Reviewerly/exHarmony huggingface dataset:
DCC-Find: DNS Covert Channel Detection by Features Concatenation-Based LSTM

DNS (Domain Name System) plays an important role in network communication and it is rarely blocked by firewalls and intrusion detection systems (IDS). It is a suitable way for attackers to build DCC (DNS Covert Channel), which is used for data exfiltration. In recent years, some DCC detection methods have been proposed based on deep learning and there is no need for manual feature extraction. However, some expert knowledge is helpful to express the DNS characteristic. In this paper, we propose a FC-LSTM (Features Concatenation-based LSTM) model to detect DCC. The statistical features are concatenated with the output features of the LSTM model. This method makes the expression of DNS domain names more abundant. The experimental results have shown that the DCC traffic can be identified from normal traffic via this model, and the recognition rate is significantly improved compared with the traditional LSTM model and CNN model. In addition, we implement multi-classification in terms of the DCC tools (some of them are used in APT32). We also add generalization DNS packets (simulating APT34 traffic using DCC for stealing and attacking) to verify the robustness of our model. The FC-LSTM model has a good detection performance as well.
Visualization-Based Software Defect Prediction via Convolutional Neural Network with Global Self-Attention

Defect prediction technology helps software quality assurance teams understand the distribution of software defects, which can assist them to allocate testing and verification resources appropriately. Current visualization-based software defect prediction methods lack spatial and global information of code images during the feature extraction process. To solve the problem of incomplete information, this paper proposes a Convolutional Neural Network with Global Self-Attention (CNN-GSA). The method converts codes into corresponding images and uses an improved convolutional neural network, which combines channel attention, spatial attention, and self-attention mechanisms in a global attention layer, to extract defect-related structural and semantic features in code images. Empirical study shows that the model built with the features generated by CNN-GSA can achieve better F-measure results in defect prediction tasks.
Confusing Traffic against Intra-domain Webpage Fingerprinting Attacks

The website fingerprinting attack is one of the threats that disclosing user web visiting privacy even the visiting traffic is encrypted. It can appear in two types, the inter-domain website fingerprinting and the intra-domain webpage finger-printing. For the intra-domain webpages, they often generated from some predefined templates based on user inputs and may introduce more private details about user-concerned contents. To protect against intra-domain webpage fingerprinting, we adopt two web traffic generating methods to confuse traffic analyzers. The LRSO-Pad disrupts traffic analysis by padding random noise, and the DeOS performs traffic camouflage by sending decoy objects. We also test the fingerprinting and protecting influences imposed by the additional CDN traffic bursts. The conducted experiments validate our adopted methods.
A Collaboration-Aware Approach to Profiling Developer Expertise with Cross-Community Data

Developer expertise is an important factor that should be considered in various software development activities. And it is challenging to accurately profile the expertise of developers as their activities often disperse across different online communities, such as Community Question Answering sites (e.g., Stack Overflow) and Open Source Software platforms (e.g., GitHub). In this regard, early work mainly considers a single community while recent studies are starting to profile developers with cross-community data. However, few works consider the collaborative interactions among developers in evaluating developer expertise across communities. In this work, we propose a collaboration-aware approach to profiling developer expertise using cross-community data by taking into consideration developers’ contributions, collaborative interactions, and the dynamic changes of expertise. Specifically, we are concerned with the common developers in GitHub and Stack Overflow. First, we propose a time-sensitive model to characterize the developer’s expertise in the two communities and integrate the results to generate basic expertise profiles. Second, we build a developer network by analyzing the collaborative interactions among the developers of the two communities. Finally, we apply the topic-sensitive PageRank algorithm to incorporate developer relationships into expertise profiling. Results of extensive experiments on a large number of common developers of GitHub and Stack Overflow demonstrate the effectiveness of our approach.
DRICP: Defect Risk Identification Using Sample Category Perception

Aiming at the problems that the sample-based category imbalance methods were prone to the loss of important data and the current software defect prediction methods did not identify defect potential risks based on the dichotomous classification results, a defect risk identification method on the premise of the sample category perception was proposed. Firstly, noise samples, feature distributions, high-dimensional features, and category imbalance of multi-source sample sets were processed to obtain cleaned samples. Then, the category perception and perception coefficients of the cleaned samples were calculated to obtain the category perception product, and the defect risk identification (DRI) model was constructed by the category perception product. Finally, the risk identification probabilities were calculated using the DRI model to identify potential risks. The experimental results show that the proposed method performs well with accuracy, F1-score, and Matthews correlation coefficient. The obtained risk identification probabilities and defect risk levels are consistent with the actual situation of real samples, which can accurately reflect the severity of defects and identify potential risks.
Clean-label Backdoor Attack on Machine Learning-based Malware Detection Models and Countermeasures

