Security Defense Research Articles

Research on Security Defense of Coupled Transportation and Cyber-Physical Power System Based on the Static Bayesian Game

The driving and charging behavior of an increasing number of electric vehicles (EVs) have strengthened the connection between transportation network (TN) and cyber-physical power system (CPPS). Cyber-attacks imposed on the coupled system will cause a big disturbance to the power network (PN), which will further affect the travel behavior of EVs in the TN. To improve the ability of the coupled system to resist attacks, this paper presents the framework of coupled transportation and cyber-physical power system with a defense mechanism. From a defense perspective, considering comprehensive load shedding loss of load buses, an active defense model driven by static Bayesian game theory is built at the information network (IN) level of CPPS, which provides a defense strategy selection method against attacks at a certain moment. Moreover, a charging guidance model for EVs based on dynamic vehicles travel simulation is developed to describe the impact of charging station (CS) outage induced by the unsuccessful defense, and to mitigate disturbance on the TN. Simulation experiments with a modified Sioux Falls traffic network and IEEE 30-bus power grid coupled system verify the effectiveness of the proposed method and model.

Exploring the effect of industrial structure on urban heat island effect with infrared observations

Infrared technology is being used more and more in human life, from life and health, social development to national defense security. This paper investigates the land surface temperature based on the long-wave infrared remote sensing technology (MODIS). Combined with the STIRPAT (Stochastic Impacts by Regression on Population, Affluence, and Technology) model, we focus on the analysis the impact of industry structure on the climate of the surface urban heat islands (UHI), which is of great importance for the urban environment. Here, we found the impact of industrial structure upgrading on urban heat island is significant and positive. And the positive influence of industrial structure shows a significant spatial and Temporal heterogeneity. Moreover, the results of threshold regression revel that the role of industrial structure upgrading on urban heat island has a significant threshold effect. When the population scale and technology level pass the certain threshold value, the influence of industrial structure optimizing will become larger and smaller, respectively. This work involved the integration of infrared technology, satellite remote sensing, environmental economics, and will promote the contribution of infrared technology to human sustainable development.

A differential game approach for real-time security defense decision in scale-free networks

The current network security defense decision method is based on the principle of attack–defense confrontation and generally uses a random network model to project the real network. Most of the existing complex network defense decision methods consider a single defender while ignoring the confrontation and dependence between network attack and defense behaviors. In addition, the pertinence and dynamics of the defense effect are also insufficient. This article comprehensively considers the structure of a scale-free network and characteristics of network attack and defense behavior and combines a complex network with differential game theory to study the real-time defense decision problem. First, a propagation model based on a scale-free network is designed to realize the real-time fluctuation analysis of a network security state. Then, the attack and defense strategy are described, and the calculation method of revenue based on the confrontation analysis of the attack and defense behavior and a change in the security state of the network nodes based on the saddle point equilibrium strategy are introduced. Finally, based on the average connection degree of the real word Internet, a simulated network is constructed to conduct experiments. By comparison with random defense strategies and several typical complex network defense decision methods, the effectiveness and advancement of the proposed method are verified.

Hybrid-AI-Based iBeacon Indoor Positioning Cybersecurity: Attacks and Defenses.

iBeacon systems have been increasingly established in public areas to assist users in terms of indoor location navigation and positioning. People receive the services through the Bluetooth Low Energy (BLE) installed on their mobile phones. However, the positioning and navigation functions of an iBeacon system may be compromised when faced with cyberattacks issued by hackers. In other words, its security needs to be further considered and enhanced. This study took the iBeacon system of Taipei Main Station, the major transportation hub with daily traffic of at least three hundred thousand passengers, as an example for exploring its potential attacks and further studying the defense technologies, with the assistance of AI techniques and human participation. Our experiments demonstrate that in the early stage of iBeacon system information security planning, information security technology and a rolling coding encryption should be included, representing the best defense methods at present. In addition, we believe that the adoption of rolling coding is the most cost-effective defense. However, if the security of critical infrastructure is involved, the most secure defense method should be adopted, namely a predictable and encrypted rolling coding method.

