Journal of Computer Security - Volume Pre-press, issue Pre-press

Authors: Chen, You | Ding, Ning | Gu, Dawu | Bian, Yang

Article Type: Research Article

Abstract: Private set intersection cardinality (PSI-CA) and private intersection-sum with cardinality (PSI-CA-sum) are two primitives that enable data owners to learn the intersection cardinality of their data sets, with the difference that PSI-CA-sum additionally outputs the sum of the associated integer values of all the data that belongs to the intersection (i.e., intersection-sum). However, to the best of our knowledge, all existing multi-party PSI-CA (MPSI-CA) protocols are either limited by high computational cost or face security challenges under arbitrary collusion. As for multi-party PSI-CA-sum (MPSI-CA-sum), there is even no formalization for this notion at present, not to mention secure constructions for …it. In this paper, we first present an efficient MPSI-CA protocol with two non-colluding parties. This protocol significantly decreases the number of parties involved in expensive interactive procedures, leading to a significant enhancement in runtime efficiency. Our numeric results demonstrate that the running time of this protocol is merely one-quarter of the time required by our proposed MPSI-CA protocol that is secure against arbitrary collusion. Therefore, in scenarios where performance is a priority, this protocol stands out as an excellent choice. Second, we successfully construct the first MPSI-CA protocol that achieves simultaneous practicality and security against arbitrary collusion. Additionally, we also conduct implementation to verify its practicality (while the previous results under arbitrary collusion only present theoretical analysis of performance, lacking real implementation). Numeric results show that by shifting the costly operations to an offline phase, the online computation can be completed in just 12.805 seconds, even in the dishonest majority setting, where 15 parties each hold a set of size 2 16 . Third, we formalize the concept of MPSI-CA-sum and present the first realization that ensures simultaneous practicality and security against arbitrary collusion. The computational complexity of this protocol is roughly twice that of our MPSI-CA protocol. Besides the main results, we introduce the concepts and efficient constructions of two novel building blocks: multi-party secret-shared shuffle and multi-party oblivious zero-sum check, which may be of independent interest. Show more

Keywords: Multi-party PSI-CA, multi-party PSI-CA-sum, secure multi-party computation, privacy

DOI: 10.3233/JCS-230091

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-41, 2024

Authors: Kumar, Sachin | Suyal, Swati | Kumar, Ashok

Article Type: Research Article

Abstract: In this paper, a scheme for image data security is designed by using Bifid cipher and Arnold map. The conventional 2D-Bifid cipher is changed to handle the encryption and decryption of color images. Further, a block-based method is realized using Arnold map to encrypt and decrypt the image data of square as well as non-square sizes. The proposed scheme is constructed on a widely adopted cryptographic framework, i.e., substitution-permutation design, where Bifid cipher-based scheme acts as a substitution layer and Arnold map-based scheme acts as a diffusion layer. The designed scheme has a huge key space with key sensitivity not …only to accurate keys but also to their accurate orders. The practicability and performance of the designed scheme is validated by conducting a detailed analysis along with a comparative study. This paper contributes to a simple, efficient and secure image encryption method, which outperforms to the related works. Show more

Keywords: Image security, Image encryption, Image decryption, Bifid cipher, Arnold map

DOI: 10.3233/JCS-230101

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-24, 2024

Authors: Horta Neto, Antonio Jose | dos Santos, Anderson Fernandes Pereira | Goldschmidt, Ronaldo Ribeiro

Article Type: Research Article

Abstract: Organizations are vulnerable to cyber attacks as they rely on computer networks and the internet for communication and data storage. While Reinforcement Learning (RL) is a widely used strategy to simulate and learn from these attacks, RL-guided offensives against unknown scenarios often lead to early exposure due to low stealth resulting from mistakes during the training phase. To address this issue, this work evaluates if the use of Knowledge Transfer Techniques (KTT), such as Transfer Learning and Imitation Learning, reduces the probability of early exposure by smoothing mistakes during training. This study developed a laboratory platform and a method to …compare RL-based cyber attacks using KTT for unknown scenarios. The experiments simulated 2 unknown scenarios using 4 traditional RL algorithms and 4 KTT. In the results, although some algorithms using KTT obtained superior results, they were not so significant for stealth during the initial epochs of training. Nevertheless, experiments also revealed that throughout the entire learning cycle, Trust Region Policy Optimization (TRPO) is a promising algorithm for conducting cyber offensives based on Reinforcement Learning. Show more

