Min Lei, Yixian Yang, Xinxin Niu, Yu Yang, Jie Hao

1 Information Security Center, Beijing University of Posts and Telecommunications, Beijing100876, China

2 Guizhou University, Guizhou Provincial Key Laboratory of Public Big Data, Guizhou Guiyang 550025, China

3 Jiangsu Engineering Center of Network Monitoring, Nanjing University of Information Science & Technology, Nanjing 210044, China

I. STATUS OF CYBER SECURITY

Security issues, such as copy–move forgery[1], ordinal regression [2], and cloud computing security [3], have been increasing with the development of information technology. Many researchers have proposed schemes to deal with different threats. Pan et al. [4] proposed a method to solve the video coding threat. Shen et al. [5] proposed a data sharing framework to solve the cloud computing security issues.Yuan et al. [6] presented coverless image steganography for secret communication. Yuan et al. [7] proposed fingerprint liveness detection to solve the security and privacy problems.Yang et al. [8] studied the problems of security meridian-collateral and security confrontation systematically and refreshed the traditional concept of security. Ren et al. [9] proposed a scheme to solve security problems in wireless sensor networks. Shen et al. [10] proposed a lightweight multi-layer authentication protocol to solve security and privacy issues in wireless body area networks (WBANs). Kong et al. [11] presented a belief propagation-based method for task allocation issues in open and dynamic cloud environments. Ma et al. [12]proposed a k-degree anonymity to solve privacy issues in social network data sharing.

Security experts commonly believe that only two states exist in network confrontation：win and lose. The real purpose of adverse information is to maximize the interests of the attacker rather than defeat the opponent completely. Therefore, the security state transforms from two states to three states, i.e., the attacker wins, the defender wins, and Nash equilibrium.

This paper is organized as follows： Section II presents the concept of local absolute se-curity. Section III de fines security. Section IV provides the de finition of attack and defense.Section V defines what a hacker is. Conclusions are provided in Section VI.

II. LOCAL ABSOLUTE SECURITY

The real purpose of network security is to reduce the insecure entropy of a network system and to prevent this insecure entropy from rapidly increasing.

The insecure entropy theorem for an in-finite system is stated as follows： All insecure of the system is achieved, which means that the security of the system reaches its maximum value simultaneously. Under normal circumstances, entropy is always positive. If insecure as time passes, and vice versa.

Insecure entropy is de fined as

Although solving this equation set accurately is difficult, this equation set is useful for some special cases such as the static case.

orf1(Q1,Q2, ...,Qn) = ... =fn(Q1,Q2, ...,Qn), then at this moment, the insecure entropy of the system is in a quiescent state, i.e., the security of the system becomes neither worse nor better.

Dynamic Case 1:If all the characteristic roots of the equation set are negative numbers,i.e., each insecure factor is gradually controlled by the defender, then the order of the system recovers. Therefore, the defender will win in succession.

Dynamic Case 2:If all the characteristic roots of the equation set are complex numbers and the real number part is a negative number,then the defender can also win in succession.

Dynamic Case 3:If one characteristic root is non-negative, then the equilibrium state and security of the system can no longer be maintained.

Dynamic Case 4:If some complex and positive characteristic roots exist, i.e., the system contains a periodic term at this moment,then the security state of the system will be changed periodically. As time passes, the system will become more chaotic and insecure.

More possible states of insecure entropy exist in finite network systems other than the above examples. The theorem draws a valuable security posture map, which helps avoid strategic mistakes when making speci fic decisions.

In this paper, authors give their answers to a series of questions,such as the following:Is it right to pursue local security? What is security? What is attack and defense?What is a hacker?Moreover, this paper also proposes a number of universal basic theorems to guide all security work, including cyber security.

III. DEFINITION OF SECURITY

Firstly, security is a subjective concept and is related to angle or direction. Different people with different points of view may come to opposite conclusions with regard to the same event. Therefore, before carrying out research on security, this research must first choose an angle or direction. Secondly, security is a time-related concept. The security state of a system will change with time. Today, the system is secure, but it may not be safe tomorrow. Security is also related to the object, i.e.,if systems A and B are independent, then the security of system B should be ignored completely when study system A.

On the basis of the above explanations, this paper conducted research on a finite system and obtained the following conclusions：

Insecurity obeys the second law of thermodynamics:The probability of insecurity in a finite system is always growing unless an external force such as a corresponding security reinforcement exists.

Insecure prime event decompositiontheorem of a finite system:Assume thatisand that the following conditions are satis fied：

For any given insecure event, whetherdecomposable, then there exists some sort of decomposition

According to the above decomposition theorem of the insecure prime event, this research can obtain the following conclusions：

Theorem 1 (“Divide and conquer” theorem)： Any set of the insecure event of a finite system A can be decomposed into some insecure prime events which are independent security or to reduce the probability of system insecurity.