A new dynamic security defense system based on TCP_REPAIR and deep learning

Honeypot is an active defense mechanism, which attracts attackers to interact with virtual resources in the honeypot mainly by simulating real working scenarios and deploying decoy targets, so as to prevent real resources from being damaged and collect attackers’ attack processes and analyze potential system vulnerabilities to proactively respond to similar attacks. Because of the existing honeypot system has defects such as the inability to deploy specific honeypots to induce attacks based on complex attacks, the inability to select the best honeypot for dynamic response based on honeypot deployment and maintenance costs during attack interactions, and insufficient ability to identify variants of known attack methods. Although hybrid honeypots can solve some of these problems by deploying low-interaction honeypots and high-interaction honeypots, they cannot really be applied to real production scenarios because of their slow TCP connection switching speed and inability to efficiently identify encrypted malicious traffic. In this paper, we propose a new dynamic security defense system based on the combination of TCP_REPAIR-based dynamic honeypot selection architecture and a deep learning-based intelligent firewall. The system accurately distributes encrypted or non-encrypted attack traffic and its variants through the intelligent firewall. The normal traffic is sent to the actual system, and the marked malicious traffic dynamically selects honeypots to respond according to the attack process.The experimental result indicated that the system can select honeypots for targeted responses according to the actual network situation quickly and dynamically and covertly, effectively improving the utilization rate of honeypot clusters as well as the ability to decoy.

SpecTerminator: Blocking Speculative Side Channels Based on Instruction Classes on RISC-V

In modern processors, speculative execution has significantly improved the performance of processors, but it has also introduced speculative execution vulnerabilities. Recent defenses are based on the delayed execution to block various speculative side channels, but we show that several of the current state-of-the-art defenses fail to block some of the available speculative side channels, and the current most secure defense introduces a performance overhead of up to 24.5%. We propose SpecTerminator, the first defense framework based on instruction classes that can comprehensively and precisely block all existing speculative side channels. In SpecTerminator, a novel speculative side channel classification scheme based on the features of secret transmission is proposed, and the sensitive instructions in the speculative window are classified and identified using optimized hardware taint tracking and instruction masking techniques to accurately determine the scope of leakage. Then, according to the execution characteristics of these instructions, dedicated delayed execution strategies, such as TLB request ignoring, selective issue, and extended delay-on-miss, are designed for each type of sensitive instruction to precisely control that these instructions are delayed only in pipeline stages that are at risk of leakage. In contrast to previous defenses based on the Gem5 simulator, we have innovatively implemented defenses against Spectre attacks based on the open-source instruction set RISC-V on an FPGA-accelerated simulation platform that is more similar to real hardware. To evaluate the security of SpecTerminator, we have replicated various existing x86-based Spectre variants on RISC-V. On SPEC 2006, SpecTerminator defends against Spectre attacks based on memory hierarchy side channels with a performance overhead of 2.6% and against all existing Spectre attacks with a performance overhead of 6.0%.

A Framework Design to Improve the Operation Capability of Cyber Security for Electric Power Dispatching and Control Systems based on the Concept of SOC

Benefiting from the vision of the Security Operation Center (SOC), this paper proposes a construction plan for a cyber security operation center for the electric power dispatching and control system. This solution integrates and analyzes various data such as ledger database, knowledge database, and historical alarm database in the power dispatching and control system, and realizes the functions of alarm handling, risk assessment, and emergency response for the existing security management platform. Through the risk evaluation experiment, it is verified that our scheme has the function of overall interacted active security defense, and can effectively improve the cyber security risk resistance of the power dispatching and control system.

