检索结果-内蒙古大学图书馆

Identifying Industrial Control Equipment Based on Rule Matching and Machine Learning

Computer Modeling in Engineering & Sciences 2023年第10期137卷 577-605页

作者： Yuhao Wang Yuying Li Yanbin Sun Yu Jiang Cyberspace Institute of Advanced Technology(CIAT) Guangzhou UniversityGuangzhou510006China

To identify industrial control equipment is often a key step in network mapping,categorizing network resources,and attack *** example,if vulnerable equipment or devices can be discovered in advance and the attack path canbe cut off,security threats canbe effectively avoided and the stable operationof the Internet canbe *** existing rule-matching method for equipment identification has limitations such as relying on experience and low *** paper proposes an industrial control device identification method based on PCA-Adaboost,which integrates rule matching and machine *** first build a rule base from network data collection and then use single andmulti-protocol rule-matchingmethods to identify the type of industrial control ***,we utilize PCA-Adaboost to identify unlabeled *** experimental results show that the recognition rate of this method is better than that of the traditional Nmap device recognitionmethod and the device recognition accuracy rate reaches 99%.The evaluation effect of the test data set is significantly enhanced.

关键词： Network mapping network resource industrial control equipment identification

来源：评论

学校读者我要写书评

暂无评论

Graph Anomaly Detection via Multi-Scale Reconstruction of Graph Encoder-Decoder Networks

Graph Anomaly Detection via Multi-Scale Reconstruction of Gr...

引用

2025 IEEE International Conference on Acoustics, Speech, and Signal Processing, ICASSP 2025

作者： Yu, Jiaqi Yang, Hong Zhang, Peng Cyberspace Institute of Advanced Technology Guangzhou University Guangzhou China

ISBN: (纸本)9798350368741

Existing unsupervised graph anomaly detection (GAD) methods can be categorized into reconstruction based methods and contrastive learning based methods. The principle of reconstruction methods is to capture anomalous nodes based on data reconstruction errors. However, existing reconstruction methods are limited to a single scale reconstruction of graph structures, typically predicting edges solely based on direct connections, without considering the rich contextual information within node neighborhoods. Moreover, reconstructing original low-density inputs usually introduce noise, where the reconstruction model may overfit the anomalous data. To this end, we propose a new reconstruction based graph anomaly detection method (GADMR for short). GADMR introduces a multi-scale reconstruction, which contains both structure and feature levels. From structure level, we use a node-subgraph reconstruction method to capture the relationship between a node and their neighboring subgraphs at multiple scales. From feature level, we employ a multi-layer representation reconstruction method to facilitate the evaluation of discrepancies in high-level feature representations. Extensive experiments on six benchmark datasets show that GADMR outperforms popular anomaly detection methods. © 2025 IEEE.

关键词： graph anomaly detection graph autoencoders graph neural networks unsupervised learning

来源：评论

学校读者我要写书评

暂无评论

A Study on Classification of Tor Encrypted Traffic Based on Mamba 10

A Study on Classification of Tor Encrypted Traffic Based on ...

引用

10th IEEE Smart World Congress, SWC 2024

作者： Zhao, Silin Tan, Qingfeng Xiang, Yu Tan, Runnan Institute of Advanced Technology in Cyberspace Guangzhou University Guangzhou China

ISBN: (纸本)9798331520861

Network traffic classification is an important and fundamental work to ensure network security and network management in an orderly manner, and traffic classification of darknet encrypted traffic with high degree of encryption mainly in Tor network has always been a very challenging task, the most mainstream Transformer as the core model is often inefficient although the classification effect is very good, in the text, we try to use the Mamba as the core model to perform the Tor network encrypted traffic classification task by by pre-training and fine-tuning, A small improvement in classification results and an improvement in performance on the ISCX-Tor dataset. © 2024 IEEE.