The “divide and conquer” theorem gives a solution to the problem of thermal equilibrium, i.e., the insecurity status of the finite system A will eventually stabilize to some insecure events that are independent with each other.

The signi ficance of this theorem to the cyber security community is that it indicates that this research should scienti fically decompose all security threats into disjoint subclasses

According to the meridian-collateral tree of security [8], it follows that：

Step 1. If system A is insecure, then at least a certain insecure prime event or even prime inducements (acupoints) have occurred. See the second layer of the meridian-collateral tree.

Step 2. If an insecure prime event has occurred, then at least a certain prime inducement or even primitive inducements (acupoints) have occurred. See the third layer of the meridian-collateral tree.

... ...

Step k. If a certaink?1 step primitive inducement has occurred, then at least a certainkstep prime inducement or maybe even primitive inducements (acupoints) have occurred.See the (k+1)thlayer of the meridian-collateral tree.

Now, it is clear that how to perform a “permanent cure”. As long as the system A suffers from a disease, there can find a “sick” submeridian-collateral map from the full meridian-collateral map, which is called as M. The“sick” submeridian-collateral map M should satisfy the following requirements：

1) All the prime inducements or primitive inducements (acupoints) in each layer of system are “ill.”

2) Except for M, the other parts of system A are “healthy.”

To heal the system’s disease, only need to cure all the primitive inducements (acupoints)—a vivid way to describe this approach is to say that it involves performing acupunc-ture only on the primitive inducements (acupoints). Note that the “illness” of inducements for primitive inducements (acupoints), other inducements, which are not primitive inducements, can heal themselves. The process of“permanent cure” can be described as follows：

Firstly, heal the primitive inducements (acupoints) of the bottom layer, which is de fined as layer N. As a result, the prime inducements of layer N?1 have the chance to self-heal. Then,heal the primitive inducements (acupoints) of the layer N?1. As a result, the prime inducements of layer N?2 can also heal themselves.Then, heal the primitive inducements (acupoints) of layer N?3 and continue the above steps until finish the top layer healing.

This meridian-collateral map is not only used to find a “permanent cure” but also has other signi ficant applications as follows：

1) System A remains uninjured if protect all the correlative primitive inducements.

2) For the same reason, if strike at the correlative primitive inducements, then the assault against the opponent becomes steady and ruthless.

3) Neglecting the primitive inducement issues, the meridian with a higher average probability that this meridian-collateral map is the weakest one in the structure (i.e., the shortest stave in cask theory) needs to focus partly on protection and mainly on attack.

4) Protract and supply the map any time,and it will come in handy at a critical moment.

Although this research have proved the meridian-collateral map of a finite system exists,this research have not proposed a solution to the problem of how to draw this map. This task is not easy, and scholars will have to exert considerable efforts to create such maps for speci fic systems in the future.

IV. DEFINITION OF ATTACK AND DEFENSE

“Attack and defense” is the core of security and is almost equal to security itself, particularly in red-and-black confrontation scenes such as battlefields, public security, and network security. Thus, this paper engage in conflict to study attack and defense more systematically. In the past, people did not classify attack-and-defense scenarios clearly.Moreover, the term is often misused, sometimes it becoming a “must be experienced,hardly described” term. In addition, without correct classification, research on the “attack and defense” theory cannot be systematically performed, and it first needs to be categorized into two classes： blind attack-and-defense and non-blind attack-and-defense. The first class means that each party knows its own gains and losses but knows nothing about the opposite party. Common examples are network attack-and-defense, national games, actual battlefields, and espionage. By contrast, in non-blind attack-and-defense scenarios, every party knows the results and even reaches a consensus. Rock–paper–scissors games,chess, and stocks are examples of this class.In general, blind attack-and-defense scenarios are more bloody and cruel, whereas non-blind attack-and-defense scenarios are more entertaining. The two class scenarios are shown in Figure 1.

Fig. 1 Blind and non-blind countermeasure scenarios

The non-blind attack-and-defense between the attacker (hacker) and the defender (honker) is not the Nash equilibrium state because if one party knows the other’s game strategy,then they always can win by adjusting their own strategy. However, the Nash equilibrium state does exist in blind attack-and-defense scenarios. Therefore, this paper focuses only on blind attack-and-defense.

To express this concept more clearly, this research use boxing terms to introduce blind attack and defense systems. An attacker(hacker) is denoted by random variable.After every attack, he gives a “sincerely blind evaluation.” For example, he could regard the attack as successful or failed. If he thinks the attack is successful, thenis assigned as 1;otherwise,is assigned as 0. The defender(honker) is denoted by random variable. After each attack he gives a sincerely blind evaluation of the defense. For example, he could regard the defense as successful or failed. If he thinks the attack is successful, thenis assigned as 1; otherwise,is assigned as 0.

