Loading...

Table of Content

    10 July 2025, Volume 25 Issue 7 Previous Issue    Next Issue

    For Selected: Toggle Thumbnails
    Research on Large Model Analysis Methods for Kernel Race Vulnerabilities in Cloud-Edge-Device Scenarios
    CHEN Ping, LUO Mingyu
    2025, 25 (7):  1007-1020.  doi: 10.3969/j.issn.1671-1122.2025.07.001
    Abstract ( 229 )   HTML ( 44 )   PDF (16674KB) ( 81 )  

    With the widespread application of cloud-edge-device scenarios, kernel race condition detection in operating systems faces new challenges, and its complexity is increasing. To address this issue, this paper proposed a kernel race condition analysis method called LogFuzz based on large language model. This method achieved dynamic learning and precise analysis of system call dependencies through a knowledge injection mechanism, effectively alleviating the difficulties in kernel vulnerability analysis in cloud-edge-device environments. The research first utilized crash logs for system call pattern extraction and analysis, addressing the limitations of traditional methods in modeling complex dependencies. On this basis, domain knowledge from large language models was introduced, and system call semantics and syntactic features are deeply mined through a parameter-efficient fine-tuning framework to guide fuzz testing. Experimental results show that the proposed method, in Linux kernel testing, improved branch coverage by 3.31% compared to traditional methods after 18 hours and successfully triggered 7 system crashes. The method proposed in this paper provides a new technical path for kernel race condition detection in cloud-edge-device scenarios and is of great significance for enhancing system security.

    Figures and Tables | References | Related Articles | Metrics
    An FPGA-Based Heterogeneous Acceleration System for SM4 Algorithm
    ZHANG Quanxin, LI Ke, SHAO Yujie, TAN Yu’an
    2025, 25 (7):  1021-1031.  doi: 10.3969/j.issn.1671-1122.2025.07.002
    Abstract ( 187 )   HTML ( 22 )   PDF (12803KB) ( 61 )  

    The national cryptographic SM4 algorithm is widely used in the WAPI wireless network standard. Currently, the SM4 encryption-decryption research mainly focuses on the optimization of the hardware implementation structure to improve throughput and security. Meanwhile, the development of big data and 5G communication technology has raised higher requirements for the bandwidth and real-time performance of data encryption. Based on the background, this paper proposed an FPGA-based heterogeneous acceleration system for SM4 algorithm, which used hardware to implement the SM4 algorithm and optimize encryption performance. The system adopted a streaming high-speed data transmission architecture, supported multiple SM4 cores to work in parallel, and fully utilized the computer bandwidth. The system was designed with configurable interfaces to connect SM4 with the transmission architecture and provided sufficient flexibility. The system was implemented on Xilinx XCVU9P FPGA and supported changing the load and mode of SM4 anytime. Through experiments, the maximum operating frequency of SM4 is 462MHz, the system throughput is as high as 92Gbit/s, and the delay is only 266μs. The results show that compared with other existing works, this system can achieve higher SM4 operating frequency and system throughput, which meets the high bandwidth and low latency requirements of SM4 acceleration.

    Figures and Tables | References | Related Articles | Metrics
    Research on Simple and Low Interaction Authentication Protocols for IoT Devices
    WANG Mei, YANG Xiaoran, LI Zengpeng
    2025, 25 (7):  1032-1043.  doi: 10.3969/j.issn.1671-1122.2025.07.003
    Abstract ( 138 )   HTML ( 20 )   PDF (12762KB) ( 41 )  

    In the context of the maturity and widespread application of Internet of Things (IoT) technology, this paper designed and implemented a simple, low-interaction IoT device interconnection authentication protocol to address the issues of authentication and encrypted communication efficiency and security among IoT devices. The design of this protocol included a device trust binding process and a device key negotiation process. The trust binding process involved the exchange of identity identification public keys authenticated by a cloud server to verify the identity of the communication counterpart and ensure the secure storage of identity identification public keys. To ensure security, the authentication process employed symmetric encryption to transmit both parties’ identity identification public keys, with the key determined by a oblivious pseudorandom function. The key negotiation process was based on the HMQV (Hashed Menezes-Qu-Vanstone) protocol, which was used to negotiate a session key for secure communication. Compared to the Huawei device interconnection authentication protocol, the proposed protocol reduces the number of interactions, and experimental results demonstrate that it has lower computational and communication overhead, resulting in higher efficiency.