关键词： Network security

来源：评论

学校读者我要写书评

暂无评论

Non-Ideal Energy Efficiency Optimization Based on MIMO Communications

引用

IEEE Internet of Things Journal 2025年第13期12卷 23975-23987页

作者： Li, Jiaxuan Yin, Xue Ding, Xuhui Yang, Ziyi Ye, Neng Yang, Kai Beijing Institute of Technology School of Information and Electronics Beijing100081 China Beijing Institute of Technology School of Cyberspace Science and Technology Beijing100081 China Beijing Institute of Technology Advanced Technology Research Institute Jinan250101 China

In MIMO systems, hybrid digital and analog precoding structures are gaining attention for reducing power consumption and costs compared to fully digital precoding. However, deployment expenses and circuit power consumption still pose challenges. Non-ideal hardware in practical applications further impacts energy efficiency, making research into high-energy-efficiency MIMO structures under such conditions essential. To tackle this issue, an exceedingly effective hybrid precoding strategy is developed, incorporating the implications of non ideal hardware characteristics. Initially, the research models the aforementioned hardware characteristics, formulates the signal model for the hybrid-structured MIMO communication system, and discerns the non-convex problem relative to energy efficiency optimization. Subsequently, the optimization problem is effectively resolved by choosing analog radio frequency (RF) precoding and digital baseband precoding designs, including the precoding design for array gain. Furthermore, fractional programming is utilized to achieve digital precoding. An iterative optimization method is utilized to solve this problem. Finally, the mixed precoding scheme is formulated to showcase the system’s energy efficiency performance through simulation and explore the impact of imperfect hardware on the system. Additionally, to further diminish design complexity, the implementation of various channels is analyzed to propose a low-complexity method via the approximation of the equivalent channel matrix. Simulation results show that the performance of this method achieves performance comparable to existing hybrid precoding methods, when the number of antennas is sufficiently large. © 2014 IEEE.

关键词： Hybrid power

来源：评论

学校读者我要写书评

暂无评论

Regular expression implementation: A comprehensive review from software algorithms to hardware acceleration 5

Regular expression implementation: A comprehensive review fr...

引用

5th International Conference on Computer Communication and Network Security, CCNS 2024

作者： Sheng, Chenxing Zhang, Shuo Liu, Yaping Liao, Haifu School of Cyberspace Institute of Advanced Technology Guangzhou University China

ISBN: (纸本)9781510681842

With the rapid development of internet technology, cybersecurity faces an increasing number of challenges, among which network intrusion detection systems are crucial. Due to its flexibility, regular expression matching has become a key technology in this area. The fast growth and increasing complexity of modern networks require that regular expression matching technology be both efficient and storage-saving. This article provides an overview of the classification of regular expression matching technologies, from software algorithms to hardware implementations. The content includes an introduction to automata theory, detailed discussions on software and hardware implementation methods. Finally, the article looks to the future development trends, emphasizing the significant value and potential impact of regular expression matching technology in the field of information processing. © 2024 SPIE.

关键词： Network intrusion

来源：评论

学校读者我要写书评

暂无评论

DASM: Dual Attention Subgraph Matching Model Incorporating Local Behavior-Aware Features for Threat Hunting 10

DASM: Dual Attention Subgraph Matching Model Incorporating L...

引用

10th IEEE Smart World Congress, SWC 2024

作者： Tang, Fei Cai, Yongxin Chen, Ximing Gao, Chengliang Chen, Rongrong Qiu, Jing Cyberspace Institute of Advanced Technology Guangzhou University Guangzhou China

ISBN: (纸本)9798331520861

Threat hunting represents a crucial instrument for safeguarding network security, entailing the proactive identification of potential security threats within a system. However, the types of operations represented in the provenance graphs are diverse and complex. Most learning-based threat matching methods concentrate on the learning of the overall graph structure, yet they neglect to delve deeply into the local structural features that emerge under different operation types. To address these issues, this paper proposes DASM, a dual attention subgraph matching model incorporating local behavior-aware features for threat hunting. Specifically, at the local level, we propose a local operational feature learning method for the provenance graph, constructing an independent local graph for each operation type and applying a node attention mechanism to refine feature learning. At the global level, we design an attack operational semantic attention network that adaptively adjusts the importance weights of different operations, ensuring that core behavioral features are accurately identified. DASM effectively captures local details while emphasizing global behavioral patterns, thereby enhancing the accuracy and reliability of complex attack pattern matching. Subsequently, we implement an efficient graph matching procedure for provenance and attack query vectors in an ordered embedding space. Experimental results show that DASM excels in attack graph matching on the DARPA dataset, achieving 95% accuracy and outperforming recent provenance graph-based attack subgraph matching methods. © 2024 IEEE.

