Accurate detection of third-party libraries (TPLs) is essential for securing millions of Android applications, enabling vulnerability tracking, malware detection, and supply chain security auditing. However, existing TPL detection benchmarks have limited scale and outdated coverage, which hinders a rigorous and fair evaluation of the tool’s effectiveness in real-world scenarios. To bridge this gap, we present TPL-Benchmark, a comprehensive benchmark comprising over 6,000 real-world applications with precise, version-level annotations for both remote and local dependencies. More specifically, we develop TPL-Extractor, an efficient and accurate automated framework for version-level dependency annotation, aiming to address the high labor cost and limited precision of prior ground-truth construction methods. Equipped with this benchmark, we reproduce and evaluate twelve state-of-the-art TPL detection tools, revealing optimization directions in adaptability to R8-era transitions, version resolution accuracy, candidate&–library correspondence granularity, similarity threshold robustness, and efficiency/scalability on large app or library sets. Beyond benchmarking, we further analyze how TPL characteristics influence downstream security tasks, including vulnerability detection, malware analysis, secret leakage assessment, and LLM-based evaluation. Collectively, our study advances the understanding of TPL detection and establishes a foundation for more robust, adaptive, and scalable security analyses in the Android ecosystem.
Deep Reinforcement Learning (DRL) has demonstrated remarkable capabilities in domains such as robotics, finance, and autonomous systems. With the increasing cost of training, DRL models are increasingly shared and reused via model marketplaces, cloud platforms, and open-source repositories. This trend exposes DRL systems to action-level backdoor attacks, where adversaries inject malicious behaviors into models during the training phase and later manipulate their action outputs at deployment, potentially endangering safety-critical applications (e.g., causing vehicle collisions or drone crashes). Despite demonstrating feasibility, such attacks typically rely on handcrafted, task-specific backdoor rewards, which severely limit their generality and practicality, thereby causing practitioners to underestimate the true threat they pose. In this paper, we propose ADAPDOOR, the first general attack framework for adaptive backdoor reward exploration. ADAPDOOR coarsely initializes the backdoor reward from benign reward statistics and iteratively fine-tunes it based on the performance feedback from both benign and backdoor tasks. This enables stable action-level backdoor injection across diverse tasks without relying on extensive trial-and-error and expert knowledge. We conduct comprehensive experiments across 3 DRL algorithms, 11 environments, and 53 backdoor tasks, showing that ADAPDOOR outperforms existing baselines by 42.0% to 144.2%, under varying agent counts, action spaces, and reward signal types. Our findings reveal that action-level backdoors pose a more severe and realistic threat to DRL systems than previously recognized. Furthermore, we evaluate three potential defenses to explore pathways for mitigating this threat. The source code and task configurations of our evaluation are publicly available to ensure reproducibility and facilitate further research.
Intrusion detection systems (IDS) are crucial for protecting the security of network devices. In a dynamic network environment, network attack behavior is constantly changing. IDS developed using closed datasets has limited detection capabilities and cannot effectively respond to potential unknown attacks. Existing methods exhibit poor generalization to unknown attacks and have rigid decision boundaries that struggle to adapt to evolving network attacks. To address this challenge, we propose a known/unknown attack detection method based on inter-class relationships with the collaboration of virtual class and soft labels, which includes: 1) feature space optimization, 2) quantification of uncertainty for unknown attack detection. Firstly, to construct clear decision boundaries in high-dimensional space and reserve representation space for unknown attacks, we design to adaptively insert a virtual class in the neighborhood of known attack categories, reducing the intra-class distance of known attacks and expanding the inter-class intervals. Secondly, we learn soft-label prototypes from known samples to characterize the similarity and difference relationships among known attack categories. We quantify classification uncertainty by computing the Kullback-Leibler divergence between these prototypes and the predicted outputs, after which a Gaussian Mixture Model is applied to model the divergence distribution and adaptively identify unknown attacks. Extensive experimental results on CICIDS2017, NSL-KDD, and CICIoV 2024 demonstrate that the proposed method achieves superior performance across various evaluation metrics. Compared with state-of-the-art methods, our approach improves the harmonic mean of known and unknown class detection accuracy by over 7% on NSL-KDD, while specifically boosting the unknown attack detection accuracy by approximately 1.12%,5.24% on the CICIDS2017,NSL-KDD datasets, respectively.
Understanding adversarial attacks is crucial for the secure deployment of visual recognition systems. While ensemble attacks combine the strengths of transfer-based and query-based methods to generate highly transferable adversarial examples, their practicality is often limited in real-world scenarios where the number of queries is restricted. In this paper, we propose a novel frequency-driven ensemble adversarial attack, termed WPEBA, that enables efficient black-box attacks with a minimal number of queries. We first apply wavelet packet decomposition (WPD) to decompose images into frequency sub-bands. Driven by a unified ensemble loss across multiple surrogate models, we adaptively adjust frequency-band weights using internal gradient feedback and jointly generate gradient-based and block-based perturbations in the frequency domain. The perturbed components are then reconstructed into the spatial domain via inverse WPD to produce adversarial examples for querying the target model. Finally, we utilize the query feedback from the target model to dynamically update the surrogate-model weights, guiding the attack in subsequent iterations. Extensive evaluations demonstrate that WPEBA achieves an average attack success rate exceeding 99% with merely one or two queries across six distinct standard architectures. Furthermore, it maintains effective attack performance against models equipped with robust defenses and the Google Cloud Vision API. Overall, our method provides a new and practical approach for evaluating general model robustness.
