International Journal of Digital Crime and Forensics

The key network node identification technology plays an important role in comprehending unknown terrains and rapid action planning in network attack and defense confrontation. The conventional key node identification algorithm only takes one type of relationship into consideration; therefore, it is incapable of representing the characteristics of multiple relationships between nodes. Additionally, it typically disregards the periodic change law of network node vulnerability over time. In order to solve the above problems, this paper proposes a network key node identification method based on the vulnerability life cycle and the significance of the network topology. Based on the CVSS score, this paper proposes the calculation method of the vulnerability life cycle risk value, and identifies the key nodes of the network based on the importance of the network topology. Finally, it demonstrates the effectiveness of the method in the selection of key nodes through network instance analysis.

Yuwen Zhu

Lei Yu

Key Node Identification Based on Vulnerability Life Cycle and the Importance of Network Topology

基于脆弱性生命周期和网络拓扑重要性的关键节点识别

Traditional software defenses take corresponding actions after the attacks are discovered. The defenders in this situation are comparatively passive because the attackers may try many different ways to find vulnerability and bugs but the software remains static. This leads to the imbalance between offense and defense. Software diversity alleviates the current threats by implementing a heterogeneous software system. The N-Variant eXecution (NVX) systems, effective and applicable runtime diversifying methods, apply multiple variants to imporove software security. Higher diversity can lead to less vulnerabilities that attacks can exploit. However, runtime diversifying methods such as address randomization and reverse stack can only provide limited diversity to the system. Thus, we enhance the diversity of variants with a compiler-assisted approach. We use a Deep Reinforcement Learning-based algorithm to generate variants, ensuring the high diversity of the system. For different numbers of variants, we show the results of the Deep Q Network algorithm under different parameter settings.

Junchao Wang

Jin Wei

Jianmin Pang

Fan Zhang

Shunbin Li

Security Enhancement Through Compiler-Assisted Software Diversity With Deep Reinforcement Learning

通过深度强化学习实现编译器辅助的软件多样性增强安全性

The Industrial Control System (ICS) has become the key concept in the modern industrial world, enabling process monitoring and system control for general industrial systems and critical infrastructures. High-skilled hackers can invade an imperfect ICS by existing vulnerabilities without much effort. Conventional defenses (such as encryption and firewall) to keep invaders away are getting less and less effective when an attack is carried out by exploiting an array of particular vulnerabilities. Under this circumstance, a new-type intrusion detection system (IDS) based on deception strategy using honeypot technique is proposed, which is of dramatic effectiveness in protecting ICSs of critical infrastructures. In this honeypot-based model, we capture malicious Internet flows and system operations. We analyze the collected data before alerting and preventing the intrusion alike when it affects the system in the future. This paper deals with the model's concept, architecture, deployment, and what else can be achieved in the field of Critical Infrastructure Cybersecurity (CIC).

Shaobo Zhang

Yuhang Liu

Dequan Yang

A Novel IDS Securing Industrial Control System of Critical Infrastructure Using Deception Technology

一种利用欺骗技术保护关键基础设施工业控制系统的新型入侵检测系统

This paper proposes an audio tampering detection method based on the ENF phase and BI-LSTM network from the perspective of temporal feature representation learning. First, the ENF phase is obtained by discrete Fourier transform of ENF component in audio. Second, the ENF phase is divided into frames to obtain ENF phase sequence characterization, and each frame is represented as the change information of the ENF phase in a period. Then, the BI-LSTM neural network is used to train and output the state of each time step, and the difference information between real audio and tampered audio is obtained. Finally, these differences were fitted and dimensionally reduced by the fully connected network and classified by the Softmax classifier. Experimental results show that the performance of this method is better than the state-of-the-art approaches.

Chunyan Zeng

Yao Yang

Zhifeng Wang

Shuai Kong

Shixiong Feng

Audio Tampering Forensics Based on Representation Learning of ENF Phase Sequence

基于ENF相位序列表示学习的音频篡改取证

In the information age, hackers will use Web vulnerabilities to infiltrate websites, resulting in many security incidents. To solve this problem, security-conscious enterprises or individuals will conduct penetration tests on websites to test and analyze the security of websites, but penetration tests often take a lot of time. Therefore, based on the traditional Web vulnerability scanner, the Web vulnerability detection analyzer designed in this article uses vulnerability detection technologies such as sub-domain scanning, application fingerprint recognition, and web crawling to penetrate the website. The vulnerability scanning process of the website using log records and HTML output helps users discover the vulnerability information of the website in a short time, patch the website in time. It can reduce the security risks caused by website vulnerabilities.

Dawei Xu

Tianxin Chen

Zhonghua Tan

Fudong Wu

Jiaqi Gao

Yunfan Yang

Web Vulnerability Detection Analyzer Based on Python

基于Python的Web漏洞检测分析器

The traditional laboratory anomaly detection methods mainly focus on the hidden dangers caused by chemical leaks and other items, ignoring the impact of abnormal behaviors such as incorrect operations and improper behavior on safety in the laboratory. This paper proposes a laboratory abnormal behavior detection method based on multimodal information fusion. The method generates a dense optical flow field of RGB image sequences based on optical flow theory and global smoothing constraints, and mines motion mode information. Meanwhile, the contour modal information of behavior is captured through convolution and adjacency matrix operations. Using decision level and proximity functions to integrate student behavior motion mode information and contour mode information, and using the maximum value as the behavior detection result. The experimental results show that the method can effectively detect abnormal behavior in the laboratory environment, with small detection errors and a specificity close to 1.00, effectively ensuring the safety of the laboratory environment.

