Incremental search services in search engines update the suggestion list for users by sending real-time requests. Focusing on the information leakage of encrypted search traffic, a side- channel analysis method on Chinese search is proposed. Leveraging the distinguishability of packet length increments and time intervals, a three-stage analysis model is constructed to identify user queries. Experimental results show that the performance in four commonly used Chinese search engines achieves the theoretical quantified value. The identification accuracy for the set containing 1.4x10(5) monitored queries reaches 76%. Finally, four mitigation methods are evaluated to demonstrate that side-channel analysis can be effectively defended by blocking the information leakage sources.

The explosion of information has resulted in incremental search becoming an essential tool for many websites. This technology provides real-time suggestions by sending the current query to the server. Despite encryption, search requests can be leveraged by passive attackers to infer the query typed by the user. In this paper, we show that at least nine of Alexa’s top 50 websites have serious side-channel leaks. More importantly, we use information theory to quantify the leakage and report the upper bound of recognition accuracy that an attacker can achieve. We further develop a generic attack attempting to infer users’ queries by monitoring web search traffic. Experimentally, the attack performance is close to the theoretical bounds. The most vulnerable website allows up to 53% of English queries and 76% of Chinese queries to be identified from 825k and 140k queries, respectively. Overall, our work highlights the prevalence of such side-channel leaks on the Internet and provides insights for developers to help mitigate the threat.

Portable document format (PDF) files are increasingly used to launch cyberattacks due to their popularity and increasing number of vulnerabilities. Many solutions have been developed to detect malicious files, but their accuracy decreases rapidly in face of new evasion techniques. We explore how to improve the robustness of classifiers for detecting adversarial attacks in PDF files. Content replacement and the n-gram are implemented to extract robust features using proposed guiding principles. In the two-stage machine learning model, the objects are divided based on their types, and the anomaly detection model is first trained for each type individually. The former detection results are organized into tree-like information structure and treated as inputs to convolutional neural network. Experimental results show that the accuracy of our classifier is nearly 100% and the robustness against evasive samples is excellent. The object features also enable the identification of different vulnerabilities exploited in malicious PDF files.

Implementing effective resource management is crucial for urban sustainability. Potential resource management strategies should be assessed under the framework of a resource nexus to avoid problem shifting. The urban metabolism of food, energy, and water is driven by lifestyle, industrial structure, and infrastructure. This study employed material flow analysis to identify resource metabolism through the phases of supply, process, demand, and final sink. The resource intensity of urban activities and the risk of the nexus of resources were quantified to illuminate management strategies. This study investigated the food-energy-water nexus (FEW nexus) for a small and multi-sector island city, Kinmen, and found that the nexus risk of water for food is the highest. Water and energy consumption have excessive loads on resource metabolism in a multi-sector city, and the main demand sectors increase the nexus risk in water for food. The results indicated that higher risk results from higher resource consumption intensity, particularly in areas of economic growth. Resource management of the FEW nexus needs the best tradeoff strategy to meet the goals of urban metabolism sustainability. The risk assessment framework can support the design of optimal resource management strategies to pursue urban sustainability. Consequently, given the limitations of water treatment technology, the impact of energy risk mitigation is poor (below 4% of energy risk in 2015) and the energy risk will continue to increase (by about 10% based on the economic activity). As a result, imported water is the best tradeoff strategy to meet the FEW nexus safety for Kinmen City as a low-resource and sightseeing activity area.

Mobile app traffic now accounts for a majority owing to the booming mobile devices and mobile apps. State-of-the-art identification methods, such as DPI and flow-based classifiers, have difficulties in designing features and labeling samples manually. Motivated by the excellence of CNNs in visual object recognition, we propose convolutional autoencoder network (CAEN), a deep learning approach to mobile app traffic identification. Our contributions are two-fold. First, we propose a novel method of converting traffic flows into vision-meaningful images, and thus enable the machine to identify the traffic in a human way. Based on the method, we create an open dataset named IMTD. Second, convolutional autoencoder (CAE) algorithm is introduced into the proposed network model, realizing the automatic feature extraction and the learning from massive unlabeled samples. The experimental results show that the identification accuracy of our approach can reach 99.5%, which satisfies the practical requirement.

The mobile apps mostly communicate with servers via HTTP, which makes port-based method ineffective. Furthermore, depth packet inspection and flow-based classifiers have difficulties in designing features and labeling samples manually. Motivated by the excellence of computer vision, this paper proposed a method of mobile app traffic identification based on visual perception features. First, it converted the app traffic flows into vision-meaningful images. Collecting real traffic from the network gateway, it created the IMTD17 dataset. Then, it designed a two-dimensional convolutional perception network (2D-CPN) with the ability of visual feature extraction. The network realized the learning of massive unlabeled samples by the convolutional autoencoder, and used multi-class regression to create the mapping from the latent feature to the app categories. The experimental results show that the identification accuracy of the approach satisfies the practical requirement.

Aiming at reducing the high False Negative rate of the existing Trojan horse detection method based on behavior, this paper utilized the sequence characteristics of tunnel Trojan communication extracted from the transport layer and the bi-directional recurrent neural network in deep learning to build a HTTP tunnel Trojan detection model. The experimental result showed that the deep learning-based detection model reduced the false positive rate of normal network traffic and improved the Trojan detection rate. We also found that the deep learning based detection model reduced the feature selecting and data cleaning process of generating samples and improved the easy-using of the HTTP tunnel Trojan detection model.

Traffic identification is a fundamental issue in network security. Traditional methods, such as depth packet inspection (DPI) and flow-based classifiers, have difficulties in labeling massive samples and extracting features manually. Motivated by the achievements in computer vision, we focus on mobile app traffic, proposing a deep learning model based on variational autoencoder network (VEAN). Our contributions are two-fold. First, we propose a novel method of transforming mobile app traffic flows into vision-meaningful images, and thus enable the machine to identify the traffic in a human way. Then, based on the transformation method, we create an open dataset named IMTD17. Second, an improved network model is proposed, where variational autoencoder (VAE) algorithm is introduced into a two-stage learning. The model realizes the learning from massive unlabeled data, and the feasibility of the replacement for manual feature extraction is illustrated by the visualization analysis of the latent features. The experimental results show that the identification accuracy can reach 99.6%, which satisfies the practical requirement.