Adversarial sample attacks severely threaten deep learning (DL)-based XSS detection models. A transformative solution is to actively mine adversarial samples to expose vulnerabilities preemptively. This paper proposes a novel XSS adversarial sample attack method, XA2-ES. We first refine data processing to vectorize samples and establish a Tri-Agent framework with optimized Soft Actor-Critic (SAC) modules to generate suitable candidate actions. Then, we propose an action mask and a feedback mechanism, avoiding performing infeasible or ineffective actions. Finally, we construct a shadow model to identify the most reliable actions from all candidates and update each agent every 5 mutations. Experimental results show that XA2-ES not only significantly outperforms existing work in effectiveness and stealthiness, but also offers novel inspirations for future work.

Web page tampering detection is crucial in web threat perception. Current methods rely on monitoring historical changes of web pages to identify anomalies. These approaches often struggle to effectively distinguish between tampering and benign changes, especially in the presence of numerous dynamic pages. Furthermore, the increasing complexity of website structures places more resource demands on tampering monitoring and makes some malicious alterations more covert and challenging to detect. We propose a web page tampering detection based on pretraining with dynamic temporal graphs. The core of the method involves constructing a website temporal graph model based on evolutionary information, and enhances the graph feature perturbations to expose concealed tampering behaviors. Specifically, the framework's autoencoder is composed of enhanced DySAT, enabling it to handle dynamic data. We introduce DySAT, bolstered with GATv2, to capture dynamic attention. Additionally, we design a temporal masking mechanism and prediction error to improve the effectiveness of generative self-supervised learning in temporal graph pretraining. Experimental results on Webpage Tampering Dataset (WPT-Dataset) demonstrate that our method outperforms other comparative approaches in terms of both detection efficacy and stability. Furthermore, the research findings on the anomaly detector and model performance provide direction for the practical application of our method.

Edge coverage-guided fuzzing has demonstrated remarkable achievements in vulnerability discovery. Some studies with fine-grained coverage metrics have been proposed to enhance the vulnerability mining capabilities of fuzzing by capturing more program paths. However, this refinement often results in a significant increase in seeds, which are highly homogeneous and may limit vulnerability detection. Additionally, finer granularity requires more bitmap hits, increasing the risk of hash collisions. To address these shortages, the paper proposes the structure of a basic block unit with multiple predecessors and successors (referred to as MPS). Then, a fine-grained coverage method called MPS-Fuzz is designed based on the MPS structure. In this approach, it is convenient to exclude basic blocks involving loop structures when determining MPS units, which helps reduce seed homogeneity. Additionally, we introduce an additional bitmap to record the coverage status of MPS units, ensuring that the collision rate of the edge bitmap does not increase. Moreover, these additional operations do not incur excessive time overhead. To demonstrate the properties of the MPS-Fuzz, we implement our approach on AFL and conduct experiments on 16 benchmarks from FuzzBench and Unifuzz. The result indicates that, after 24-hour fuzzing, MPS-Fuzz explores an average of 9.6% more edges and an average of 25.7% more bugs than AFL. Compared to other fine-grained coverage methods (N-gram and PathAFL), MPS-Fuzz also achieves better performance. Moreover, MPS-Fuzz has discovered a previously unknown bug on real-world program and got a CVE assigned.

In the AI-driven era, NVIDIA CUDA libraries have become indispensable for accelerating compute-intensive tasks, yet their security assessment remains critically understudied due to closed-source code and unique programming paradigms. Existing efforts primarily target CUDA compiler vulnerabilities (e.g., NVCC), but overlook broader library-specific risks. This paper addresses the challenges of fuzzing CUDA libraries: (1) context-dependent API ordering and closed-source opacity hinder the synthesis of valid, diverse API sequences; and (2) implicit parameter dependencies reduce the effectiveness of mutation for LLM-generated harnesses. Anewtool called CuFuzz has been proposed, aimed at uncovering potential vulnerabilities in the CUDA libraries. CuFuzz has the ability to generate testing harnesses for various CUDA library functions from scratch, perform efficient parameter mutation, and adapt to the needs of multiple CUDA libraries. First, LLMs are used to extract semantic relationships from CUDA documentation and sample codes, constructing a knowledge graph that prioritizes API interactions and contextual dependencies. The API coverage bitmap is proposed to guide the fuzzer to explore under-tested library functions. In addition to harness generation, the API knowledge graph is also combined with compiler diagnostics to repair erroneous harnesses, thereby improving compilation success rates. Subsequently, CuFuzz employs the LLMs to analyze and decouple parameter dependencies, separates out the mutable parameters, and performs parameter-isolated mutation on them to enhance mutation efficiency. Evaluated across three CUDA releases (12.4, 12.7, and 13.0) on eight widely adopted libraries (e.g., cuBLAS, cuFFT), CuFuzz achieves 2.97× higher API coverage and 4.0× superior API edge coverage relative to baseline (Fuzz4all), on average. The experiments uncovered 6 unknown bugs, validated by NVIDIA’s security team and obtained 2 CVEs.