Nash mixed detection strategy of multi-type network attack based on zero-sum stochastic game

The defense strategy of the Internet of Things (IoT) under hacker attack is a crucial issue in the security field of industry. When IoT plants are attacked by hackers, it is impossible to understand the type of attack employed by the hackers. At this point, we need a detection mechanism that can cope with the known multiple types of network attacks. In this paper, we focus on the issue of IoT security defense and construct a multi-detector detection system capable of detecting multiple types of network attacks based on a zero-sum stochastic game framework. The system can choose between multiple detectors according to a mixed Nash equilibrium strategy that takes into account both the detection cost and the detection effect. Finally, we present a simulation comparison between the multi-detector system and the single detector system to verify that the mixed strategy leads to higher detection effectiveness and lower control performance loss.

High Signal-to-Noise Ratio MEMS Noise Listener for Ship Noise Detection

Ship noise observation is of great significance to marine environment research and national defense security. Acoustic stealth technology makes a variety of ship noise significantly reduced, which is a new challenge for marine noise monitoring. However, there are few high spatial gain detection methods for low-noise ship monitoring. Therefore, a high Signal-to-Noise Ratio (SNR) MEMS noise listener for ship noise detection is developed in this paper. The listener achieves considerable gain by suppressing isotropic noise in the ocean. The working principle and posterior end signal processing method of the listener are introduced in detail. A gain of 10 dB over the sound pressure detector is obtained by detecting the standard sound source. In addition, the traffic vessel noise monitoring experiment verifies that the listener can detect the ship noise. The results show that the listener has a very broad application prospect in the field of low-noise ship observation.

Evaluation method and optimization strategies of resilience for air & space defense system of systems based on kill network theory and improved self-information quantity

Resilience of air & space defense system of systems (SoSs) is critical to national air defense security. However, the research on it is still scarce. In this study, the resilience of air & space defense SoSs is firstly defined and the kill network theory is established by combining super network and kill chain theory. Two cases of the SoSs are considered: (a) The kill chains are relatively homogenous; (b) The kill chains are relatively heterogenous. Meanwhile, two capability assessment methods, which are based on the number of kill chains and improved self-information quantity, respectively, are proposed. The improved self-information quantity modeled based on nodes and edges can achieve qualitative and quantitative assessment of the combat capability by using linguistic Pythagorean fuzzy sets. Then, a resilient evaluation index consisting of risk response, survivability, and quick recovery is proposed accordingly. Finally, network models for regional air defense and anti-missile SoSs are established respectively, and the resilience measurement results are verified and analyzed under different attack and recovery strategies, and the optimization strategies are also proposed. The proposed theory and method can meet different demands to evaluate combat capability and optimize resilience of various types of air & space defense and similar SoSs.

Practice and Enlightenment of China's Aerospace Complex System Management in the National System

Aerospace engineering is characterized by its huge scale, technological complexity, high standards of quality and reliability, tremendous cost, and long R&D cycle. It is closely tied with national politics and defense security, and may indirectly provide socioeconomic benefits. To organize and implement a complex aerospace project, it is necessary to make innovations in technologies, schedules, qualities, and facilit ies construction management measures and establish an aerospace engineering management system adaptive to the high-complexity feature, based on the management models of the traditional aerospace system engineering. Different types of participants play different functions in project decision-making. The expert group participates in the whole process of the formulation and decision-making of the schemes, providing decision support for each system and the general department. This study describes the implications for the space domain of China’s deployment of the state-owned enterprises (SOEs) as power projection vehicles to advance Beijing’s national strategy. In order to provide reference for the application of model-based systems engineering (MBSE) in the aerospace field, suggestions and conclusions on the development of MBSE application in China were provided.

