论文发表

The Message Queuing Telemetry Transport (MQTT) protocol has become a de-facto standard for lightweight communication in the Internet of Things. However, the standard MQTT lacks built-in security mechanisms for authentication and end-to-end data protection. Existing research has enhanced MQTT security via TLS, reliance on trusted authorities, and lightweight cryptographic extensions, but these approaches suffer from significant computational overhead, heavy reliance on trusted Brokers, and poor scalability in resource-constrained environments. Accordingly, this paper proposes MQTT-L, a lightweight end-to-end secure protocol designed for resource-constrained devices. MQTT-L introduces salt-driven renewable one-way hash chains to achieve lightweight Client-to-Broker authentication and fast reconnection. Furthermore, a key agreement mechanism based on extended Chebyshev chaotic maps is designed to establish end-to-end session keys, and the ChaCha20-Poly1305 cipher is integrated into MQTT-L to ensure the confidentiality and integrity of end-to-end messages. To verify the security and authentication properties of MQTT-L, we utilize the well-known ProVerif tool for formal security verification and further prove its security informally. Finally, performance evaluations, including theoretical analysis, and experimental evaluations conducted on a Mosquitto MQTT Broker testbed, demonstrate the superiority of MQTT-L over existing schemes and TLS-MQTT.

In the field of Internet of Vehicles, driverless taxi (DT) services require secure and low-latency interactions among users, edge servers, DTs, and a trusted authority (TA). Nevertheless, existing vehicular authentication schemes are mainly designed for V2V, V2I, or multi-server environments and fail to account for variations in user behavior, interaction frequency, and risk level, thereby reducing service efficiency. To address these challenges, this paper proposes a game-theory based trust-adaptive Anonymous Secure Mutual Authentication (ASMA) protocol for multi-level users in DT services. ASMA integrates extended Chebyshev chaotic map operations into the authentication process to realize anonymous mutual authentication and session key negotiation. In addition, a dynamic trust evaluation mechanism is introduced to update user trust scores according to historical behaviors and current authentication outcomes, so that users are classified into premium, normal, and risky levels and are assigned differentiated authentication processes. In this way, premium users can complete authentication with lower latency, while risky users are required to undergo stricter verification. Security analysis in the Real-or-Random model and Scyther tool demonstrate that ASMA achieves its intended security goals. Performance evaluation on the NS-3 platform shows that ASMA provides favorable computational latency, communication overhead, and energy consumption compared with related schemes. A Nash equilibrium analysis experiment was conducted on the proposed hybrid game model, proving that the differentiated authentication strategy is an endogenous result under long-term incentives. At the same time, a dynamic convergence simulation of trust scores verifies that the evaluation mechanism can make the trust score converge stably to a reasonable range.

Cloud-assisted Vehicular Ad Hoc Networks (VANETs) facilitate efficient data sharing by leveraging cloud for storing critical traffic information. However, ensuring secure, privacy preserving, and accountable data access with dynamic attribute updates in such environments remains challenging. Therefore, this paper proposes a Traceable and Attribute-Updatable Data Sharing Scheme (TAUDS) with privacy preserving based on attribute tree for cloud-assisted VANETs. Firstly, we construct an attribute tree that enables a two stage black-box tracing mechanism. It first performs an attribute-based binary search to narrow the suspect user set, then conducts identity-based binary localization to precisely identify malicious users, which reduces tracing overhead. We design an attribute update mechanism via dynamic leaf node adjustments on the attribute tree. It supports efficient revocation and modification without reissuing the whole system. For privacy protection, TAUDS employs symmetric encryption to keep user identities confidential, and uses a linear secret sharing scheme to achieve policy hiding. Secondly, under the Decisional Bilinear Diffie-Hellman assumption, formal security analysis proves that TAUDS achieves indistinguishability under chosen-plaintext attack, while its collusion resistance is verified informally. Finally, performance evaluations show clear improvements in computational cost and energy consumption, which confirms that TAUDS is suitable for resource-constrained vehicular environments.

In colleges and universities, music theory courses often adopt uniform teaching methods that fail to consider students' varying backgrounds, skill levels, and learning interests. This study proposes a personalized music theory teaching model from a machine learning. Using datasets of 400 students from Jisou University, the model first applied logistic regression to predict students' mastery of music theory with a precision of 0.89. Subsequently, K-means clustering (K=3) identified three optimal learning profiles-Achiever, Explorer, and Expressive-that guided differentiated teaching strategies. Furthermore, model employed the Analytic Hierarchy Process (AHP) to evaluate the teaching outcomes from multiple dimensions. Experimental results demonstrate that, compared with the traditional teaching model, the personalized teaching model increased teaching evaluation scores by 25% and 27% for freshmen and sophomores, respectively. Average test scores also improved by 4.4 and 6 points. These findings demonstrate that the model not only enhances the effectiveness of music theory teaching but also provides a replicable framework for integrating machine learning into college-level music education.