AI coding agents such as Claude Code and Gemini CLI increasingly extend themselves with third-party skills: markdown packages bundling natural-language instructions, executable scripts, and tool permissions. Because a skill is at once code and agent-facing instruction, it introduces a supply chain dependency whose risk is neither pure code nor pure prompt. Detection tools have never been measured against verified ground truth spanning this hybrid space, leaving their effectiveness unknown and wild-only evaluations biased. We present MalSkillBench, the first runtime-verified benchmark of malicious agent skills: 3,944 malicious skills labeled along a three-dimensional taxonomy of 108 cells. Of these, 3,214 come from a closed-loop Generate-Verify-Feedback pipeline admitting only samples whose malicious behavior fires inside a Docker sandbox under system-call monitoring and an LLM judge; we add 703 in-the-wild and 4,000 matched benign skills. Our measurements are consistent: code injection reaches 94.5

Graph Neural Networks (GNNs) have achieved remarkable success in modeling structured data. Recent studies, however, reveal that they are highly vulnerable to backdoor attacks, which can implant triggers into training data to mislead predictions on nodes injected with triggers while maintaining accuracy on clean inputs. Despite recent advances, existing graph backdoor attacks often rely on explicit training interventions and substantial trigger injection while focusing solely on single-node misclassification, which limits their practicality in real-world deployments. To address these limitations, we propose a clean-label graph backdoor attack that induces one-hop neighborhood misclassification under a minimal trigger injection budget. Without altering target nodes’ features or labels, our method attaches a single trigger node to a target node, thereby misclassifying both the target and its immediate neighbors as the target class. To maximize effectiveness while preserving stealthiness, we propose a poisoned node selection strategy guided by semantic consistency and structural activeness, and design a conditional diffusion-based trigger generator optimized with multiple auxiliary objectives. Extensive experiments on multiple real-world benchmarks and mainstream GNN architectures show that our approach achieves over 95% attack success rate on both target nodes and their neighbors in most settings, including under state-of-the-art defenses. These findings underscore the urgent need for more robust graph learning systems and reveal novel attack surfaces in graph security.

Existing works on federated learning (FL) backdoor attacks often assume FL as a long-term process, where the global model is continuously trained on a dynamic dataset, and attackers launch rapid attacks near the convergence stage of the global model. However, in practical scenarios, FL can also be a short-term process. When static datasets are used, the training process may be terminated once the global model approaches convergence. For this scenario, we propose Early Stage Backdoor Attack (ESBA), a stealthy federated learning backdoor attack designed for the phase before global model convergence. The success of ESBA lies in utilizing a custom loss function that mitigates local forgetting, backdoor model parameter update constraints based on global model training inertia, and a centralized optimization mechanism for backdoor model updates that leverages cosine similarity and L2 norm. In addition, we observe that FL backdoor attacks exhibit abnormal statistical patterns in specific parameter dimensions. Motivated by this insight, we propose a novel anomaly detection metric and design Parameter Distribution Filtering Mechanism (PDFM). PDFM leverages HDBSCAN clustering on historical model updates from clients to identify malicious updates with statistically anomalous characteristics. We conduct comprehensive evaluations of ESBA and PDFM on six datasets. Experimental results show that ESBA can bypass nine advanced defense mechanisms. Moreover, PDFM can effectively defend against six advanced FL backdoor attack methods, including ESBA.

With the widespread application of the Go language, the demand for vulnerability detection in Go programs is increasing. Existing detection models and methods have deficiencies in extracting source code features of Go programs and mainly focus on detecting concurrency vulnerabilities. In response to these issues, we propose a Go program vulnerability detection method based on a graph neural network (GNN). The core of this approach is to utilize GraphSAGE to extract the global structure and deep semantic information of each concurrent function, maximizing the learning of concurrency vulnerability features. To capture contextual information of fine-grained code fragments in source code, we employ taint analysis to extract taint propagation chains and use a Transformer model with a multi-head attention mechanism, based on lexical analysis, to extract fine-grained vulnerability features. We integrate graph-level and token-level features to maximize the detection of various complex types of vulnerabilities in Go source code. Experimental results on a real-world vulnerability dataset demonstrate that our model outperforms existing detection methods and tools, achieving an F1-score of 91.35%. Furthermore, ablation experiments confirm that the proposed feature fusion method effectively extracts deep vulnerability features.

