Protocol reverse based on hierarchical clustering and probability alignment from network traces

Protocol message format extraction is a principal process of automatic network protocol reverse engineering when target protocol specifications are not available. However, binary protocol reverse engineering has been a new challenge in recent years for approaches that traditionally have dealt with text‐based protocols rather than binary protocols. In this study, the authors propose a novel approach called PRE‐Bin that automatically extracts binary‐type fields of binary protocols based on fine‐grained bits. First, a silhouette coefficient is introduced into the hierarchical clustering to confirm the optimal clustering number of binary frames. Second, a modified multiple sequence alignment algorithm, in which the matching process and back‐tracing rules are redesigned, is also proposed to analyse binary field features. Finally, a Bayes decision model is invoked to describe field features and determine bit‐oriented field boundaries. The maximum a posteriori criterion is leveraged to complete an optimal protocol format estimation of binary field boundaries. The authors implemented a prototype system of PRE‐Bin to infer the specification of binary protocols from actual traffic traces. Experimental results indicate that PRE‐Bin effectively extracts binary fields and outperforms the existing algorithms.

It is a multiple criteria problem to evaluate the security of information networks. However, one key issue which is not fully considered in extant studies is how to obtain the values of these multiple evaluation criteria, and in most evaluation models some redundant criteria values are calculated. Motivated by this, in the work we first use the pairwise comparison method to attain the values of each evaluation aspect of the security of information networks, and then develop a novel similarity-based M(1, 2, 3) approach to rate the security of alternative networks. Application study shows that the proposed approach could rate the overall security of alternative information networks and recognize the most vulnerable aspects of each information network, which provides good supports for making policies to enhance the security of alternative information networks.

+ Linear and dynamic models of the system of information security in social networks, taking into consideration the relationships between users, were studied and the resistance of the security system was analyzed. There is a practical interest in studying dependence of the behavior of the system of social network security on the parameters of users’ interaction. Dynamic systems of information security in social networks in the mathematical sense of this term were considered. A dynamic system refers to any object or process, for which the concept of state as a totality of certain magnitudes at a given time is unambiguously defined and the law that describes a change (evolution) of the initial state over time was assigned. The network of social interactions consists of a totality of social users and a totality of the relations between them. Individuals, social groups, organizations, cities, countries can act as users. Relations imply not only communication interactions between users but also relations of the exchange of various resources and activities, including conflict relations. As a result of research, it was found that the security systems of a social network are nonlinear. Theoretical study of the dynamic behavior of an actual object requires the creation of its mathematical model. The procedure for developing a model is to compile mathematical equations based on physical laws. These laws are stated in the language of differential equations. Phase portraits of the data security system in the MATLAB/Multisim program, which indicate the stability of a security system in the working range of parameters even at the maximum value of the impacts, were determined. Thus, the influence of users’ interaction parameters on the parameters of the system of social network security was explored. Such study is useful and important in terms of information security in the network, since the parameters of users’ interaction significantly affect, up to 100 %, the security indicator.

Application-level protocol specifications are helpful for network security management, including intrusion detection and intrusion prevention which rely on monitoring technologies such as deep packet inspection. Moreover, detailed knowledge of protocol specifications is also an effective way of detecting malicious code. However, current methods for obtaining unknown and proprietary protocol message formats (i.e., no publicly available protocol specification), especially binary protocols, highly rely on manual operations, such as reverse engineering which is time-consuming and laborious. In this paper, we propose Biprominer, a tool that can automatically extract binary protocol message formats of an application from its real-world network trace. In addition, we present a transition probability model for a better description of the protocol. The chief feature of Biprominer is that it does not need to have any priori knowledge of protocol formats, because Biprominer is based on the statistical nature of the protocol format. We evaluate the efficacy of Biprominer over three binary protocols, with an average precision more than 99% and a recall better than 96.7%.