    Figures and Tables | References | Related Articles | Metrics
    Analysis Method of Inter-Domain Routing Propagation Characteristics Based on Routing Temporal Betweenness
    LIU Yujing, WANG Zhilin, LI Pengfei, WANG Chengxiao
    2025, 25 (7):  1044-1052.  doi: 10.3969/j.issn.1671-1122.2025.07.004
    Abstract ( 156 )   HTML ( 9 )   PDF (10503KB) ( 25 )  

    The security and reliability of the inter-domain routing system of the Internet are of great significance for cybersecurity. Understanding the propagation patterns of inter-domain routing is crucial for detecting abnormal network routing events and enhancing routing security measures. The article proposed an analysis method of inter-domain routing propagation characteristics based on routing temporal betweenness. By defining the routing time betweenness centrality of autonomous systems, the proportion of time autonomous system forwards specific data traffic was characterized, thus comprehensively reflecting the propagation process and state characteristics of routing messages in the network. From a temporal perspective, this method could establish a normal baseline for inter domain routing systems. From a spatial perspective, this method could identify key autonomous system information related to the target network. Based on the massive inter domain routing data and topology data publicly available on the Internet, routing propagation characteristics were studied for the KlaySwap prefix hijacking event, the prefix ownership change event and the Angola Cables routing leak event, providing a powerful support for anomaly detection of prefix hijacking and route leakage.

    Figures and Tables | References | Related Articles | Metrics
    Firmware Simulation Scheme of IoT Devices Based on Dynamic Substitution of Library Functions
    ZHANG Guanghua, CHANG Jiyou, CHEN Fang, MAO Bomin, WANG He, ZHANG Jianyan
    2025, 25 (7):  1053-1062.  doi: 10.3969/j.issn.1671-1122.2025.07.005
    Abstract ( 154 )   HTML ( 10 )   PDF (11655KB) ( 25 )  

    The limited resources of IoT devices make it difficult for traditional vulnerability detection technologies to be effectively applied to these devices. Firmware simulation technology provides a way to solve this problem, but the existing firmware simulation solutions have problems such as strong hardware dependence, high operating costs, and poor portability. In view of the shortcomings of existing simulation solutions, this paper proposed a firmware simulation scheme of IoT devices based on dynamic substitution of library functions. Firstly, a firmware simulation method based on human-computer collaboration was designed. The simulation environment was built through firmware analysis and firmware hosting, and expert experience in the process of firmware file acquisition was introduced. Then, a library function replacement technology based on symbolic execution was designed to extract key information from the previous stage, symbolic execution was used to analyze and guide library function generation, and finally compiled the library function into a dynamic link library to complete the library function replacement. The experimental results show that the simulation speed of the proposed scheme in the article has increased by an average of 80.50% compared to FIRMADYNE, and the optimized symbol execution speed has increased by more than 100% compared to before optimization. At the same time, through vulnerability replication and vulnerability mining verification, the simulation fidelity of this scheme can meet the requirements of vulnerability detection and mining.

    Figures and Tables | References | Related Articles | Metrics
    A Multidimensional Cyber Range Attribute Characterization Model and Similarity Algorithm Based on ATT&CK
    YANG Wang, MA Mingyu, BIAN Junjing
    2025, 25 (7):  1063-1073.  doi: 10.3969/j.issn.1671-1122.2025.07.006
    Abstract ( 171 )   HTML ( 33 )   PDF (12473KB) ( 55 )  

    Cyber ranges play a crucial role in cybersecurity talent training, intrusion detection, and vulnerability identification. Existing cyber range construction methods suffer from inefficient parameter modeling and high manual involvement, failing to meet growing cybersecurity demands. To enhance construction efficiency, researchers have proposed improvements and new solutions, yet challenges like lacking systematic modeling methods remain. This paper presented a multidimensional cyber range attribute characterization model and similarity algorithm based on ATT&CK. The study first extended the ATT&CK framework to develop the multidimensional model, then designed a security attribute matrix and similarity representation method for systematic modeling. Simulation results demonstrate the approach significantly improved construction efficiency while reducing manual effort.