In recent years, machine learning technology has been extensively utilized, leading to increased attention to the security of AI systems. In the field of image recognition, an attack technique called clean-label backdoor attack has been widely studied, and it is more difficult to detect than general backdoor attacks because data labels do not change when tampering with poisoning data during model training. However, there remains a lack of research on malware detection systems. Some of the current work is under the white-box assumption that requires knowledge of machine learning-based models which can be advantageous for attackers. In this study, we focus on clean-label backdoor attacks in malware detection systems and propose a new clean-label backdoor attack under the black-box assumption that does not require knowledge of machine learning-based models, which is riskier. The experimental evaluation of the proposed attack method shows that the attack success rate is up to 80.50% when the poisoning rate is 14.00%, demonstrating the effectiveness of the proposed attack method. In addition, we experimentally evaluated the effectiveness of the dimensionality reduction techniques in preventing clean-label backdoor attacks, and showed that it can reduce the attack success rate by 76.00%.
An enhanced MinHash encryption scheme for encrypted deduplication

The encrypted deduplication can provide both storage savings and data confidentiality for cloud storage systems. Convergent encryption (CE) is a well-known solution for encrypted deduplication, but it brings huge computation and storage overheads for key management. MinHash encryption is an effective solution to this issue. It reduces the number of keys by grouping multiple consecutive chunks into segments and generating one key for each segment. However, MinHash encryption does not take full advantage of the segment similarity, which can be used to further reduce the overhead for key management. To this end, we augment MinHash encryption with Bloom filter and Locality Sensitivity Hash (LSH) to design an enhanced MinHash encryption scheme. Firstly, our scheme generates a sketch for each segment based on the Bloom filter, and projects sketches to the points in a hash table through LSH functions. Secondly, we detect the segment similarity by the distance between points, and similar segments are grouped into super-segments. Finally, we combine MinHash encryption and server-aided message-locked encryption to encrypt the super-segments for achieving encrypted deduplication. We conduct trace-driven experiments using a realworld dataset. Compared with MinHash encryption, our scheme has higher storage efficiency and better encryption performance.
A Pattern-Based Test Platform for Families of Smart Health Products

One of the most critical ICT application domains is healthcare, where a single failure can lead a patient into a hazardous situation. Due to this, there’s a great necessity to ensure that the developed solutions are safe and secure and perform as expected. Smart-Health-4-All (SH4ALL) is a project aiming at accelerating the research, development, commercialization, and dissemination of trustworthy smart health solutions in Portugal. One of the key components of the project is a web platform that supports the generation of integration and system tests for smart health solutions (comprising medical devices, applications, etc.), following a software product line approach. At the domain engineering level, the platform supports the creation of feature models and related test patterns for families of smart health products. At the product engineering level, the platform supports the instantiation of test patterns and the generation of corresponding test scripts ready for execution on specific products under test. This paper presents the aforementioned test platform and test process, and the discovery of test patterns.
CGMBL: Combining GAN and Method Name for Bug Localization

Developers often need to locate buggy code files in the software quality maintenance process. Bug localization aims to automatically identify potentially buggy source code files from the project codes for developers based on the bug reports. Up to now, researchers have proposed many methods to advance this task. However, the early studies only focus on the accuracy of capturing text features or the efficiency of calculating relevance scores, which do not consider the semantic gap between bug reports in natural language and codes in programming language. In this paper, we propose a novel adversarial learning model to bridge the semantic gap. Due to the different characteristics of natural language and programming language, we propose two different representation models for bug reports and code files respectively, and regards the two representation models as the generators. Then we construct adversarial learning by adding a discriminator to distinguish the source of representations so that the model can learn the public features of different texts. In addition, method name is the summary of the code function, and the relevant method name often appears in the bug report. We consider the method name information according to whether the method name appears in the report. Our model can dynamically integrate the information to improve the model effect. We evaluate our model on three open-source java project datasets and compare it with four state-of-the-art methods. The experimental results show that our model outperforms the baseline models and has a significant improvement in evaluation metrics. Besides, we conduct ablation experiments to explain each module’s contribution to the model.
An Optimized Isomorphic Design for the SM4 Block Cipher Over the Tower Field

