DDoS attacks have caused very serious damage to enterprise networks. Recently, a new kind of DDoS attack called link-flooding attack (LFA), has surfaced and is already being used by attackers to flood and congest network critical links. LFA attacks are very difficult to detect since adversaries often utilize large-scale legitimate low-speed flows and rolls target links to isolate target areas for launching attacks. To address such a critical security problem, we design and implement a novel LFA defense system called LFADefender that leverages some key features, such as programmability, network-wide view, and flow traceability, of an emerging network technology, Software-Defined Networking (SDN), to effectively detect and migrate LFA attacks. In LFADefender, we propose an LFA target link selection approach and design an LFA congestion monitoring mechanism to effectively detect LFA attacks. In addition, we present a multiple optional paths rerouting method to temporarily mitigate links congestion caused by LFA attacks. We further propose a malicious traffic blocking approach to radically mitigate LFA attacks. Our evaluation results show that LFADefender can accurately detect and rapidly mitigate LFA attacks, but only imposes minimal overhead in the communication channels between network control and data planes.

Unmanned aerial vehicles (UAVs) are being used extensively in various fields. UAVs provide various services to users, including monitoring, logistics, and sensing, because of their flexible deployment and dynamic reconfigurability. However, UAV networks have become more susceptible to malicious threats because of their multiconnectivity and openness. A great effort has been made to develop an effective intrusion detection system (IDS) based on machine-learning approaches for UAVs. Unfortunately, existing methods were unable to identify real time and zero-day attacks for UAV networks. This is due to that existing methods have still used obsolete data sets and past knowledge-based detection. Also, the shortcomings of standalone IDS render them unsuitable for defending UAV networks from potential security risks. Further, the lack of precise identification for compromised UAV nodes in UAV networks poses a critical security gap, risking the entire network’s integrity with the compromise of a single node. Therefore, in this work, we propose an autonomous collaborative IDS (UAV-CIDS) with a feedforward convolutional neural network (FFCNN), which accurately identifies zero-day with high accuracy. The proposed solution takes into account encoded Wi-Fi traffic logs of three popular UAVs types: 1) DBPower UDI; 2) parrot Bebop; and 3) DJI spark. Evaluation results indicate that our FFCNN model has produced outstanding results based on the UAVIDS data set with 98.23% accuracy compared to existing models. After the detection of attacks, their mitigation is equally significant. In addition, we also design and implement real-time incident response handling against cyber-attacks on UAV Networks. The incident response handling will assist in minimizing the effects of a security breach, remediate vulnerabilities and systematically secure the entire UAV networks.

Due to insecure design and configuration, IoT devices are vulnerable to various security issues. In most attacks against IoT, e.g., Mirai, attackers control devices to perform malicious behaviors that are not expected by owners and administrators. Therefore, how to effectively detect malicious behaviors is crucial to protect the security of IoT devices. Different from powerful PCs and servers, resource-constrained IoT devices generally are used to execute the specific function and their behaviors are limited. Based on this observation, we propose IoT-Praetor, an undesired behavior security detection system for IoT devices. In IoT-Praetor, a new Device Usage Description (DUD) model is proposed to construct an IoT device behavior specification including communication and interaction behaviors. Furthermore, automatic behavior extraction approaches are presented. We also design a behavior rule engine to detect device behaviors in real-time. To evaluate the effectiveness of IoT-Praetor, we implemented our methods on Samsung SmartThings and perform a security test. The evaluation results show that the successful detection rate of malicious interaction behavior is 94.5% on average, and the detection rate of malicious communication behavior is above 98%, and system running time delay is only in millisecond level.

The development of the Industrial Internet will generate a large amount of valuable data, known as industrial big data (IBD). By mining and utilizing IBD, enterprises can improve production efficiency, reduce costs and risks, optimize management processes, and innovate services and business models. However, IBD comes from various institutions in all walks of life and has features such as multisource, heterogeneity, and multimodality. And data sharing and trading (DS&T) occur in the Industrial Internet environment without mutual trust. These characteristics pose new challenges to analytics methods and privacy and security protection technologies. Therefore, this article aims to provide references for privacy-preserving and secure industrial big data analytics (IBDA) from three perspectives: 1) research framework; 2) platform architecture; and 3) key technologies. First, we review the current state of research on theories and technologies related to IBDA. Then, we reveal three challenges to secure and efficient IBDA. We take the analytics and utilization of IBD as systematic engineering, propose the research framework for privacy-preserving and secure IBDA, and point out the specific content to be studied. Further, we design the architecture of the IBDA platform with the idea of layering, including a function model, security architecture, and system architecture. Finally, detailed research proposals and potential technologies for IBD analytics and utilization are presented from three aspects: 1) data fusion and analytics; 2) data privacy and security protection; and 3) blockchain.

Virtual Trusted Platform Modules (vTPMs) are widely used in commercial cloud platforms (e.g., VMware Cloud, Google Cloud, and Microsoft Azure) to provide virtual root-of-trust and security services for virtual machines. Unfortunately, current state-of-the-art vTPM implementations for cloud computing cannot provide strong protection for vTPMs at run-time and suffer from poor performance under binding vTPMs to a physical TPM. In this paper, we propose SvTPM, an SGX-based virtual trusted platform module, which provides complete life cycle protection of vTPMs in the cloud and does not rely on the physical TPM. SvTPM provides strong isolation protection so malicious cloud tenants or even cloud administrators cannot access vTPM's private keys or any other sensitive data. In this paper, we implement a prototype of SvTPM, which identifies and solves a couple of critical security challenges for vTPM protection with SGX, such as NVRAM rollback attacks, NVRAM binding attacks, and vTPM rollback attacks. SvTPM also shows how to establish trust between vTPM and SGX Platform. Our performance evaluation shows that the NVRAM launch time of SvTPM is $1700\times$ faster than vTPM built upon hardware TPM. In TPM standard command evaluation, we find that SvTPM incurs negligible performance overhead while providing strong isolation and protection. To our knowledge, SvTPM is the first practical work to solve the critical security challenges of securing vTPM using SGX.

Moving target defense (MTD) has provided a dynamic and proactive network defense to reduce or move the attack surface that is available for exploitation. However, traditional network is difficult to realize dynamic and active security defense effectively and comprehensively. Software-defined networking (SDN) points out a brand-new path for building dynamic and proactive defense system. In this paper, we propose CHAOS, an SDN-based MTD system. Utilizing the programmability and flexibility of SDN, CHAOS obfuscates the attack surface including host mutation obfuscation, ports obfuscation, and obfuscation based on decoy servers, thereby enhancing the unpredictability of the networking environment. We propose the Chaos Tower Obfuscation (CTO) method, which uses the Chaos Tower Structure (CTS) to depict the hierarchy of all the hosts in an intranet and define expected connection and unexpected connection. Moreover, we develop fast CTO algorithms to achieve a different degree of obfuscation for the hosts in each layer. We design and implement CHAOS as an application of SDN controller. Our approach makes it very easy to realize moving target defense in networks. Our experimental results show that a network protected by CHAOS is capable of decreasing the percentage of information disclosure effectively to guarantee the normal flow of traffic.