Defense security and sustainable development in Africa: Emerging challenges and response

The endemic nature of insecurity in Africa stands out as one which is disastrous, thereby making African a shadow of itself. This study examines defense security and sustainable development in emerging democracies of Sub-Saharan Africa. Methodologically, Crosssectional descriptive survey design was adopted in the study, while primary and secondary sources of data were relied upon, interview and focus group discussion (FGD) were used as primary instruments of data collections. The social contract theory is adopted as the framework of analysis. Finding of this study revealed that bad governance has perpetuated class antagonism which breeds dissatisfaction amongst people in a bid to seek equality and justice in the distribution of power and economic resources. This process conceives conflict and the result for which many take to demand for rights which are unmet, hence unleashed terror to secure inalienable rights, access to power and economy. An analysis on Sustainable Development in this study, does reveal that denial and lack of access and opportunities are fundamental premises under which devastations of an economy can ensue and hence the entrenchment of the reign of terror. This process, as applicable in Africa, did also permeate the preponderance of reserved armies of unemployed under the guise of mendicant friars that further heightened the predominance of the terrorist regime in Africa amidst destruction of lives and economy. A way out of this is to create mechanism to open up more equitable access to power and economic opportunities which could lead to full capacity utilization of people’s potentials and subsequently empower them with incomes and improved living conditions. This requires both commitment and diplomacy of the government and to undertake under the banner of collective responsibility and good governance.

Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

Ensuring the Stability of Cyber Defense of the State in the Conditions of Armed Conflict

The article is devoted to the problem of sustainability of cyber defense of national security in the context of modern armed conflicts. The work examines key aspects that pose a threat to the state's cyber security, including cyber attacks, cyber espionage and cyber sabotage. The article analyzes the need for the development of cyber infrastructure, personnel training and a crisis plan for recovery after a cyber attack. It also examines the role of government institutions in ensuring cyber security, including regulatory development and cooperation with the private sector and academic institutions. In addition, the article highlights the international aspect of cyber defense resilience and the importance of cooperation between states and compliance with international norms and rules in cyberspace. The work ends with conclusions about the importance of joint efforts of national and international public structures to ensure sustainable cyber security in the conditions of armed conflicts.

EDUCATION AS A TOOL FOR ENSURING NATIONAL SECURITY

The issue of improving the provision of national security of Ukraine by improving the sphere of education has been updated. It has been established that today's conceptual transformational changes taking place in Ukraine and the world require consideration of the field of education as an integral part of the formation of the general field of national security of Ukraine. It is proved that pAmong the various factors of national security, an important role is played by the educational sphere and educational potential, which is a system-forming factor in the life of society and actively affects the state of political, economic, social, defense and other components of security. The reverse statement is also justified: political, economic, defense and other spheres, being system-forming factors of society, determine the conditions for the formation and development of educational potential. National security cannot be ensured only by the means of educational policy, but it cannot be guaranteed in isolation from it.

Machine Learning Techniques for Detecting Phishing URL Attacks

Cyber Attacks are critical and destructive to all industry sectors. They affect social engineering by allowing unapproved access to a Personal Computer (PC) that breaks the corrupted system and threatens humans. The defense of security requires understanding the nature of Cyber Attacks, so prevention becomes easy and accurate by acquiring sufficient knowledge about various features of Cyber Attacks. Cyber-Security proposes appropriate actions that can handle and block attacks. A phishing attack is one of the cybercrimes in which users follow a link to illegal websites that will persuade them to divulge their private information. One of the online security challenges is the enormous number of daily transactions done via phishing sites. As Cyber-Security have a priority for all organizations, Cyber-Security risks are considered part of an organization’s risk management process. This paper presents a survey of different modern machine-learning approaches that handle phishing problems and detect with high-quality accuracy different phishing attacks. A dataset consisting of more than 11000 websites from the Kaggle dataset was utilized and studying the effect of 30 website features and the resulting class label indicating whether or not it is a phishing website (1 or −1). Furthermore, we determined the confusion matrices of Machine Learning models: Neural Networks (NN), Naïve Bayes, and Adaboost, and the results indicated that the accuracies achieved were 90.23%, 92.97%, and 95.43%, respectively.

