Cyber threats are evolving as threat actors diversify their attack strategies and patterns, incorporating refined and new tools to conceal their real identity and fingerprints. The rapidly evolving nature of Advanced Persistent Threats (APTs) outpaces current reactive security solutions, which are not designed to anticipate variants of future attacks. In this paper, we introduce APTMORPH+, a proactive threat hunting solution that anticipates variants of emerging APT campaigns. APTMORPH+ leverages a Generative Adversarial Network (GAN) model augmented with Reinforcement Learning (RL) to generate such variant campaigns. APTMORPH+ is trained on temporal security context data spanning 2019-2025 from the MITRE ATT&CK knowledge base to generate variant campaigns informed by security contexts. The model consists of an Adversarial Learning loop and a Reinforcement Learning loop that incorporate (i) a Technique Generator to anticipate the techniques of an APT campaign, (ii) a Technique Discriminator to filter out the least probable techniques to occur, (iii) a Security Context Evaluator to evaluate the semantic meaning of the variant campaigns, (iv) a Sequence Assembler to assemble the final sequences of campaigns, and (v) a Campaign Classifier, which identifies the aligned variant campaigns based on semantic features. To validate APTMORPH+, we performed time-series splitting of the MITRE data by comparing the campaigns before and after a selected year. APTMORPH+ was able to anticipate emerging variant APT campaigns while maintaining a high behavioral similarity score.
The finite-time disturbance decoupling problem for large-scale Boolean networks (BNs) is investigated in this paper. Firstly, the network aggregation method is employed to divide the original system into several smaller-size subsystems. Some necessary and sufficient conditions are derived to verify whether the subsystems are finite-time disturbance decoupled. For any subsystem that fails to achieve decoupling, state-flipping control is further introduced and a decoupling judgment matrix is constructed by using the truth matrix construction method. Then the necessary and sufficient conditions for solving the finite-time disturbance decoupling problem are proposed, thereby realizing finite-time disturbance decoupling for the original system. Furthermore, two algorithms are designed: one for verifying whether the original BN is finite-time disturbance decoupled, and the other for finding the minimum set of flipping nodes. Finally, the effectiveness of the proposed methods is validated through a numerical example.
With the rapidly expanding scale, Internet of Things (IoT) networks are facing increasingly severe and evolving cyber threats, where Advanced Persistent Threats (APTs) frequently exploit the resource-constrained nature of terminal devices and heterogeneous protocol vulnerabilities to launch targeted attacks. Although proactive methods such as deception defense have been employed to address the cons of traditional static defenses, their application to large-scale IoT environments still faces two critical challenges. First, owing to the limited deception resources, the defender must strategically select a subset of nodes to deploy the deception resources, resulting in a combinatorial optimization challenge. Second, the strategies of the defender and the attacker can exhibit cyclic dominance under complex adversarial environments, preventing the defender from learning a robust deception deployment strategy. To address these challenges, we propose the A$^{4}$DIoT framework with two critical designs: i) We partition the large-scale IoT network into smaller subnets and endow each subnet with an AI agent that determines the local strategy according to the local state information, while a global AI agent is deployed to coordinate the local AI agents to approximate the defender's global optimal deception resource deployment strategies under the limited resource constraint; ii) We construct a strategic layer where the empirical game analysis is leveraged to break the cyclic dominance by introducing uncertainty to confuse the attacker's cognition of the defender's strategy and thereby provide a stable and robust deception defense strategy. Experiments on simulated IoT networks demonstrate that A$^{4}$DIoT achieves up to 102.5% improvement compared to baselines in terms of defensive utility and can effectively scale up to large IoT environments
Raft's leader election trusts orderers equally, so a delay-degraded orderer can take leadership and throttle a per missioned blockchain channel. Learning-augmented consensus lets a model move the leader; BORA bounds the model. Its advice is a blacklist capped at |Bt| ≤ max(f −r −1,0), read through a fail-open guard: every yield is a vanilla-Raft stuttering step. All five Raft safety invariants hold for any prediction, by a TLAPS refinement of an election-level model; the liveness core is mechanised without axioms, the minimum-hold argued. Against a moment-matched adversary one-sided linear scores symmetric about a common mean sit at chance; temporal dependence, not learning, separates. On Hyperledger Fabric, BORA takes the blacklisted orderer from 8.8% of forced elections unguarded at N = 7–21 to 0% (0/240 per guarded arm, operator- or detector produced) with four missed leader replacements observed in 480, and from 19% at N = 5. A degraded leader stalled 13 of 36 runs, a degraded follower none. A Transformer detector flags the node in 3.1s, no false positive in 158 cycles; a white-box adversary abandoning autocorrelation evades every differentiable model tested through its anomaly head. Forged messages and host compromise are out of scope
Dispersed computing emerges as a promising approach to effectively address the demands of computation-intensive and latency-sensitive tasks. Specifically, it achieves this by leveraging dispersed, heterogeneous idle network computation points (NCPs) to deliver computing services. To enhance flexibility and communication reliability in complex scenarios, relay NCPs (R-NCPs) are integrated into the network to bridge users and computing NCPs (C-NCPs). However, this dispersed computing network faces several key challenges: 1) incentivizing selfish C-NCPs; 2) security and trust threats from malicious points; 3) dynamic resource and task management among multi-level entities. In light of these challenges, this paper proposes a Stackelberg game-based and blockchain-secured online collaborative framework. Specifically, the interactions among users, R-NCPs and C-NCPs are modeled as a leader-follower Stackelberg game to balance interests and maximize system utility. To ensure computation integrity and isolate malicious points, an improved blockchain with a multi-dimensional reputation is integrated into the R-NCPs. For this coupled problem, a hierarchical approach is proposed: using a KKT-based method to derive the follower-level solutions, and developing a novel hybrid multi-agent deep reinforcement learning algorithm (DDPPO) for the leader-level Nash equilibrium. Extensive simulations demonstrate that the proposed method outperforms baselines in total system utility, energy efficiency, and security.
