Detect HTTP Tunnels Using Support Vector Machines

Dengke He(하등과),DaeHun Nyang(양대헌),KyungHee Lee(이경희) 한국정보보호학회 2011 정보보호학회논문지 Vol.21 No.3

최근 모든 네트워크에서 사용자가 웹 페이지에 접근할 때 HTTP가 폭넓게 사용되기 때문에 HTTP 트래픽은 방화벽과 다른 게이트웨이 보안 장치를 통과할 때 보통 별도의 검사 절차 없이 로컬 보안 정책에 의해서 통과된다. 하지만 이러한 특성은 악의적인 사람에 의해 사용될 수 있다. HTTP 터널 응용 프로그램의 도움으로 악의적인 사람은 로컬보안 정책을 우회하기 위해 HTTP로 데이터를 전송할 수 있다. 따라서 보통의 HTTP 트래픽과 터널링된 HTTP 트래픽을 구별하는 것은 아주 중요하다. 우리는 터널링된 HTTP 트래픽을 검출하는 통계적인 방법을 제안한다. 우리가 제안하는 방법은 사이트 독립적이기 때문에 지역적 제약을 갖지 않는다. 우리가 제안한 방법은 한 번의 학습만으로도 다른 사이트에 적용될 수 있다. 게다가 우리의 방법은 높은 정확도로 터널링된 HTTP 트래픽을 검출할 수 있다. Hyper Text Transfer Protocol(HTTP) is widely used in nearly every network when people access web pages, therefore HTTP traffic is usually allowed by local security policies to pass though firewalls and other gateway security devices without examination. However this characteristic can be used by malicious people. With the help of HTTP tunnel applications, malicious people can transmit data within HTTP in order to circumvent local security policies. Thus it is quite important to distinguish between regular HTTP traffic and tunneled HTTP traffic. Our work of HTTP tunnel detection is based on Support Vector Machines. The experimental results show the high accuracy of HTTP tunnel detection. Moreover, being trained once, our work of HTTP tunnel detection can be applied to other places without training any more.

최근 제안된 두 그룹서명기법의 암호분석

하등과(DengKe Ha),김기태(KiTae Kim),양대헌(DaeHun Nyang),이경희(KyungHee Lee) 한국정보보호학회 2010 정보보호학회논문지 Vol.20 No.5

연결불가능성(unlinkability)과 추적불가능성(traceability)은 그룹서명이 만족해야 하는 기본적인 요구사항이다. 본 논문에서 최근 Lee등과 Zhu등에 의해서 제안된 두 그룹 서명기법들이 갖는 취약점을 분석하였다. Lee등의 기법은 합법적인 서명자가 생성한 서명을 검증할 수 없는 설계상의 치명적인 문제를 갖고 있으며, 검증과정이 안고 있는 문제와 별개로 동일한 서명자가 생성한 서명을 항상 링크할 수 있음을 보인다. 또, Zhu등의 그룹서명기법에서 그룹의 관리자가 추적할 수 없도록 서명을 생성하는 것이 가능함을 보이고, 저자들의 주장과 달리, 그들의 기법이 전방향 안전성을 만족하지 않음을 보인다. Unlinkability and traceability are basic security requirements of a group signature scheme. In this paper, we analyze two recent group signature schemes, Lee et al.'s scheme and Zhu et al.'s scheme. We show that Lee et al.’s scheme does not work correctly. Further, it fails to meet unlinkability, that is, anyone who intercepts or receives group signatures are able to check if they are from the same signer. We also show that Zhu et al.'s scheme is unable to satisfy traceability, that is, a malicious group member can generate valid group signatures that cannot be opened. Moreover, once becoming group member, the malicious group member will never be revoked from group. Besides, Zhu et al.'s scheme fails to satisfy forward security, a requirement claimed by authors.

Effects of monochromatic lights on the growth performance, carcass characteristics, eyeball development, oxidation resistance, and cecal bacteria of Pekin ducks

Hua, Dengke,Xue, Fuguang,Xin, Hairui,Zhao, Yiguang,Wang, Yue,Xiong, Benhai Asian Australasian Association of Animal Productio 2021 Animal Bioscience Vol.34 No.5

