Security Defense Research Articles

SpecTerminator: Blocking Speculative Side Channels Based on Instruction Classes on RISC-V

In modern processors, speculative execution has significantly improved the performance of processors, but it has also introduced speculative execution vulnerabilities. Recent defenses are based on the delayed execution to block various speculative side channels, but we show that several of the current state-of-the-art defenses fail to block some of the available speculative side channels, and the current most secure defense introduces a performance overhead of up to 24.5%. We propose SpecTerminator, the first defense framework based on instruction classes that can comprehensively and precisely block all existing speculative side channels. In SpecTerminator, a novel speculative side channel classification scheme based on the features of secret transmission is proposed, and the sensitive instructions in the speculative window are classified and identified using optimized hardware taint tracking and instruction masking techniques to accurately determine the scope of leakage. Then, according to the execution characteristics of these instructions, dedicated delayed execution strategies, such as TLB request ignoring, selective issue, and extended delay-on-miss, are designed for each type of sensitive instruction to precisely control that these instructions are delayed only in pipeline stages that are at risk of leakage. In contrast to previous defenses based on the Gem5 simulator, we have innovatively implemented defenses against Spectre attacks based on the open-source instruction set RISC-V on an FPGA-accelerated simulation platform that is more similar to real hardware. To evaluate the security of SpecTerminator, we have replicated various existing x86-based Spectre variants on RISC-V. On SPEC 2006, SpecTerminator defends against Spectre attacks based on memory hierarchy side channels with a performance overhead of 2.6% and against all existing Spectre attacks with a performance overhead of 6.0%.

A Framework Design to Improve the Operation Capability of Cyber Security for Electric Power Dispatching and Control Systems based on the Concept of SOC

Benefiting from the vision of the Security Operation Center (SOC), this paper proposes a construction plan for a cyber security operation center for the electric power dispatching and control system. This solution integrates and analyzes various data such as ledger database, knowledge database, and historical alarm database in the power dispatching and control system, and realizes the functions of alarm handling, risk assessment, and emergency response for the existing security management platform. Through the risk evaluation experiment, it is verified that our scheme has the function of overall interacted active security defense, and can effectively improve the cyber security risk resistance of the power dispatching and control system.

Nash mixed detection strategy of multi-type network attack based on zero-sum stochastic game

The defense strategy of the Internet of Things (IoT) under hacker attack is a crucial issue in the security field of industry. When IoT plants are attacked by hackers, it is impossible to understand the type of attack employed by the hackers. At this point, we need a detection mechanism that can cope with the known multiple types of network attacks. In this paper, we focus on the issue of IoT security defense and construct a multi-detector detection system capable of detecting multiple types of network attacks based on a zero-sum stochastic game framework. The system can choose between multiple detectors according to a mixed Nash equilibrium strategy that takes into account both the detection cost and the detection effect. Finally, we present a simulation comparison between the multi-detector system and the single detector system to verify that the mixed strategy leads to higher detection effectiveness and lower control performance loss.

High Signal-to-Noise Ratio MEMS Noise Listener for Ship Noise Detection

Ship noise observation is of great significance to marine environment research and national defense security. Acoustic stealth technology makes a variety of ship noise significantly reduced, which is a new challenge for marine noise monitoring. However, there are few high spatial gain detection methods for low-noise ship monitoring. Therefore, a high Signal-to-Noise Ratio (SNR) MEMS noise listener for ship noise detection is developed in this paper. The listener achieves considerable gain by suppressing isotropic noise in the ocean. The working principle and posterior end signal processing method of the listener are introduced in detail. A gain of 10 dB over the sound pressure detector is obtained by detecting the standard sound source. In addition, the traffic vessel noise monitoring experiment verifies that the listener can detect the ship noise. The results show that the listener has a very broad application prospect in the field of low-noise ship observation.