The attack and defense model of network security based on game theory has developed into an effective network security model. It is a hot topic in the field of network and information security to use the idea of game theory to attack and defend the network security. This paper analyzes the general model of game theory in the field of security. This paper also analyzes the general model of network security attack and defense game. This paper also analyzes the game theory model of cryptographic protocol. This paper studies the existing network security methods based on game theory, reviews the development and evolution process and technical core of network security based on game theory, and compares the specificity of network security models based on game theory. Finally, the paper discusses the problems in the field of network security based on game theory, and tries to forecast its future development trend.

Electronic networks have become one of the necessities of our modern era, such that they have become indispensable in institutions, companies, governments, and even in homes. Wherever you are, you will find around you many types of computer networks that transfer a huge amount of information and data between people and institutions at the world level, and they vary. This information and data, in its importance and degree of confidentiality, range from ordinary general and scientific information to government information and statistics, state budgets, and extremely dangerous and confidential intelligence information. All of these types of information and data are transmitted and preserved in most cases via computer networks of various types and locations. Hence the importance of these networks in the contemporary world and in daily interactions between humans in general, and from this importance stems the danger represented by the security of these networks and the security of the information that is circulated through their lines. Here we are trying to clarify the importance of the security of information networks and what are the risks that threaten them? How to combat and protect against these risks.

Unsupervised field segmentation of unknown protocol messages

With the development of network technology and the diversification of network applications, network environment is becoming increasingly complex which leads to various network attacks. Malicious traffic, such as DDOS and infiltration attacks, may degrade the network quality, or even block the network directly. Now, traditional network security methods are difficult to meet the needs for network security and information security. Due to the high recognition accuracy and strong generalization of deep neural network (DNN), deep learning based abnormal traffic detection methods have become a research hotspot. However, there are obvious problems containing high false positive rate poor robustness. We propose a novel abnormal traffic detection method based on attention-guided bidirectional gated recurrent unit (Att-BiGRU). Different from the traditional feature extraction methods in DNNs, we use stacked sparse Auto-encoder (SSAE) to extract traffic features for interference factors filtering. The extracted features can reproduce the original input samples as much as possible which enhances the representation of traffic features and effectively improves the robustness of anomaly detection traffic. Then, attention mechanism was introduced to optimize the traffic features. Extensive experiments on UNSW-NB15 show that the proposed scheme has the impressive performance. Compared with recent abnormal traffic detection algorithms, the proposed scheme achieves better results with 89.67% accuracy and 4.2% FAR.

Protocol reverse engineering (PRE) aims to infer the specification of network protocols when the source code is not available. Specifically, field inference is one crucial step in PRE to infer the field formats and semantics. To perform field inference, binary analysis based PRE techniques are one major approach category. However, such techniques face two key challenges --- (1) the format inference is fragile when the logics of processing input messages may vary among different protocol implementations, and (2) the semantic inference is limited by inadequate and inaccurate inference rules.

The security and integrity of a computer system is compromised when an intrusion occurs. It becomes impossible for legitimate users to access different network services when network-based attacks purposely occupy or sabotage network resources and services. Our proposed method is a scalable detection method for network based anomalies. We use Support Vector Machines (SVM) for classification. This paper presents a method for enhancing the training time of SVM, particularly when dealing with large data sets, using hierarchical clustering technique. We use the Dynamically Growing Self-Organizing Tree (DGSOT) algorithm for clustering because it has proved to overcome the problems of traditional hierarchical clustering algorithms (e.g., hierarchical agglomerative clustering). Clustering analysis helps to find the boundary points, which are the most qualified data points to train SVM, between any two classes. We present a new approach of combination of SVM and DGSOT, which begins with an initial training set and expands it gradually using the clustering structure produced by the DGSOT algorithm. We show that our proposed variations contribute significantly in improving the training process of SVM with high percentage of detection accuracy. Keywords: SVM, classification, Intrusion detection, Intrusion detection System, Network Security

Now with the wide use of computer network and e-commerce, network security has become an important problem that it must be considered and resolved. More and more professions in the enterprises and individuals are subjected to the security problem in different degree. It is looked for the more reliable safety solutions. In the rapid development of the networks, emphasis on network information security is growing. Through analyzing the network information security factor, several common network information security policies are proposed, and the system of network information security is formed. By using virtual machine technology, network attacks and network protection subsystem are virtually out on a server, the configuration management of the vast majority of current network operations and network attack protection can be realized. The training environment of network attack and defense with function is more comprehensive, more superior performance and more realistic simulation experiments degree. Then, network security threats and defense strategies are summarized in this paper.