Frequent data sharing in Vehicular Ad Hoc Networks (VANETs) necessitates a robust foundation of secure access control to ensure data security. Existing ciphertext-policy attribute-based encryption schemes are constrained by the performance bottleneck of a single attribute authority. Furthermore, although many schemes adopt outsourced decryption, the verifiability of the decryption results is not guaranteed. Therefore, this paper proposes a Symmetrically Verifiable Outsourced Decryption Data Sharing Scheme with Privacy-Preserving for VANETs (VODDS). To balance the computational overhead across multiple authorities, VODDS introduces a distributed key distribution mechanism that organizes them into groups. Within each group, the key distribution credential is generated through a Group Key Agreement, with each round secured by a Byzantine consensus mechanism to achieve a balance between security and efficiency. User identities are converted into anonymous representations via hashing for embedding into the attribute keys. Furthermore, blockchain technology is used to record a hash commitment for the verification ciphertext. This enables the user to verify the outsourced result through a smart contract, which performs a symmetrical verification by matching the user’s locally computed hash against the on-chain record. Moreover, VODDS employs a linear secret sharing scheme to achieve policy hiding. We provide security analysis under the q-parallel Bilinear Diffie–Hellman Exponent and Decisional Diffie–Hellman assumptions, which proves the security of VODDS. In addition, VODDS exhibits higher efficiency compared to related schemes in the performance evaluation.

The End–Edge–Cloud (EEC) paradigm hierarchically orchestrates Internet of Things (IoT) devices, edge nodes, and cloud, optimizing system performance for both delay-sensitive data and compute-intensive processing tasks. Securing IoT data sharing in the EEC-driven paradigm while maintaining data traceability poses critical challenges. In this paper we propose STDSM, a symmetry-enhanced secure and traceable data sharing model for the EEC-driven data sharing paradigm. STDSM enables IoT data owners to share data securely by attaching symmetric security labels (for secrecy and integrity) to their data. This mechanism symmetrically controls both data outflow and inflow. Furthermore, STDSM can also track data user identity. Subsequently, the security properties of STDSM, including data confidentiality, integrity, and identity traceability, are formally verified; the verification takes 280 ms, using a novel approach that combines High-Level Petri Net modeling with the satisfiability modulo theories library and the Z3 solver. In addition, our experimental results show that STDSM reduces time overhead by up to 15% while providing enhanced traceability.

Binary code similarity detection(BCSD), as a fundamental technique in software security, has various applications, including malware family detection, known vulnerability detection and code plagiarism detection. Recent deep learning-based BCSD approaches have demonstrated promising performance. However, they face two significant challenges that limit detection performance. First, most approaches that use sequence networks (like RNN and Transformer) utilize coarse-grained tokenization methods, which results in large vocabulary size and severe out-of-vocabulary (OOV) problem. Second, CFG-based methods typically use variants of graph convolutional networks, which only consider local structural information and discard long-distance dependencies between basic blocks.

To address these challenges, this paper proposes Syntax Tree-based instruction embedding and introduces the acyclic graph neural network. The former decomposes assembly instructions into fine-grained tokens and employs a tree-structured neural network to generate vector representations for instructions. The latter transforms CFGs into directed acyclic graphs based on their reducibility, and further captures the dependency between basic blocks with a directed acyclic graph neural network. We implemented these two techniques in a prototype named RCFG2Vec and conducted comprehensive evaluation on two public datasets. The experiment results demonstrate that RCFG2Vec outperforms almost all baselines and achieves detection performance comparable with jTrans, a large model-based approach. Meanwhile, when integrated with our proposed techniques, several baseline approaches exhibit significant improvements in detection performance.

In real-time Internet of Things networks, age of information (AoI) and energy cost (EC) are generally deemed as two significant performance metrics to characterize the information freshness and energy efficiency. This paper aims at updating not just sensing data but sensing data and control data simultaneously in vehicular networks. By employing the promising free-ride coding mechanism, the randomly encoded control data is superposed on the low-density parity-check coded sensing data and then is sent to the receiver, consuming neither additional bandwidth nor transmission power. Considering the time and energy of both status update generation and transmission, the average AoI (AAoI) and average EC (AEC) expressions are derived for preemptive and blocking updating schemes with truncated automatic repeat request protocol. Numerical simulations present the AAoI of both sensing data and control data, as well as the AEC of the transmitter, which demonstrate that free-ride coding mechanism not only can improve the freshness of control data but impose an insignificant influence on the performance of sensing data. Moreover, comparison with the blocking scheme suggests that the preemptive one obtains the smaller AAoI but the larger AEC.

