Social bots have been evolving over time, and they have become more advanced and sophisticated while avoiding existing detection methods. This has made some of the original social bot detection methods no longer superior and detecting social bots has become a long and arduous task. The field of social bot detection currently suffers from a small number of publicly available relevant datasets and requires manual annotation of a large amount of data. This paper propose ALRGCN, a detection framework that combines active learning with Relational Graph Convolutional Neural networks (RGCN), to address the problem of high cost of manually labeling large amounts of data. The main idea is to use active learning methods to expand the labeled dataset and maximize the value of manual labeling. Active learning uses a seed selection algorithm to construct an initial training set and an uncertainty sampling method to filter out samples with high information entropy for training by a classification model, aiming at classifying data that are prone to misclassification by a professional's experience. Given that social bots usually appear as clusters, this paper introduces RGCN to capture its network structure features. RGCN can effectively analyze the attributes of a node and its neighboring nodes, which in turn helps that node to perform classification. The experiments are conducted on the TwiBot-20 dataset, and ALRGCN achieves a 2.83% improvement on F1 compared to the baseline experiments conducted for use. The experimental results demonstrate that ALRGCN can be more effective in detecting social bots with smaller labeled samples.

源代码作者身份识别有助于解决恶意代码攻击溯源、代码剽窃、软件侵权等问题,本文提出一种新的基于图匹配网络和抽象语法树的源代码作者身份识别方法.首先,通过删除注释、统一换行符、制表符预处理源代码,消除不同集成开发环境和代码布局的影响;然后,基于数据增强抽象语法树将源代码转换为树结构,添加不同类型的边构建代码特征图,不仅关注语法和句法特征,还提取了代码中数据流和控制流特征;接着使用特征图训练图匹配神经网络,生成源代码的图嵌入特征向量;最后,使用孪生神经网络对输出的两个图嵌入特征向量进行计算,识别源代码作者身份.实验结果表明,本文的方法在包含1000位程序员的Google Code Jam数据集上达到了95.60％的准确率,与现有的源代码作者身份识别方法相比,提高了准确率和扩展性.

社交机器人一直在应用中不断发展,并且为了逃避现有的检测方法,变得更加先进和复杂,较大地影响了原有部分社交机器人检测方法的效果.检测社交机器人成为了一项漫长而又艰巨的工作.在社交机器人检测领域中,目前存在着已公开相关数据集较少的情况,需要人工标注大量的数据.本文提出了一种结合主动学习与关系图卷积神经网络(RGCN)的检测方法——ALRGCN,用以解决人工标注大量数据成本较高的问题.其主要思路是利用主动学习方法来扩充标记数据集,以最大化人工标注的价值.主动学习利用种子选择算法构建初始训练集以及不确定性采样方法筛选出较高信息熵的样本,交由分类模型进行训练,旨在通过专业人员的经验来人工标注一些分类器难以分类的数据.鉴于社交机器人通常以集群的形式出现,本文引入了 RGCN来捕捉其网络结构特征.RGCN可以有效地分析节点及其相邻节点的属性,进而帮助该节点进行分类.实验在TwiBot-20数据集上进行,通过对比进行使用的基线实验,ALRGCN在F1上取得了 2.83％的提升.实验结果证明,ALRGCN在标注样本更小的情况下可以更有效地检测出社交机器人.

现有的基于覆盖率反馈的灰盒模糊测试技术在漏洞挖掘实践当中获得了巨大的成功.然而,以AFL为代表的灰盒模糊测试器在发现整数类型漏洞方面仍有不足.这类模糊测试器使用简单的整数替换方法,没有解决在哪里变异和如何变异的问题.为了解决这些问题,本文提出了解决方案IFuzz.该方案采用自主设计的通用模糊测试hook框架来获取额外的轻量级运行时信息,进而进行逐字节扰动变异并运用这些信息以推断整数位置,最后通过给字节分配不同的能量来进行整数变异.实验评估结果表明,该方法能有效提高整数类型漏洞的模糊测试效率.

随着信息过载问题日益严重,对新闻长文本进行自动摘要,不仅可以帮助读者实现快速精准地浏览,也能够减少撰写摘要所需要的人力物力.现有的自动文摘算法主要分为抽取式和生成式两大类,前者注重从原文抽取关键句子,后者倾向于模仿人类总结摘要的过程对原文进行理解和压缩.然而现有的算法中,面向中文长文本摘要的研究较少,并且大多数算法都聚焦于提升生成摘要的可读性而忽略了事实准确性.针对以上问题,本文提出了一种基于实体注意力的生成式摘要算法,将实体注意力与时序注意力相结合,并将实体信息引入了损失函数.经实验,所提出的模型在中文长文本数据集CLTS上取得了45.86的ROUGE-L得分,和其他模型相比能生成具有更高可读性的摘要.

