This study presents an analytical model for rule-based network security middleboxes as those of network firewalls, intrusion detection systems and email spam filters. In these systems, incoming packets carrying requests arrive at the middlebox and obtain queued for processing in multiple stages. The stages consist of first a main stage for packet processing and then subsequent stages of rulebase interrogation in which rules or conditions are checked sequentially until a match is triggered. The service at these stages is characterised to be mutually exclusive; that is, only one stage is active at any time. The authors derive useful formulas that can predict the middlebox performance, taking into account its incoming request rate, the queue size and the processing capacity of the middlebox, and thereby proper engineering capacity of the middlebox can be achieved.

With over 50 billion downloads and more than 1.3 million apps in Google's official market, Android has continued to gain popularity among smartphone users worldwide. At the same time there has been a rise in malware targeting the platform, with more recent strains employing highly sophisticated detection avoidance techniques. As traditional signature-based methods become less potent in detecting unknown malware, alternatives are needed for timely zero-day discovery. Thus, this study proposes an approach that utilises ensemble learning for Android malware detection. It combines advantages of static analysis with the efficiency and performance of ensemble machine learning to improve Android malware detection accuracy. The machine learning models are built using a large repository of malware samples and benign apps from a leading antivirus vendor. Experimental results and analysis presented shows that the proposed method which uses a large feature space to leverage the power of ensemble learning is capable of 97.3–99% detection accuracy with very low false positive rates.

Hummingbird-2, designed by Engels et al., is a lightweight cipher with built-in MAC functionality. In this study, the authors examine the security of Hummingbird-2 in the related-key model. First, the authors define a new cryptographic notion of an S-box, called combination points, based on its differential equation, and demonstrate some properties of combination points. A potential application of the new notion is to recover some partial input of an S-box, and the authors show this on Hummingbird-2 by recovering some internal state bits. Then, by carefully studying the differential distributions of the S-boxes, a set of key dependent S-boxes can be derived and be used to recover the subkey word of Hummingbird-2. At last, by the divide and conquer strategy, all the 128 key bits can be recovered with a complexity of 2⁴⁰, which is much lower than that (2⁶⁴) of the attack at FSE 2013. The attack has been fully implemented on a PC and the secret key has been recovered in a few hours. The results provide some new insights into the design of cryptographic S-boxes.

In August 2012, the Streebog hash function was selected as the new Russian cryptographic hash standard (GOST R 34.11-2012). In this study, the authors investigate the new standard in the context of malicious hashing and present a practical collision for a malicious version of the full hash function. In particular, they apply the rebound attack to find three solutions for three different differential paths for four rounds. Then, using the freedom of the round constants they connect them to obtain a collision for the 12 rounds of the compression function. Additionally, and because of the simple processing of the counter, they bypass the barrier of the checksum finalisation step and transfer the compression function collision to the hash function output with no additional cost. The presented attack has a practical complexity and is verified by an example. Although the results of this study may not have a direct impact on the security of the current Streebog hash function, it presents an urge for the designers to publish the origin of the used parameters and the rational behind their choices in order for this function to gain enough confidence and widespread adoption by the security community.

The 802.16m mobile worldwide interoperability for microwave access (WiMAX) standard is the amendment to the 802.16e standard. It introduced high mobility features that enable mobile broadband services at vehicular speeds beyond 120 km/h. However, handover latency in mobile WiMAX may affect real-time application sessions such as VoIP at very high vehicle speed. This makes it imperative to develop fast and secure handover schemes for such very high-speed vehicles. One of the main factors that affect handover performance in 802.16m standard is the delay introduced by the authentication procedure when a mobile user moves between base stations (BSs). In this study, a recently proposed intra-access service network (ASN) handover authentication scheme with privacy preservation is extended to a fast symmetrical key inter-ASN handover authentication scheme that avoids the involvement of third party. The proposed scheme solves the pairwise master key backward and forward security problems and provides mutual authentication between the mobile station (MS) and the target BS during inter-ASN handover event. Finally, the proposed scheme provides MS anonymity and reduces the need to a high-quality tamper-proof device in the BS that was required in the previous scheme.