Evaluation method and optimization strategies of resilience for air & space defense system of systems based on kill network theory and improved self-information quantity

Resilience of air & space defense system of systems (SoSs) is critical to national air defense security. However, the research on it is still scarce. In this study, the resilience of air & space defense SoSs is firstly defined and the kill network theory is established by combining super network and kill chain theory. Two cases of the SoSs are considered: (a) The kill chains are relatively homogenous; (b) The kill chains are relatively heterogenous. Meanwhile, two capability assessment methods, which are based on the number of kill chains and improved self-information quantity, respectively, are proposed. The improved self-information quantity modeled based on nodes and edges can achieve qualitative and quantitative assessment of the combat capability by using linguistic Pythagorean fuzzy sets. Then, a resilient evaluation index consisting of risk response, survivability, and quick recovery is proposed accordingly. Finally, network models for regional air defense and anti-missile SoSs are established respectively, and the resilience measurement results are verified and analyzed under different attack and recovery strategies, and the optimization strategies are also proposed. The proposed theory and method can meet different demands to evaluate combat capability and optimize resilience of various types of air & space defense and similar SoSs.

Practice and Enlightenment of China's Aerospace Complex System Management in the National System

Aerospace engineering is characterized by its huge scale, technological complexity, high standards of quality and reliability, tremendous cost, and long R&D cycle. It is closely tied with national politics and defense security, and may indirectly provide socioeconomic benefits. To organize and implement a complex aerospace project, it is necessary to make innovations in technologies, schedules, qualities, and facilit ies construction management measures and establish an aerospace engineering management system adaptive to the high-complexity feature, based on the management models of the traditional aerospace system engineering. Different types of participants play different functions in project decision-making. The expert group participates in the whole process of the formulation and decision-making of the schemes, providing decision support for each system and the general department. This study describes the implications for the space domain of China’s deployment of the state-owned enterprises (SOEs) as power projection vehicles to advance Beijing’s national strategy. In order to provide reference for the application of model-based systems engineering (MBSE) in the aerospace field, suggestions and conclusions on the development of MBSE application in China were provided.

Defense security and sustainable development in Africa: Emerging challenges and response

The endemic nature of insecurity in Africa stands out as one which is disastrous, thereby making African a shadow of itself. This study examines defense security and sustainable development in emerging democracies of Sub-Saharan Africa. Methodologically, Crosssectional descriptive survey design was adopted in the study, while primary and secondary sources of data were relied upon, interview and focus group discussion (FGD) were used as primary instruments of data collections. The social contract theory is adopted as the framework of analysis. Finding of this study revealed that bad governance has perpetuated class antagonism which breeds dissatisfaction amongst people in a bid to seek equality and justice in the distribution of power and economic resources. This process conceives conflict and the result for which many take to demand for rights which are unmet, hence unleashed terror to secure inalienable rights, access to power and economy. An analysis on Sustainable Development in this study, does reveal that denial and lack of access and opportunities are fundamental premises under which devastations of an economy can ensue and hence the entrenchment of the reign of terror. This process, as applicable in Africa, did also permeate the preponderance of reserved armies of unemployed under the guise of mendicant friars that further heightened the predominance of the terrorist regime in Africa amidst destruction of lives and economy. A way out of this is to create mechanism to open up more equitable access to power and economic opportunities which could lead to full capacity utilization of people’s potentials and subsequently empower them with incomes and improved living conditions. This requires both commitment and diplomacy of the government and to undertake under the banner of collective responsibility and good governance.

Understanding Failures in Security Proofs of Multi-Factor Authentication for Mobile Devices

Multi-factor authentication is a promising way to enhance the security of password-based authenticated key exchange (PAKE) schemes. It is widely deployed in various daily applications for mobile devices (e.g., e-Bank, smart home, and cloud services) to provide the first line of defense for system security. However, despite intensive research, how to design a secure and efficient multi-factor authentication scheme is still a challenging problem. Hundreds of new schemes have been successfully proposed, and many are even equipped with a formal security proof. However, most of them have been shortly found to be insecure and cannot achieve the claimed security goals. Now a paradox arises: How can a multi-factor scheme that was “formally proven secure” later be found insecure? To answer this seemingly contradicting question, this paper takes a substantial first step towards systematically exploring the security proof failures in multi-factor authentication schemes for mobile devices. We first investigate the root causes of the “provable security” failure in vulnerable multi-factor authentication schemes under the random oracle model, and classify them into eight different types in terms of the five steps of conducting a formal security proof. Then, we elaborate on each type of these eight proof failures by examining three typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 70 representative multi-factor authentication schemes under our extended evaluation criteria. The schemes we select range from 2009 to 2022, and the comparison results suggest that understanding failures in formal security proofs is helpful to design more secure multi-factor authentication protocols for mobile devices.

