Personal privacy disclosure is one of the most serious challenges in smart industrial applications. Anonymous authentication is an effective solution to protect personal privacy. However, the existing anonymous credential protocols are not perfectly suitable for smart industrial environments such as smart vehicles in the sense that the credential revocation issue is not well solved. In this paper, we propose BASS, a Blockchain-based Anonymous authentication with Selective revocation for Smart industrial applications supporting attribute privacy, selective revocation, credential soundness and multi-showing-unlinkability. According to the diverse demands of credential authorities, BASS can selectively provide revocation of credentials or revocation of users. We extend BASS from single-attribute privacy to multi-attribute privacy as well. Finally, we implement a prototype to evaluate the cryptographic core primitives of BASS by deploying smart contracts in Ethereum to demonstrate the validity of BASS in smart industrial applications.

Internet of Vehicles (IoV) being a subdivided application of the Internet of Things, is considered as one of the most prominent and emerging technologies for model transportation systems. However, security and privacy remain two key requirements for IoV networks, as communications between vehicles and other Internet-connected things are generally carried out over public channels. Some of the most typical attack issues for the IoV networks include hardware tampering, unauthorized data access, message modification, tracking vehicle locations, etc. Although there have been a number of solutions (e.g., mutual authentication and key agreement protocols) proposed to ensure the secure communication for IoV, most of them still suffer from some vulnerabilities, such as linkability, server spoofing, and replay attacks, in violation of the security requirements of IoV. Hence, it remains challenging to design secure and efficient solutions. In this article, we first take a recently proposed authentication protocol as an example and analyze the weaknesses of it with simple mathematical analysis. We then propose an improved multiserver-based authentication and key agreement protocol for IoV (called SeMAV), which applies the password and smart card to hide the private keys. We also present both formal and informal security proofs to confirm the robustness against those commonly known attacks. The theoretical comparative summary and simulation results also show that SeMAV can achieve a good performance when compared with some other related protocols in the literature.

As cyber attacks grow more complex and sophisticated, new types of malware become more dangerous and challenging to detect. In particular, fileless malware injects malicious code into the physical memory directly without leaving attack traces on disk files. This type of attack is well concealed, and it is difficult to find the malicious code in the static files. For malicious processes in memory, signature-based detection methods are becoming increasingly ineffective. Facing these challenges, this paper proposes a malware detection approach based on convolutional neural network and memory forensics. As the malware has many symmetric features, the saved training model can detect malicious code with symmetric features. The method includes collecting executable static malicious and benign samples, running the collected samples in a sandbox, and building a dataset of portable executables in memory through memory forensics. When a process is running, not all the program content is loaded into memory, so binary fragments are utilized for malware analysis instead of the entire portable executable (PE) files. PE file fragments are selected with different lengths and locations. We conducted several experiments on the produced dataset to test our model. The PE file with 4096 bytes of header fragment has the highest accuracy. We achieved a prediction accuracy of up to 97.48%. Moreover, an example of fileless attack is illustrated at the end of the paper. The results show that the proposed method can detect malicious codes effectively, especially the fileless attack. Its accuracy is better than that of common machine learning methods.

Due to the rapid emergence of malware and its greater harm, the successful execution of malware often brings incalculable losses. Consequently, the detection of malware has become increasingly crucial. The sequence of API calls in software embodies substantial behavioral information, offering significant advantages in the identification of malicious activities. Meanwhile, the capability of automatic feature extraction by deep learning can better mine the features of API call sequences. In the current research, API features remain underutilized, resulting in suboptimal accuracy in API detection. In this paper, we propose a deep-learning-based method for detecting malware using API call sequences. This method transforms the API call sequence into a grayscale image and performs classification in conjunction with sequence features. By leveraging a range of deep-learning algorithms, we extract diverse behavioral information from software, encompassing semantic details, time-series information, API call frequency data, and more. Additionally, we introduce a specialized neural network framework and assess the impact of pixel size on classification effectiveness during the grayscale image-mapping process. The experimental results show that the accuracy of our classification method is as high as 99%. Compared with other malware-detection techniques, especially those based on API call sequences, our method maps API call sequences to gray image analysis and has higher detection accuracy.

With the rapid development of artificial intelligence (AI) in the healthcare industry, the sharing of personal healthcare data plays an essential role in advancing medical AI. Unfortunately, personal healthcare data sharing is plagued by challenges like ambiguous data ownership and privacy leakage. Blockchain, which stores the hash of shared data on-chain and ciphertext off-chain, is treated as a promising approach to address the above issues. However, this approach lacks a flexible and reliable mechanism for incremental updates of the same case data. To avoid the overhead of authentication, access control, and rewards caused by on-chain data changes, we propose a blockchain and trusted execution environment (TEE)-based privacy-preserving sharing scheme for healthcare data that supports incremental updates. Based on chameleon hash and TEE, the scheme achieves reliable incremental updates and verification without changing the on-chain data. In the scheme, for privacy concerns, off-chain data are protected through symmetric encryption, whereas data verification, decryption, and computation are performed within TEE. The experimental results show the feasibility and effectiveness of the proposed scheme.