Logs are widely used in software to trace the runtime states and critical events. Log-based anomaly detection is crucial for software maintenance and reliability assurance. Existing log-based anomaly detection methods are suffering from imperfections of log parsing, the neglect of the log individual context, and the discarding of non-character tokens. In this paper, we propose ContexLog, a non-parsing log-based anomaly detection method with all information preservation and enhanced log contextual representation, to detect diverse anomalies effectively. Log messages are first grouped as sequences with different windowing techniques. To capture all log features, ContexLog tokenizes each log sequence and preserves all information, including character and non-character tokens. It then represents the log sequential context and individual context simultaneously to construct input for a Transformer encoder-based classification model. Experimental evaluations on real-world datasets and synthetic datasets demonstrate ContexLog outperforms existing methods in achieving accurate anomaly detection results, handling unseen logs to avoid log parsing imperfections, and utilizing non-character tokens to detect diverse anomalies.

Cloud-assisted Internet of Things (IoT) has become an increasingly popular paradigm to greatly improve the performance of IoT applications by delegating the cloud to manage the massive IoT data. How to achieve secure and real-time traceable data sharing (STDS) is crucial in this paradigm, especially, a large amount of sensitive data produced by IoT devices needs to be stored or accessed to/from the clouds. This article proposes an STDS scheme, which leverages the acrlong DIFC model to allow data owners to not only securely and efficiently share their data produced by IoT devices with data users but also have the capability of tracking the data users’ identity with nonrepudiation based on the hash chain technique. Subsequently, the acrlong HLPN, acrlong SMT-Lib, and Z3 solver are used to formally analyze and verify STDS based on acrlong BMC technique to prove the correctness and security STDS. The formal analysis results show that STDS fulfills its intended security goals. Finally, the performance evaluation results have demonstrated the efficiency of STDS.

Large-scale services are generating massive logs, which trace the runtime states and critical events. Anomaly detection via logs is critical for service maintenance and reliability assurance. Existing log-based anomaly detection methods make use of the limited information in log data, resulting in their incapability of detecting diverse anomalies related to unused log features. In this paper, we propose AllInfoLog, a robust log-based anomaly detection method taking advantage of all log information, to detect diverse types of anomalies. To capture all log features, AllInfoLog utilizes four encoders to extract semantic, parameter, time, and other feature embeddings, respectively. The embeddings of all log features are then combined to train an attention-based Bi-LSTM model to detect diverse anomalies. The experimental evaluations on real-world log datasets, synthetic datasets, and unstable log datasets demonstrate AllInfoLog outperforms the state-of-the-art log-based anomaly detection methods from aspects of performance and robustness, and has effectiveness to detect diverse types of anomalies.

In the cloud, data security issues such as data leakage and maliciously access frequently occurs. Deploying strict security controls on the information flows in the cloud can effectively prevent such problems from happening. How to accurately control the information flows in the cloud and provide an intuitive way of auditing has become an indispensable need to enhance data security. This paper proposes an auditable and secure information flow control (ASIFC) module for PaaS cloud. By using decentralized information flow control model, ASIFC strictly controls the inter-process communication such as pipes, shared memory, and message queues, accurately and intuitively controlling the information flows in the cloud. Moreover, based on NetworkX, a log-driven visualization interface which can display flow direction of information in PaaS cloud is offered, providing understandable content for auditing. The performance evaluation results show that the module outperforms FlowK and Flume in micro-benchmark.

In the field of cloud computing, collaboration and data sharing among clouds have dramatically increased. How to protect the security of shared cloud data is being an urgent problem. Based on decentralized information flow control (DIFC) model, this paper presents an approach, DIFC-based data sharing approach (DIFCS), to protect both confidentiality and integrity of shared cloud data. Additionally, this paper designs a privilege protection policy for DIFCS, resulting in its capability of preventing malicious users from modifying privilege. The correctness and security properties of DIFCS are proved by formal analysis and verification, where firstly, DIFCS is formally interpreted into high-level petri net (HLPN) representation and analyzed using Z language, then is automatically verified with SMT-Lib and Z3 solver. The formal analysis and verification results reveal that DIFCS holds the security properties of confidentiality, integrity, authenticity, and privilege tamper-proof. The experimental results further demonstrate the high efficiency of DIFCS.

With the development of cloud computing, data sharing and collaboration have become increasing among cloud-oriented organizations. In addition to trivial management work, data providers face many difficulties in managing access control policies in cloud data sharing, to prevent permission abuse and information leakage. This article mainly answers the following question: is it possible to achieve verifiably secure inter-cloud data sharing? This article proposes an inter-cloud data sharing (ICDS) approach based on ciphertext-policy attribute-based encryption (CP-ABE) to ensure the security of ICDS. The security properties that ICDS holds are formally verified, where the information flow rules are defined and used in the verification. The information flow of the proposed ICDS is firstly modeled by use of high-level Petri nets (HLPN) formally, then being represented in Z language, and at last the security properties of ICDS are verified by the Z3 solver. The formal analysis proves that the ICDS holds the security properties of confidentiality, authenticity, and collusion-resistance.