实现的方案,对比结果显示即便之前团队的方案运行的平台硬件条件好于本文实验环境,文中提出的方案运行速率依然能做到大幅领先.因此,本文方案在安全性、运算速率提高的同时适用平台也更加广泛,在实际生活中针对大数据和个人数据的安全保护中必将发挥巨大的作用.

当某些网络资源的网络负载超出其容量时,通信网络可能会发生拥塞,从而导致拥塞的网络设备丢弃数据包,拥塞控制机制在保持网络稳定性和实现网络资源的高利用率方面起着重要作用.在高带宽延迟网络中,TCP所使用的AIMD算法窗口抖动剧烈,导致其稳定性弱,系统吞吐量小,拥塞发生时,拥塞窗口剧烈减小.为此,本文提出一种基于柯西分布的网络拥塞控制策略,该策略主要是根据采样RTT数值的统计特性,迭代统计模型之柯西分布函数,动态更新预测下一次的拥塞窗口,使网络能在较短的时间达到较高的吞吐量;通过NS-3仿真对所提出的策略进行了验证.结果表明,与TCP New Reno相比,此策略有效提高了网络稳定性和网络性能.

针对域名产生算法生成的恶意域名,提出基于动态卷积算法的检测方法.基于现有的深度学习检测模型,在检测模型的向量嵌入阶段采用基于字符嵌入的高级词嵌入方法,能够对生僻词语和训练集中不存在的新词进行有效表示,减小嵌入矩阵的规模,降低存储成本.设计动态卷积算法对恶意域名进行检测,动态调整网络参数,有利于在更大范围内提取深层的特征,压缩数据大小,提高运算的速度,能够更有效识别恶意域名.实现了整体检测模型,通过实验验证了该方案的可行性.

为解决云服务在用户隐私、数据保护等安全方面的问题,云密码服务应运而生.面对云服务中用户数量多、需求差异大等特点,云密码服务一般提供海量密钥.如何在云密码服务中结合虚拟密码机设计有效的密钥保护体系成为云密码服务中关键的问题.本文结合虚拟密码机之间的独立、隔离特性,设计以虚拟密码机中密钥库为核心的密钥保护体系.在该体系中,从虚拟密码机、云密码服务两个层面将海量密钥实现分层逐级保护,同时,对密钥的远程管理需求,设计基于密码技术的身份认证且建立安全通信通道.

十三五以来,国家对本科课堂教学活力和教学评价提出了新要求.如何用丰富的教学手段,让理工科专业课的课堂活起来;如何进行客观的过程性评价,让学生平时忙起来.本文按照"以学生为中心"的教育理念,以45分钟课堂为主战场,以电子信息类基础课课程教学为突破口,介绍了如何利用互联网+新技术手段与传统教学全过程有效融合,从教学内容、资源、组织实施、平时成绩评定等方面开展教学模式改革,形成充满活力、且高效的课堂教学新模式.同时对教学改革中的问题进行了思考,并提出了解决方案.