As one of the most critical infrastructure, the power grid has been increasingly threatened by network attacks, especially advanced persistent threats (APTs). APT in the power grid is a continual and stealthy attack that analyzes the interaction between the cyber layer and the physical layer. The existing offensive and defensive processes for power grid using honeypots against APTs are modeled based on full rationality. Therefore, both the attacker and the defender make decisions to maximize their payoffs under full rationality. However, fully rational decisions made by end-users are not always conformed with the real cases, and prospect theory is a typical boundedly rational method to model these deviations. In this study, we propose a subjective APT-honeypot game model to study the offensive and defensive interactions between the attacker and the defender based on the prospect theory. In this model, we protect the power grid bus nodes by deploying honeypots, which consider both low- and high-interaction honeypot modes. We prove the existence of Bayesian-Nash equilibrium strategies in defense and attack strategies under bounded rationality. In addition, we used IEEE-30 Bus system to verify the proposed model in this paper. Experiment results show that bounded rationality affects strategy selection and reduces attacker's payoffs.

With the increasingly fierce competition for marine resources, underwater acoustic communication as the main form of underwater communication, its security has received more and more attention. The traditional underwater acoustic communication technology with fixed frequency and modulation may cause information leakage and location exposure of the communicating platform. The communication based on ocean noise is helpful to improve the communication security. This paper proposes a new covert underwater acoustic communication scheme based on ship-radiated noise and chaos signal. Firstly, the characteristics of chaos signal is studied, which is generated by the Chebyshev sequence, and the reconstruction process of ship-radiated noise is analyzed. Secondly, we generate mimic ship-radiated noise containing the secret message based on the time and frequency feature of the chaos signal and ship-radiated noise. Finally, resampling technology is used to equalize the Doppler frequency shift, and time inversion mirror technology is used to perform multipath channel equalization. Simulation and sea experiment verify the effectiveness and feasibility of this scheme. In the sea experiments, the proposed scheme can reliably transimit over 40 per second when the communication distance is about 10km.

Due to the capability of passing through heavily censored networks or gateway equipped with the traffic-monitoring module, DNS tunnel has been the dominant covert communication technique for command and control between the victim and the attacker in network attack events. Although the discovery of DNS tunnel has been intensively studied, the internal application behavior identification for DNS tunnels still remains a challenging problem. The fine-gained identification can help to reveal more behavior information wrapped in DNS tunnels. In this study, we investigate the spatial-temporal information from the raw packets to identify the internal application behaviors in DNS tunnels. Multi-dimensional features on packet length and timing for DNS tunnels with different internal application behaviors are incorporated with a machine-learning algorithm to identify the internal application behaviors in DNS tunnels. We consider 4 common types of application behaviors in our research, including browsing webpages, emailing, downloading data, and controlling the remote servers. The experimental results show that the proposed scheme can achieve higher identification accuracy with a much lower packet consuming rate when compared with the state-of-the-art internal protocol identification scheme. The experiment results depict that our proposed scheme is better in terms of F-score, which can reach 99% with only 100 packets.

With the development of wireless communication technology, more and more information leakage is realized through a wireless covert channel, which brings great challenges to the security of wireless communication. Compared with the wireless covert channel on the upper layer, the wireless covert channel based on the physical layer (WCC-P) has better concealment and greater capacity. As the most widely used scheme of WCC-P, the wireless covert channel with the modulation of the constellation point (WCC-MC) has attracted more and more attention. In this paper, a deep learning scheme based on amplitude-phase characteristics is proposed to detect and classify the WCC-MC scheme. We first extract the amplitude and phase characteristic of error vector magnitude (EVM) and constellation points and then map the amplitude and phase characteristic to the grayscale image, respectively. Finally, the generated feature images are trained, detected, and classified with the adjusted convolution neural network. The experimental results show that the detection accuracy of our proposed scheme can reach 98.5%, and the classification accuracy can reach 81.7%.

KSII Transactions on Internet and Information Systems TIIS Paper Details