To address the issues of hallucinations in large language models for cyber threat attribution and the insufficient robustness of traditional graph-constrained reasoning against fragmented threat intelligence data, research on credible cyber attack traceability methods was conducted. The framework integrating threat intelligence knowledge graph and graph-constrained reasoning (TIKGCR) was proposed, which constructs an attack pattern-oriented knowledge graph Trie (KG-Trie) index and designs an adaptive soft-constrained decoding and multi-path evidence aggregation mechanism. Experimental results show that the framework achieves attribution accuracies of 94.6% and 92.8% on the CTI-Trace and TRAIL datasets respectively, with a hallucination rate of only 1.5%. It maintains an accuracy of 85.5% under a 50% knowledge graph missing rate and inference time cut by roughly 23. This framework achieves a balance between structural credibility and semantic robustness, providing effective technical support for cyber threat attribution in high-risk scenarios.
In new-type power systems, deep learning-based load forecasting models have been widely applied to resource scheduling and market response, making backdoor attack a more insidious potential threat. However, in these strongly coupled, multivariate forecasting scenarios, backdoor triggering not only needs to achieve targeted manipulation of the forecast output but also needs to consider key samples, variable selection, and cross-variable dependencies. To address these issues, a backdoor injection method , KoopTrigger, based on Koopman spectral sensitivity identification and graph structure perturbation modeling was proposed. Firstly, this method selects highly vulnerable input windows based on Koopman operator sensitivity analysis to generate efficient poisoning samples; then, it constructs a gated sparse graph convolution generator to inject low-rank perturbations into the variable dimensions, achieving structured backdoor triggering across windows; finally, a two-stage adversarial training mechanism is used to stably induce the model to learn the attack target. Experiments were conducted on four multivariate datasets: ETTh1, Ireland, Panama, and Milan. The results show that KoopTrigger can achieve efficient and covert prediction manipulation in multiple prediction models, significantly outperforming the ablation version. It also shows better attack performance and generalization performance compared to the baseline method.
With the rapid advancement of Industry 4.0, Intelligent manufacturing has become increasingly important. Traditional manual inspection still suffers from low efficiency, high cost, and limited stability, while supervised learning methods rely heavily on accurately labeled anomalous samples, which are scarce and diverse in real industrial scenarios. In contrast, unsupervised industrial image anomaly detection learns the distribution and intrinsic patterns of normal samples only, and has therefore attracted growing attention from both academia and industry.First, a systematic review of unsupervised industrial image anomaly detection under the one-class learning setting was provided. Existing methods were categorized into two main paradigms according to the source of anomaly scores: feature embedding and image reconstruction, and the development of representative approaches was summarized.Second, based on this taxonomy, the evolution and research trends of these two paradigms were analyzed. The common characteristics and differences among existing methods in terms of feature representation, anomaly scoring mechanisms, and localization strategies were summarized to provide a structured understanding of current research.Then, commonly used benchmark datasets and evaluation metrics in this field were reviewed.Finally, the main challenges in current research were discussed from the perspective of practical industrial applications, and potential future research directions were outlined to facilitate further development and deployment of unsupervised industrial image anomaly detection methods.
The differential analysis of block ciphers based on deep learning has become a hot research topic in the field of cryptography. To investigate the impact of different data formats on the performance of neural network differential distinguisher, by combining the characteristics of single-differential and multi-differential distinguisher data formats, and taking advantage of the differential propagation uncertainty of the S-box component in the CRAFT, a “single-differential + S-box intermediate state” distinguisher data format was designed and proposed. Through residual neural network (ResNet) models, three types of data formats corresponding to the 5-7 rounds of neural network differential distinguisher of the CRAFT were obtained. For the 5-round neural network differential distinguisher, the accuracy of all three discriminators was above 97%. For the 6-round neural network differential distinguisher, the accuracy of the “single-differential + S-box intermediate state” distinguisher was 96.14%, significantly better than the 61.39% of the single-differential distinguisher and the 72.78% of the multi-differential distinguisher. For the 7-round neural network differential distinguisher, the accuracy of the three distinguishers was slightly above 50%. Among them, the training data complexity of the model corresponding to the single-differential distinguisher was 221.07, while the training data complexity of the multi-differential and “single-differential + S-box intermediate state” distinguisher was 221.66. Further, by using a 6-round “single difference + S-box intermediate state” distinguisher to conduct partial key recovery attacks on the 7-round CRAFT, when the number of plaintext-ciphertext pairs selected was 10 000, the success rate can reach 93% in 100 attack experiments, the time complexity of a complete cryptanalysis attack was 222.01.
Fully homomorphic encryption does not support nonlinear homomorphic computation, making it difficult to directly implement homomorphic ReLU evaluation in privacy-preserving machine learning. Existing schemes that employ high-degree polynomials to approximate the ReLU activation function involve large-bitwidth modular multiplication and high-degree polynomial multiplication operations, resulting in limited system throughput and low resource utilization.To address this, a CPU-FPGA heterogeneous collaborative architecture was proposed for homomorphic ReLU evaluation, with the CPU executing high-degree polynomial approximation and the FPGA accelerating homomorphic polynomial evaluation. Specifically, a segmented lookup table modular reduction algorithm was first designed. By means of a two-level decomposition mapping mechanism, large-bitwidth modular multiplication was converted into parallel high/low-bit lookup table operations and linear combinations. As a result, the modular multiplication delay was reduced by 97% compared to the existing state-of-the-art scheme. Secondly, a dynamic resource-reusing CG-NTT architecture was proposed to optimize polynomial multiplication efficiency. Relying on a fixed memory access pattern, a dynamic table reuse strategy was implemented. Compared with traditional NTT architectures, 15%～37% of the computation units were reduced, and 45%～50.8% of the operation latency was decreased. Finally, a CPU-FPGA heterogeneous acceleration framework was constructed. Through a phase-tuning interface and a resource coordination mechanism, a speedup of 21.4 times was achieved for homomorphic ReLU evaluation. The feasibility of the proposed scheme in accelerating ciphertext inference was verified by experiments, although the most time-consuming bootstrapping operation still had to be executed on the CPU side. Therefore, future research will be focused on the hardware acceleration of the bootstrapping operation, in order to further improve the practical performance of the ciphertext inference system.