    Figures and Tables | References | Related Articles | Metrics
    A Randomness Enhanced Bi-Level Optimization Defense Method against Data Poisoning Backdoor Attacks
    YAN Yukun, TANG Peng, CHEN Rui, DU Ruochen, HAN Qilong
    2025, 25 (7):  1074-1091.  doi: 10.3969/j.issn.1671-1122.2025.07.007
    Abstract ( 151 )   HTML ( 12 )   PDF (22409KB) ( 22 )  

    Data poisoning backdoor attacks have revealed vulnerabilities in the security of deep neural networks, posing serious threats to their reliability in real-world applications. Although numerous defense strategies have been proposed, their practical deployment still faces two key challenges: 1) heavy reliance on prior knowledge of attacker behavior or training data characteristics, which limits the generalizability of these methods; and 2) difficulty in balancing model performance and defense effectiveness. To address these challenges, this paper proposed RADAR, a randomness enhanced bi-level optimization defense framework tailored for data poisoning backdoor attacks. Centered on data identification, RADAR organically integrated robust training and sample selection mechanisms. It enabled dynamic identification between clean and suspicious poisoned samples during training without requiring any prior knowledge, and subsequently fine-tuned the model on a trusted subset to obtain a backdoor-resilient model. Specifically, RADAR combined noise-augmented self-supervised pretraining with differentially private, parameter-adaptive fine-tuning. This allowed the model to identify poisoned samples as global outliers even in extreme scenarios where they dominated the target class, thereby ensuring accurate clean sample selection. In addition, RADAR introduced a random smoothing-based disentangled training strategy for clean features under limited clean data conditions, effectively reducing the false positive rate in suspicious poisoned sample identification. Extensive experiments across diversed data poisoning backdoor attacks demonstrate that RADAR not only maintains strong classification performance on clean data but also exhibits outstanding defensive capabilities, consistently suppressing attack success rates to below 7%. These results highlight the security and practical applicability of RADAR.

    Figures and Tables | References | Related Articles | Metrics
    General Construction and Instantiation for Query Request Bandwidth Optimization in Homomorphic Encryption-Based PIR
    TIAN Haibo, LI Yitong, DU Yusong
    2025, 25 (7):  1092-1102.  doi: 10.3969/j.issn.1671-1122.2025.07.008
    Abstract ( 108 )   HTML ( 12 )   PDF (11911KB) ( 23 )  

    Homomorphic encryption-based Private Information Retrieval allows users to retrieve data from a database without revealing the query index by leveraging homomorphic encryption technology, and it has always attracted significant attention in the academic community. To address the issue of large query request bandwidth in homomorphic encryption-based PIR schemes for high-throughput on the server side, this paper designed a Regev homomorphic encryption-based randomized homomorphic stream cipher algorithm within the framework of Randomized Homomorphic Stream Cipher. This paper proposed a general construction for optimizing query request bandwidth in homomorphic encryption-based PIR. Furthermore, this paper presented and implemented a concrete instantiation based on the SimplePIR protocol. The correctness and security of this instantiation were thoroughly analyzed. Experimental evaluations were conducted to measure the actual throughput and query request bandwidth under various database sizes. The experimental results demonstrate that for a 64 MB database, the instantiation achieves a 36.6% reduction in query request bandwidth.

