•We quantitatively evaluate the effect of blasting vibrations on an existing tunnel.•We evaluate critical issues on controlled blasting scheme and its implementation.•We discuss safety criterion of ...blasting vibrations for the tunnel via field test.•A 3D numerical model is presented for tunnel vibration and verified by test data.•The blasting construction scheme should be implemented carefully in soft soils.
The controlled blasting technique is employed, for the first time, on the diaphragm wall of an existing road tunnel in soft soils in the city of Shanghai, and therefore, safety demands on evaluation of influence of the blasting vibrations on the tunnel are highly required. Based on the practical blasting scheme of four sections of diaphragm wall of the tunnel to be exploded in three groups, the field monitoring of blasting vibrations is carried out on the bottom plate of the tunnel and the blasting vibration effects on the tunnel are measured throughout the blasting construction. The sequential characteristics of vibration velocities and accelerations of the tunnel structure are obtained from the field blasting tests. In order to fully understand the safety criterion of the blasting vibrations on the tunnel, a 3D numerical model is established by the finite element software ABAQUS. The numerical simulation results are confirmed by field monitoring data. Based on the monitoring data and numerical results of the tunnel subjected to blasting loads, results show: (1) the blasting energy is transferred mainly along the vertical direction; (2) the basic frequency domain of the tunnel responses caused by the explosion is relatively in a lower frequency range; (3) distinct vibration response spectra of the tunnel structure are observed along the horizontal and vertical directions; (4) the performance of the tunnel subjected to the blasting construction is in a critical state of safety and thus the blasting construction scheme should be implemented carefully. Finally, critical issues on evaluation of the blasting construction are fully discussed and evaluated, which provide a reference for other similar projects.
The monkeypox virus was declared as a Public Health Emergency of International Concern (PHEIC) by the World Health Organization (WHO) and continues to cause infection cases worldwide. Given the risk ...of virus evolution, it is essential to identify monkeypox virus infection in a timely manner to prevent outbreaks. This study establishes a novel one-pot recombinase polymerase amplification-Clustered Regularly Interspaced Short Palindromic Repeats (RPA-CRISPR) assay for monkeypox virus with an ultra-high sensitivity. The assay shows good specificity, accuracy, and the rapidness and convenience important for point-of-care testing. It provides an effective tool for the early diagnosis of monkeypox, which is useful for the prevention of an epidemic.
DNS is often used by attackers as a covert channel for data exfiltration, also known as DNS tunneling. Since the plaintext DNS lookup leads to privacy issues, DNS over HTTPS (DoH) has recently been ...standardized and deployed. DoH encapsulates DNS in HTTPS to encrypt DNS traffic between clients and recursive resolvers. Attackers can also use DoH for subtle data exfiltration. However, existing DNS tunneling detection methods for plaintext DNS are usually ineffective for DoH tunneling. In this paper, we propose a method to detect DoH-based data exfiltration. We analyze TLS fingerprints of DoH clients and build classifiers with flow-based features to detect DoH tunneling. Our experiment discusses the influence of various factors on the detection results in detail, including adversarial considerations by exploring the potential evasion. Experimental results demonstrate that the proposed method is effective, and it is very difficult to evade detection due to the difficulty of feature imitation. Besides, our method can still provide the defender with helpful information for attack investigation even if the attacker evades detection.