On the basis of the above descriptions, the attacker and the defender can always defeat each other completely in their own evaluations. However, the general theory of security strictly proves that some theories cannot be overturned, as follows：

Theorem 2 (The limit theorem of offensive and defensive capability):By using random variablesandin the above definition, it can define a new variablecan comprise a communication channel, e.g.,two random variablesand, can comprise a communication channel, whereis the input andis the output. Thus, ifis the capacity of attack channel, which comprises random variables, then

1) If an attacker wants to defeat a defendertimes successfully, then some skills that correspond to the Shannon code and can achieve the purpose of any probability tending to 1 in theattacks are needed.

2) Conversely, if attacker obtainsreal success inattacks, then.

1) If a defender wants to defeat a hackertimes successfully, then some skills that correspond to the Shannon code and can achieve the purpose of any probability tending to 1 indefenses are needed.

2) Conversely, if a defender obtainsreal success indefenses, then.

Theorem 3 (Power comparison theorem):Assumingandare the channel capacities of attack channeland defense channelG,respectively, it have

According to the above theorem, if make channel capacity larger than that of the opponent by adjusting it, then it can achieve victory in macro-level confrontation.

To date, this paper have studied attack and defense only in a one-versus-one case (one hacker attacks one honker). However, numerous “mass brawl” cases exist in cyber security,especially when a number of hackers attack a honker or a hacker attacks a number of honkers. In order to highlight the key points, this paper just researched blind attack-and-defense.

For simplicity, this research first consider the situation when two hackers attack a honker (two versus one) and then generalize the be assumed to be independent with each other.

Assume that the attacker and defender take actions based on turns, and each side conducts a sincerely blind evaluation based on the result of the blind attack-and-defense after every turn. Believing that the blind evaluation is true and credible is reasonable because these sincerely blind evaluation results are not revealed to others.

As one honker needs to deal with two hackers every turn, use a two-dimensional random variable,, to represent the honker.He will conduct a sincerely blind evaluation on the result of defending againstandin every turn as follows：

Similar to the one-versus-one case, some limit theorems also exist as follows：

Theorem 4 (Limit theorem of honker defense ability in the “two versus one” case):inturns, then it follows that

Moreover, the above upper bound can be achieved, which indicates that the honker must have effective defensive methods to successfully defeating the first hacker

The above theorem can also gener-

Theorem 5 (Limit theorem of honker defensive capability in the “m versus one”

In other words, if the honker wants

Now, this paper consider the “one (hacker)versus two (honkers)” case.

Generally, to reinforce security, honkers often build one or more backup (heterogeneous) system when building the main system.Therefore, in this case, if the hacker wants to win the battle with the honker, he must hack the main system and all the backup systems.This is the background to “one hacker attacks a number of honkers.”

For simplicity, this paper consider the situation where one hacker attacks two honkers(one versus two) and then generalize it to other cases.

Assuming all sides take actions based on turns, each side will conduct a sincerely blind self-evaluation on the result of every turn.

This paper use random variableto repre-

where

V. DEFINITION OF HACKER

In attack and defense, the attacker (hacker) is the first main character, because the defender was born to fight against the attacker. Therefore, in-depth research on hackers, especially their attack strategies, is important.

Any attack has a price, and this price can be economy, politics, or time. Similarly, the goal that the hacker wants to achieve also can be economy, politics, or time. Therefore, a hacker can be roughly classi fied as an “economic hacker,” “political hacker,” or “time hacker.”

An economic hacker is concerned only about their profit and not their opponents.Sometimes, they can afford the appropriate economic costs to achieve the final win. Thus,the target of this hacker is to obtain the largest profit with the lowest price. As long as he is ready, the economic hacker can attack at any time.

A political hacker critically hurts opponents at any price, sometimes has a very clear target,and never gives up until they achieve their goal. They always accurately aim at the target,but only pull the trigger at the critical moment.

A time hacker hopes to break through the honker’s defense in the shortest possible time and make the system rebuild last as long as possible. In fact, they can be seen as academic researchers.

From a purely theoretical point of view,there is no need to distinguish the three hackers. However, for clarity and also for quanti fication, this paper focus on economic hackers.

The security field has an old, important, and frequently repeated saying, which can also be considered a security axiom： “Security is relative, and insecurity is absolute.”

Security axiom:For any (finite) system,the probability that a system is not secure and can always be hacked by a hacker is equal to 1.

According to the above axiom, we know that, although the probability of a hacker successfully hacking a speci fic part of the system is close to 0, the probability of a hacker being able to finally hack a system is equal to 1.

