Android applications are developing rapidly across the mobile ecosystem, but Android malware is also emerging in an endless stream. Many researchers have studied the problem of Android malware detection and have put forward theories and methods from different perspectives. Existing research suggests that machine learning is an effective and promising way to detect Android malware. Notwithstanding, there exist reviews that have surveyed different issues related to Android malware detection based on machine learning. We believe our work complements the previous reviews by surveying a wider range of aspects of the topic. This paper presents a comprehensive survey of Android malware detection approaches based on machine learning. We briefly introduce some background on Android applications, including the Android system architecture, security mechanisms, and classification of Android malware. Then, taking machine learning as the focus, we analyze and summarize the research status from key perspectives such as sample acquisition, data preprocessing, feature selection, machine learning models, algorithms, and the evaluation of detection effectiveness. Finally, we assess the future prospects for research into Android malware detection based on machine learning. This review will help academics gain a full picture of Android malware detection based on machine learning. It could then serve as a basis for subsequent researchers to start new work and help to guide research in the field more generally.

Due to the limitations of symmetric-key techniques, authentication and key agreement (AKA) protocols based on public-key techniques have attracted much attention, providing secure access and communication mechanism for various application environments. Among these public-key techniques used for AKA protocols, chaotic-map is more effective than scalar multiplication and modular exponentiation, and it offers a list of desirable cryptographic properties such as un-predictability and higher efficiency than scalar multiplication and modular exponentiation. Furthermore, it is believed that three-factor AKA protocols can achieve higher security level than single- and two-factor protocols. However, none of existing three-factor AKA protocols can meet all security requirements. One of the most prevalent problems is how to balance security and usability. To deal with this problem, we put forward a provably secure three-factor AKA protocol based on extended chaotic-maps for mobile lightweight devices, by adopting the techniques of "Fuzzy-Verifiers" and "Honeywords". We prove the security of our protocol in the random oracle model. We also simulate the protocol by using the AVISPA tool. The security analysis and simulation results show that our protocol can meet all 13 evaluation criteria regarding security. The evaluation results demonstrate that our protocol offers better balance between security and usability over state-of-the-art ones.

Despite decades of intensive research, it is still challenging to design a practical multi-factor user authentication scheme for wireless sensor networks (WSNs). This is because protocol designers are confronted with a long-standing "security vs. efficiency" dilemma: sensor nodes are lightweight devices with limited storage and computation capabilities, while the security requirements are demanding as WSNs are generally deployed for sensitive applications. Hundreds of proposals have been proposed, yet most of them have been found to be problematic, and the same mistakes are repeated again and again. Two of the most common security failures are regarding smart card loss attacks and node capture attacks. The former has been extensively investigated in the literature, while little attention has been given to understanding the node capture attacks. To alleviate this undesirable situation, this paper takes a substantial step towards systematically exploring node capture attacks against multi-factor user authentication schemes for WSNs. We first investigate the various causes and consequences of node capture attacks, and classify them into ten different types in terms of the attack targets, adversary's capabilities and vulnerabilities exploited. Then, we elaborate on each type of attack through examining 11 typical vulnerable protocols, and suggest corresponding countermeasures. Finally, we conduct a large-scale comparative measurement of 61 representative user authentication schemes for WSNs under our extended evaluation criteria. We believe that such a systematic understanding of node capture attacks would help design secure user authentication schemes for WSNs.

With the popularization of intelligent terminals, especially current trends, such as “Industrie 4.0” and the Internet of Things, mobile crowdsensing is becoming one of the promising applications built on smart devices in mobile networks. However, the existing mobile crowdsensing models are mostly based on a centralized platform, which is not fully trusted in reality and results in the existence of fraud and other security problems. Furthermore, the data quality collected through crowdsensing is varied, and the location privacy is difficult to guarantee, especially at the worker selection stage. To solve these two problems, an effective blockchain-based location-privacy-preserving crowdsensing model, CrowdBLPS, is proposed in this article. First, the idea of a blockchain is introduced into this model. The decentralized structure and the consensus approach are applied to realize the nonrepudiation and nontampering of information. Second, to improve the data sensing quality and protect worker privacy, a two-stage approach, including the preregistration stage and the final selection stage, is proposed. Finally, we further implement a prototype on the Ethereum public testing network, and the experimental results show the feasibility, availability, and reliability of CrowdBLPS.

The unprecedented proliferation of smart home together with wireless sensor networks has enriched human’s daily life. Inevitably, the smart home without the guard of authentication mechanism is bound to bring a series of security issues. Hence, a great number of authentication protocols have been designed to verify the user’s identity and ensure that the data be accessed with authorization in smart home. Recently, (M. Shuai et al., 2019) (Computers & Security, 2019) proposed a two-factor anonymous authentication scheme for smart home and presented that their scheme can be immune to various attacks. However, by careful analysis, we found that (M. Shuai et al.’s, 2019) scheme needed further improvements in session key forward secrecy and against: type-I node capture attack and node impersonation attack. As a going step to this direction, here, we first design a robust two-factor user authentication also for smart home based on the elliptic curve cryptography. Second, we give security proofs to demonstrate that the construction of the proposed scheme can be of user anonymity, session key forward secrecy, and resist all attacks shown in this article. Third, performance comparisons covered in storage/network communication/computation costs are carried out to indicate that our scheme can be comparable to those newly designed schemes, especially, the user and gateway in our scheme need only 352 and 320 bits, respectively.

As an essential part of Internet of Things (IoT), wireless sensor networks (WSNs) have touched every aspect of our lives, such as health monitoring, environmental monitoring and traffic monitoring. However, due to its openness, wireless sensor networks are vulnerable to various security threats. User authentication, as the first fundamental step to protect systems from various attacks, has attracted much attention. Numerous user authentication protocols armed with formal proof are springing up. Recently, two biometric-based schemes were proposed with confidence to be resistant to the known attacks including offline dictionary attack, impersonation attack and so on. However, after a scrutinization of these two schemes, we found them not secure enough as claimed, and then demonstrated that these schemes suffer from various attacks, such as offline dictionary attack, impersonation attack, no user anonymity, no forward secrecy, etc. Furthermore, we proposed an enhanced scheme to overcome the identified weaknesses, and proved its security via Burrows–Abadi–Needham (BAN) logic and the heuristic analysis. Finally, we compared our scheme with other related schemes, and the results showed the superiority of our scheme.