Objective: Light is a significant component of housing environment in commercial poultry industry. This study was conducted to investigate whether Pekin ducks perform better under monochromatic lights than under white light with respect to their growth performance, carcass quality, eyeball development, oxidation resistance, and cecal bacterial communities. Methods: A total of 320 one-day-old male Pekin ducklings were randomly distributed into five rooms with different light treatments, white, red, yellow, green, and blue light. Each room consisted of 4 replicated pens with 16 ducklings per pen. Results: Blue light significantly decreased fat deposition by decreasing abdominal fat. Long wavelength light, such as red, green, and yellow light, considerably increased the back-to-front eyeball diameter and the red light potentially enlarged the side-to-side eyeball diameter. Besides, the blue light had adverse effects on the oxidation resistance status in terms of increasing the product malonaldehyde of lipid oxidation and decreasing the plasma concentration of total superoxide dismutase. The phyla of Firmicutes had the greatest abundance in the green and blue treatments, while Bacteroidetes in blue treatment was the least. The genus of Faecalibacterium was significantly lower under the red light. Conclusion: The high risk of cecal health status and decreased anti-oxidation activity were observed under blue light. Red, yellow, and green light might increase the risk of oversized eyeball and cecal illness. Therefore, monochromatic lights compared to white light did not show advantages on the performance of housing ducks, it turns out that the white light is the best light condition for grow-out ducks.

Management Strategy Based on Genetic Algorithm Optimization for PHEV

Zhang Yu,Meng Dawei,Zhou Meilan,Lu Dengke 보안공학연구지원센터 2014 International Journal of Control and Automation Vol.7 No.11

Aiming at the refitted HAFEI hybrid electric vehicle (HEV), fuzzy logic energy management strategy is constructed based on genetic algorithm optimization. The difference value D between the total require torque Tr of path and the target required torque Te of engine, the intelligence quotient value with Tr is selected as the first input variable of fuzzy controller, the SOC of battery as the second input variable; torque control coefficient C is selected as output variable, meanwhile two input variable membership function is improved on genetic algorithm. To further evaluate the control strategy, dynamic programming control strategy is used as standard; the simulation experiments show that every kind of gas emission is obviously reduced by 12% to 47% in fuzzy control strategy B based on genetic algorithm optimization compared to strategy A based on determinacy rules. Compared to dynamic programming, fuel economy in strategy A is only 45.09% of standard value which is not ideal, the utilization of fuel is low and the gas emission is serious, while in strategy B fuel economy is 78.89% of standard value and effect is improved obviously.

Estimation and variable selection for partially functional linear models

Jiang Du,Dengke Xu,Ruiyuan Cao 한국통계학회 2018 Journal of the Korean Statistical Society Vol.47 No.4

In this paper, a new estimation procedure based on composite quantile regression and functional principal component analysis (PCA) method is proposed for the partially functional linear regression models (PFLRMs). The proposed estimation method can simultaneously estimate both the parametric regression coefficients and functional coefficient components without specification of the error distributions. The proposed estimation method is shown to be more efficient empirically for non-normal random error, especially for Cauchy error, and almost as efficient for normal random errors. Furthermore, based on the proposed estimation procedure, we use the penalized composite quantile regression method to study variable selection for parametric part in the PFLRMs. Under certain regularity conditions, consistency, asymptotic normality, and Oracle property of the resulting estimators are derived. Simulation studies and a real data analysis are conducted to assess the finite sample performance of the proposed methods.

Study on the Impact of Shandong Rural Ancient Architecture Protection and Tourism Cultural Industry on Rural Revitalization

Gu Ning,Sun Dengke,Kan Dequan 한중경제문화학회 2021 한중경제문화연구 Vol.17 No.-

Development of an immunochromatographic strip for detection of antibodies against porcine reproductive and respiratory syndrome virus

Huawei Li,Jifei Yang,Dengke Bao,Jie Hou,Yubao Zhi,Yanyan Yang,Pengchao Ji,Enmin Zhou,Songlin Qiao,Gaiping Zhang 대한수의학회 2017 Journal of Veterinary Science Vol.18 No.3

A simple and rapid immunochromatographic test strip incorporating a colloidal gold-labeled recombinant Nsp7 antigen probe was successfully developed for the detection of anti-porcine reproductive and respiratory syndrome virus (PRRSV) antibodies in swine. Recombinant Nsp7 protein of PRRSV labeled with colloidal gold was dispensed on a conjugate pad for use as the detector. Staphylococcal protein A and purified porcine anti-Nsp7 antibodies were blotted on a nitrocellulose membrane to form test and control lines, respectively. A comparison of the strip with standard diagnostic tests, enzyme-linked immunosorbent assays and immunoperoxidase monolayer assay, was also performed. The immunochromatographic test strip was shown to be of high specificity and sensitivity. Furthermore, the strip assay is rapid and easy to perform with no requirement for professional-level skills or equipment. It is suggested that the immunochromatographic test strip can be used to quickly and accurately detect PRRSV antibody and to be suitable for diagnostic purposes in the field.

