Owing to the rapid development of information security technology, the security analysis of encryption protocols has received widespread attention. In this paper, we propose a stateful black-box encryption protocol fuzzing method to analyze the security of real-world black-box encryption protocol programs and devices. This method does not rely on the source code but uses captured packets as input, performs state selection based on a Monte Carlo tree search algorithm, and processes the encryption/decryption conversion of mutant test cases based on the intermediate mapper. It sends test cases and collects responses in interactive communication with the tested program and dynamically optimizes the corpus based on the collected state information. Based on this method, we develop SBEPFuzz and primarily analyze IPsec. We evaluate SBEPFuzz on six widely used IPsec implementations. The experimental results show that SBEPFuzz achieves higher code coverage, and can discover more protocol state sequences and vulnerabilities. Furthermore, we discover four anomalies, including malformed packets triggering service crashes and abnormal interactions leading to plaintext ID leakage, which also reflect the differences in details among different implementations.

Encrypted traffic classification is a key technology for network monitoring and management, and its recent research results are mostly based on deep learning. Due to the difficulty in obtaining sufficient labeled data, few-shot traffic classification has received considerable attention. However, most of the existing results have two defects. First, they are mostly based on the assumption of a labeled base dataset for pre-training. Second, they neglect the problem of unknown traffic discovery under open-set conditions. In this paper, aiming at the problem of few-shot open-set encrypted traffic classification, a corresponding framework FSOSTC is constructed under the condition of unsupervised pre-training. Two data augmentation methods for packet feature map are proposed to assist the pre-training through self-supervised learning, which is combined with parameter fine-tuning, unknown discovery and class extension strategies. Experiments on public datasets verify the effectiveness of FSOSTC. For the few-shot open-set malicious traffic classification task, the CSA reaches 95.41% and the AUROC reaches 0.8664.

With the increase in the proportion of encrypted network traffic, encrypted traffic identification (ETI) is becoming a critical research topic for network management and security. At present, ETI under closed world assumption has been adequately studied. However, when the models are applied to the realistic environment, they will face unknown traffic identification challenges and model efficiency requirements. Considering these problems, in this paper, we propose a lightweight unknown traffic discovery model LightSEEN for open-world traffic classification and model update under practical conditions. The overall structure of LightSEEN is based on the Siamese network, which takes three simplified packet feature vectors as input on one side, uses the multihead attention mechanism to parallelly capture the interactions among packets, and adopts techniques including 1D-CNN and ResNet to promote the extraction of deep-level flow features and the convergence speed of the network. The effectiveness and efficiency of the proposed model are evaluated on two public data sets. The results show that the effectiveness of LightSEEN is overall at the same level as the state-of-the-art method and LightSEEN has even better true detection rate, but the parameter used in LightSEEN is 0.51 % of the baseline and its average training time is 37.9 % of the baseline.

With the increasing concern on the preservation of personal privacy, privacy-preserving data mining has become a hot topic in recent years. Spectral clustering is one of the most widely used clustering algorithm for exploratory data analysis and usually has to deal with sensitive data sets. How to conduct privacy-preserving spectral clustering is an urgent problem to be solved. In this study, the authors focus on introducing the notion of differential privacy, which is considered as the de facto standard of privacy-preserving data analysis, into spectral clustering. Specifically, by combining the well-studied constrained spectral clustering with the Wishart mechanism in a novel way, the authors propose a differentially private constrained spectral clustering (DP-CSC) algorithm. The DP-CSC algorithm is proved to capture asymptotic property and achieves -differential privacy. To illustrate the effectiveness and efficiency of DP-CSC, the authors conduct experiments on five real-word data sets. The results indicate that the DP-CSC algorithm can provide acceptable clustering accuracy with short running time while preserving individual privacy.

The amount of Internet data is significantly increasing due to the development of network technology, inducing the appearance of big data. Experiments have shown that deep mining and analysis on large datasets would introduce great benefits. Although cloud computing supports data analysis in an outsourced and cost-effective way, it brings serious privacy issues when sending the original data to cloud servers. Meanwhile, the returned analysis result suffers from malicious inference attacks and also discloses user privacy. In this paper, to conquer the above privacy issues, we propose a general framework for P reserving M ultiparty D ata P rivacy ( PMDP for short) in cloud computing. The PMDP framework can protect numeric data computing and publishing with the assistance of untrusted cloud servers and achieve delegation of storage simultaneously. Our framework is built upon several cryptography primitives (e.g., secure multiparty computation) and differential privacy mechanism, which guarantees its security against semihonest participants without collusion. We further instantiate PMDP with specific algorithms and demonstrate its security, efficiency, and advantages by presenting security analysis and performance discussion. Moreover, we propose a security enhanced framework sPMDP to resist malicious inside participants and outside adversaries. We illustrate that both PMDP and sPMDP are reliable and scale well and thus are desirable for practical applications.