    Figures and Tables | References | Related Articles | Metrics
    Design and Implementation of Automatic Assessment System for Cryptographic Criteria of S-Box
    LENG Yongqing, AO Tianyong, QIU Xin, CUI Xingli, LI Shaoshi
    2025, 25 (7):  1103-1110.  doi: 10.3969/j.issn.1671-1122.2025.07.009
    Abstract ( 130 )   HTML ( 16 )   PDF (8666KB) ( 17 )  

    To address the lack of convenient assessment tools for computing cryptographic criteria of S-boxes that are key components of block ciphers, many calculation methods of cryptographic criteria of S-box and fast calculation algorithms were given in this paper, and a fast algorithm for obtaining the algebraic normal form of an S-box component Boolean function was proposed. Based on these methods, an assessment software for computing rapidly cryptographic criteria of S-box was designed with MFC/C++ programming. The software can automatically calculate many cryptographic criteria of S-box such as the nonlinearity, linear approximation advantage, differential uniformity, algebraic degree, algebraic term distribution, avalanche characteristics, diffusion characteristics, number of fixed points. The software has the advantages of simple operation, comprehensive assessment. The software can effectively reduce researchers’ workload for assessing S-boxes.

    Figures and Tables | References | Related Articles | Metrics
    Research on New Composable Authenticated Distributed Data Structure Model
    GAO Yang, ZHANG Qi, WANG Chen, XU Jian
    2025, 25 (7):  1111-1125.  doi: 10.3969/j.issn.1671-1122.2025.07.010
    Abstract ( 107 )   HTML ( 11 )   PDF (16036KB) ( 16 )  

    The Authenticated Distributed Data Structures Model (ADDSM) is proposed as an extension of the Authenticated Data Structures (ADS) model to address issues such as the ADS model’s lack of composability and its inability to support complex data combination operations. However, previous approaches suffer from incomplete theoretical descriptions, a lack of data persistence solutions, and an absence of confidentiality protection. To address this challenge, this paper proposed a new composable authenticated distributed data structure model (NC-ADDSM). Firstly, this paper provided a complete theoretical description of the model, including its formal definition, property descriptions, and security definitions. Secondly, this paper designed algorithms for initialization, data insertion, data query, data verification, and data persistence to build the NC-ADDSM. Finally, this paper proposed communication protocols that supported data update and query verification, ensuring that only entities possessing the decryption key can access plaintext data. Theoretical analysis and experimental results show that the proposed model maintains security while exhibiting high execution efficiency.

    Figures and Tables | References | Related Articles | Metrics
    A Multi-Indicator Search Method for RSBF Based on the Matrix nA and the Matrix nB Associated with Walsh Spectral and Truth Table
    ZHAO Haixia, LIU Dexiong
    2025, 25 (7):  1126-1137.  doi: 10.3969/j.issn.1671-1122.2025.07.011
    Abstract ( 96 )   HTML ( 11 )   PDF (12807KB) ( 14 )  

    Rotational Symmetric Boolean Function(RSBF) possess the advantages of simple structure, fast operation speed and high resource utilization. Using RSBF that take into account multiple security indicators as the nonlinear component of the symmetric cryptographic algorithm, which can effectively guarantee the efficiency and security of the algorithm. The search algorithm based on two importance matrices ${}_{n}\text{A}$ and ${}_{n}B$ was an important way to obtain RSBF, which had the advantages of fast realization and setting target values. This paper designed a search method based on two importance matrices to obtain RSBF that effectively considers five security indicators, including resiliency order $m$, nonlinearity $nl$, algebraic degree $d$, absolute value indicator ${{\Delta }_{f}}$, and sum of squares indicator ${{\sigma }_{f}}$. By using this search method, the 9-variable RSBF of $\left( m,nl,d,{{\Delta }_{f}},{{\sigma }_{f}} \right)=\left( 4,224,4,192,{{2}^{21}} \right)$ and the 8-variable RSBF of $\left( m,nl,d,{{\Delta }_{f}},{{\sigma }_{f}} \right)=\left( 2,112,5,32,{{2}^{17.3}} \right)$, as well as 4, 5, 6 and 7-variable RSBF with excellent comprehensive security indicators were obtained. The results demonstrate that the proposed search method can obtain RSBF with multiple security indicators reaching the ideal bound under the condition that various security indicators mutually restrict each other.

