Software-defined networking (SDN) has become a promising trend for managing the Industrial Internet of Things (IIoT) devices. As the core of sensitive data storage and business interaction, the SDN is vulnerable to advanced persistent threats (APTs) attacks, while honeypots have shown great promise against APT attacks. In this article, we propose a new SDN-based dynamic bounded rational honeypot-APT game model in IIoT. Specifically, the defender maximizes the utility by chossing the period strategy of honeypot collecting and analyzing the data, while the attacker maximizes utility by choosing the period strategy of its latency and attack. To describe the bounded rationality, we model the simultaneous dynamic attack and defense process through the prospect theory, in which the Prelec function and the value function are both introduced. Experiment results show that bounded rationality affects strategy selection and reduces defender and attacker’s utilities. Furthermore, our strategy outperforms the existing work in defensive performance.

Distinguishing malicious domain names generated by various domain generation algorithms (DGA) is critical for defending a network against sophisticated network attacks. In recent years, stealthy domain generation algorithms (SDGA) have been proposed and revealed significantly stronger stealthiness comparing to the traditional character-based DGA. Existing state-of-the-art detection schemes are not effective enough for detecting SDGA. In this paper, we exploit the character-level characteristics of the SDGA domain names and propose a heterogeneous deep neural network framework (HDNN) for detecting SDGA. HDNN employs a proposed improved parallel CNN (IPCNN) architecture with multi-sizes of convolution kernel for extracting multi-scale local features from a domain name. The framework also contains a proposed self-attention based bidirectional long short term memory (SA-Bi-LSTM) architecture which can extract the bidirectional global features with attention mechanism from a domain name. Besides that, the focal loss function is introduced to mitigate the imbalance of the sample quantity in the training phase. The benchmark experiments are carried out based on the database composed of the collected benign domain names, real-world DGA and SDGA ones. Compared to the 6 influential deep-learning-based DGA detection schemes, the proposed scheme has achieved state-of-the-art detection results on SDGAs, and also achieved state-of-the-art results on binary and multiclass classification for traditional DGAs.

Secure communication technology has attracted more and more attention to improve the security of the Internet of Things (IoT). In this article, we discuss the maximum secrecy capacity problem for a mobile unmanned aerial vehicle (UAV) assisted secure communication in IoT, where the UAV relays the covert information from the transmitter (Alice) to the legal receiver (Bob) without detection by an eavesdropper (Eve) though sharing the spectrum with the ground device-to-device (D2D) communications. Our design aims to maximize the sum secrecy capacity Bob received by optimizing the transmit power and the UAV’s trajectory jointly while guaranteeing that the normal communication behavior between ground D2D pairs is not affected. Therefore, we propose a jointly optimizing the transmit power and UAV trajectory algorithm (JOTUTA) based on the block coordinate descent (BCD) method. Specifically, we first transform the non-convex problem of transmit power based on a fixed UAV’s trajectory into a convex problem by D.C. (difference of two convex functions) programming. Secondly, we solve the problem of UAV’s trajectory optimization with given transmit power by the successive convex approximation (SCA) method. Experiments results show the effectiveness of JOTUTA and the advantages of improving the secrecy capacity are verified compared with existing work.

As one of the most critical infrastructure, the power grid has been increasingly threatened by network attacks, especially advanced persistent threats (APTs). APT in the power grid is a continual and stealthy attack that analyzes the interaction between the cyber layer and the physical layer. The existing offensive and defensive processes for power grid using honeypots against APTs are modeled based on full rationality. Therefore, both the attacker and the defender make decisions to maximize their payoffs under full rationality. However, fully rational decisions made by end-users are not always conformed with the real cases, and prospect theory is a typical boundedly rational method to model these deviations. In this study, we propose a subjective APT-honeypot game model to study the offensive and defensive interactions between the attacker and the defender based on the prospect theory. In this model, we protect the power grid bus nodes by deploying honeypots, which consider both low- and high-interaction honeypot modes. We prove the existence of Bayesian-Nash equilibrium strategies in defense and attack strategies under bounded rationality. In addition, we used IEEE-30 Bus system to verify the proposed model in this paper. Experiment results show that bounded rationality affects strategy selection and reduces attacker's payoffs.