关键词： Network security

来源：评论

学校读者我要写书评

暂无评论

BPFGuard: Multi-Granularity Container Runtime Mandatory Access Control

引用

IEEE Transactions on Cloud Computing 2025年第2期13卷 629-640页

作者： Lu, Hui Du, Xiaojiang Hu, Dawei Su, Shen Tian, Zhihong Guangzhou University Cyberspace Institute of Advanced Technology Guangzhou511370 China Stevens Institute of Technology Department of Electrical and Computer Engineering HobokenNJ07030 United States

The adoption of container-based cloud computing services has been prevalent, especially with the introduction of Kubernetes, which enables the automated deployment, scaling, and administration of applications in containers, hence boosting the popularity of containers. As a result, researchers have placed greater emphasis on container runtime security, notably investigating the efficacy of traditional techniques such as Capabilities, Seccomp, and Linux security modules in guaranteeing container security. However, due to the limitations imposed by the container environment, the results have been unsatisfactory. In addition, eBPF-based solutions face the problem of being unable to quickly load policies and affect real-time operations when faced with newer kernel vulnerabilities. This paper investigates the limitations of existing container security mechanisms. Additionally, it examines the specific constraints of these mechanisms in Kubernetes environments. The paper classifies container monitoring and obligatory access control into three distinct categories: system call access control, LSM hook access control, and kernel function access control. Therefore, we propose a technique for regulating container access with a variety of granularity levels. This technique is executed using eBPF and is tightly integrated with Kubernetes to collect relevant meta-information. In addition, we suggest implementing a consolidated routing method and employing function tail call chaining to overcome the limitation of eBPF in enforcing mandatory access control for containers. Lastly, we conducted a series of experiment to verify the effectiveness of the system's security using CVE-2022-0492 and to benchmark the system that had BPFGuard enabled. The results indicate that the average performance loss increased merely by 2.16%, demonstrating that there are no adverse effects on the container services. This suggests that greater security can be achieved at a minimal cost. © 2013 IEEE.

关键词： Real time control

来源：评论

学校读者我要写书评

暂无评论

CAROKRS: Cost-Aware Resource Optimization Kubernetes Resource Scheduler 9

CAROKRS: Cost-Aware Resource Optimization Kubernetes Resourc...

引用

9th International Conference on Cloud Computing and Big Data Analytics, ICCCBDA 2024

作者： Li, Tianzhe Qiu, Lupeng Chen, Fuhao Chen, Hao Zhou, Naqin Cyberspace Institute of Advanced Technology Guangzhou University Guangzhou China

ISBN: (纸本)9798350373554

Kubernetes (K8s) is a widely used container orchestration tool in cloud computing platforms, providing strong support for the automated deployment, scaling, and management of applications. One of its key features is the ability to use scheduling algorithms to determine the optimal placement of containers on available nodes in a cluster. Poor scheduling decisions can lead to decreased service performance or wastage of cloud resources. However, effective resource scheduling has always been one of the challenges faced by Kubernetes: existing K8s schedulers often have limitations in their scheduling approaches, typically optimizing scheduling decisions for a specific target. Additionally, existing K8s schedulers lack targeted awareness of cluster and deployment resources for optimization goals, resulting in less noticeable optimization effects. This paper aims to propose a Cost-aware Resource Optimization Kubernetes Resource Scheduler (CAROKRS) to improve the utilization of computing resources, avoid resource overruns, and reduce deployment costs. Through research on the adaptability patterns between pod resource demands and node resource situations, we introduce a resource fitness scheduling algorithm (RFSA). Based on this, we further optimize the scheduling strategy using a supplementary scheduling algorithm (SSA) based on a simulated annealing algorithm, resulting in a final scheduling strategy with low deployment costs, low overrun rates, and high resource utilization rates. Experimental results show that the Cost-aware Resource Optimization Kubernetes Resource Scheduler, compared to the native K8s scheduler, achieves an average reduction of 89.78% in deployment costs, an average increase of 60.59% in load balancing, and an average decrease of 36.05% in resource overruns. © 2024 IEEE.

