Guangzhou University

Binxing Fang

Shuo Zhang

Qingyuan Li

Yaping Liu

Zhihong Tian

Zhe Li

Mohan Li

Qianqing Zhang

Deshun Zeng

Xiaobo Wu

Yifei Zhou

Weihon Han

Yu Jiang

Zhaoquan Gu

Shudong Li

Lihua Yin

Peng Sun

Sufang Peng

Yanbin Sun

An APT organization identification method, system and storage medium based on a stacking ensemble are provided, the method comprising: using a TF-IDF algorithm combined with an n-gram to extract and vectorize behavior features from malware samples to form a malicious behavior vector feature set; based on the malicious behavior vector feature set, calculating correlations between features and chi-square values between the features and categories, performing screening twice on the malicious behavior vector feature set to obtain an improved low-dimensional feature subset data; constructing a multi-model fusion stacking ensemble, learning an APT organization identification model, using the APT organization identification model to perform an identification on new ATP attacks. The feature selection of high-dimensional behavior vector features reduces the complexity of the data set; the imbalance of samples in the data set is also considered, and multi-model integrated training to improve the recognition accuracy is adopted; in addition, the APT organization identification model for malicious samples is obtained through machine learning training, which improves the automatic identification efficiency of new sample is improved.

Stacking-ensemble-based APT organization identification method and system, and storage medium

The present disclosure relates to the technical field of Internet, in particular to a method for measuring network international outlet interfaces of a designated area. The method includes the following steps: acquiring a designated collection of routing interface paths and area location information of IP addresses of routing interface nodes; dividing the collected routing interface paths into critical hop complete paths and critical hop missing paths; determining whether a routing interface path is a critical hop complete path; using a 2-tuple to identify network international outlet interfaces of the routing interface path; and counting the quantity of the network international outlet interfaces of the measured area.

Method for measuring network international outlet interfaces of designated area

A method for certificate transaction validation of a blockchain-based resource public key infrastructure aims to avoid security threats caused by conflicts or illegal transactions during transactions and improve security. A technical solution is as follows: constructing a resource public key infrastructure RPKIB system composed of a resource issuer, a resource transaction application client, a resource receiver, a blockchain network and a validation node; designing operations of a resource certificate and route origin authorization ROA as transactions, submitting operations of various resource transactions initiated by a resource issuer as transactions to the blockchain network, running, by the validation node, a smart contract to verify the transactions, and distinguishing whether the operations are malicious behaviors or normal operations of an authority.

Method for certificate transaction validation of blockchain-based resource public key infrastructure

The disclosure discloses a method for bidirectional authorization of a blockchain-based resource public key infrastructure, aiming at solving security threat problems that a legal BGP route is illegal and a legal IP address is blocked caused by malicious operations. A technical solution is as follows: constructing a blockchain-based resource public key infrastructure system RPKIB composed of a resource issuer, a resource transaction application client, a resource receiver and a blockchain network; changing any operation of issuing, revoking, overwriting and modifying of a resource certificate by the resource issuer into a bidirectional authorization mode, and implementing the operation of the resource certificate only when the issuer and the receiver both agree; and carrying out, by the issuer, operations of a resource certificate RC and route origin authorization ROA as transactions that are carried out through the blockchain network, and distinguishing whether the operations are malicious behaviors or normal operations.

Method for bidirectional authorization of blockchain-based resource public key infrastructure

The disclosure disclosures a blockchain-based verifiable inter-domain routing validation method, which includes: constructing a blockchain-based verifiable inter-domain routing system consisting of a verifiable inter-domain routing and a routing behavior validation subsystem; constructing, by a sender router R1, a routing behavior validation terminal of an autonomous domain to which the R1 belongs, and the routing validation blockchain system, a routing evidence and a routing evidence validation proposal, validating and endorsing the proposal, determining whether the proposal satisfies an endorsement policy, generating a routing evidence transaction, conducting consensus ordering on the transaction and updating a routing validation blockchain; and constructing, by a receiver router T, a routing behavior validation terminal of an autonomous domain to which the T belongs, and the routing validation blockchain system, a routing request validation message and retrieving whether a routing evidence corresponding to the routing request exists.

Blockchain-based verifiable inter-domain routing validation method

Growing community of inventors

Guangzhou, China

Binxing Fang