Dawei Zhang

Laboratory Abnormal Behavior Detection Based on Multimodal Information Fusion

基于多模态信息融合的实验室异常行为检测

In vechcular networks, a promising approach to enhance vehicle task processing capabilities involves using a combination of roadside base stations or vehicles, there are two challenges when integrating the two offloading modeth: 1) the high mobility of vehicles can easily lead to connectivity interruptions between nodes, which in turn affects the processing of the tasks that are being offloaded; and 2) vehicles on the road are not completely trustworthy, and vehicle tasks that contain private information may suffer from result errors or privacy leakage and other problems. This paper investigates the computing offloading problem for minimizing task completion delay in vehicular networks. Specifically, we design a trust model for mobile in-vehicle networks and construct a migration decision problem to minimize the overall delay of task execution for all vehicle users. The simulation results show that the scheme proposed in this paper can effectively reduce the execution delay of the task compared to the baseline scheme.

Xiao Han

Huiqiang Wang

Guoliang Yang

Chengbo Wang

Efficient Task Offloading for Mobile Edge Computing in Vehicular Networks

车载网络中移动边缘计算的高效任务卸载

Mobile phones and computers are widely used devices these days, with almost everyone carrying a smartphone and multiple personal computing devices at their homes. Unfortunately, the perpetrator exploits these devices for their unlawful activities. They employ various tactics such as sending phishing emails, and malicious links to harvest confidential information and exploit users. The perpetrators often leave traces on search engines, where they search for illegal materials and weapons, or send threatening emails to victims. This paper primarily focuses on locating and retrieving browsers' artifacts while considering the challenges posed by private browsing modes, which perpetrator may use to cover their tracks. The study also compares well-known search engines like Edge, Safari, and Firefox, analyzing the strengths and weaknesses of their directories. Moreover, it explores evidence extraction from smartphones, comparing the success rates between rooted or jailbroken phones and evidence obtained from browsers versus applications.

Emad Ul Haq Qazi

Tanveer Zia

Areej Muqbil Alotibi

Salem Yahya Altaleedi

Examining the Behavior of Web Browsers Using Popular Forensic Tools

使用流行取证工具研究网络浏览器的行为

Aiming at the problem that dangerous operation behaviors in the laboratory is difficult to identify by monitoring the video. An algorithm of dangerous operation behavior detection in multi-task laboratory based on improved YOLOv5 structure is proposed. Firstly, the algorithm enhances, adaptively scales, and adaptively anchors box computing on the input of YOLO network. Then convolution operation is carried out to strengthen the ability of network feature fusion. Finally, the GIoU_Loss function is used at the output to optimize the network parameters and accelerate the convergence of the model. The experimental results show that the algorithm performs well in real-time head localization, head segmentation, and population regression, with significant innovation and superiority. Compared with traditional methods, this algorithm has better accuracy and real-time performance and can more effectively achieve human operation behaviors detection in laboratory application environments.

Laboratory Dangerous Operation Behavior Detection System Based on Deep Learning Algorithm

基于深度学习算法的实验室危险操作行为检测系统

To improve the security and privacy of audio data stored in third party servers, a novel watermarking scheme is proposed. Firstly, the authors split the host signal into frames and scramble each frame to get the encrypted signal. Secondly, they generate watermark bits by using the frame number and embed them into each frame of the encrypted signal, which is the data that will be uploaded to the third party servers. For the users, they can download the encrypted data and verify the data is intact or not. If the data is intact, the users decrypt the data to get the audio signal. If the audio signal is attacked in the process of transmission, they can also locate the location of the attacked frame. The experimental results show that the method proposed is effective not only for encrypted signals, but also for the encrypted signals after decryption.

Abbreviation	Int. J. Digit. Crime Forensics
Journal Impact	0.72
Quartiles(Global)	COMPUTER SCIENCE, INTERDISCIPLINARY APPLICATIONS(Q4)

ISSN	1941-6210, 1941-6229
h-index	18

Publication Information	Publisher: IGI Global Publishing，Publishing cycle: ，Journal Type: journal，Open Access Journals: No
Basic data	Year of publication: 2009，Proportion of original research papers: 100.00%，Self Citation Rate:0.00%， Gold OA Rate: 97.33%

International Journal of Digital Crime and Forensics

Journal Citation Format

A journal article with 1 author

A journal article with 2 authors

A journal article with 3 authors

A journal article with 5 or more authors

Books Citation Format

Thesis Citation Format

Web sites Citation Format

Patent Citation Format

Staying up late manually editing references? ivySCI automatically matches journals and helps you generate references with a single click.

Share Submission Experience