A Cooperative Defense Framework Against Application-Level DDoS Attacks on Mobile Edge Computing Services

Mobile edge computing (MEC), extending computing services from cloud to edge, is recognized as one of key pillars to facilitate real-time services and tackle backhaul bottleneck. However, it is not economically efficient to attach intensive security appliances to every MEC node to defend application-level DDoS attacks and ensure the availability of services. Thus, we explore the elasticity of security defense among MEC nodes by proposing a COoperative DEfense ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE</i> ) framework for MEC, referred to as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE4MEC</i> . CODE4MEC aims to adapt to traffic changes by coordinating container-carried defensive resources among cooperative MEC nodes in an automatic way. Towards this aim, we propose four control plane functions to enable a life-cycle management for CODE4MEC, namely, CODE triggering, scheduling, coordination and releasing. However, an effective CODE4MEC requires non-trivial algorithmic schemes, in particular for CODE scheduling and coordination functions. We thus design an online combinatorial auction mechanism for real-time CODE scheduling, and prove a tighter performance bound relative to prior arts. As for CODE coordination, a flow-based traffic and context information coordination scheme is proposed to enable classical defense schemes to work properly and efficiently. Finally, using a combination of real testbed and simulation evaluations, we validate the effectiveness of CODE4MEC.

The Effect of Cyber Security Risks on E-Governance usage: A Case Study of Tanzanian Immigration Department

The use of e-Governance, has offered citizens a convenient, efficient and transparent manner of enjoying most important services. However, ICT services are prone to cyber security threats which can hinder the effective and efficient usage of e-Governance services. This study assessed the effect of cyber security threats and risks on the Tanzania e-Governance services usage at the Immigration department. The study has used an exploration research design to collect primary data from 113 randomly sampled respondents at the Tanzania Immigration department. The data was analysed descriptively to determine the frequency and mean relationships between the variables. Additionally, a regression model has been used to determine the direction of relationships between the independent and dependent variables. The findings revealed that 93.8% of the respondents are aware of the e-Governance services. However, this is not proportional to the e-Governance usage since only 27.4% of the responding officers indicated that they are frequent users of the service. The study further indicate that the system faces minimal security risks at the department which is a result of well-established security defense system such as the use of strong and frequent password change. The study recommends e-governance service operators should constantly monitor the systems to identify threats, develop a more user-friendly architecture, and promote adoption among Tanzanians.

Construction of a Security Defense Model for the University's Cyberspace Based on Machine Learning

Construction of a Security Defense Model for the University's Cyberspace Based on Machine Learning

G2Grad-CAMRL: An Object Detection and Interpretation Model Based on Gradient-Weighted Class Activation Mapping and Reinforcement Learning in Remote Sensing Images

Remote sensing images contain important information such as airports, ports, and ships. By extracting remote sensing image features and learning the mapping relationship between image features and text semantic features, the interpretation and description of remote sensing image content can be realized, which has a wide range of application value in military and civil fields such as national defense security, land monitoring, urban planning, disaster mitigation and so on. Aiming at the complex background of remote sensing images and the lack of interpretability of existing target detection models, and the problems in feature extraction between different network structures, different layers, and the accuracy of target classification, we propose an object detection and interpretation model based on Gradient weighted class activation mapping and reinforcement learning. Firstly, ResNet is used as the main backbone network to extract the features of remote sensing images and generate feature graphs. Then, we add the global average pooling layer to obtain the corresponding feature weight vector of the feature graph. The weighted vectors are superimposed to output class activation maps. The reinforcement learning method is used to optimize the generated region generation network. At the same time, we improve the reward function of reinforcement learning to improve the effect of the region generation network. Finally, network dissecting analysis is used to obtain the interpretable semantic concept in the model. Through experiments, the average accuracy is more than 85%. Experimental results in the public remote sensing image description dataset show that the proposed method has high detection accuracy and good description performance for remote sensing images in complex environments.