Rust is a promising language by providing strong safety guarantees through its advanced features including borrowing semantics and lifetime checking, and has been adopted in security-critical domains. However, Rust programs may still be vulnerable to sensitive data leak issues due to its lack of information flow checking capabilities. As a result, these data leaks undermine Rust’s strong security guarantees. In this paper, to fill the current gap, we propose a novel information flow checking approach for Rust language by leveraging static taint analysis, to detect potential data leak issues. We first propose an approach to annotate sensitive data within Rust programs by utilizing Rust’s macro features. We then design an information flow checking algorithm based on static taint analysis, in which we use tainted abstract domains to model data sensitivity and use transfer functions to model the data flow. Furthermore, we design a context-sensitive algorithm to track the propagation of tainted values across procedure boundaries by leveraging a functional approach. We implement our approach in a software prototype RustGuard by extending Rust’s official rustc compiler and conduct extensive evaluations with it. Our evaluation results demonstrate that our approach achieves precision and recall both of 91.67
Machine learning-based encrypted traffic classification achieves high accuracy when training and testing samples originate from the same proxy protocol. However, in real-world scenarios where the deployed proxy protocol is uncertain, cross-protocol distributional gaps lead to significant degradation in classification performance. Encrypted proxy protocols generally encapsulate and encrypt transport-layer payloads without padding or compression, thereby introducing structured protocol-specific encapsulation bias. We propose a signature-based cross-protocol encrypted proxy traffic classification approach (SPTC) to address the challenge of cross-protocol classification. SPTC first performs traffic length sequence alignment to mitigate encapsulation-induced bias through bias calculation and calibration. It then extracts signature-based features by constructing cumulative sum paths and deriving high-order path signature descriptors that capture the global geometric characteristics of traffic flows. Finally, the method employ a random forest classifier to achieve robust cross-protocol classification. SPTC achieves up to 99.3
Encrypted traffic classification plays a vital role in network security and management. While existing techniques that rely on byte or attribute sequences show promising results in traffic classification, they still have several limitations, including: (1) the sequence-based representations fall short in preserving the multi-modal information and spatial-temporal characteristics of datagrams; (2) the complexity of sequence models increases rapidly as the sequence length grows; (3) training classifiers for specific scenarios often involves a time-consuming and labor-intensive process of labeling data. In this paper, we propose representing datagrams as two homogeneous multi-modal spatial-temporal matrices that retain information from various modalities while maintaining the traffics spatial-temporal characteristics. Then, we introduce spatial-temporal state space models to better align with the inherent properties of these matrices and reduce computational complexity. Furthermore, we develop a self-supervised training paradigm called inter-flow contrast learning to capture flow semantics by utilizing large volumes of unlabeled data. Experimental results demonstrate that our method significantly outperforms state-of-the-art approaches across five real-world traffic datasets. We will release our code publicly after the double-blind review process concludes.
Intrusion Detection Systems (IDS) based on machine learning (ML) face severe threats from adversarial attacks. A common defense method is to deploy auxiliary networks. However, these auxiliary networks, while defending against adversarial attacks, often make alterations to clean examples (examples without adversarial perturbations), which are typically negative changes. These alterations lead to a decrease in the classification accuracy of clean examples by IDS models, resulting in a high rate of false positives and false negatives. We proposed the Diverse-Task Generative Adversarial Network (DTGAN) to address this challenge. DTGAN is a training strategy for auxiliary networks based on generative adversarial networks. By analyzing the data distribution and task requirements of different types of examples, we classified the examples received by IDS and design different learning tasks for each type of example during the training of the auxiliary network. This approach results in an auxiliary network that considers the effects of handling different examples, ensuring that clean examples maintain their original data distribution after processing and avoiding any negative impact on clean examples caused by the auxiliary network. Experiment results demonstrated that DTGAN can defend against adversarial attacks while maintaining the classification accuracy of clean examples for IDS models. Through DTGAN defense, IDS models based on CNN architecture can achieve an accuracy of over 80
Advanced Persistent Threats (APTs) pose significant challenges to cybersecurity due to their stealth and persistence. Provenance-based intrusion detection methods address this by first modeling historical system activities using audit logs, and then identifying diverse APT patterns through contextual analysis. Given the scarcity of labeled APT data, recent studies have adopted self-supervised learning methods to capture benign system behaviors, and then detect anomalies as deviations from learned normal patterns. However, existing methods struggle to distinguish sophisticated benign activities from attack patterns due to their limited semantic understanding of system behaviors. In this paper, we introduce TRAP, an anomaly detection system that employs multi-scale training strategies to optimize provenance graph representations for enhanced attack detection. First, a node-level feature reconstruction task is designed to extract fine-grained node semantics within system behaviors. Second, a contrastive learning technique is employed to align the edge- and graph-level contextual semantics across diverse augmented provenance graph views, fostering a more comprehensive representation of behavioral patterns. Third, to bolster the efficacy of contrastive learning, we devise a tailored graph augmentation strategy that exploits the temporal evolution dynamics of the provenance graph to produce multiple augmented views that balance semantic consistency and diversity. Extensive experiments demonstrate that TRAP outperforms existing APT detection systems. Code is available at: https://github.com/xueboQiu/TRAP.
