Malicious Set Research Articles

MBTree: Detecting Encryption RATs Communication Using Malicious Behavior Tree

Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT). Compared to statistical-based detection of malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree, an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace behavior. MBTree first models the RAT network behaviors as the malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect malicious network traces that are similar to any MLTrees in the malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.

Entanglement-assisted private communication over quantum broadcast channels

We consider entanglement-assisted (EA) private communication over a quantum broadcast channel, in which there is a single sender and multiple receivers. We divide the receivers into two sets: the decoding set and the malicious set. The decoding set and the malicious set can either be disjoint or can have a finite intersection. For simplicity, we say that a single party Bob has access to the decoding set and another party Eve has access to the malicious set, and both Eve and Bob have access to the pre-shared entanglement with Alice. The goal of the task is for Alice to communicate classical information reliably to Bob and securely against Eve, and Bob can take advantage of pre-shared entanglement with Alice. In this framework, we establish a lower bound on the one-shot EA private capacity. When there exists a quantum channel mapping the state of the decoding set to the state of the malicious set, such a broadcast channel is said to be degraded. We establish an upper bound on the one-shot EA private capacity in terms of smoothed min- and max-entropies for such channels. In the limit of a large number of independent channel uses, we prove that the EA private capacity of a degraded quantum broadcast channel is given by a single-letter formula. Finally, we consider two specific examples of degraded broadcast channels and find their capacities. In the first example, we consider the scenario in which one part of Bob’s laboratory is compromised by Eve. We show that the capacity for this protocol is given by the conditional quantum mutual information of a quantum broadcast channel, and so we thus provide an operational interpretation to the dynamic counterpart of the conditional quantum mutual information. In the second example, Eve and Bob have access to mutually exclusive sets of outputs of a broadcast channel.

A new security model in p2p network based on Rough set and Bayesian learner

A new security management model based on Rough set and Bayesian learner is proposed in the paper. The model focuses on finding out malicious nodes and getting them under control. The degree of dissatisfaction (DoD) is defined as the probability that a node belongs to the malicious node set. Based on transaction history records local DoD (LDoD) is calculated. And recommended DoD (RDoD) is calculated based on feedbacks on recommendations (FBRs). According to the DoD, nodes are classified and controlled. In order to improve computation accuracy and efficiency of the probability, we employ Rough set combined with Bayesian learner. For the reason that in some cases, the corresponding probability result can be determined according to only one or two attribute values, the Rough set module is used; And in other cases, the probability is computed by Bayesian learner. Compared with the existing trust model, the simulation results demonstrate that the model can obtain higher examination rate of malicious nodes and achieve the higher transaction success rate.