The field of energy security is an important, complex and evolving field with important implications at the international, national and regional levels. Considering that no scholars have conducted bibliometric studies on the current energy security field, the authors of this study chose to use a bibliometric approach to conduct a search on the Web of Science using “energy security” as the keyword, and they conducted a systematic review of 5236 papers published between 2005 and 2022 to determine the current status and development of research in the field of energy security by addressing the following six questions: (1) What are the characteristics of the types of literature in the field of energy security? (2) What are the annual publication and citation frequency trends in the field of energy security? (3) What is the distribution of source journals, countries/regions, institutions, scholars and topics in the field of energy security? (4) What are the research hotspots in the field of energy security in the recent development history? (5) What are the most influential studies and the most disruptive studies in the field of energy security? (6) What are the characteristics of the different levels of cooperation networks in the field of energy security? Finally, we concluded the following: (1) In terms of publication dynamics, the number of annual publications and the citation frequency in the field of energy security maintain an upward trend, with a large number of source journals and a wide range of topics. The number of countries, institutions and scholars involved in research in the field of energy security keeps increasing, but the cooperation is fragmented and geopolitical. (2) From the perspective of research themes, research in the field of energy security has both strong technical characteristics and is associated with social science research themes. The contradictions between energy security and social, economic, environmental, land and climate issues, the interplay between energy supply systems and complex geopolitical and international relations issues and the important role of renewable energy and related technologies in maintaining national/regional energy security are the main issues of concern to researchers. (3) In terms of research centers, although the UK and the US still retain a first-mover advantage in this field, China has gradually overtaken and has become the country with the largest output of literature in recent years. The center of research in the field has also gradually shifted from Europe and the US to the East and South Asia regions. Overall, the governance of energy security issues still requires a combination of policy, economic and technological aspects. The results will help scholars systematically understand the current status of research, research frontiers and future trends in the field of energy security.

Protocol Reverse Engineering (PRE) is of great significance to the research of cyber security and it is helpful to understand protocol specifications. There has been many researches on PRE but most of them need additional manual analysis, which is not available for private and unknown protocols. We propose a protocol state analysis and annotation method, which extracts the feature information of binary-based protocol data through an auto-encoder model. Moreover, density-based clustering algorithm is only used to distinguish protocol types in existing studies, we propose an improved algorithm and apply it to protocol state analysis. Finally, we apply alignment algorithm to get state information and do annotation. We run simulation to verify the effectiveness of proposed method and prove its feasibility in private and unknown protocols. The results of clustering algorithms are compared to show the improvement. Then the application of proposed method is summarized based on the simulation results, which provides a novel idea for the protocol analysis.

Contemporarily, two emerging techniques, blockchain, and machine learning are driving dramatic rapid growth in the field of network security. This paper describes a literature review of machine learning approaches for network security analytics and summarizes some applications of blockchain in the field of network security. We first illustrate three types of network security data, including network traffic, software binary, and security logs. Then we discuss the application of machine learning and deep learning approaches to analyze these data. We cover a broad array of attack types, including malware, spam, insider threats, network intrusions. We also summarize some applications and potential development direction of blockchain technology.

In order to solve the problem that there are a large number of unknown protocols on the network, which affect the network management and network security in varying degrees, an unknown binary protocol identification method is proposed. On the premise that the center cluster of unknown protocols is obtained by the clustering algorithm, the unknown protocols for network traffic are identified by combining one‐class of classification with one‐dimensional CNN classification technology. At first, a class of classification algorithm is used to select the unknown protocols, and then, the labeled protocol data obtained by clustering are used to train the one‐dimensional CNN model, and the classified binary protocol packets are directly used as the input of the one‐dimensional convolution neural network. After the classification of the CNN model, the unknown protocols are finally identified. The experimental results show that the proposed classification and recognition method is better than the traditional CNN and SVM algorithms, and the maximum frequency pooling is better than the traditional pooling method.