Ensuring the Stability of Cyber Defense of the State in the Conditions of Armed Conflict

The article is devoted to the problem of sustainability of cyber defense of national security in the context of modern armed conflicts. The work examines key aspects that pose a threat to the state's cyber security, including cyber attacks, cyber espionage and cyber sabotage. The article analyzes the need for the development of cyber infrastructure, personnel training and a crisis plan for recovery after a cyber attack. It also examines the role of government institutions in ensuring cyber security, including regulatory development and cooperation with the private sector and academic institutions. In addition, the article highlights the international aspect of cyber defense resilience and the importance of cooperation between states and compliance with international norms and rules in cyberspace. The work ends with conclusions about the importance of joint efforts of national and international public structures to ensure sustainable cyber security in the conditions of armed conflicts.

EDUCATION AS A TOOL FOR ENSURING NATIONAL SECURITY

The issue of improving the provision of national security of Ukraine by improving the sphere of education has been updated. It has been established that today's conceptual transformational changes taking place in Ukraine and the world require consideration of the field of education as an integral part of the formation of the general field of national security of Ukraine. It is proved that pAmong the various factors of national security, an important role is played by the educational sphere and educational potential, which is a system-forming factor in the life of society and actively affects the state of political, economic, social, defense and other components of security. The reverse statement is also justified: political, economic, defense and other spheres, being system-forming factors of society, determine the conditions for the formation and development of educational potential. National security cannot be ensured only by the means of educational policy, but it cannot be guaranteed in isolation from it.

Machine Learning Techniques for Detecting Phishing URL Attacks

Cyber Attacks are critical and destructive to all industry sectors. They affect social engineering by allowing unapproved access to a Personal Computer (PC) that breaks the corrupted system and threatens humans. The defense of security requires understanding the nature of Cyber Attacks, so prevention becomes easy and accurate by acquiring sufficient knowledge about various features of Cyber Attacks. Cyber-Security proposes appropriate actions that can handle and block attacks. A phishing attack is one of the cybercrimes in which users follow a link to illegal websites that will persuade them to divulge their private information. One of the online security challenges is the enormous number of daily transactions done via phishing sites. As Cyber-Security have a priority for all organizations, Cyber-Security risks are considered part of an organization’s risk management process. This paper presents a survey of different modern machine-learning approaches that handle phishing problems and detect with high-quality accuracy different phishing attacks. A dataset consisting of more than 11000 websites from the Kaggle dataset was utilized and studying the effect of 30 website features and the resulting class label indicating whether or not it is a phishing website (1 or −1). Furthermore, we determined the confusion matrices of Machine Learning models: Neural Networks (NN), Naïve Bayes, and Adaboost, and the results indicated that the accuracies achieved were 90.23%, 92.97%, and 95.43%, respectively.

A Cooperative Defense Framework Against Application-Level DDoS Attacks on Mobile Edge Computing Services

Mobile edge computing (MEC), extending computing services from cloud to edge, is recognized as one of key pillars to facilitate real-time services and tackle backhaul bottleneck. However, it is not economically efficient to attach intensive security appliances to every MEC node to defend application-level DDoS attacks and ensure the availability of services. Thus, we explore the elasticity of security defense among MEC nodes by proposing a COoperative DEfense ( <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE</i> ) framework for MEC, referred to as <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">CODE4MEC</i> . CODE4MEC aims to adapt to traffic changes by coordinating container-carried defensive resources among cooperative MEC nodes in an automatic way. Towards this aim, we propose four control plane functions to enable a life-cycle management for CODE4MEC, namely, CODE triggering, scheduling, coordination and releasing. However, an effective CODE4MEC requires non-trivial algorithmic schemes, in particular for CODE scheduling and coordination functions. We thus design an online combinatorial auction mechanism for real-time CODE scheduling, and prove a tighter performance bound relative to prior arts. As for CODE coordination, a flow-based traffic and context information coordination scheme is proposed to enable classical defense schemes to work properly and efficiently. Finally, using a combination of real testbed and simulation evaluations, we validate the effectiveness of CODE4MEC.