    Figures and Tables | References | Related Articles | Metrics
    Review of Security Protection Technologies for Multi-Agent Systems
    WANG Zhengyang, LIU Xiaolu, SHEN Zhuowei, WEI Mengli
    2025, 25 (7):  1138-1152.  doi: 10.3969/j.issn.1671-1122.2025.07.012
    Abstract ( 304 )   HTML ( 31 )   PDF (19353KB) ( 88 )  

    This study focused on security protection technologies for multi-agent systems, conducting a comprehensive and in-depth exploration from the perspective of threats faced by the system. Firstly, based on the six major characteristics of multi-agent systems,including openness, heterogeneity, autonomy, collaboration, dynamic adaptability, and emergence, the intrinsic security risks were discussed. The security risks were categorized from three dimensions: attack targets, attack methods, and attacker attributes, with relevant attack methods provided. Secondly, A summary of threat identification methods was given, highlighting the limitations of threat modeling approaches. In terms of security defense technologies, challenges and research progress in areas such as encryption and authentication, intrusion detection and response, reputation management, fault tolerance design, and security policies and audits were reviewed. Thirdly, The potential cross-domain attack threats caused by large models directly invoking agents were explored, analyzing the damage that visual and audio attack methods could cause when exploited by large models, and proposing possible defensive measures from the perspective of disrupting the attack chain. Finally, The evolution direction of security architecture was elaborated, introducing elastic security architecture and its internal working logic. Finally, the current research status was summarized, and suggestions for future research are provided from theoretical, technological, and interdisciplinary innovation perspectives.

    Figures and Tables | References | Related Articles | Metrics
    A Progressive Focusing-Based Scheme for Low-Quality Fingerprint Pose Estimation
    ZHANG Xuefeng, MIAO Kai
    2025, 25 (7):  1153-1162.  doi: 10.3969/j.issn.1671-1122.2025.07.013
    Abstract ( 131 )   HTML ( 10 )   PDF (9283KB) ( 14 )  

    To address the low accuracy issue of fingerprint pose estimation algorithms in processing low-quality and distorted fingerprints, this paper proposed an ABSF-based progressive focusing scheme. The workflow included: preprocessing raw fingerprint images to obtain texture images; generating enhanced fingerprint images through image enhancement; estimating reference point regions from enhanced images; evaluating positioning accuracy using quality criteria-performing ridge quality enhancement for unqualified cases, or executing final pose estimation for qualified cases. Experimental validation on FVC, NIST SD27 and DF benchmark databases demonstrates superior estimation precision and recognition accuracy compared to existing methods.

    Figures and Tables | References | Related Articles | Metrics
    Research on Semantic Intelligent Recognition Algorithms for Meteorological Data Based on Large Language Models
    FENG Wei, XIAO Wenming, TIAN Zheng, LIANG Zhongjun, JIANG Bin
    2025, 25 (7):  1163-1171.  doi: 10.3969/j.issn.1671-1122.2025.07.014
    Abstract ( 195 )   HTML ( 21 )   PDF (10781KB) ( 52 )  

    Meteorological data, as a typical spatiotemporal big data, faces severe data security challenges while empowering economic and social development. Addressing current issues in meteorological data security monitoring, such as insufficient semantic understanding, low accuracy in data feature recognition, and poor generalization capability, this study proposed an intelligent semantic recognition framework for meteorological data based on large language models. By constructing high-quality training datasets and domain knowledge bases, integrating Retrieval-Augmented Generation (RAG) with LoRA lightweight model technology, applying Chain-of-Thought (CoT) fine-tuning, and selecting PPO as the reinforcement learning algorithms to continuously optimize the recognition performance of the meteorological data security model. Experimental results demonstrate that this method effectively improves the accuracy of meteorological data feature recognition.

    Figures and Tables | References | Related Articles | Metrics