Abstract Phishing email detection faces many challenges, as existing detection methods have difficulty in distinguishing phishing-oriented intent from legitimate semantics, lack unified modeling of persuasion strategies and rhetorical structures, and suffer from the impact of class imbalance. To address these issues, this paper proposes a three-stage phishing email detection framework. In the first stage, unsupervised SimCSE is employed to obtain discriminative sentence representations. In the second stage, a multi-task graph construction model, KD-PEPRD-Graph, jointly identifies intra-sentence persuasion principles and inter-sentence rhetorical dependencies, and automatically generates a persuasion–rhetorical dependency graph for each email. Furthermore, a knowledge distillation mechanism is introduced to enhance the generalization ability of the graph construction model using unlabeled emails. In the third stage, the SimCSE-Graphormer-LMF detection model is proposed. Node features are initialized with the SimCSE encoder. Graphormer then performs global reasoning over the constructed graph. To mitigate class imbalance, the large-margin-aware focal loss is also incorporated. The core contribution of this work lies in jointly modeling intra-sentence persuasion principles and inter-sentence rhetorical dependencies within a unified graph structure, thereby uncovering how persuasion principles, organized through rhetorical dependencies, together construct the deceptive narrative of phishing emails. Experiments show that the proposed model achieves F1 scores of 99.15% and 84.31% on the IWSPA-AP and Hard-Example datasets, respectively, outperforming all baseline methods. On the Enron-Nazario dataset, it attains performance comparable with the state-of-the-art large-language-model baseline Gemini 3.1-PPS&RDR. Statistical significance tests based on the McNemar’s test confirmed the reliability of these improvements. Taken together, the results across the three datasets validate the effectiveness of the proposed framework, which achieves high detection performance while maintaining a manageable model size and acceptable inference latency.
Abstract The increasing sophistication of malicious software (malware) requires advanced tools to effectively analyze and counter threats. In this paper, we present MalGraphIQ, a dynamic analysis system designed to understand the behavior of unknown Windows binaries by introducing the Windows Behavior Catalog (WBC). The WBC is a new repository of behavioral patterns inspired by MITRE’s Malware Behavior Catalog, which systematically catalogs key application programming interfaces and system calls used by Windows binaries to exhibit specific behaviors. By leveraging sandbox technologies (specifically, CAPEv2), our dynamic analysis system uses the WBC to detect and quantify behaviors in programs, regardless of whether they are malicious or benign. It also generates graph-based visual representations of these behaviors, simplifying the interpretation of the actions performed by the program. To evaluate its effectiveness, we apply our system to multiple malware families and validate the results using cross-validation, demonstrating its ability to uncover specific actions and behavioral patterns across different malware samples and unknown binaries. The results show the system’s ability to detect behavioral patterns and distinguish between different types of malware, with an accuracy of up to 0.96 and an F1 score of 0.92, underlining the potential of our approach in malware detection and program behavioral analysis.
Abstract Due to the limitations of current defense methods—the neglect of spatial-temporal information and insufficient privacy guarantees, membership inference attacks (MIAs) on dynamic graph-based models remain inadequately addressed. This paper examines the vulnerability of dynamic graph-based victim models by employing a dynamic node-level MIA procedure. The attack involves three steps: training multiple shadow models, training the attack model using member and nonmember data, and querying the victim model to determine whether dynamic nodes were part of the victim training dataset. To strengthen defenses against MIAs, the paper proposes the Differential Private Spatial-Temporal Self-Attentions (DP-STSA) method, which enhances model resilience by integrating spatial-temporal self-attentions with differential privacy with adaptively allocated privacy budgets. Supplemental layers with spatial-temporal self-attentions reduce the model’s sensitivity to specific nodes, and differential privacy allocates different Laplace noise to supplemental layers for obfuscating gradients. Assuming that the attacker has a strong background knowledge of the victim models, experiments depend on four real dynamic graph datasets and simulate the attack procedure on four different models. Experimental results demonstrate that dynamic nodes are highly susceptible to MIAs. However, DP-STSA offers improved protection of dynamic node membership privacy while preserving the utility of the victim models, outperforming other mentioned defense methods.
An increasing number of wireless devices deployments are utilizing harvested ambient energy to increase system lifetime. The temporal profiles of the diverse environmental energy sources may be highly variable. So, creating an adaptive processor management mechanism enables the computing device to adjust its activity to changing environmental conditions and adopt an energy neutral operation mode. In this paper, we take into consideration any Priority Assignment (PA) rule jointly to preemptive scheduling. The paper proposes the priority assignment with energy harvesting) framework, a generalized scheduling approach that integrates a predictive look-ahead processor management mechanism into any PA rule, whether fixed or dynamic. We demonstrate that the resulting scheduler is optimal in that it allows to achieve energy neutrality with no deadline missing, no wasted energy, and no energy starvation whenever feasible with the PA rule. Our simulation results demonstrate that PA-H achieves a $100\%$ deadline success ratio as soon as the energy replenishment ratio reaches neutrality. Furthermore, we quantify the benefit of this approach, showing that it can reduce the minimum required storage capacity by $\sim 90\%$ compared with standard rate monotonic scheduling. This enables the design of smaller, more sustainable autonomous devices without compromising real-time reliability.
Advances in information technology have had a positive impact on various fields, including administrative management in the educational sector. At the Muhammadiyah Al-Furqon Islamic Boarding School in Tasikmalaya—the subject of this study—the process of issuing student leave permits was previously conducted manually, often leading to challenges such as delays in record-keeping, data errors, and inefficiency. Additionally, parents had to visit the boarding school in person to request a permit, which did not always guarantee approval. As a solution, this study designed and developed a web-based student leave permit information system that can assist administrators in automatically recording and printing permission letters, as well as make it easier for parents to submit permission requests online. This study employed the Research and Development (R&D) method using the Waterfall development model. Data collection was conducted through observations, interviews, literature reviews, and questionnaires. The feasibility study results, using the TELOS method, were as follows: Technical (96.7%), Economic (100%), Legal (100%), Operational (90.1%), and Schedule (88.5%), resulting in an overall score of 95.1%. These results fall into the "Highly Feasible" category, indicating that this website is highly effective in facilitating student permission requests for both parents and boarding school administrators.