Keywords: Reinforcement learning, transfer learning, imitation learning, knowledge transfer, cyber attacks, unknown scenarios

DOI: 10.3233/JCS-230145

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-19, 2024

Authors: Fei, Kexiong | Zhou, Jiang | Su, Lin | Wang, Weiping | Chen, Yong

Article Type: Research Article

Abstract: With the advancement of network security equipment, insider threats gradually replace external threats and become a critical contributing factor for cluster security threats. When detecting and combating insider threats, existing methods often concentrate on users’ behavior and analyze logs recording their operations in an information system. Traditional sequence-based method considers temporal relationships for user actions, but cannot represent complex logical relationships well between various entities and different behaviors. Current machine learning-based approaches, such as graph-based methods, can establish connections among log entries but have limitations in terms of complexity and identifying malicious behavior of user’s inherent intention. In this …paper, we propose Log2Graph, a novel insider threat detection method based on graph convolution neural network. To achieve efficient anomaly detection, Log2Graph first retrieves logs and corresponding features from log files through feature extraction. Specifically, we use an auxiliary feature of anomaly index to describe the relationship between entities, such as users and hosts, instead of establishing complex connections between them. Second, these logs and features are augmented through a combination of oversampling and downsampling, to prepare for the next-stage supervised learning process. Third, we use three elaborated rules to construct the graph of each user by connecting the logs according to chronological and logical relationships. At last, the dedicated built graph convolution neural network is used to detect insider threats. Our validation and extensive evaluation results confirm that Log2Graph can greatly improve the performance of insider threat detection compared to existing state-of-the-art methods. Show more

Keywords: Insider threat detection, cluster security, advanced persistent threats, graph construction, graph convolution neural network

DOI: 10.3233/JCS-230092

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-24, 2024

Authors: Yan, Haotian | Hu, Haibo | Ye, Qingqing | Xu, Jianliang

Article Type: Research Article

Abstract: Edge computing is a significant paradigm that can provide message aggregation and message verification with low time delay. To overcome the limitation of computation ability in one edge node, collaborative edge computing is proposed. Each edge node only needs to verify a subset of the message integrity, which is beneficial when incoming messages are large. In this paper, we propose an Elliptic Curve Based Multi-hop Sanitizable Signature (ECMSS), which can provide both signature aggregation and subset verification. The theoretical analysis shows that ECMSS can achieve unforgeability and non-transferability. Concurrently, the experimental results show that our proposed scheme achieves high efficiency …and guaranteed security. Show more

Keywords: Collaborative edge computing, smart city, message integrity, Sanitizable Signature

DOI: 10.3233/JCS-230107

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-27, 2024

Authors: Abdeen, Basel | Al-Shaer, Ehab | Singhal, Anoop | Khan, Latifur | Hamlen, Kevin W.

Article Type: Research Article

Abstract: With the rapid increase in the robustness and impact of cyber-attacks, a counter-evolution in defense efforts is essential to ensure a safer cyberspace. A critical aspect of cyber defense is the experts’ ability to understand, analyze, and share knowledge of attacks and vulnerabilities in a timely and intelligible manner that facilitates the detection and mitigation of emerging threats. Cyber threat intelligence (CTI) reports, and Common Vulnerabilities and Exposures (CVEs) are two primary sources of information that security analysts use to defend against cyber attacks. Analyzing the tactics, techniques, and procedures (TTPs) of attackers from these sources by mapping them to …the ATT&CK framework provides valuable insights to defenders and aids them in countering various threats. Unfortunately, due to the complexity of this mapping and the rapid growth of these frameworks, mapping CTI reports and CVEs to ATT&CK is a daunting and time-intensive undertaking. Multiple studies have proposed models that automatically achieve this mapping. However, due to their reliance on annotated datasets, these models exhibit limitations in quality and coverage. To overcome these challenges, we present SMET – a tool that automatically maps text to ATT&CK techniques based on textual similarity. SMET achieves this mapping by leveraging ATT&CK BERT, a model we trained using the SIAMESE network to learn semantic similarity among attack actions. In inference, SMET utilizes semantic extraction, ATT&CK BERT, and a logistic regression model to achieve ATT&CK mapping. As a result, SMET has demonstrated superior performance compared to other state-of-the-art models. Show more

Keywords: Cyber threat intelligence, MITRE ATT&CK, CVE, large langauge models, deep learning, contrastive learning, SIAMESE networks

DOI: 10.3233/JCS-230218

Citation: Journal of Computer Security, vol. Pre-press, no. Pre-press, pp. 1-20, 2024