Software-defined networking (SDN) is a new networking paradigm that realizes the fast management and optimal configuration of network resources by decoupling control logic and forwarding functions. However, centralized network architecture brings new security problems, and denial-of-service (DoS) attacks are among the most critical threats. Due to the lack of an effective message-verification mechanism in SDN, attackers can easily launch a DoS attack by faking the source address information. This paper presents DoSGuard, an efficient and protocol-independent defense framework for SDN networks to detect and mitigate such attacks. DoSGuard is a lightweight extension module on SDN controllers that mainly consists of three key components: a monitor, a detector, and a mitigator. The monitor maintains the information between the switches and the hosts for anomaly detection. The detector utilizes OpenFlow message and flow features to detect the attack. The mitigator protects networks by filtering malicious packets. We implement a prototype of DoSGuard in the floodlight controller and evaluate its effectiveness in a simulation environment. Experimental results show the DoSGuard achieves 98.72% detecion precision, and the average CPU utilization of the controller is only around 8%. The results demonstrate that DoSGuard can effectively mitigate DoS attacks against SDN with limited overhead.

Software-defined networking (SDN) decouples the control plane and data plane through OpenFlow technology and allows flexible network control. It has been widely applied in different areas and has become a focus of attention in the future network. With SDN’s development, its security problem has become a necessary point of research to be solved urgently. In this paper, we propose a novel attack, namely, the packet injection exploiting attack. By maliciously injecting false hosts into SDN network topology, attackers can further use them to launch a denial of service (DoS) attack. The consequences affect the throughput and processing capabilities of the controller, severely consume data plane resources, and ultimately affect the entire network. To prevent the packet-injection exploiting attack, we designed PIEDefender, an efficient, protocol-independent component built on SDN controllers to detect and mitigate attacks effectively. We implement the PIEDefender prototype on the Floodlight controller and assess the effectiveness in the software environment. Experimental results show that PIEDefender achieves a 97.8% injection detection precision and a 97.96% DoS detection precision, incurring an average CPU consumption of 10%. The evaluation demonstrates that the PIEDefender can effectively mitigate the attack against SDN with limited overhead.

In view of the characteristics of SQL injection attack under the background of complex HTTP traffic, this paper systematically proposes a framework of SQL injection attack detection based on HTTP traffic, including four modules: data collection, data cleaning, feature representation and model building. The data collection module introduces a variety of channels to obtain data, and the flow cleaning module improves the detection ability of SQL injection attack under the complex traffic environment by reducing the interference of irrelevant information. The feature representation module describes an efficient and easy to obtain feature generation method, that is, lexical features that retain special symbols. The model building module proposed a model building method for detecting arbitrary length Payload and a variable length sequence training method to guarantee efficiency. The detection location covers HTTP request headers, URLs, and POST, providing multi-dimensional protection against SQL injection attacks. In the real network environment, the framework detects SQL injection attacks with low alarm omission rate and low false positive rate.

In the field of video action classification, existing network frameworks often only use video frames as input. When the object involved in the action does not appear in a prominent position in the video frame, the network cannot accurately classify it. We introduce a new neural network structure that uses sound to assist in processing such tasks. The original sound wave is converted into sound texture as the input of the network. Furthermore, in order to use the rich modal information (images and sound) in the video, we designed and used a two-stream frame. In this work, we assume that sound data can be used to solve motion recognition tasks. To demonstrate this, we designed a neural network based on sound texture to perform video action classification tasks. Then, we fuse this network with a deep neural network that uses continuous video frames to construct a two-stream network, which is called A-IN. Finally, in the kinetics dataset, we use our proposed A-IN to compare with the image-only network. The experimental results show that the recognition accuracy of the two-stream neural network model with uesed sound data features is increased by 7.6% compared with the network using video frames. This proves that the rational use of the rich information in the video can improve the classification effect.

Recommendation system is an efficient way to filter information, and it has been widely used to predict users' potential interests. To build a powerful recommendation system, we need to use as much information as possible to profile users and items precisely, so it can make more accurate and personalized recommendation for users. The recommender which use merely identifications of user and item as features can't fully utilize the information provided by the data, but also decrease the generalization of the model which have poor performance in both academia and industry. So, using multiple features and learning the intrinsic complex relationship among them are critical for a good recommendation system. In this work, we propose an end-to-end, deep learning based recommendation model without feature engineering. The model consists of two parts, which are used to capture the low-order linear relationship and high-order nonlinear relationship of the features called Weighted Interactive Model and Deep Model. In the Weighted Interactive Model, we use pointwise multiplication to capture low-order relationship of two features. To make the model more expressive, each interaction and dimension of the interactions are assigned by different weights. In addition, we use the user-item rating matrix to build expressions of user and item, which improves generalization of the model. We have conducted many experiments on the open data set for different parameters, and the results outperform than other state-of-the-art methods which show the effectiveness of our proposed model.

Rust has garnered increasing attention as a programming language known for its high security and efficiency. However, new evidence suggests that attackers are now using Rust to develop novel ransomware variants, aiming to evade detection tools and maximize destructive capabilities. In this paper, we construct a real-world dataset consisting of 1823 Rust-based ransomware samples and conduct the empirical study that analyzes their behavioral patterns, revealing six attack features and two evasion mechanisms. Extensive observations show that Rust-based ransomware exhibits distinct behaviors compared to benign software, including semantically fragmented multi-process encryption and unique encryption patterns. Based on these insights, we design a lightweight and real-time detection method called RTCatch to counter evolving Rust-based ransomware attacks. The core of RTCatch lies in process correlation, which aggregates ransomware features across correlated processes, effectively addressing the challenge of feature dispersion caused by multi-process encryption. Experimental results demonstrate that RTCatch achieves a recall of 98.68% on the constructed dataset and performs rapid inference in 253 ms with a maximum response time of 2.97 s while incurring minimal computational and storage overhead. Furthermore, large-scale tests on 873 traditional ransomware samples show that RTCatch maintains consistent detection performance, indicating its robustness across different ransomware families.