检索结果-内蒙古大学图书馆

A software upgrade security analysis method based on program analysis

A software upgrade security analysis method based on program...

2021 IEEE International Conference on Computer Science, Electronic Information engineering and Intelligent Control Technology, CEI 2021

作者： Lv, Xiaoshao Shu, Hui Kang, Fei Huang, Yuyao State Key Laboratory of Mathematical Engineering and Advanced Computing Henan Zhengzhou450001 China

ISBN: (纸本)9780738146492

Security of online software upgrade has become one of the most important evaluation criteria of cyber security. It is too inefficient to evaluate the security of software upgrade by manual reverse analysis method, which requires high-level cryptography knowledge and reverse analysis ability of researchers. The universality of software upgrade vulnerability puts forward high requirements for efficient and automatic analysis methods. In this paper, we propose a program analysis method combining dynamic analysis and static analysis to automatically evaluate software upgrade security. By parsing the process of software online upgrade deeply, we establish the upgrade vulnerability models, and utilize the program analysis method to evaluate the upgrade security. The experimental result has shown that this method can evaluate the security of software upgrade accurately and quickly. © 2021 IEEE.

关键词： Cryptography

来源：评论

学校读者我要写书评

暂无评论

A survey of offensive security research on PLCs

A survey of offensive security research on PLCs

引用

2021 International Conference on Computer, Communication, Control, Automation and Robotics, CCCAR 2021

作者： Ma, Rongkuan Wei, Qiang Wang, Qingxian State Key Laboratory of Mathematical Engineering and Advanced Computing Henan Zhengzhou450001 China

Industrial Control Systems (ICSs) are widely deployed in critical infrastructures, such as electric power, water filtration and distribution. Programmable Logic Controllers (PLCs) work as the core components of an ICS. The offensive security technology of PLCs has attracted the popular interests of both attackers and researchers. In this paper, we firstly abstract a 4-layers model of PLC's implementation, and then summarize and classify attacks against PLCs into 5 types. Further, we point out the features and trends of the related attack studies, which is helpful to promote the research in the ICS security community and provide vital suggestions for defenders. © Published under licence by IOP Publishing Ltd.

关键词： Programmable logic controllers

来源：评论

学校读者我要写书评

暂无评论

FirmVulSeeker—BERT and Siamese Network-Based Vulnerability Search for Embedded Device Firmware Images

引用

Journal on Internet of Things 2022年第1期4卷 1-20页

作者： Yingchao Yu Shuitao Gan Xiaojun Qin State Key Laboratory of Mathematical Engineering and Advanced Computing WuxiJiangsu214083China

In recent years,with the development of the natural language processing(NLP)technologies,security analyst began to use NLP directly on assembly codes which were disassembled from binary executables in order to examine binary similarity,achieved great ***,we found that the existing frameworks often ignored the complex internal structure of instructions and didn’t fully consider the long-term dependencies of *** this paper,we propose firmVulSeeker—a vulnerability search tool for embedded firmware images,based on BERT and Siamese *** first builds a BERT MLM task to observe and learn the semantics of different instructions in their context in a very large unlabeled binary ***,a finetune mode based on Siamese network is constructed to guide training and matching semantically similar functions using the knowledge learned from the first ***,it will use a function embedding generated from the fine-tuned model to search in the targeted corpus and find the most similar function which will be confirmed whether it’s a real vulnerability *** evaluate the accuracy,robustness,scalability and vulnerability search capability of *** show that it can greatly improve the accuracy of matching semantically similar functions,and can successfully find more real vulnerabilities in real-world firmware than other tools.

关键词： Embedded device firmware vulnerability search BERT siamese network

来源：评论

学校读者我要写书评

暂无评论

Research on IoT malware based on the ATT&CK model 11

Research on IoT malware based on the ATT&CK model

引用

2021 11th International Workshop on Computer Science and engineering, WCSE 2021

作者： Hao, Bo Kang, Fei Yang, Ju Xiong, Xiaobing State Key Laboratory of Mathematical Engineering and Advanced Computing Henan Zhengzhou450001 China

ISBN: (纸本)9789811817915

The security of the IoT has become a hot research area in cyberspace security, among which the malware is a major threat. Based on the ATT&CK model, this paper studies the composition and behavior of IoT malware, constructs a malicious behavior model of IoT malware, and analyzes the technical implementation of each tactic in the malicious behavior model of IoT malware from three aspects: operating system related, target environment related and specific tools related. Based on this, we finally propose the evolution direction of IoT malware, which will be conducive to a more comprehensive grasp of the characteristics of IoT malware, and be supportive for maintaining the security of IoT. © 2021 11th International Workshop on Computer Science and engineering, WCSE 2021. All Rights Reserved.

