The key features of 5G network (i.e., high bandwidth, low latency, and high concurrency) along with the capability of supporting big data platforms with high mobility make it valuable in coping with emerging medical needs such as COVID-19 and future healthcare challenges. However, enforcing the security aspect of a 5G-based smart healthcare system that hosts critical data and services is becoming more urgent and critical. Passive security mechanisms (e.g., data encryption and isolation) used in legacy medical platforms cannot provide sufficient protection for a healthcare system that is deployed in a distributed manner and fail to meet the need for data/service sharing across ‘cloud-edge-terminal’ in the 5G era. In this paper, we propose a security awareness and protection system that leverages zero-trust architecture for a 5G-based smart medical platform. Driven by the four key dimensions of 5G smart healthcare including ‘subject’ (i.e., users, terminals, and applications)‘, object’ (i.e., data, platforms, and services)‘, behavior’, and ‘environment’, our system constructs trustable dynamic access control models and achieves real-time network security situational awareness, continuous identity authentication, analysis of access behavior, and fine-grained access control. The proposed security system is implemented and tested thoroughly at industrial-grade, which proves that it satisfies the needs of active defense and end-to-end security enforcement of data, users, and services involved in a 5G-based smart medical system.

The domain name system (DNS) that maps alphabetic names to numeric Internet Protocol (IP) addresses plays a foundational role in Internet communications. By default, DNS queries and responses are exchanged in unencrypted plaintext, and hence, can be read and/or hijacked by third parties. To protect user privacy, the networking community has proposed standard encryption technologies such as DNS over TLS (DoT), DNS over HTTPS (DoH), and DNS over QUIC (DoQ) for DNS communications, enabling clients to perform secure and private domain name lookups. We survey the DNS encryption literature published from 2016 to 2021, focusing on its current landscape and how it is misused by malware, and highlighting the existing techniques developed to make inferences from encrypted DNS traffic. First, we provide an overview of various standards developed in the space of DNS encryption and their adoption status, performance, benefits, and security issues. Second, we highlight ways that various malware families can exploit DNS encryption to their advantage for botnet communications and/or data exfiltration. Third, we discuss existing inference methods for profiling normal patterns and/or detecting malicious encrypted DNS traffic. Several directions are presented to motivate future research in enhancing the performance and security of DNS encryption.

Distributed Denial-of-Service (DDoS) attacks are increasing in frequency and volume on the Internet, and there is evidence that cyber-criminals are turning to Internet-of-Things (IoT) devices such as cameras and vending machines as easy launchpads for large-scale attacks. This paper quantifies the capability of consumer IoT devices to participate in reflective DDoS attacks. We first show that household devices can be exposed to Internet reflection even if they are secured behind home gateways. We then evaluate eight household devices available on the market today, including lightbulbs, webcams, and printers, and experimentally profile their reflective capability, amplification factor, duration, and intensity rate for TCP, SNMP, and SSDP based attacks. Lastly, we demonstrate reflection attacks in a real-world setting involving three IoT-equipped smart-homes, emphasising the imminent need to address this problem before it becomes widespread.

Domain Name System (DNS) is a critical service for enterprise operations, and is often made openly accessible across firewalls. Malicious actors use this fact to attack organizational DNS servers, or use them as reflectors to attack other victims. Further, attackers can operate with little resources, can hide behind open recursive resolvers, and can amplify their attack volume manifold. The rising frequency and effectiveness of DNS-based DDoS attacks make this a growing concern for organizations. Solutions available today, such as firewalls and intrusion detection systems, use combinations of black-lists of malicious sources and thresholds on DNS traffic volumes to detect and defend against volumetric attacks, which are not robust to attack sources that morph their identity or adapt their rates to evade detection. We propose a method for detecting distributed DNS attacks that uses a hierarchical graph structure to track DNS traffic at three levels of host, subnet, and autonomous system (AS), combined with machine learning that identifies anomalous behaviors at various levels of the hierarchy. Our method can detect distributed attacks even with low rates and stealthy patterns. Our contributions are three-fold: (1) We analyze real DNS traffic over a week (nearly 400M packets) from the edges of two large enterprise networks to highlight various types of incoming DNS queries and the behavior of malicious entities generating query scans and floods; (2) We develop a hierarchical graph structure to monitor DNS activity, identify key attributes, and train/tune/evaluate anomaly detection models for various levels of the hierarchy, yielding more than 99% accuracy at each level; and (3) We apply our scheme to a month's worth of DNS data from the two enterprises and compare the results against blacklists and firewall logs to demonstrate its ability in detecting distributed attacks that might be missed by legacy methods while maintaining a decent real-time performance.

