Security Code Research Articles

Channel Attention Image Steganography With Generative Adversarial Networks

Recently, extensive research has revealed the enormous potential of deep learning in the application of image steganography. However, some defects still exist in previous studies on deep learning-based steganography. In this paper, we propose a novel end-to-end network architecture for image steganography with channel attention mechanisms based on generative adversarial networks, which can yield perceptually indistinguishable stego images at various capacities. Three subnetworks constitute our model, where a generator embeds the payload into cover images, an extractor extracts it from stego images, and a powerful steganalyzer acts as a discriminator to enhance steganographic security. We design a specific channel attention module, which tunes channel-wise features in the deep representation of images dynamically by exploiting channel interdependencies. The experimental results demonstrate that the channel attention strategy is conducive to improving the quality of generated stego images and the accuracy of message extraction. To tackle the inevitable issue of extraction errors, we resort to error correction codes, with which our model achieves the maximum effective embedding rates over 4 bits per pixel. Finally, we verify that the proposed model outperforms current GAN-based steganographic schemes on two datasets and the undetectability is superior to traditional algorithms when the steganalyst cannot access model hyperparameters.

Сравнение средств защиты информации Страж NT 4.0 и Secret Net Studio

This article discusses and compares hardware and software security. Currently, each company values its information and, therefore, chooses the software that can protect it more. To choose the means of information protection, the main parameters are considered: the quality of protection, functionality and price. Following these parameters, the most popular software-hardware information protection tools are compared. The article compares two main software products: “Strazh NT” from RUBINTECH company and “Secret Net Studio” from Security Code company. Considering the main parameters and characteristics of programs and their pricing policy, it should be noted that according to the characteristics and functionality, “Secret Net Studio” is the leader in pricing policy regarding “Strazh NT”. In a brief comparative analysis of the means of information protection against unauthorized access, based on the characteristics, it can be emphasized that “Secret Net Studio” is the most multifunctional means of information protection. In addition, this software product is cross-platform, which has a great impact on the potential user when making a choice with respect to the two products presented. If you pay attention to prices, then “Strazh NT” is the most profitable, but not the most convenient in terms of operation.

Photonic crystal films with upconversion luminescence based on the self-assembly of polystyrene encapsulated NaYF4:Ln3+ composite microspheres for dual-mode optical code

The design and fabrication of advanced materials with multiple optical states for constructing security code are of great value in anti-counterfeiting. Herein, novel upconversion photonic crystal (UCPC) films with tunable luminescence and structural color were prepared by vertical deposition of polystyrene encapsulated NaYF4:Ln3+ (CSNPs@SiO2/PS) composite microspheres. The composite microspheres were synthesized by sequential coating technology. Firstly, NaYF4:Ln3+@NaYF4 core/shell nanoparticles (CSNPs) were synthesized and served as upconversion luminescent emission centers. Then, the CSNPs were further coated by a SiO2 shell with pendant double bond to form CSNPs@SiO2-MPS. Afterward, mono-dispersed CSNPs@SiO2/PS composite microspheres were synthesized by emulsion polymerization of styrene in the presence of CSNPs@SiO2-MPS. By tailoring the doped lanthanide ions in CSNPs and adjusting the diameter of the composite microspheres, UCPC films with diverse upconversion fluorescence and structural color can be obtained. As a proof of concept, these different kinds of UCPC films were employed as information coding units to construct dual-mode anti-counterfeiting code. Our protocol provided a new security strategy for information storage.

Blockchain based hierarchical semi-decentralized approach using IPFS for secure and efficient data sharing

Nowadays, cloud servers are gathering an increasing amount of data. Data is commonly stored on cloud servers in the form of ciphertext to protect security and concealment of data. When a consumer requests to access of encrypted data, a third party must provide an access key. The system's security, however, will be compromised if the third party or internal personnel are dishonest. To address this issue, a novel blockchain-based secure decentralized system using IPFS is proposed in this research for secure data transfer. Because all participant of system model are recorded the every action on the chain, and the continuously extending chain makes it conditionally difficult to modify any block without being detected, a blockchain based system is often regarded as a safe platform. In the proposed approach, the data owner uploads an encrypted file to IPFS, which is subsequently separated into n secret sections called hash codes for data security. The data owner must additionally write the access permissions in order to achieve access to this secure data. For security, the system uses two-level key management: first, the data owner encrypts the file, and then the IPFS server makes a hash code of that encrypted file. The proposed solution, which employs blockchain technology, enables consumers to be handled across several domains, erase the single-point failure in traditional centralized systems, and overhead related to communication and computation are decreased at the consumer level. According to the security analysis, the proposed system might effectively resist single and collaboratively malicious persons, as well as untrustworthy cloud servers.

