The Internet of Things (IoT) provides various benefits, which makes smart device even closer. With more and more smart devices in IoT, security is not a one‐device affair. Many attacks targeted at traditional computers in IoT environment may also aim at other IoT devices. In this paper, we consider an approach to protect IoT devices from being attacked by local computers. In response to this issue, we propose a novel behavior‐based deep learning framework (BDLF) which is built in cloud platform for detecting malware in IoT environment. In the proposed BDLF, we first construct behavior graphs to provide efficient information of malware behaviors using extracted API calls. We then use a neural network‐Stacked AutoEncoders (SAEs) for extracting high‐level features from behavior graphs. The layers of SAEs are inserted one after another and the last layer is connected to some added classifiers. The architecture of the SAEs is 6,000‐2,000‐500. The experiment results demonstrate that the proposed BDLF can learn the semantics of higher‐level malicious behaviors from behavior graphs and further increase the average detection precision by 1.5%.

For a Software Defined Network (SDN), security is an important factor affecting its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection tasks by using the programmability of the network. This will undoubtedly involve a heavy burden for the controller. More devastatingly, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN, and this center physically decouples from the SDN controller and constructs SDN security services. We adopt virtualization technology to construct a security meta-function library, and propose a dynamic security service composition construction algorithm based on web service composition technology. The rule-combining method is used to combine security meta-functions to construct security services which meet the requirements of users. Moreover, the RETE algorithm is introduced to improve the efficiency of the rule-combining method. We evaluate our solutions in a realistic scenario based on OpenStack. Substantial experimental results demonstrate the effectiveness of our solutions that contribute to achieve the effective security protection with a small burden of the SDN controller.

Although the frequency of Internet worm's outbreak is decreased, the impact of worm on people's wealth security and society's stabilization is still an unnegligible problem, especially the emergence of botnet. With the growth of variable network structure and applications, such as P2P network, Internet worms can explore more fast and covert ways to propagate. Hence, an accurate worm propagation model is urgently needed. In this paper, the concept and structure of worms are presented, then the typical propagation models in different environment are discussed, and the Advantages and Disadvantages of different models are given. It is our hope that others in the community who need to get up to speed in the worm literature can benefit from this survey.