关键词： Simulated annealing

来源：评论

学校读者我要写书评

暂无评论

Against Credential Thief - A Modular Honeytoken Based Framework 30th

Against Credential Thief - A Modular Honeytoken Based Framew...

引用

30th International Conference on Computational and Experimental Engineering and Sciences, ICCES 2024

作者： Nie, Bohang Tan, Qingfeng Cyberspace Institute of Advanced Technology Guangzhou University Guangzhou510006 China

ISBN: (纸本)9783031687747

Sophisticated hacking techniques pose significant risks to both corporate and personal data, creating a formidable challenge for traditional defense methods. Cyber deception is considered a promising mechanism that can effectively improve defensive disadvantages. Honeytoken, a type of cyber deception method, can effectively detect data leakage and abuse when used properly. This study utilizes a Natural Language Processing (NLP) algorithm to construct an efficient honeytoken system for securing *** algorithm enriches the semantic features of usernames and generates honeytokens. Experimental results demonstrate the ability to produce honeytokens that closely resemble real usernames in both structure and semantics. Additionally, our analysis reveals that the majority of usernames carry semantic information, validating the efficacy of our approach. © The Author(s), under exclusive license to Springer Nature Switzerland AG 2024.

关键词： Information leakage

来源：评论

学校读者我要写书评

暂无评论

CyGPT: Knowledge Graph-Based Enhancement Techniques for Large Language Models in Cybersecurity 9

CyGPT: Knowledge Graph-Based Enhancement Techniques for Larg...

引用

9th IEEE International Conference on Data Science in cyberspace, DSC 2024

作者： Ou, Lu Ni, Xiaoya Wu, Wei Tian, Zhihong Guangzhou University Cyberspace Institute of Advanced Technology Guangzhou510006 China

ISBN: (纸本)9798350391367

Large Language Models (LLMs) excel in numerous Natural Language Processing (NLP) tasks but encounter significant challenges in practical applications, including hallucinations, outdated information, and a lack of domain-specific external knowledge. This study proposes a collaborative, training-free reasoning approach, leveraging close cooperation between Knowledge Graphs (KG) and LLMs for cybersecurity applications. Our approach employs the 'Joint Reasoning Chain,' which dynamically integrates information from network security-specific knowledge graphs, serving as an external knowledge base to enhance the domain-specific external knowledge of LLMs. This cooperative method not only improves reliable knowledge-based reasoning but also enhances the traceability of decision-making processes. Furthermore, we introduce a novel GPT-based technique to evaluate answer quality and have performed systematic experiments on a purpose-built test set. The results confirm that our method significantly boosts GPT's performance in network security knowledge, demonstrating the potential of knowledge graphs to augment LLMs' reasoning abilities and their applicability in specialized fields. © 2024 IEEE.

关键词： Knowledge graph

来源：评论

学校读者我要写书评

暂无评论

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案：

请选择收藏分类：

通借通还

建议与咨询 留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

时间限定

文献类型

馆藏选择

核心期刊

语言

文献类型

帮助

文字说明：

检索规则说明：

检索范例：

分类表

所选分类

限定检索结果

文献类型

馆藏范围

日期分布

学科分类号

主题

机构

作者

语言

请选择保存的检索档案： 新增检索档案 确定 取消

请选择收藏分类： 新增自定义分类 确定 取消

通借通还

建议与咨询留下您的常用邮箱和电话号码，以便我们向您反馈解决方案和替代方法

请选择保存的检索档案：

请选择收藏分类：