Coptis chinensis Polysaccharides Inhibit Advanced Glycation End Product Formation

Ye Yang,Yun Li,Dengke Yin,Song Chen,Xiangdong Gao 한국식품영양과학회 2016 Journal of medicinal food Vol.19 No.6

Coptis chinensis Franch (Huanglian) is commonly used to treat diabetes in China. In this study, the effects of the C. chinensis Franch polysaccharides (CCP) on advanced glycation end product (AGE) formation in vitro and in streptozotocin-induced diabetic mice were investigated. CCP significantly inhibited all the three periods of nonenzymatic protein glycation in vitro, including Amadori product, dicarbonyl compound, and AGE formation (P < .01). In diabetic mice, the administration of CCP not only improved both bodyweight and serum insulin and decreased fasting blood glucose and glycated serum protein concentrations but also decreased the AGE accumulations and morphological abnormalities in pancreas and liver. The inhibitory effects of CCP on AGE formation afford a potential therapeutic use in the prevention and treatment of diabetes.

Detect H1TP Tunnels Using Support Vector Machines

하등과,양대헌,이경희,He, Dengke,Nyang, Dae-Hun,Lee, Kyung-Hee Korea Institute of Information Security and Crypto 2011 정보보호학회논문지 Vol.21 No.3

최근 모든 네트워크에서 사용자가 웹 페이지에 접근할 때 HTTP가 폭넓게 사용되기 때문에 HTTP 트래픽은 방화벽과 다른 게이트웨이 보안 장치를 통과할 때 보통 별도의 검사 절차 없이 로컬 보안 정책에 의해서 통과된다 하지만 이러한 특성은 악의적인 사람에 의해 사용될 수 있다. HTTP 터널 응용 프로그램의 도움으로 악의적인 사람은 로컬 보안 정책을 우회하기 위해 HTTP로 데이터를 전송할 수 있다. 따라서 보통의 HTTP 트래픽과 터널링된 HTTP 트래픽을 구별하는 것은 아주 중요하다. 우리는 터널링된 HTTP 트래픽을 검출하는 통계적인 방법을 제안한다. 우리가 제안하는 방법은 사이트 독립적이기 때문에 지역적 제약을 갖지 않는다. 우리가 제안한 방법은 한 번의 학습만으로도 다른 사이트에 적용될 수 있다. 게다가 우리의 방법은 높은 정확도로 터널링된 HTTP 트래픽을 검출할 수 있다. Hyper Text Transfer Protocol(HTTP) is widely used in nearly every network when people access web pages, therefore HTTP traffic is usually allowed by local security policies to pass though firewalls and other gateway security devices without examination. However this characteristic can be used by malicious people. With the help of HTTP tunnel applications, malicious people can transmit data within HTTP in order to circumvent local security policies. Thus it is quite important to distinguish between regular HTTP traffic and tunneled HTTP traffic. Our work of HTTP tunnel detection is based on Support Vector Machines. The experimental results show the high accuracy of HTTP tunnel detection. Moreover, being trained once, our work of HTTP tunnel detection can be applied to other places without training any more.

Correction Technique of Inertial Force and Moment in Direct Force Measuring Test of Dynamic Aerodynamic Performance of Airfoils

Yuqin Jiao,Chunsheng Xiao,Dengke Wu 한국항공우주학회 2022 International Journal of Aeronautical and Space Sc Vol.23 No.4

The research on both direct force measuring test technique of dynamic aerodynamic performance of oscillating airfoils in low-speed flow and inertial force and pitching moment correction technique is carried out in the two-dimensional test section of the NF-3 low-speed wind tunnel of Northwestern Polytechnical University. The influence of the inertial force and pitching moment of the airfoil model on wind tunnel experimental data of dynamic aerodynamic performance is studied, the signal interference of the experimental data is analyzed, and the digital filtering method of the data, and the correction method for inertial force and pitching moment of airfoil models are proposed. The analysis of the results shows that the experimental data have obvious interference signal components within frequency interval between 16 and 60 Hz. When the oscillation frequency of the airfoil increases, the frequency band of the interference component becomes wider. Low-pass digital filtering in which the lift and drag data are subjected to a cutoff frequency of 16 Hz and the pitching moment data to a cut-off frequency of 8 Hz can eliminate the signal interference. The direct force measuring result of dynamic aerodynamic performance in the wind-off state contains a certain amount of aerodynamic forces, and there is a larger error in the method in which the influence of inertial force and pitching moment on the direct force measuring result is corrected by subtracting the wind-off data in the dynamic test. It is correct and feasible to use designed model motion law to fit the change of the angle of attack, to calculate and correct the inertial force and pitching moment. As the reduced frequency increases, the dynamic stall of the pitching oscillating airfoil is further delayed and the hysteresis loop of lift and pitching moment becomes larger.