The evolution prediction of network public opinion events is a key step in monitoring and management of the complicated network public opinion, as well as in preventing the sudden outbreak of public opinion crisis； however, less attention is paid on the public opinion evolution prediction, especially in the social network. In this paper, an evolution prediction model for public sentiment events on the social network is proposed, in which the sentiment value of comment texts is termed as the object of evolution prediction and the semantic similarity between sentiment words and comment texts concerning some public events is used to construct a corresponding graph structure for each period of event development, then a model for predicting the sentiment time series is constructed by combining gated recurrent unit (GRU) and graph attention network (GAT). To further verify the effectiveness of the proposed model, the text of comments on the Freud event in Twitter is selected as the dataset and the comparative experiments are conducted with the prediction model based on graph convolutional network. The experimental results show that the R2 coefficient of determination of the proposed model is 0.569, the mean absolute error (MAE), mean square error (MSE) and root mean square error (RMSE) are all smaller than those of the graph convolutional network-based prediction model, which can demonstrate the better performance of the proposed model concerning the evolution prediction of the public sentiment events under the social network environment.

Python is a concise language which can be used to build lightweight tools or dynamic object-orientated applications. The various attributes of Python have made it attractive to numerous malware authors. Attackers often embed malicious shell commands into Python scripts for illegal operations. However, traditional static analysis methods are not feasible to detect this kind of attack because they focus on common features and failure in finding those malicious commands. On the other hand, dynamic analysis is not optimal in this case for its time-consuming and inefficient. In this paper, we propose PyComm, a model for detecting malicious commands in Python scripts with multidimensional features based on machine learning, which considers both 12 statistical features and string sequences of Python source code. Meanwhile, three comparison experiments are designed to evaluate the validity of proposed method. Experimental results show that presented model has achieved an excellent performance based on those practical features and random forest (RF) algorithm, obtained an accuracy of 0.955 with a recall of 0.943.

At present, static text passwords are still the most widely-used identity authentication method. Password-generation technology can generate large-scale password sets and then detect the defects in password-protection mechanisms, which is of great significance for evaluating password-guessing algorithms. However, the existing password-generation technology cannot ignore low-quality passwords in the generated password set, which will lead to low-efficiency password guessing. In this paper, a password-generation model based on an ordered Markov enumerator and critic discriminant network (OMECDN) is proposed, where passwords are generated via an ordered Markov enumerator (OMEN) and a discriminant network according to the probability of the combination of passwords. OMECDN optimizes the performance of password generation with a discriminative network based on the good statistical properties of OMEN. Moreover, the final password set is formed by the selected passwords with a higher score than the preset threshold, which guarantees the superiority of the hit rate of almost all ranges of combinations of passwords over the initial password set. Finally, the experiments show that OMECDN achieves a qualitative improvement in hit rate metrics. In particular, regarding the generation of 10(7) passwords on the RockYou dataset, the matching entries of the password set generated by the OMECDN model are 25.18% and 243.58% higher than those generated by the OMEN model and the PassGAN model, respectively.

要想实现对纷繁复杂的网络舆情的监控和管理,预防舆情危机的突发状况,一个关键的解决方案就是对网络舆情事件的发展趋势进行预测.然而,目前针对舆情演变预测的研究工作却十分有限,尤其是社交网络环境中的舆情演变预测.本文将评论文本的情感值作为演变预测的对象,利用情感词和舆情事件中评论文本的语义相似度,为事件发展的每个时间段都构造一个对应的图结构,再结合门控循环单元(GRU)与图注意力网络(GAT)对情感时间序列进行预测.为了验证模型的有效性,本文以Twitter中弗洛伊德事件的评论文本作为数据集,开展与基于图卷积网络的预测模型的对比实验.实验结果表明,本文提出模型的R2决定系数为0.569,平均绝对误差(MAE)、均方误差(MSE)和均方根误差(RMSE)均小于基于图卷积网络的预测模型,能较好地实现舆情事件中评论文本的情感演变预测.