The Effect of Cyber Security Risks on E-Governance usage: A Case Study of Tanzanian Immigration Department

The use of e-Governance, has offered citizens a convenient, efficient and transparent manner of enjoying most important services. However, ICT services are prone to cyber security threats which can hinder the effective and efficient usage of e-Governance services. This study assessed the effect of cyber security threats and risks on the Tanzania e-Governance services usage at the Immigration department. The study has used an exploration research design to collect primary data from 113 randomly sampled respondents at the Tanzania Immigration department. The data was analysed descriptively to determine the frequency and mean relationships between the variables. Additionally, a regression model has been used to determine the direction of relationships between the independent and dependent variables. The findings revealed that 93.8% of the respondents are aware of the e-Governance services. However, this is not proportional to the e-Governance usage since only 27.4% of the responding officers indicated that they are frequent users of the service. The study further indicate that the system faces minimal security risks at the department which is a result of well-established security defense system such as the use of strong and frequent password change. The study recommends e-governance service operators should constantly monitor the systems to identify threats, develop a more user-friendly architecture, and promote adoption among Tanzanians.

Construction of a Security Defense Model for the University's Cyberspace Based on Machine Learning

Construction of a Security Defense Model for the University's Cyberspace Based on Machine Learning

G2Grad-CAMRL: An Object Detection and Interpretation Model Based on Gradient-Weighted Class Activation Mapping and Reinforcement Learning in Remote Sensing Images

Remote sensing images contain important information such as airports, ports, and ships. By extracting remote sensing image features and learning the mapping relationship between image features and text semantic features, the interpretation and description of remote sensing image content can be realized, which has a wide range of application value in military and civil fields such as national defense security, land monitoring, urban planning, disaster mitigation and so on. Aiming at the complex background of remote sensing images and the lack of interpretability of existing target detection models, and the problems in feature extraction between different network structures, different layers, and the accuracy of target classification, we propose an object detection and interpretation model based on Gradient weighted class activation mapping and reinforcement learning. Firstly, ResNet is used as the main backbone network to extract the features of remote sensing images and generate feature graphs. Then, we add the global average pooling layer to obtain the corresponding feature weight vector of the feature graph. The weighted vectors are superimposed to output class activation maps. The reinforcement learning method is used to optimize the generated region generation network. At the same time, we improve the reward function of reinforcement learning to improve the effect of the region generation network. Finally, network dissecting analysis is used to obtain the interpretable semantic concept in the model. Through experiments, the average accuracy is more than 85%. Experimental results in the public remote sensing image description dataset show that the proposed method has high detection accuracy and good description performance for remote sensing images in complex environments.

An Integrated Multilayered Framework for IoT Security Intrusion Decisions

Security breaches can seriously harm the Internet of Things (IoT) and Industrial IoT (IIoT) environments. The damage can exceed financial and material losses to threaten human lives. Overcoming these security risks is challenging given IoT ubiquity, complexity, and restricted resources. Security intrusion management is a cornerstone in fortifying the defensive security process. This paper presents an integrated multilayered framework facilitating the orchestration of the security intrusion management process and developing security decision support systems. The proposed framework incorporates four layers with four dedicated processing phases. This paper focuses mainly on the analytical layer. We present the architecture and models for predictive intrusion analytics for reactive and proactive defense strategies. We differentiate between the device and network levels to master the complexity of IoT infrastructure. Benefiting from the singularity of IIoT devices traffic, we approach the reactive security intrusion prediction through outlier detection models mean. We thoroughly experiment with ten outlier detection models on the IIoT wustl realistic dataset. The obtained results show the adequacy of the approach with an area under the curve (AUC) results surpassing 98% for several models with a good level of precision and time efficiency. Furthermore, we investigate the use of survival analysis semi-parametric predictive models to forecast the security intrusion before its occurrence for the proactive security strategy. The experiments show encouraging results with a concordance index (c-Index) reaching 89% and an integrated brier score (IBS) of 0.02. By integrating outlier intrusion detection and survival forecasting, the framework provides a valuable means to monitor the security intrusions in IoT.