Background: Telemedicine that combines information technology and health care augments the operational model of traditional medical services and brings new opportunities to the medical field. China promotes telemedicine with great efforts, and its practices in the deployment of telemedicine platforms and delivery of services have become important references for the research and development in this field. Objective: Our work described in this paper focuses on a regional telemedicine platform that was built in 2014. We analyzed the system design scheme and remote consultations that were conducted via the system to understand the deployment and service delivery processes of a representative telemedicine platform in China. Methods: We collected information on remote consultations conducted from 2015 to 2020 via the regional telemedicine platform that employs a centralized architectural system model. We used graphs and statistical methods to describe the changing trends of service volume of remote consultation, geographical and demographic distribution of patients, and waiting time and duration of consultations. The factors that affect consultation duration and patient referral were analyzed by multivariable linear regression models and binary logistic regression models, respectively. The attitudes toward telemedicine of 225 medical practitioners and 225 patients were collected using the snowball sampling method. Results: The regional telemedicine platform covers all levels of medical institutions and hospitals in all 18 cities of Henan Province as well as some interprovince hospitals. From 2015 to 2020, 103,957 remote medical consultations were conducted via the platform with an annual increasing rate of 0.64%. A total of 86.64% (90,069/103,957) of medical institutions (as clients) that applied for remote consultations were tier 1 or 2 and from less-developed regions; 65.65% (68,243/103,945) of patients who applied for remote consultations were aged over 50 years. The numbers of consultations were high for departments focusing in the treatment of chronic diseases such as neurology, respiratory medicine, and oncology. The invited experts were mainly experienced doctors with senior professional titles. Year of consultation, tier of hospital, consultation department, and necessity of patient referral were the main factors affecting the duration of consultations. In surveys, we found that 60.4% (136/225) of medical practitioners and 53.8% (121/225) of patients had high satisfaction and believed that telemedicine is of vital importance for the treatment of illness. Conclusions: The development of telemedicine in China shows a growing trend and provides great benefits especially to medical institutions located in less developed regions and senior citizens who have less mobility. Cases of remote consultations are mainly for chronic diseases. At present, the importance and necessity of telemedicine are well recognized by both patients and medical practitioners. However, the waiting time needs to be further reduced to improve the efficiency of remote medical services.

Enterprise networks that host valuable assets and services are popular and frequent targets of distributed network attacks. In order to cope with the ever-increasing threats, industrial and research communities develop systems and methods to monitor the behaviors of their assets and protect them from critical attacks. In this survey, we systematically survey related research articles and industrial systems to highlight the current status of this arms race in enterprise network security. First, we discuss the taxonomy of distributed network attacks on enterprise assets, including reconnaissance attacks probing vulnerable enterprise hosts and servers, and distributed denial-of-service (DDoS) attacks aiming to paralyze network services hosted within an enterprise network. Second, we review existing methods that leverage either static configurations or dynamic network graphs to monitor network behavior of enterprise hosts, verify their benign activities and isolate potential anomalies. Third, state-of-the-art detection methods for distributed network attacks sourced from external attackers, such as proprietary rules in commercial firewalls and community signatures in open-source software tools are elaborated with highlights on their merits and bottlenecks. Fourth, as programmable networks and machine learning (ML) techniques are increasingly becoming adopted by the community, their current applications in network security are discussed. Finally, we suggest several research gaps on enterprise network security to inspire future research.