近年来,模糊测试技术已经在软件系统漏洞挖掘和脆弱性检测中得到了广泛的使用.模糊测试主要对收集到的种子进行特定变异来获得大量的测试用例,用于执行目标程序,触发程序中潜在的崩溃.在测试过程中,如何从种子队列中选择合适的种子进行变异是影响模糊测试性能的一个重要因素,目前的策略存在一定的盲目性,影响了模糊测试的效率.因此,本文提出了一种基于深度学习测试用例的输入文件分类方法,利用深度学习技术对模糊测试过程中生成的大量测试用例和执行覆盖率情况进行模型训练,学习输入文件的结构和覆盖状态之间的关系.本文基于AFL实现了一种利用此方法判断种子优先级的模糊测试策略,经过实验评估,该方法对覆盖率提升和崩溃的发现有一定的积极作用.

During the outbreak of a specific social event, end-to-end automatic opinion summarization is needed to analyze the surge of text related to the event. However, in the Chinese domain, the major existing works either emphasize salient aspects or sentence extraction in a discrete fashion with no consideration of human readability, or focus on short Chinese text. To remedy the drawbacks of these methods, in this paper, an event-based opinion summarization model for long Chinese text with a parameter fusion mechanism is proposed to address the human readability and imbalance issue of the event-based datasets. In particular, to capture the sentiment information in the source article in an end-to-end manner, a sentiment attention layer and a sentiment cross-entropy loss function are presented. In addition, when facing the issue of imbalance in event-based datasets, a parameter fusion mechanism inspired by the federated learning is proposed, which can further improve the human readability of the output. Finally, the efficacy of the proposed model is substantiated via comprehensive experiments performed on the collected event-based datasets, the Chinese long text summarization dataset (CLTS), and the cable news network/daily mail (CNN/DM) dataset using Recall-Oriented Understudy for Gisting Evaluation (ROUGE) and sentiment classification accuracy metrics. In addition, the source code is made available at https://github. com/ShawnYoung97/opinion-sum.

近年来,恶意软件威胁事件大规模地破坏正常的计算机系统秩序,进而造成大量的经济损失影响社会正常运转.经过对已有恶意软件分类方法和流行人工智能方法的研究,本文提出了一种基于BERT的预训练汇编文本嵌入方法,利用图神经网络对恶意家族分类,效果明显优于传统方法.

中文短文本分类是自然语言处理的重要领域之一,文中提出了一种基于多维度图神经网络的短文本分类方法,通过对文档中的中文词语进行建模,分别构建序列边、词频边、主题边与结点信息相融合以达到提取深度语义信息的目的,提高图神经网络的分类能力.通过和现有方法对比,本文提出的基于多维度图神经网络的短文本分类方法具有更高的准确率,能够有效的达到中文短文本分类的目的.

近年来,随着模糊测试的不断发展,定向模糊测试逐渐成为研究热点,其广泛应用于补丁测试、漏洞复现和静态分析验证等方向.当前定向模糊测试仍然存在一些问题,即距离不同的种子能量分配不均衡的问题.为了解决该问题,本文提出一种基于时间分片的定向模糊测试工具SliceAFL.在程序运行的不同时间,为不同距离的种子采用不同的能量调度算法,以平衡各种状态下的种子能量.SliceAFL对7个真实程序进行测试,与AFLGo相比,在长路径的CVE复现速度提高了30％,并且覆盖率和crash数量均有提升.

In a complex network, some nodes are relatively concentrated in topological structure, thus forming a relatively independent node group, which we call a community. Usually, there are multiple communities on a network, and these communities are interconnected and exchange information with each other. A node that plays an important role in the process of information exchange between communities is called an inter-community bridge node. Traditional methods of defining and detecting bridge nodes mostly quantify the bridging effect of nodes by collecting local structural information of nodes and defining index operations. However, on the one hand, it is often difficult to capture the deep topological information in complex networks based on a single indicator, resulting in inaccurate evaluation results; on the other hand, for networks without community structure, such methods may rely on community partitioning algorithms, which require significant computing power. In this paper, considering the multi-dimensional attributes and structural characteristics of nodes, a deep learning-based framework named BND is designed to quickly and accurately detect bridge nodes. Considering that the bridging function of nodes between communities is abstract and complex, and may be related to the multi-dimensional information of nodes, we construct an attribute graph on the basis of the original graph according to the features of the five dimensions of the node to meet our needs for extracting bridging-related attributes. In the deep learning model, we overlay graph neural network layers to process the input attribute graph and add fully connected layers to improve the final classification effect of the model. Graph neural network algorithms including GCN, GAT, and GraphSAGE are compatible with our proposed framework. To the best of our knowledge, our work is the first application of graph neural network techniques in the field of bridge node detection. Experiments show that our designed framework can effectively capture network topology information and accurately detect bridge nodes in the network. In the overall model effect evaluation results based on indicators such as Accuracy and F1 score, our proposed graph neural network model is generally better than baseline methods. In the best case, our model has an Accuracy of 0.9050 and an F1 score of 0.8728.