Health Care Planning for the Final Phase of Life - an Advance Care Planning Concept in Germany

Health Care Planning for the Final Phase of Life - an Advance Care Planning Concept in Germany Abstract. The international concept of Advance Care Planning (ACP) is a systematic and qualified communication process for people who want to talk about possible disease scenarios and their wishes for medical, nursing, psychosocial and spiritual care, and treatment for those scenarios, in the presence of their relatives and therapists. In Germany, section 132 g on health care planning for the last phase of life was stipulated in the Social Security Code Book (Sozialgesetzbuch) V as an insurance benefit of statutory health insurance funds (Gesetzliche Krankenversicherung) for certain patient groups, which reflects the ACP concept. An ACP concept that is geared towards the structures of the healthcare system in Germany has become known nationwide as "Behandlung im Voraus Planen" (BVP). As part of the BVP conversations, the individual wishes for future medical, nursing, and psychosocial treatments are recorded and discussed according to the principle of shared decision-making with residents of senior citizens' facilities or with disabled people in cantres for integration assistance. These wishes can be recorded in detail in a document such as an advance directive. Specially trained persons from the medical and non-medical professional groups - such as nurses, social workers, curative educator therapists - can hold these BVP conversations. For this purpose, further training which follows a predefined core curriculum of the GKV-Spitzenverband must be successfully completed.

A Cross Language Code Security Audit Framework Based on Normalized Representation

With the rapid development of information technology, audit objects and audit itself are more and more inseparable from software. As an important means of software security audit, code security audit will become an important aspect of future audit that cannot be ignored. However, the existing code security audit is mainly based on source code, which is difficult to meet the audit needs of more and more programming languages and binary commercial software. Based on the idea of normalized transformation, this paper constructs a cross language code security audit framework (CLCSA). CLCSA first uses compile/decompile technology to convert different high-level programming languages and binary codes into normalized representation, and then uses machine learning technology to build a cross language code security audit model based on normalized representation to evaluate code security and find out possible code security vulnerabilities. Finally, for the discovered vulnerabilities, the heuristic search strategy will be used to find the best repair scheme from the existing normalized representation sample library for automatic repair, which can improve the effectiveness of code security audit. CLCSA realizes the normalized code security audit of different types and levels of code, which provides a strong support for improving the breadth and depth of code security audit.

Cost Reassignment for Improving Security of Adaptive Steganography Using an Artificial Immune System

The cost function is crucial to the security of adaptive image steganography, However, some existing cost functions are heuristically designed and hard to be optimal in the undetectability against the evolving steganalyzer. In this letter, we propose a cost reassignment algorithm for adaptive steganography based on artificial immune system. Under the scenario of minimizing additive distortion, this method reassigns the cost by adjusting the modification probability distribution obtained by the cost function, and dynamically optimizes the adjustment mode through the immunity-based information hiding model, so that the modified pixels are more concentrated in the regions that are difficult to be detected. The experimental results show that the proposed method is suitable for a variety of the state-of-the-art cost functions and can achieve better performance on resisting the steganalysis.

Hybrid turbo code for information security and reliability

Wireless communication channels are highly vulnerable to security attacks and channel noise. Most wireless communication systems deploy advanced encryption standard (AES) and turbo code for security and reliability. However, the sequential process of encryption and encoding increases the resources, computational cost and reduces the overall error correction performance. A hybrid turbo code (HTC) for encryption and error correction is proposed. The HTC deploys a proposed Weierstrass elliptic curve interleaver (WECI) for random shuffling of the input bits. The difficulty of solving the elliptic curve discrete logarithm makes the WECI cryptographically strong. The simulation results of HTC depict a bit error rate of almost 10-3.8 at a signal-to-noise ratio of 2 dB similar to the conventional turbo code. Moreover, it provides security and reliability to the transmitted data at a reduced computational cost and memory as compared to the conventional system using AES followed by turbo code.