In addition to tactics, hackers in the process of attack also pay attention to the strategy that enables them to obtain the maximum economic interest.

Assume a hacker wants to attacksystems to obtain economic interests. Past experience indicates the input-output ratio of the attack

Theorem 9 (The best combination attack theorem): Assume the economic interests of a hacker attackingsystems ue.

According to the above theorem, this logarithmic optimal combination attack not only enables the growth rate of the hacker’s economic interest to reach its maximum value but also maximizes the input-output ratio of every attack round.

Quantitative analysis of the hacker obtains many results, but the results are too mathematical, and using popular scienti fic terms to describe them is inadequate. Therefore, this paper will not elaborate on them.

VI. CONCLUSION

The concepts of security and information are not yet strictly de fined. However, this lack of a de finition does not mean that further research on these concepts cannot be conducted. In fact,as early as 60 years ago, Shannon proposed the information theory, which established a solid foundation for the rapid development of modern communication. So far, most research on security, especially cyber security, has focused only on engineering and technology.This approach not only lacks comprehensive and systematical theoretical guidance but also leaves behind numerous obvious loopholes.This paper answers a series of questions, such as the following： Is it right to pursue local security? What is security? What is attack and defense? What is a hacker? This paper also proposes a number of universal basic theorems to guide all security work, including cyber security.

ACKNOWLEDGMENT

This work is supported by the National Key R&D Program of China (2016YFF0204001),the National Key Technology Support Program (2015BAH08F02), the CCF-Venustech Hongyan Research Initiative (2016-009),the PAPD fund, the CICAEET fund, and the Guizhou Provincial Key Laboratory of Public Big Data Program.

[1] J. Li, X L Li, B. Yang and X M. Sun, Segmentation-based Image Copy-move Forgery Detection Scheme. IEEE Transactions on Information Forensics and Security, vol. 10, no. 3, pp. 507-518, Mar. 2015.

[2] B. Gu, V S. Sheng, K Y. Tay, W. Romano and S.Li, Incremental Support Vector Learning for Ordinal Regression. IEEE Transactions on Neural Networks and Learning Systems, vol. 26, no. 7,pp. 1403-1416, 2015.

[3] Z H. Xia, X H. Wang, X M. Sun and Q. Wang, A Secure and Dynamic Multi-keyword Ranked Search Scheme over Encrypted Cloud Data.IEEE Transactions on Parallel and Distributed systems, vol. 27, no. 2, pp. 340-352, 2016.

[4] Z Q. Pan, Y. Z and S. Kwong, Efficient Motion and Disparity Estimation Optimization for Low Complexity multiview video Coding. IEEE Transactions on Broadcasting, vo. 61, no. 2, pp. 166-176, 2015.

[5] J. Shen, D Z. Liu, J. Shen, Q. Liu, and X M. Sun,A secure cloud-assisted urban data sharing framework for ubiquitous-cities. Pervasive and mobile Computing, 2017, DOI: 10.1016/j.pmcj.2017.03.013.

[6] C S. Yuan, Z H. Xia, and X M. Sun, Coverless Image Steganography Based on SIFT and BOF,Journal of Internet Technology, vol. 18, no. 2,pp: 435-442, March, 2017.

[7] C S. Yuan, X M. Sun, and Rui LV, Fingerprint Liveness Detection Based on Multi-Scale LPQ and PCA, China Communications, vol.13, no.7,pp.60-65,2016.

[8] Y X. Yang, H P. Peng, L X. Li and X X. Niu, General Theory of Security and a Study Case in Internet of Things. IEEE Internet of Things Journal,vol. PP, no. 99, pp. 1-10, 2016.

[9] W. Ren, Y.Ren, H.Zhang, Secure, Dependable and Publicly Verifiable Distributed Data Storage in Unattended Wireless Sensor Networks,SCIENCE CHINA Series F, vol.53, no. 3, pp.677 –692, 2010.

[10] J. Shen, S H. Chang, J. Shen, Q. Liu, and X M.Sun, A lightweight multi-layer authentication protocol for wireless body area networks, Future Generation Computer Systems, 2016, DOI:10.1016/j.future.2016.11.033.

[11] Y. Kong, M J. Zhang and D Y. Ye, A belief propagation-based method for Task Allocation in Open and Dynamic Cloud Environments,Knowledge-based Systems, vol. 115, pp. 123-132, 2016.

[12] T H. Ma, Y L. Zhang, J. Cao, J. Shen, M L. Tang,Y. Tian, A. AI-Dhelaan, and M. AI-Rodhaan,KDVEM: a k-degree anonymity with Vertex and Edge Modification algorithm, Computing,70(6), 1336–1344, 2015.