Earticle

Clustering algorithm is a common analysis technology for network forensics, which, lacking of any prior knowledge, can effectively find out the invasions by analyzing the collected real-time communication data flowing through the network. This paper proposed an improved dynamic kernel clustering algorithm for mixed numeric and categorical network communication data. First, centroid prototype based on the mean and distribution centroid was put forward to represent the cluster center. Then by using Gaussian kernel function, the paper introduced a new dissimilarity measure between the data object and the centroid prototype in combination with the significance of different categorical values. On this basis, the objective function was defined, which took into account both the compact degree in a cluster and the discrete degree among the clusters. After that an improved kernel clustering algorithm was designed. In the process of clustering, centroid prototype and the value of the clustering parameter dynamically updated for a better description of the characteristics of clusters’ change. Finally, in order to verify the feasibility and effectiveness of the algorithm, the paper further applied it to network forensics, and the experimental results showed that the method could mine the intrusion behavior more accurately.

COSB-128 is a type of fast controllable permutation block (CPB), which is designed to ensure a high speed of data transformation and high stability to differential analysis. In this paper, we present the possibility to distinguish between a 10-round COSB-128 and a 128-bit random permutation through a full 10-round related-key difference characteristic by proposing a distinguishing attack with high probability on this cipher. This attack is another result from previous study of related-key attack on COSB-128 [2]. From that point, it reveals the potential to extend to the related-key recovery attack on this algorithm in the future.

In recent years, counterfeiting is posing a serious threat to face recognition based authentication system. Introducing liveness detection into a face-based authentication system can be a good solution to the problem. This paper applied eye region detection and tracking technology to anti-counterfeiting application, and designed an eye region activity based liveness detection system. First, a scale balance and a “face-to-eye” strategy were proposed to fast detect the eye region, and then KLT algorithm was used to track the detected eye region. At last, a random instruction (closing eye, moving to the left or right) was evoked to the user, and the liveness judgment was given according to the results of the users’ cooperation. Experiments show that the proposed eye region activity based face liveness detection system is real-time and robust, and can meet the needs of practical applications.

The health state assessment and remaining life prediction of Train Control Center (TCC) is an important premise to carry out state repair of equipment, which can effectively protect the safe operation of the system. The paper aims to assess the health state of the equipment by adopting the health index model of TCC based on fuzzy comprehensive evaluation. As to various uncertain factors the TCC has such as the operating environment, the quality of the equipment and maintenance, the life prediction model of TCC is established based on the evaluative result, namely health index HI. Further variation that the equipment health index changes with time is established to realize the life prediction of TCC. The example shows that the life of TCC can be predicted effectively by means of the health state assessment for the equipment. The railway department can obtain the corresponding data, which can provide the basis of the maintenance and update for the equipment.

Mobile devices and virtualized appliances in the Internet of Things can be end nodes on varying networks owned by different parties over time, while still seamlessly participating in licit or illicit activities. Digital Forensics and Incident Response (DFIR) tools today struggle to perform digital investigations in such loosely controlled networked environments as they face several challenges including: scarcity of resources, availability, trust, privacy, data volumes, velocity and variety. In this paper we analyze the state of research in DFIR in networked environments, identifying the challenges facing DFIR tools particularly in loosely controlled network environments. We present the requirements for a system to address these challenges at the various steps of the typical digital investigation methodology. From this we identify the need for support from Peer to Peer (P2P) overlays and discuss their relative merits and drawbacks in order to identify those that would best support DFIR in loosely controlled networked environments. Finally we incorporate both structured and unstructured P2P overlays in various capacities in our architecture in order to organize devices in loosely controlled networks, using context information, thus enabling efficient capture, analysis and reporting of artifacts of use in digital investigations.

In this paper, we construct an oriented user group verifiable attribute-based encryption (OG-ABEv) scheme. Our scheme not only maintains on the security of previous ABE schemes, but also enhances two functions: (1) It integrates user group into the ABE scheme, thereby strengthening the confidentiality of data sharing and reducing excessive centralization of user rights; (2) It provides a verification method to supervising the central authority (CA). It also allows users to immediately check the correctness of the attribute keys and allows semi-trusted or untrusted CA be in our system. We formalize the concept of OG-ABEv and prove our scheme.

In this paper, the characteristics of the thermal damage in explosive field have been analyzed, and the technical indicators of the heat flux sensors which are used for thermal damage test have been pointed out. The structure of Gardon gauge was modeled and analyzed. And the mathematical model of Gardon gauge was improved on this basis. By expanding the mathematical model to the non-steady heat transfer stage, the response speed of the Gardon gauge is increased immensely. And also the structure of Gardon gauge was improved to meet the need of the thermal damage test in the explosion field. At last, a numerical simulation was performed on the improved gauge, which verified the feasibility of applying this gauge to the thermal damage test in the explosion field.

We propose the copyright management for mix music system that classifies the information of the music used by the producers and records the range for it. The system saves the information of the produced mix music in the database. Mix music means a mixture of musical styles in the field of music. In the course of mix music production, the music producer needs permission of usage of music copyright and pays the whole price of the music. However, the most mix music producers use only part of that music. The payment for the whole of the music is very expensive. Therefore, they use the music illegally, so that they do not have to pay the expensive price. If it becomes possible to pay only that used part, the producers will not use it illegally and also the music market will be invigorated. Many mix music producers experienced inconvenience because they should input much information manually. The program to find the information of used music and input it automatically. In addition, the information about the created mix music is managed automatically in the database for the mix music. This system improves the previous music identification algorithm. We use the continuous combined hash. It reduces the useless matched hash. After identifying music, we select the largest offset that is time index. In the experiment, the performance of music identification is increased and that of the time index for the original music is improved.

Modern industrial automation control network SCADA system is facing more and more serious security threat. In order to meet the demand for oil and gas SCADA system security defense, by analyzing the security risk in oil and gas SCADA system and advantage of multi-agent technology, formalization description security defense architecture based on multi-agent is presented and the roles and tasks in the architecture are described and SCADA security defense framework based on multi-agent is designed, finally, simulation model based on agent security attack and defense is given. With the experimental simulation using neural network recognition algorithm, the reliability and validity of the model are verified by comparing detection rate and false rate. Compared with the traditional security and defense, this system makes full use of many advantages of the multi-Agent architecture, and has the advantages of accurate detection, high detection efficiency and timely response.