关键词： Malware

来源：评论

学校读者我要写书评

暂无评论

Fw-fuzz: A code coverage-guided fuzzing framework for network protocols on firmware

Fw-fuzz: A code coverage-guided fuzzing framework for networ...

引用

作者： Gao, Zicong Dong, Weiyu Chang, Rui Wang, Yisen Cyberspace Security Department State Key Laboratory of Mathematical Engineering and Advanced Computing Zhengzhou China College of Computer Science and Technology Zhejiang University Hangzhou China

Fuzzing is an effective approach to detect software vulnerabilities utilizing changeable generated inputs. However, fuzzing the network protocol on the firmware of IoT devices is limited by inefficiency of test case generation, cross-architecture instrumentation, and fault detection. In this article, we propose the Fw-fuzz, a coverage-guided and crossplatform framework for fuzzing network services running in the context of firmware on embedded architectures, which can generate more valuable test cases by introspecting program runtime information and using a genetic algorithm model. Specifically, we propose novel dynamic instrumentation in Fw-fuzz to collect the running state of the firmware program. Then Fw-fuzz adopts a genetic algorithm model to guide the generation of inputs with high code coverage. We fully implement the prototype system of Fw-fuzz and conduct evaluations on network service programs of various architectures in MIPS, ARM, and PPC. By comparing with the protocol fuzzers Boofuzz and Peach in metrics of edge coverage, our prototype system achieves an average growth of 33.7% and 38.4%, respectively. We further verify six known vulnerabilities and discover 5 0-day vulnerabilities with the Fw-fuzz, which prove the validity and utility of our framework. The overhead of our system expressed as an additional 5% of memory growth. © 2020 John Wiley & Sons, Ltd.

关键词： Firmware

来源：评论

学校读者我要写书评

暂无评论

Adversarial Example Soups: Improving Transferability and Stealthiness for Free

arXiv

引用

arXiv 2024年

作者： Yang, Bo Zhang, Hengwei Wang, Jindong Yang, Yulong Lin, Chenhao Shen, Chao Zhao, Zhengyu State Key Laboratory of Mathematical Engineering and Advanced Computing Zhengzhou China School of Cyber Science and Engineering Xi’an Jiaotong University Xi’an China

Transferable adversarial examples cause practical security risks since they can mislead a target model without knowing its internal knowledge. A conventional recipe for maximizing transferability is to keep only the optimal adversarial example from all those obtained in the optimization pipeline. In this paper, for the first time, we question this convention and demonstrate that those discarded, sub-optimal adversarial examples can be reused to boost transferability. Specifically, we propose "Adversarial Example Soups" (AES), with AES-tune for averaging discarded adversarial examples in hyperparameter tuning and AES-rand for stability testing. In addition, our AES is inspired by "model soups", which averages weights of multiple fine-tuned models for improved accuracy without increasing inference time. Extensive experiments validate the global effectiveness of our AES, boosting 10 state-of-the-art transfer attacks and their combinations by up to 13% against 10 diverse (defensive) target models. We also show the possibility of generalizing AES to other types, e.g., directly averaging multiple in-the-wild adversarial examples that yield comparable success. A promising byproduct of AES is the improved stealthiness of adversarial examples since the perturbation variances are naturally reduced. Copyright © 2024, The Authors. All rights reserved.

关键词：

来源：评论

学校读者我要写书评

暂无评论

The Causal Reasoning Ability of Open Large Language Model: A Comprehensive and Exemplary Functional Testing

The Causal Reasoning Ability of Open Large Language Model: A...

引用

IEEE International Conference on Software Quality, Reliability and Security (QRS)

作者： Shun-Hang Li Gang Zhou Zhi-Bo Li Ji-Cang Lu Ning-Bo Huang State Key Laboratory of Mathematical Engineering and Advanced Computing Zhengzhou China Information Engineering University Zhengzhou China

As the intelligent software, the development and application of large language models are extremely hot topics recently, bringing tremendous changes to general AI and software industry. Nonetheless, large language models, especially open source ones, incontrollably suffer from some potential software quality issues such as instability, inaccuracy, and insecurity, making software testing necessary. In this paper, we propose the first solution for functional testing of open large language models to check full-scene availability and conclude empirical principles for better steering large language models, particularly considering their black box and intelligence properties. Specifically, we focus on the model’s causal reasoning ability, which is the core of artificial intelligence but almost ignored by most previous work. First, for comprehensive evaluation, we deconstruct the causal reasoning capability into five dimensions and summary the forms of causal reasoning task as causality identification and causality matching. Then, rich datasets are introduced and further modified to generate test cases along with different ability dimensions and task forms to improve the testing integrity. Moreover, we explore the ability boundary of open large language models in two usage modes: prompting and lightweight fine-tuning. Our work conducts comprehensive functional testing on the causal reasoning ability of open large language models, establishes benchmarks, and derives empirical insights for practical usage. The proposed testing solution can be transferred to other similar evaluation tasks as a general framework for large language models or their derivations.