The SM4 block cipher is Chinese domestic cryptography widely used to secure data confidentiality. Its performance is a key indicator in measuring the efficiency of encryption and decryption in large-scale data scenarios. In traditional tower field optimization, the paired forward and backward linear filed transformations are sandwiched between S-boxes and L-boxes for every round of the encryption operation, which introduces heavily burdensome computation times and complexity. In this paper, we propose a novel isomorphic design for the SM4 round function, where all operations are remaining in the tower filed through multiple rounds, and the paired forward and backward field transformations in each round can be omitted. Based on the isomorphic design, we introduce a more flexible fine-grained bitsliced scheme for the SM4 block cipher with the SIMD instructions, requiring only 32 independent data blocks to be processed in parallel. The experiments show that the proposed isomorphic design for the round function is superior to the traditional design, and the fine-grained bitsliced SM4 implementation on the server device and terminal device achieved 6.4 and 17.2 cycles per byte respectively, showing a performance increase of 284.3% and 54.4% compared to OpenSSL implementation(24.7 and 26.6 cycles per byte respectively).
Efficient SM2 Hardware Design for Digital Signature of Internet of Vehicles

The rapid development of the Internet of Vehicles (IoV) provides a strong technical guarantee for intelligent transportation, greatly facilitating people's daily travel. At the same time, its security problems are becoming increasingly prominent. Fortunately, the cryptographic integrated circuits (ICs) provide a security guarantee for the IoV access authentication, traffic management, data communication, etc., which is the core and cornerstone of the IoV cryptographic technology. However, the IoV has high requirements for timeliness, and its communication resources are precious, so its necessary to ensure that the overhead of the cryptographic module is small and the delay is low. In this paper, we adopt SM2 Elliptic Curve Public Key Digital Signature Algorithm-with fast operation speed and short signature data to implement cryptographic ICs. We design and optimize its hardware design to balance overhead and efficiency. Based on the Montgomery point multiplication algorithm in Lopez-Dahab (LD) projection coordinates, we have researched the core point multiplication operation in SM2 and optimized the time-consuming operation in finite fields, which improved the computational efficiency of SM2. Finally, we completed the hardware design of SM2 on GF(2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">233</sup> ) domain and verified it on a Xilinx Kintex-7 FPGA development board. The experiment results show that the design occupies a total of 77,665 Slice LUTs and merely takes 2.57 μs to complete a signature verification. The signature verification rate is 389,105 times/s. Compared with traditional solutions, our proposed method achieves less overhead and little latency.
Code-based encryption algorithms for generating and verifying digital signature

In today's Internet, the security of data exchange is possible almost entirely thanks to the RSA algorithm. The asymmetric cryptographic algorithm with the public key allows you to safely make bank transfers or send documents to offices. Digitally signing documents and website certificates would not be possible without it. The theoretical threat to RSA is the Shor algorithm, which is a quantum algorithm that enables prime factorization of the natural number ℵ.The paper presents the analysis of code-based encryption algorithms and their use in generating and verifying a digital signature. These algorithms were implemented and compared in selected digital signature applications. The issues related to correction coding and their application in code-based cryptography were reviewed, the use of code-coding algorithms in generating and verifying the digital signature was analysed and their implementation in order to verify correct operation.
Neural-FacTOR: Neural Representation Learning for Website Fingerprinting Attack over TOR Anonymity

TOR (The Onion Router) network is a widely used open source anonymous communication tool, the abuse of TOR makes it difficult to monitor the proliferation of online crimes such as to access criminal websites. Most existing approches for TOR network de-anonymization heavily rely on manually extracted features resulting in time consuming and poor performance. To tackle the shortcomings, this paper proposes a neural representation learning approach to recognize website fingerprint based on classification algorithm. We constructed a new website fingerprinting attack model based on convolutional neural network (CNN) with dilation and causal convolution, which can improve the perception field of CNN as well as capture the sequential characteristic of input data. Experiments on three mainstream public datasets show that the proposed model is robust and effective for the website fingerprint classification and improves the accuracy by 12.21% compared with the state-of-the-art methods.
Implementation of one-time editable blockchain chameleon hash function construction scheme