Researchers have previously looked into the problem of determining the connection between invasive events and network risk, and attack graph (AG) was proposed to seek countermeasures. However, AG has proved to have various limitations in practical applications. To overcome such defects, this study presents a risk flow attack graph (RFAG)-based risk assessment approach. In particular, this approach applies a RFAG to represent network and attack scenarios, which are then fed to a network flow model for computing risk flow. A bi-objective sorting algorithm is employed to automatically infer the priority of risk paths and assist risk assessment, and a fuzzy comprehensive evaluation is performed to determine risk severity. Via the aforementioned processes, the authors simplify AG and follow the risk path of originating, transferring, redistributing and converging to assess security risk. The authors use a synthetic network scenario to illustrate this approach and evaluate its performance through a set of simulations. Experiments show that the approach is capable of effectively identifying network security situations and assessing critical risk.

RIPEMD-128 is an ISO/IEC standard cryptographic hash function proposed in 1996 by Dobbertin, Bosselaers and Preneel. The compression function of RIPEMD-128 consists of two different and almost independent parallel lines denoted by line1 operation and line2 operation. The initial values and the output values of the last step of the two operations are combined, resulting in the final value of one iteration. In this study, the authors present collision differential characteristics for both 40-step line1 operation and 40-step line2 operation by choosing a proper message difference. By using message modification technique, they improve the probabilities of the differential characteristics so that they can give a collision attack on 40-step RIPEMD-128 hash function with a complexity of 2³⁵ computations. Meanwhile, they improve the distinguishing attack proposed by Landelle and Peyrin at EUROCRYPT 2013, and give a distinguisher on the full RIPEMD-128 hash function with a complexity of 2^90.4 by doing message modification.

Booming telemedicine applications makes it deemed necessary to provide security services for such applications. The algorithms proposed in this field can be grouped into three classes: watermarking-based algorithms, crypto-based algorithms and hybrid algorithms. In this study, the authors propose two crypto-based algorithms capable of providing confidentiality, authenticity and integrity services to medical images exchanged in telemedicine applications. Strong cryptographic functions with internally generated symmetric keys and hash codes are used. The advanced encryption standard-Galois counter mode is used with the whirlpool hash function to provide confidentiality and authenticity, and the elliptic curve digital signature algorithm is used to provide authenticity and integrity. The proposed algorithms are based on the digital imaging and communication in medicine (DICOM) standard; however, unlike the standard, the algorithms provide confidentiality, authenticity and integrity for the header data, as well as for the pixel data of the DICOM images. Effectiveness of the proposed algorithms is evaluated and demonstrated through extensive experimentation using a benchmark set of DICOM images.

Efficiently processing massive data is a big issue in high-speed network intrusion detection, as network traffic has become increasingly large and complex. In this work, instead of constructing a large number of features from massive network traffic, the authors aim to select the most important features and use them to detect intrusions in a fast and effective manner. The authors first employed several techniques, that is, information gain (IG), wrapper with Bayesian networks (BN) and Decision trees (C4.5), to select important subsets of features for network intrusion detection based on KDD'99 data. The authors then validate the feature selection schemes in a real network test bed to detect distributed denial-of-service attacks. The feature selection schemes are extensively evaluated based on the two data sets. The empirical results demonstrate that with only the most important 10 features selected from all the original 41 features, the attack detection accuracy almost remains the same or even becomes better based on both BN and C4.5 classifiers. Constructing fewer features can also improve the efficiency of network intrusion detection.

Partially blind signature is an important technique in secure electronic cash (e-cash) system. The first concrete certificateless partially blind signature (CLPBS) scheme for e-cash was constructed in 2011. Recently it was found that this construction had a security weakness and a rescued scheme was given. Unfortunately, the formal security proof was not given. In this study, the authors first give cryptanalysis of their rescued scheme. They demonstrate that a malicious user in their rescued scheme can forge a signature on any message by replacing the signer's public key. In an e-cash system, blind signatures issued by the bank are viewed as e-cash. Once they apply their scheme to an untraceable e-cash system, a malicious user can forge valid electronic coins (i.e. valid signatures) without being detected by the bank. It will result in loss of the bank. Then, they propose a newly improved CLPBS scheme which achieves the strongest security level and has higher computational efficiency than the rescued scheme published earlier. Finally, they give an example of potential application to e-cash systems using their scheme.