The increasing number of cyberattacks has made the cybersecurity situation more serious. Thus, it is urgent to use cyber threat intelligence to deal with the complex and changing cyber environment. However, cyber threat intelligence usually exists in an unstructured form, and a huge amount of data poses a great challenge to security analysts. To this end, this paper proposes a novel threat intelligence information extraction system combining multiple models, which contains four key steps: entity extraction, coreference resolution, relation extraction, and knowledge graph construction. In the entity extraction task, a multihead self-attention mechanism is adopted to extract the dependency relationships between words. In the coreference resolution task, contextual information and mention embedding are fused to improve the mention representation. Meanwhile, features of different dimensions are extracted using a convolutional neural network. In the relation extraction task, additional features such as part of speech, mention width, entity type, and distance of entity pairs are incorporated to improve the embedding representation. Finally, a knowledge graph is constructed to explicitly present entities and their relationships. Experimental results indicate that compared with the baseline model, the F1 score of our model is improved by at least 8.87, 9.82, and 10.56 on entity extraction, coreference resolution, and relation extraction, respectively. The knowledge graph in Neo4j demonstrates the effectiveness of our system.

The rapid development of the Internet of Things (IoT) requires network automation, to improve management efficiency and reduce manual operations. Zero-touch network is a promising technology for empowering network management automation by creating virtualized networks for software-based solutions. However, the traditional software-defined network (SDN) technology is not suitable for IoT devices, due to its massive, heterogeneous, and distributed characteristics. In this paper, we introduce digital twin technology (DT) into the IoT, and propose a DT modeling method through ontology and knowledge graph technologies, which maps IoT elements in the digital space and provides the advantages of centralized control, device abstraction, and flexible control of management. Then, referring to the conceptual architecture of a zero-touch network, a DT-based zero-touch management framework suitable for IoT is established. Finally, aiming at specific device management and network optimization problems in the IoT, a zero-touch management scheme with digital twin technology as the core and intention as the driver is proposed, and the effectiveness of the proposed method is demonstrated using an example.

Password-based authenticated key exchange (PAKE) allows participants sharing low-entropy passwords to agree on cryptographically strong session keys over insecure networks. In this paper, we present two PAKE protocols from lattices in the two-party and three-party settings, respectively, which can resist quantum attacks and achieve mutual authentication. The protocols in this paper achieve two rounds of communication by carefully utilizing the splittable properties of the underlying primitive, a CCA (Chosen-Ciphertext Attack)-secure public key encryption (PKE) scheme with associated nonadaptive approximate smooth projection hash (NA-ASPH) system. Compared with other related protocols, the proposed two-round PAKE protocols have relatively less communication and computation overhead. In particular, the two-round 3PAKE is more practical in large-scale communication systems.

Increasingly, more administrators (defenders) are using defense strategies with deception such as honeypots to improve the IoT network security in response to attacks. Using game theory, the signaling game is leveraged to describe the confrontation between attacks and defenses. However, the traditional approach focuses only on the defender; the analysis from the attacker side is ignored. Moreover, insufficient analysis has been conducted on the optimal defense strategy with deception when the model is established with the signaling game. In our work, the signaling game model is extended to a novel two-way signaling game model to describe the game from the perspectives of both the defender and the attacker. First, the improved model is formally defined, and an algorithm is proposed for identifying the refined Bayesian equilibrium. Then, according to the calculated benefits, optimal strategies choice for both the attacker and the defender in the game are analyzed. Last, a simulation is conducted to evaluate the performance of the proposed model and to demonstrate that the defense strategy with deception is optimal for the defender.

Along with the computer network and software systems tend to be complex, using new technology, the method such as holes or social engineering skills on the implementation of the unknown network attack methods emerge in endlessly. Due to lack of corresponding labels in such attacks when detecting actually, traditional learning methods which need large amounts of labelled data will often appear low accuracy, besides, existing approaches of zero-shot learning suffer from domain shift problems. In our paper, we put forward a novel approach of unknown network attack detection on the basis of zero-shot learning. Under the multi-metric space, we align semantic embedding and visual embedding via designing a zero-shot learning model based on variational autoencoder, and transfer known class learning to the unknown class through the semantic feature vector. This approach not only alleviates the projection domain shift problem, but also improving the detection accuracy of unknown network attacks. Experiments show that our model has good practicability and feasibility on the NSL - KDD dataset, comparing with the other classifier models.