Cross-Site Scripting Attacks and Defensive Techniques: A Comprehensive Survey

The advancement of technology and the digitization of organizational functions and services have propelled the world into a new era of computing capability and sophistication. The proliferation and usability of such complex technological services raise several security concerns. One of the most critical concerns is cross-site scripting (XSS) attacks. This paper has concentrated on revealing and comprehensively analyzing XSS injection attacks, detection, and prevention concisely and accurately. I have done a thorough study and reviewed several research papers and publications with a specific focus on the researchers’ defensive techniques for preventing XSS attacks and subdivided them into five categories: machine learning techniques, server-side techniques, client-side techniques, proxy-based techniques, and combined approaches. The majority of existing cutting-edge XSS defensive approaches carefully analyzed in this paper offer protection against the traditional XSS attacks, such as stored and reflected XSS. There is currently no reliable solution to provide adequate protection against the newly discovered XSS attack known as DOM-based and mutation-based XSS attacks. After reading all of the proposed models and identifying their drawbacks, I recommend a combination of static, dynamic, and code auditing in conjunction with secure coding and continuous user awareness campaigns about XSS emerging attacks.

Key Generation and Secure Coding in Communications and Private Learning

Key Generation and Secure Coding in Communications and Private Learning

LANGUAGE IS OUR WEAPON: NEW MEANINGS OF OLD METAPHOR DURING THE RUSSIAN-UKRAINIAN WAR

The article deals with the peculiarities of the radical expansion of the Ukrainian-speaking communicative space motivated by the Russian invasion of Ukraine, which did not take place due to regulation, but due to the explosive growth of the emotional and socio-political consciousness of Ukrainians. The activity of a voluntary choice in favor of the Ukrainian language in daily communication has been demonstrated, in particular in the practice of state-makers, high-ranking officials of Ukraine, and public figures. This witnessed a radical change in the understanding of language as a symbol of identity and language as a means of communication. The lexical and phraseological means of motivating the choice of the Ukrainian language as a priority means of communication are characterized (voluntarily switched, wanted to switch to Ukrainian and did so, made a choice, decided to speak, decided for myself) and reasons for dissociation from the Russian language (I do not want to speak the same language with the occupiers; I don’t want to have anything to do with the occupiers; I don’t want to speak the language in which children are killed; I don’t want to spread the “Russian measure”; I don’t want to be part of the Russian pseudo-culture; to avoid associations with Russia), etc. Rethinking, recoding linguistic values, realizing that language is one of the fundamental signs of a self-sufficient, self-determined, historically and culturally realized nation is especially significant for state-makers and senior officials of Ukraine. In the context of the analysis of language as a security code, the nature of lexical shibboleths is considered.

Security Assurance Model of Software Development for Global Software Development Vendors

The number of security attacks and the impact has grown considerably in the recent several years. As a result, new emerging software development models are required that assist in developing software that is secure by default. This article reviews the most widely used security software models. It proposes a new Security Assurance Model (SAM) for Software Development that is adaptable to all contemporary scenarios, emphasizing global software development (GSD) vendor companies. The SAM of Software Development was developed after studying 11 well-known development models and analyzing results obtained from a systematic literature review (SLR) and questionnaire survey. The SAM of Software Development consists of seven security assurance levels: Governance and Security Threat Analysis, Secure Requirement Analysis, Secure Design, Secure Coding, Secure Testing and Review, Secure Deployment, and Security Improvement. The security assurance levels of SAM of software development consist of 46 critical software security risks (CSSRs) and 388 practices for addressing these risks. The proposed SAM of Software Development was assessed based on a tool created by Motorola, which is used to evaluate the present state of a company’s software processes and find areas for improvement. We conducted 3 case studies on software development companies, using data from real software projects to examine the results of a practical experiment in each company. The results of the case studies indicate that the proposed SAM of Software Development helps measure the security assurance level of an organization. In addition, it can potentially serve as a framework for researchers to develop new software security measures.