A Systematic Literature Review of Offensive and Defensive Security Solutions With Software Defined Network

Software Defined Networking (SDN) is one of the most significant innovations in telecommunication systems in the past two decades. From the very beginning, the scientific community understood the importance of investigating the possible usages of SDN as a means to increase network security, but also their potential to be exploited as an attack device. For this reason, there has been a massive production of research works, which, however, do not form a well-defined corpus. The literature is spread over many venues and composed of contributions with very different flavors. Though some review works already exist, in this work we conduct a systematic literature review of the field, gathering 466 relevant publications— the largest curated dataset on the topic to the best of our knowledge. In our work, the dataset undergoes a twofold analysis: (a) quantitative, through publication metadata, which allows us to chart publication outlets, approaches, and tackled issues; (b) qualitative, through 14 research questions that provide an aggregated overview of the literature contributions to the key issues, also to spot gaps left open. From these analyses, we derive a call for action to address the main open challenges.

Temperature Sensing Characteristics of Two Fundamental Solitons in a Glycerin-Filled Microstructured Optical Fiber

In this paper, the temperature sensing characteristics of two fundamental solitons in a glycerin-filled six-hole microstructured optical fiber (MOF) were systematically exploited through experiment and simulation. The six-hole MOF has a large duty cycle, which can increase the space to fill the temperature-sensitive material glycerin for improving the temperature sensing sensitivity. By detecting the center wavelength shift of 3dB bandwidth of two fundamental solitons at 1050 nm, 390 mW, a maximum sensitivity of -0.601 nm/ °C was obtained based on the first fundamental soliton and -0.598 nm/ °C was obtained based on the second. Simulation results combined with the experimental results showed that the higher the average pump power, the higher the temperature sensitivity, and the temperature sensitivity of the first was slightly higher than that of the second. The difference in sensing characteristics between the two fundamental solitons discovered in this study could provide a novel solution to solve the cross-sensitivity of dual-parameter sensing. To the best of our knowledge, this is the first research about utilizing two fundamental solitons for temperature sensing, which broadens the boundary of the nonlinear-based sensors, and has promising prospects in the fields of national defense security, disease monitoring, agriculture production, etc.

Physical Strength Improvement of Nata de Coco by Water Replacement with Carboxymethylcellulose (CMC) as A Potential Bulletproof Material: A Preliminary Study

The dependence on the imported bullet-proof vest as one of the main equipments of the National Defense System needs attention. This condition treats the independence of domestic defense security. In contrast, the potential of natural materials for bullet-proof vest plates are abundant in Indonesia. Nata de Coco is one of the natural raw materials for producing bullet-proof vest plates that has the potential to be developed. This preliminary research proved that increasing the bond strength of cellulose in Nata de Coco was performed by adding the appropriate crosslinkers. The addition of carboxymethylcellulose (CMC) 2% crosslinker to form Nata de Coco kevlar-like plates (Navlar) was evidenced to increase threefold tensile strength (99.15 MPa) from its original Nata de Coco (31.92 MPa). The development of Navlar is a very strategic sector for producing high-quality bullet-proof vest plates equivalent to kevlar strength. Navlar is more prospective than Kevlar due to its abundant source, cheap, lightweight, and ease to manufacture. Developing Navlar could replace the dependence on imported Kevlar and support the domestic defense industry.

Design of a Purple Team for the Colombian Financial Sector Focused on Stock Brokerage Companies (SBK)

Private and public sector companies are suffering cyber attacks globally, so the need to invest in cybersecurity has become a priority. In this sense, several supervisors have formulated regulations around cybersecurity, with a particular emphasis on banks and their challenges but not much on the Stockbrokers (SBK) entities that are the subject of this research work. Although one of the most common methodologies is the simulation of offensive (red team) and defensive (blue team) security, purple teams are emerging as an alternative that enables a broader spectrum of learning and analysis for companies, particularly SBKs This article details a methodological guide for the design and implementation of a purple team in SBKs in order to strengthen cybersecurity governance in the face of contemporary cyber threats.