Under the premise of ensuring the security and integrity of the blockchain, the editable blockchain realizes the correction operation of the data on the chain, but the number of edits is not limited, so that malicious users can modify the data on the chain infinitely in the case of obtaining a trapdoor. Based on this, a function construction scheme that combines the Elliptic Curve Discrete Logarithm Problem difficulty assumption with a cryptographic primitive called one-time chameleon hash function is proposed.A controllable variable is introduced for the hash generation part of the chameleon hash function, so that the same hash value can find two preimages without revealing trapdoor information, However, when searching for the third pre-image, the secondary use of the set controllable variable results in "access failure", i.e., satisfying the secondary collision resistance, The security of the scheme under the assumption of Elliptic Curve Discrete Logarithm Problem is proved in the random oracle model, and a chameleon hash algorithm that is also resistant to secondary editing is selected for experimental comparative analysis. The results show that the scheme in this paper reduces the number of modal operations, which makes the algorithm complexity reduced. It is able to improve the computing efficiency of hash generation algorithm and hash collision algorithm significantly with the same security strength. The combination of the amendment privilege restriction of the chameleon hash function and the efficiency of its algorithm is realized, which provides a technical reference for the amendment privilege management of editable blockchain.
Building Safe and Stable DNN Controllers using Deep Reinforcement Learning and Deep Imitation Learning

Cyber-physical systems (CPSs) with controllers built using deep neural nets and reinforcement learning (DRL) have become increasingly used in the functioning of our society. How to assure the correctness such as the safety and stability of these DNN controllers is extremely important and remains a major research challenge. This paper presents an approach to build safe and stable DNN controllers using DRL and deep imitation learning (DIL). An initial DNN controller is built using DRL, which is used to bootstrap a behavior preserving target DNN controller with safety and stability guarantees via DIL. We have applied this approach in successfully building safe and stable DNN controllers of a simplified airplane pitch control system.
An Anomaly-Based Approach for Detecting Modularity Violations on Method Placement

This paper presents a technique for detecting an anomaly in method placements in Java packages. This anomaly detection helps code reviewers discover a method belonging to an inappropriate package in modularity when developers commit changes in their software development projects. Moving such a method to an appropriate package will contribute to the maintenance of good modularity in their projects. This is particularly beneficial in the later stage of development, where modularity is often violated by adding new features not anticipated in the initial plan. Our technique is based on few-shot classification in machine learning. This paper empirically reveals that our neural network model can detect an anomaly in method placements and a significant portion of the anomalies is considered as inappropriate method placements in modularity. Our model can discover even a method placement that violates a project-specific coding rule that its developers would choose for some reason of maintainability or readability. Our technique is useful for maintaining the consistency in such a project-specific rule.
Identity Authentication Strategy of Mobile Crowd Sensing based on CFL

In order to protect information privacy and ensure user information security, in view of the obvious centralization of the existing identity authentication technologies such as Public Key Infrastructure(PKI) and Identity-Based Encrypted(IBE), this paper proposes an efficient authentication strategy that applies Cryptography Fundamental Logics(CFL) identity authentication technology to Mobile Crowd Sensing(MCS) system, which can complete the authentication between Task Publisher, Cluster Head and Task Participant without the participation of a third-party center. Firstly, this paper introduces to use CFL technology to solve the problem of identity authentication relying on the central server; Secondly, an algorithm combined with MCS system is proposed to solve the decentralization of authentication process; Finally, the Average System Response Time and System Throughput of the three technologies are obtained through simulation experiments, analyzed and compared. The result shows that: this strategy has obvious advantages, it can faster and more secure the identity authentication.
Adopting Misclassification Detection and Outlier Modification to Fault Correction in Deep Learning-Based Systems

Over the past few decades, researchers in software engineering (SE) have focused on testing, analyzing, repairing, and generating programs automatically and effectively. Today, combining neural networks and traditional software engineering techniques has major potential to benefit software quality and productivity. Regarding the development of neural networks, deep learning (DL) and convolution neural networks (CNNs) have been widely adopted by software applications for making decisions or providing suggestions. Considering life-critical DL-based applications, there is a need to correct the wrong decisions made by DL systems immediately. Therefore, we propose a novel fault-correction framework for alleviating potential misclassification issues of DL systems called the Outlier Modification for DL Systems (OMDLS). Our experiment results with two public datasets using different scales and label numbers to show that modifying the outliers based on the misclassification pairs can improve accuracy by up to 2.12% without retraining the model and modifying the inference immediately.