针对网络空间中缺乏可靠来源的访问控制列表的问题,提出了基于IP特征分析的访问控制混合模型.模型共分为2层:1)通过分析大量基于流的时间特征、空间特征和速度特征,利用统计学与值域压缩方法,挖掘恶意IP的流之间和良性IP的流之间的关联信息差异,形成基于IP特征的特征空间;2)采用1)中提取的特征,结合无监督学习和有监督学习,形成访问控制混合模型,然后通过访问控制混合模型,生成访问控制列表.提出的方法在UNSW-15公开数据集、CICIDS2017公开数据集以及作者实验室人工收集的数据集上进行了测试和验证.实验结果表明,提出的方法的精确率为100％,采用该方法获得的可用于访问控制列表的IP数目要多于其他算法.

Source code authorship attribution aids in resolving software infringement and plagiarism issues, it is also helpful with the identification of the author of malware in the field of cybersecurity. However, traditional de-anonymization methods mainly extract semantic and lexical features, ignoring code structural features such as control flow and data flow, and the feature vectors generated by them are sparse vectors which are prone to overfitting when dealing with large-scale programmer’s de-anonymization. In this paper, we proposed a novel code de-anonymization model, which is based on the AST, by extracting both AST and structural features, the model builds the feature graph representation of Python file and then uses graph neural network to realize code de-anonymization. Experimental results show the high accuracy, we achieve an accuracy of 98.06% with 117 programmers, and 95.60% with 1000 programmers on Google Code Jam Python datasets.

对网络安全从业人员来说,基于暗网市场的研究扮演了一个非常重要的角色.与此同时,由于暗网市场文本数据本身的特点,针对暗网市场的命名实体识别研究面临着巨大的挑战.提出了一个针对暗网市场文本的命名实体识别系统(DNER),使用卷积神经网络(CNN)进行字符向量化以学习单词形态特征,使得系统能从单词级和字符级2方面学习特征.同时,将双向长短时记忆神经网络(Bi-LSTM)应用于暗网市场文本的命名实体识别,并采用CRF模型实现序列标签之间的约束性.此外,对暗网市场文本进行了词性标注.最后,比较了DNER和其他基本命名实体识别模型在暗网市场文本命名实体识别的效果.实验结果显示,DNER系统在暗网市场文本的准确率达到98.59％,召回率达到93.82％,F1值达到了96.15％.

In order to reduce the loss caused by the attack of ransomware, this paper proposed a framework (AntiRansomware System, ARS) based on the family characteristics and the traditional malicious code detection technology. Specifically, a method is proposed to detect ransomware based on file behavior statistics. It uses the minifilter to collect the file behavior information of benign and ransomware as train set, and uses a variety of supervised classification algorithms to train classifier for runtime detection. Then, the copyonwrite technology is utilized to dynamically backup modified files in the program at runtime, and the detection results are used to determine whether to restore files. Finally, a prototype system is developed and tested. The results show that, under the premise of ensuring the security of the data file, the ARS framework can effectively prevent the ransomware attack and reduce the harm of ransomware.

Domain Name System (DNS) tunnels, established between the controlled host and master server disguised as the authoritative domain name server, can be used as a secret data communication channel for malicious activities. Owing to the ready evasion of the DNS traffic to bypass the network security mechanism, DNS tunnelling can cause severe damage. Thus, an in-depth and comprehensive understanding of the various detection technologies is of considerable importance when facing this type of threat. However, most of the existing reviews focus on a single aspect of the DNS tunnel detection technologies, such as methods based on machine learning, traffic, and payload analysis. In addition, few studies have conducted comprehensive investigation that includes a sequentially integrated range of literature in this researchfield, or have analysed the latest literature on DNS tunnels. This paper reviews these detection technologies from a novel perspective of rule-based and model-based methods with descriptions and analyses of the DNS-based tools and their corresponding features. To the best of our knowledge, this is the first study to comprehensively discuss and analyse DNS tunnel detection in a novel and specific classification fashion from various aspects in detail, covering almost all the detection methods developed from 2006 to 2020. Furthermore, a comparative analysis of detection methods and several suggestions for future research directions are presented.