Competitive Swarm Optimization with Encryption Based Steganography for Digital Image Security

Digital image security is a fundamental and tedious process on shared communication channels. Several methods have been employed for accomplishing security on digital image transmission, such as encryption, steganography, and watermarking. Image stenography and encryption are commonly used models to achieve improved security. Besides, optimal pixel selection process (OPSP) acts as a vital role in the encryption process. With this motivation, this study designs a new competitive swarm optimization with encryption based stenographic technique for digital image security, named CSOES-DIS technique. The proposed CSOES-DIS model aims to encrypt the secret image prior to the embedding process. In addition, the CSOES-DIS model applies a double chaotic digital image encryption (DCDIE) technique to encrypt the secret image, and then embedding method was implemented. Also, the OPSP can be carried out by the design of CSO algorithm and thereby increases the secrecy level. In order to portray the enhanced outcomes of the CSOES-DIS model, a comparative examination with recent methods is performed and the results reported the betterment of the CSOES-DIS model based on different measures.

Hybrid Turbo Code for Information Security and Reliability

Hybrid Turbo Code for Information Security and Reliability

Rensomver kao pretnja bezbednosti - društveni i krivičnopravni aspekti

This article focuses on the analysis of social and criminal aspects of the phenomenon of ransomware-malware abuse. The authors' basic hypothesis is that the optimal mechanisms in terms of security and Criminal Code protection against this specific form of attacks on computer systems and data stored therein are still underdeveloped. The review of scientific and professional literature and the use of legal-dogmatic and normative methods by various authors have shown that crime related to the use of ransomware-malware has a potential to seriously endanger certain segments of modern society - economy, sensitive personal data, national and supranational critical infrastructure. The authors have also noted the shortcomings of currently available legal solutions. The authors conclude that it is necessary to conduct tailored educations of computer system users and also to undertake appropriate activities for the purpose of improving security culture. The authors additionally present concrete proposals for improving the legal framework for criminal legislation. Keywords: ransomware-malware, s

Adversarial Steganography Embedding via Stego Generation and Selection

The recent literature has shown that adversarial embedding has promise for enhancing the security of steganography. However, existing methods achieve the final stego mainly based on a pre-trained Convolutional Neural Network (CNN)-based steganalyzer without considering any other steganalytic features. When the steganalyzer is re-trained, its performance usually drops significantly. We propose a novel adversarial embedding method via stego generation and selection. To improve the diversity of the stego images, this method first randomly generates many candidate stegos according to the amplitudes of the gradients and embedding costs of a given cover. Since the image residuals are the commonly used low-level features in many steganalyzers, the proposed method carefully designs different adaptive high-pass filters to calculate the image residuals, and then selects a final stego from among those candidate stegos which can successfully fool the pre-trained steganalyzer, according to the residual distance between stego and the cover. Extensive experimental evaluations on re-trained CNN-based and traditional steganalyzers demonstrate that the proposed method can significantly enhance the security of the modern steganographic methods in both spatial and JPEG domains, and achieve much better performance than related adversarial embedding methods.

Design of Anti-Eavesdropping Scheme for SLT-LT Codes Based on Random Symbol Sets

In recent years, physical layer security technology has provided a new way to solve the problem of secure transmissions in wireless communications from an information theory perspective by using physical layer security coding and the inherent characteristics of the channel. As a nonsystematic code, Luby transform (LT) code has the characteristics of random coding and rateless, therefore, eavesdroppers cannot directly obtain useful information from leaked code symbols. As a shifted LT (SLT) code, the SLT codes can efficiently recover information, with a smaller decoding overhead. Therefore, we propose an SLT-LT joint code anti-eavesdropping scheme based on random symbol sets. Based on the environment of the main channel, the sender selects a set of random symbols to send to legitimate receivers as known symbols and uses these random symbols and message symbols to form source symbols for the SLT-LT concatenated coding to increase the bit error rate (BER) of the eavesdroppers. The experimental results show that, compared with other anti-eavesdropping LT schemes, our proposed scheme only adds a small amount of decoding overhead but has a better security performance.

