While existing malware family classification methods achieve high performance on in-distribution data, they often overfit mutable features when subjected to different compilers, optimization levels, and advanced code obfuscation. This vulnerability significantly degrades their generalization under complex distribution shifts. Furthermore, applying existing graph invariance learning methods, which typically rely on random topological sampling, disrupts the strict semantic dependencies inherent in binary code. Additionally, a naive concatenation of dynamic and static features introduces underlying system call noise, adversely affecting the model’s ability to identify core family logic. In response, this paper proposes SDE-IG, a robust malware family classification framework based on invariant subgraphs. A cross-environment invariant subgraph extraction mechanism is designed from a static perspective. By integrating binary semantic priors with parameterized graph neural networks, this mechanism decouples the program call graph into an invariant subgraph representing core semantics and an environment subgraph capturing noise. This separation is designed to reduce reliance on environment-dependent structures that may vary across compilation, linking, and obfuscation settings. To address potential static topology failures caused by extreme obfuscation, SDE-IG incorporates a dynamic behavioral view as auxiliary semantic evidence. During end-to-end joint optimization, a collaborative mixup strategy is applied to simulate unknown variants and broaden the distribution boundary. Coupled with an asynchronous two-stage optimization and a gated residual calibration mechanism, this approach effectively minimizes the interference of dynamic behavioral noise on the static backbone representation. Experimental results show that SDE-IG achieves improved cross-period classification stability under the chronologically separated temporal distribution shifts evaluated in this study.
Active Directory Certificate Services (ADCS) is widely deployed in enterprise Windows environments, and misconfigurations can enable high-impact domain escalation. Many ADCS escalations are inherently compositional: exploitability depends on conjunctions of permissions and configuration states spanning multiple AD/ADCS objects, often requiring multi-principal capability composition where one principal enrolls while others can force vulnerable template/CA states. As a result, ADCS security tools that operate per object or from a single-credential perspective can miss escalation opportunities whose exploitability depends on such compositions, leading to an underestimation of the attack surface.We present ADCSESC-IDF (Integrated Detection Framework for Active Directory Certificate Services Escalation risks), a dataflow-based framework that casts ADCS escalation discovery as on-demand higher-order reachability. Given an ADCS attack graph and a set of principals, ADCSESC-IDF derives effective permissions based on graph reachability, encodes configuration state as compact bit-vectors, and models permission-driven override capabilities that capture when privileged rights can satisfy missing preconditions by modifying template, CA, or account attributes. To mitigate combinatorial blow-ups, the framework computes escalation-enabling transitions on demand and uses a static deterministic pipeline that supports caching and efficient bitmap predicate evaluation, with correctness-preserving lazy evaluation for large predicate families (e.g., ESC14 variants). We show that ADCSESC-IDF reveals multi-principal compositional escalations missed by existing tools, including coverage of large ESC14 predicate families. Experiments on a widely used synthetic benchmark and on a real medium-sized AD snapshot show that ADCSESC-IDF discovers escalation opportunities missed by current per-object and single-credential escalation analyses, while answering operational queries with millisecond-scale latency on the synthetic benchmark and sub-10-second latency in our real-world case study.
Rapid technological advances have greatly enhanced the development of unmanned aerial vehicles (UAVs) and their potential for beneficial uses. Such uses, however, have been limited by cybersecurity concerns. Despite considerable research attention, threat levels are increasing, and this is likely to further inhibit UAV use. A different approach is therefore required, one that marks a change from reactive mitigation to proactive prevention. This study proposes a holistic cyber-resilience framework for UAVs based on five resilience features, which are redundancy, flexibility, modularity, diversity, and tightness of feedback loops. Such a change, called for by several authors but yet to be achieved, can come through the components of a framework that are supported by expert perspectives. The study employs a mixed-methods design with in-person interviews of 32 expert professionals across eight sectors (aviation, military, security, insurance, aerospace, cybersecurity, logistics, and academia). A total of 261 vulnerabilities ranging across five threat categories are identified, with those related to communication facilitating a point of entry for cascading attacks. Drawing on expert evaluations of five resilience features, the novelty of this study is its proposed lifecycle-based framework that shifts UAV security from mitigation to embedded resilience. Practical trade-offs that include weight, power and relative costs as well as the position of the framework in relation to existing standards such as NIST CSF and MITRE frameworks are discussed.
