针对具有多家乡特征的流传输控制协议(stream control transmission protocol,SCTP)在垂直切换过程中的拥塞控制问题,提出网络状态感知的SCTP拥塞控制增强方法(network-aware SCTP,NA-SCTP),利用现有SCTP中的心跳消息(Heartbeat)来探测...针对具有多家乡特征的流传输控制协议(stream control transmission protocol,SCTP)在垂直切换过程中的拥塞控制问题,提出网络状态感知的SCTP拥塞控制增强方法(network-aware SCTP,NA-SCTP),利用现有SCTP中的心跳消息(Heartbeat)来探测备用链路的时延和带宽。切换发生后,根据探测到的时延和带宽值对备用链路的拥塞控制参数(拥塞窗口和重传定时器)进行适应性调整。仿真结果表明,NA-SCTP能及时准确地探测网络实际状态,对备用链路的拥塞控制参数进行适应性初始化,显著提高了垂直切换过程中的传输性能。所提方法可保持现有SCTP协议的拥塞控制机制,具有理论研究意义和实际应用价值。展开更多
Python is widely used in web crawler, machine learning, data analysis and so on. However, there is no guarantee that Python scripts are trusted in their whole lifetime because of system insecurity. When the system is ...Python is widely used in web crawler, machine learning, data analysis and so on. However, there is no guarantee that Python scripts are trusted in their whole lifetime because of system insecurity. When the system is attacked, scripts in the computer are likely to be tampered with. Therefore, the trustworthiness of Python scripts needs to be checked through different configuration strategies, including integrity verification and vulnerability detection. In this paper, integrity verification and vulnerability detection are based on two Python scripts, an original Python script and a current Python script, and the original Python script is assumed to has no vulnerabilities. By comparing with the original script, we can find out whether the current script is integrity or not and detect whether there are vulnerabilities if the integrity of the current file is destroyed. Integrity verification with Hash functions is not applied in some cases. In this mode, any changes including blank lines added are considered illegal. So loose integrity verification by combining UNIX diff tool with abstract syntax trees is proposed. The vulnerability detection starts from the premise that the original Python script has no vulnerabilities, and taint analysis is applied on the vulnerability detection framework Bandit to find vulnerabilities. Besides, in order not to change the usage of Python, both integrity verification and vulnerability detection modules are embedded in Python interpreter. The experiments show that the performance of security analysis framework is good and Bandit with taint can greatly reduce the false positive results without affecting the performance.展开更多
Key-recovery technology is often used by an adversary to attempt to recover the cryptographic key of an encryption scheme. The most obvious key-recovery attack is the exhaustive key-search attack. But modern ciphers o...Key-recovery technology is often used by an adversary to attempt to recover the cryptographic key of an encryption scheme. The most obvious key-recovery attack is the exhaustive key-search attack. But modern ciphers often have a key space of size 2128 or greater, making such attacks infeasible with current technology. Cache-based side channel attack is another way to get the cryptographic key of an encryption scheme, but there are random noises in side channel attack. In order to reduce random errors, it is advisable to repeat the key recovery process many times. This paper is focused on the way to improve the key recovery accuracy by dealing with the key sequences obtained from the repeated Cache-based side channel attacks. To get the real key, private key bits from side channel attack are collected firstly. And then the key sequences are aligned using sequence alignment algorithms based on dynamic programming. The provided method of key recovery is universal, which is not limited to any cryptographic algorithm. The experiment shows that the proposed method has a good performance and a high availability when the error rate of the collected key bit is within a reasonable range.展开更多
文摘针对具有多家乡特征的流传输控制协议(stream control transmission protocol,SCTP)在垂直切换过程中的拥塞控制问题,提出网络状态感知的SCTP拥塞控制增强方法(network-aware SCTP,NA-SCTP),利用现有SCTP中的心跳消息(Heartbeat)来探测备用链路的时延和带宽。切换发生后,根据探测到的时延和带宽值对备用链路的拥塞控制参数(拥塞窗口和重传定时器)进行适应性调整。仿真结果表明,NA-SCTP能及时准确地探测网络实际状态,对备用链路的拥塞控制参数进行适应性初始化,显著提高了垂直切换过程中的传输性能。所提方法可保持现有SCTP协议的拥塞控制机制,具有理论研究意义和实际应用价值。
基金Supported by the National Natural Science Foundation of China(61572066)
文摘Python is widely used in web crawler, machine learning, data analysis and so on. However, there is no guarantee that Python scripts are trusted in their whole lifetime because of system insecurity. When the system is attacked, scripts in the computer are likely to be tampered with. Therefore, the trustworthiness of Python scripts needs to be checked through different configuration strategies, including integrity verification and vulnerability detection. In this paper, integrity verification and vulnerability detection are based on two Python scripts, an original Python script and a current Python script, and the original Python script is assumed to has no vulnerabilities. By comparing with the original script, we can find out whether the current script is integrity or not and detect whether there are vulnerabilities if the integrity of the current file is destroyed. Integrity verification with Hash functions is not applied in some cases. In this mode, any changes including blank lines added are considered illegal. So loose integrity verification by combining UNIX diff tool with abstract syntax trees is proposed. The vulnerability detection starts from the premise that the original Python script has no vulnerabilities, and taint analysis is applied on the vulnerability detection framework Bandit to find vulnerabilities. Besides, in order not to change the usage of Python, both integrity verification and vulnerability detection modules are embedded in Python interpreter. The experiments show that the performance of security analysis framework is good and Bandit with taint can greatly reduce the false positive results without affecting the performance.
基金Supported in part by the Fundamental Research Funds for the Central Universities of China(2015JBM034)
文摘Key-recovery technology is often used by an adversary to attempt to recover the cryptographic key of an encryption scheme. The most obvious key-recovery attack is the exhaustive key-search attack. But modern ciphers often have a key space of size 2128 or greater, making such attacks infeasible with current technology. Cache-based side channel attack is another way to get the cryptographic key of an encryption scheme, but there are random noises in side channel attack. In order to reduce random errors, it is advisable to repeat the key recovery process many times. This paper is focused on the way to improve the key recovery accuracy by dealing with the key sequences obtained from the repeated Cache-based side channel attacks. To get the real key, private key bits from side channel attack are collected firstly. And then the key sequences are aligned using sequence alignment algorithms based on dynamic programming. The provided method of key recovery is universal, which is not limited to any cryptographic algorithm. The experiment shows that the proposed method has a good performance and a high availability when the error rate of the collected key bit is within a reasonable range.
