As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT.

Contemporarily, the fast development of computing, communication, and storage technology has revolutionized the way that various data-based applications reach massive data from underlying sensor networks. However, such a process also raises two challenging but critical issues: 1) trustworthy and 2) privacy issue for data collectors. Therefore, this article proposes a novel system, which is designed over the distributed mobile-edge network to sufficiently exploit advantages of blockchain and differential privacy (DP) to collect trustworthy data and protect privacy for data collectors. First, to improve trustworthiness of data collections, a new consensus mechanism is proposed for blockchain-based data collection structure, which comprehensively incorporates trustworthy, collection contribution, and throughput together to prefer data collectors for the next block. Second, with the assistance of fully trusted devices, a verifiable trustworthy evaluation strategy is designed to accurately compute the trustworthiness for data collectors. Third, we enforce DP on the data stored in a global blockchain maintained by the cloud server to protect privacy for data collectors without influencing data availability. Finally, both theoretical analyses and experimental results prove that the proposed system comprehensively improves performance of data collections in distributed network without adding any additional cost for the cloud server, compared to other schemes.

Recent developments in collection, computation and communication have expanded the way of data reporting in intelligent Internet of Things (IoT). However, diversity and complexity of data sources also impose new trust challenge in data collection process since untrust reporters tend to report false or even malicious data, which highlights the need to develop a novel methodology to solve such challenge. Thus, based on this domain, inspired by deterrence theory, this article proposes a blockchain-based trust system with assistant of drones to deter malicious data reporting in intelligent IoT. Specifically, to deter malicious data reporting, based on the blockchain technology, the data sensed by fully trusted drones is public published on blockchain showing participants the data standards, named as malicious deterrence scheme. This scheme provides a barrier for malicious reporters to arbitrarily publish false data to blockchain, since the false data can be easily detected while they cannot deny. Second, to further reduce malicious data reporting, a strict penalty mechanism is proposed to punish malicious reporters who have reported false data to blockchain to reduce the malicious data reporting in the following task through punishment. Third, note that the sensing of data standard generates additional costs, therefore, a drone flight route scheme based on a simper deep reinforcement learning with multihead attention mechanism (MA-DRL) is designed to reduce the flight distance for drones. Finally, extensive experiments demonstrate efficiency of our proposed system in terms of reducing malicious data reporting in advance as well as reducing drone flight distance.