关键词：

来源：评论

学校读者我要写书评

暂无评论

A Selection Strategy for Network Security Defense Based on a Time Game Model

A Selection Strategy for Network Security Defense Based on a...

引用

2021 International Conference on Digital Society and Intelligent Systems, DSInS 2021

作者： Sun, Pengyu Zhang, Hengwei Ma, Junqiang Li, Chenwei Mi, Yan Wang, Jindong Key Laboratory of Information Security of Henan Provincial State Key Laboratory of Mathematical Engineering and Advanced Computing Zhengzhou China

ISBN: (纸本)9781665406307

Current network assessment models often ignore the impact of attack-defense timing on network security, making it difficult to characterize the dynamic game of attack-defense effectively. To effectively manage the network security risks and reduce potential losses, in this article, we propose a selection strategy for network defense based on a time game model. By analyzing the attack-defense status by analogy with the SIR infectious disease model, construction of an optimal defense strategy model based on time game, and calculation of the Nash equilibrium of the the attacker and the defender under different strategies, we can determine an optimal defense strategy. With the Matlab simulation, this strategy is verified to be effective. © 2021 IEEE.

关键词： Network security

来源：评论

学校读者我要写书评

暂无评论

Effect of thickness variations of lithium niobate on insulator waveguide on the frequency spectrum of spontaneous parametric down-conversion

引用

Chinese Physics B 2021年第11期30卷 268-273页

作者： Guang-Tai Xue Xiao-Hui Tian Chi Zhang Zhenda Xie Ping Xu Yan-Xiao Gong Shi-Ning Zhu National Laboratory of Solid State Microstructures School of PhysicsSchool of Electronic Science and EngineeringCollege of Engineering and Applied Sciencesand Collaborative Innovation Center of Advanced MicrostructuresNanjing UniversityNanjing 210093China Institute for Quantum Information and State Key Laboratory of High Performance Computing College of ComputingNational University of Defense TechnologyChangsha 410073China

We study the effect of waveguide thickness variations on the frequency spectrum of spontaneous parametric downconversion in the periodically-poled lithium niobate on insulator(LNOI)*** analyze several variation models and our simulation results show that thickness variations in several nanometers can induce distinct effects on the central peak of the spectrum,such as narrowing,broadening,and *** also prove that the effects of positive and negative variations can be canceled and thus lead to a variation-robust feature and an ultra-broad *** study may promote the development of on-chip photon sources in the LNOI platform,as well as opens up a way to engineer photon frequency state.

关键词： lithium niobate on insulator spontaneous parametric down-conversion waveguide thickness variation frequency spectrum

来源：评论

学校读者我要写书评

暂无评论

Feature Rotation Invariance Learning for Point Cloud Analysis 10

Feature Rotation Invariance Learning for Point Cloud Analysi...

引用

10th IEEE Smart World Congress, SWC 2024

作者： Shi, Lu Cao, Qi Zhang, Guoqing Yi, Jin Huang, Yansen Cen, Yigang Beijing Jiaotong University State Key Laboratory of Advanced Rail Autonomous Operation The School of Computer Science and Technology Visual Intellgence +X International Cooperation Joint Laboratory of Moe Beijing100044 China University of Glasgow The School of Computing Science 567739 Singapore Beijing Jiaotong University With the Key Laboratory of Big Data & Artificial Intelligence in Transportation Ministry of Education The State Key Laboratory of Advanced Rail Autonomous Operation The School of Computer and Information Technology Beijing100044 China Guizhou University Guizhou Lianjian Civil Engineering Quality Testing Monitoring Center Co. Ltd The College of Civil Engineering Guizhou550025 China

ISBN: (纸本)9798331520861

While deep learning has significantly advanced point cloud analysis, extracting effective features from their disordered structure remains challenging. Existing approaches often rely on complex network architectures or manual feature engineering to achieve rotation invariance, which increases inference latency. This paper offers a novel perspective on this challenge, showing that rotation-sensitive models can achieve performance comparable to rotation-invariant models when trained with rotation-augmented data. Given the significant differences in the feature distributions of rotation-sensitive and rotation-invariant models, we propose Feature Rotation Invariance Learning (FRIL), a framework that leverages Distance Metric Learning and rotation-based constraints to help rotation-sensitive models extract rotation-invariant features. This approach eliminates the need for additional modules, enabling robust performance against rotations. Extensive experiments demonstrate that FRIL consistently outperforms existing rotation-invariant methods across various visual tasks. © 2024 IEEE.

关键词： Contrastive Learning

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：