Website fingerprinting is exploited to analyze encrypted traffic traces and infer the visited website. Existing website fingerprinting methods can achieve satisfying performance for the HTTP traffic ...visiting websites over TCP. Recently, a new protocol QUIC has been proposed, and HTTP-over-QUIC has been formalized as the next generation HTTP, named HTTP/3. Thus, it is necessary to classify HTTP/3 traces. However, since HTTP/3 is newly proposed and is being deployed, it is difficult to collect a large number of HTTP/3 traces. Intuitively, we can use sufficient TCP traces to improve the performance of the QUIC trace classifier. Unfortunately, the protocol discrepancy exists between TCP and QUIC traces, which undermines the generalization ability of the classifier. In this paper, for practical website fingerprinting of HTTP/3, we propose a Website-Aware Protocol Confusion Network (WAPCN), which exploits only a few QUIC traces to train a website classifier with the help of lots of available TCP traces. It consists of four main parts: a feature extractor, a website classifier, a protocol discriminator, and a website-aware adaptor. The feature extractor aims to extract trace representations from both TCP and QUIC traces. It cooperates with the website classifier to learn the discriminative representation for the website classification. The role of the protocol discriminator is to confuse protocols and guide the feature extractor to learn protocol-invariant representations. The website-aware adaptor can enhance protocol-invariant representations to be aware of the website classification boundary. Extensive experiments are conducted on various tasks to demonstrate the effectiveness of WAPCN.
The deepening of digital transformation has led to an increasing amount of data from industries being transmitted over the Internet. However, packets in plaintext originally designed for transmission ...in private networks suffer from significant security threats on the Internet. Unfortunately, existing encryption schemes, such as the representative TLS, are difficult to be applied to these industrial protocols due to their specific requirements and conditions such as low latency requirements and restricted operating environments. In this paper, we present a high-performance encryption/decryption middlebox called GuardBox to provide confidentiality and integrity for packets. GuardBox is expected to transparently encrypt/decrypt packets sent/received by protected industrial equipment with low latency and supports almost any application-layer protocol. To do that, we design a high-performance packet I/O framework and an optimized encryption/decryption scheme for GuardBox. More importantly, we use commodity trusted hardware, Intel SGX, to ensure the security of keys and the encryption/decryption process. Our extensive evaluation demonstrates that GuardBox can provide confidentiality and integrity for packets transmitted over the Internet with low latency and a near-native throughput.
Denial of service (DoS) attacks have increasingly exploited vulnerabilities in algorithms or implementation methods in application-layer programs. In this type of attack, called CPU-exhaustion DoS ...attack, a few well-crafted requests may consume a lot of server resources, which is essentially different from traditional volumetric DoS attacks. Due to the lack of recognizable patterns, the traditional network-layer defense mechanism is usually unable to detect such sophisticated DoS attacks. In this article, we propose Coda , a framework for detecting application-layer CPU-exhaustion DoS attacks in containers. Coda monitors the CPU time consumed by each connection and uses statistical methods to detect attacks. It traces system calls and other related information from the container based on Linux eBPF at the host level. Some specific system calls are used to indicate the establishment and closure of the connection, which in turn indicate the start/end of the request processing. After triggering these specific system calls, Coda starts/ends monitoring the CPU time consumed by a connection. An attack can be detected when the CPU time consumed by an attack connection is statistically different from that consumed by a legitimate connection. Coda has the following key advantages. First, it works with programs built in different programming languages. Second, it remains agnostic to the source code of protected programs. Third, it supports monitoring the container and is transparent to the container. Through evaluation of real-world attacks, we demonstrate that Coda can accurately detect ongoing application-layer CPU-exhaustion DoS attacks with low additional overhead.
DNS caches play an important role in DNS querying. However, the performance of DNS caches will be remarkably influenced by disposable domain names, which are generated by services of cloud storage, ...social networks, etc., and belong to a new class of misused case of DNS. In this paper, we proposed a novel solution named DC 3 (Domain Classification and Cascade Cache) to mitigate the negative impact. Domain Classification adopts a classifier which is based on a long short-term memory (LSTM) network to prevent disposable domains from being cached. Cascade Cache is a refined cascade LRU policy considering cache size allocation to process the remaining disposable domains. By querying the real DNS traces collected from a large ISP network, experiment results show that this solution can detect disposable domain names and mitigate their negative impacts on DNS caches effectively. Specifically, in our dataset, 67.4% of all distinct domain names are detected as disposable domain names. Correspondingly, when getting rid of them by using this solution, we can raise the cache hit rate more than double.
PDF