Secure software development: industrial practice - a review

The current state of application assets with respect to their development, functionality, scalability, user friendliness, and compatibility with legacy systems has witnessed an unprecedented degree of positive improvements. This induced increase in productivity and value has been a product of the technological innovations within and around the software development landscape. Owing to specific software development practices including software reusability, Object Oriented Programming (OOP), encapsulation, and portability, all sectors of the economy have come to embrace software products that have helped to drive business transactions. Nonetheless, the proliferation of software which has driven up the velocity, veracity and volume of data associated with transactions has become a goldmine for grabs. Hackers and adversaries alike have thus capitalized on this development to exploit the potential threats and vulnerabilities associated with software products. Insecure software is global issue, and one that impacts individuals, organizations and governments. Data loss is both a security and privacy issue, with compliance, regulatory and legal concerns, and bad actors are relentless in their efforts to steal, deface, alter/manipulate, destroy, and compromise software systems. Organizations should therefore embrace secure code principles, threat modeling, and institute a Secure Software Development Lifecycle (SSDLC) practice that will aid the embedment of security into the development phase, to contain the risks, threats, and vulnerabilities that are inherent in software development. This paper demonstrates an effort to provide and arm organizations with the necessary tools, processes, and mechanisms that can be leveraged to combat cyber-threats and enforce Information Assurance (IA) within and around enterprise application assets. Beginning with an overview of the contemporary software development practices witnessed in diverse organizations, including financial, energy, aviation, commerce, nuclear, defense, and several other Critical Infrastructure (CI) organizations, the tenets of a composite, structured and robust. SSDLC has been presented to promote a defense-in-depth security for enterprise organizations.

НОРМАТИВНО-ПРАВОВЕ ЗАБЕЗПЕЧЕННЯ СОЦІАЛЬНОЇ БЕЗПЕКИ В УКРАЇНІ ТА СВІТІ

The article is devoted to define the peculiarities of the regulatory and legal support of social security, as well as directions for its improvement, taking into account foreign experience and national realities. The assessment of the state of Ukrainian legislation in the context of the normative-legal consolidation of social security was carried out, in particular, the main normative-legal acts regulating the issue of social security in Ukraine were determined, the key provisions of the European Social Security Code and the European Social Charter were analyzed as leading regulatory documents that establish the foundations of security social interests of the population. The priority directions for improving the regulatory and legal provision of social security in Ukraine are proposed, including the legislative consolidation of social security and specification of measures to ensure it; the introduction of social standards of developed European countries into domestic practice, in particular through the improvement of the legal basis of the functioning of the system of social protection of the population; the bringing the regulatory and legal provision of social security of the population into compliance with international requirements, taking into account domestic realities; the improvement of functional aspects of institutional provision of social security by redistribution of powers and functions of state bodies in conditions of decentralization, as well as taking into account the need to introduce innovations into the process of activity of relevant institutions. It was determined that the need to improve the mechanisms of regulatory and legal support based on the leading experience of socially oriented European countries with mandatory consideration of the current state of socio-economic relations in Ukraine is an important condition for the formation of a state of protection of the social interests of the population. As prospects for further research, the necessity of studying the directions of practical implementation of state policy aimed at improving the welfare of the population and ensuring social security, taking into account the importance of the social sphere at the stage of Ukraine's recovery after the end of the war, is determined.

Deep Learning Approach for Spoken Digit Recognition in Gujarati Language

Speech Recognition is an emerging field in the area of Natural Language Processing which provides ease for human machine interaction with speech. Speech recognition for digits is useful for numbers oriented communication such as mobile number, scores, account number, registration code, social security code etc. This research paper seeks to achieve recognition of ten Gujarati digits from zero to nine (૦ to ૯) by using a deep learning approach. Dataset is generated with total 8 native speakers 4 male 4 female with the age group of 20 to 40. The dataset includes 2400 labeled audio clips of both genders. To implement a deep learning approach, Convolutional Neural Network (CNN) with MFCC is used to analyze audio clips to generate spectrograms. For the proposed approach three different experiments were performed with different dataset sizes as 1200, 1800 and 2400. With this approach maximum 98.7% accuracy is achieved for spoken digits in Gujarati language with 98% Precision and 98% Recall. It is analyzed from various experiments that increase in dataset size improves the accuracy rate for spoken digit recognition. No of epochs in CNN also improves accuracy to some extent.