Unknown attacks pose a significant threat to current cyber defenses. Traditional methods for detecting abnormal user behaviors rely on explicit associations and content information, often overlooking implicit causal relationships. Additionally, the frequent emergence of new attack types and the scarcity of training data limit their effectiveness. The paper proposes a novel approach for detecting abnormal user behaviors using large language models (LLMs), addressing these challenges under low-resource conditions. Our method extracts implicit causal relationships from system logs to build behavior graphs and employs label-free graph contrastive invariant learning to generate causal feature vectors. A multi-agent framework, including narrator and decision- maker agents, is used to improve descriptive text generation, while the Translator more efficiently converts causal vectors into meaningful descriptions. Experimental results on the WAB-dataset demonstrate that implicit causal relationships enhance the graph structure's ability to represent abnormal behaviors. The integration of LLMs enables superior behavior analysis with fewer resources compared to traditional methods. Additionally, the comprehensibility of the generated texts and the efficiency of the Translator provide a strong foundation for supporting security professionals in understanding and analyzing abnormal behaviors in real-world scenarios.

Advancements in AI have led to agents in networked environments increasingly mirroring human behavior, thereby blurring the boundary between artificial and human actors in specific contexts. This shift brings about significant challenges in trust, responsibility, ethics, security and etc. The difficulty in supervising of agent behaviors may lead to issues such as data contamination and unclear accountability. To address these challenges, this paper proposes the "Network Behavior Lifecycle" model, which divides network behavior into 6 stages and systematically analyzes the behavioral differences between humans and agents at each stage. Based on these insights, the paper further introduces the "Agent for Agent (A4A)" paradigm and the "Human-Agent Behavioral Disparity (HABD)" model, which examine the fundamental distinctions between human and agent behaviors across 5 dimensions: decision mechanism, execution efficiency, intention-behavior consistency, behavioral inertia, and irrational patterns. The effectiveness of the model is verified through real-world cases such as red team penetration and blue team defense. Finally, the paper discusses future research directions in dynamic cognitive governance architecture, behavioral disparity quantification, and meta-governance protocol stacks, aiming to provide a theoretical foundation and technical roadmap for secure and trustworthy human-agent collaboration.

With the rapid advancement of AI, agents are gradually capable of mimicking human behavior and performing complex tasks within digital ecosystems. As the boundary between human and agent behaviors becomes indistinguishable, new challenges arise for governance, trust, and ethical oversight in online environments. This paper introduces the concept of Agent Behavior and systematically compares it with human network behavior, summarizing both into a unified framework called the Network Behavior Lifecycle. Recognizing the limitations of traditional governance approaches, the paper proposes the Agent-for-Agent (A4A) paradigm, which embeds specialized regulatory agents within digital ecosystems to provide adaptive, layered, and resilient oversight. Drawing on institutional governance principles and leveraging advanced AI capabilities, the A4A framework aims to ensure agent behaviors remain aligned with societal values and ethical standards. This work highlights the necessity of robust agent behavior governance to secure the integrity and fairness of future online ecosystems, facilitating the responsible integration of intelligent agents in digital society.

Directed fuzzing targets specific parts of a program and is particularly useful for tasks like PoC verification, crash reproduction, and patch testing. It uses static analysis to guide the fuzzing process. However, it still faces two significant challenges that affect its efficiency. They overlook whether the code region is related to the target location, causing excessive computational power to be wasted on calculating distances for irrelevant regions and hindering precise distance calculation. Additionally, the reliance on random mutations during test case generation results in new cases that are mostly unreachable to the target location. Therefore, we propose PathFuzz, a fuzzer that employs a distance calculation method constrained by the target path and a directed mutation method for the bytes that cause deviation from the target path. We first identified code regions related to the target location and calculated finer-grained basic block distances within these regions. Next, through taint analysis, we map program input bytes to the basic blocks that process them. We then perform directed mutations, adjusting the input bytes corresponding to the basic blocks that deviate from the target execution path to guide it back on track. We evaluated PathFuzz on Magma dataset, and experiments show that compared to several SOTA directed fuzzers, PathFuzz is on average 17.85 times, 2.47 times, 17.61 times, and 4.85 times faster, respectively, and it can trigger four vulnerabilities that other tools cannot within the specified time.

Machine learning has been widely applied to malware detection tasks; but unfortunately, they exhibit significant vulnerability to adversarial attacks and can be easily circumvented using perturbation carefully crafted. Concurrently, we are witnessing a corresponding increase in the attention dedicated to adversarial attacks against malware detection models. Nevertheless, current research on adversarial examples still faces obstacles such as poor escape effectiveness and difficulty in preserving functionality. Particularly, greedily recruiting the best manipulations from a vast search space often leads to poor diversity of adversarial perturbation sequence. To rectify these shortcomings, this paper proposes an automated, continuously optimized approach for generating malware adversarial examples based on evolutionary computing. Our method filters effective action sequences from a large pool of random manipulations, assigning different priorities to different actions. The generation and optimization of adversarial examples are formalized as a sparse minimization optimization problem based on a fixed-length action vector. We introduce AOP-Mal, a novel genetic framework to automatically generate and optimize adversarial examples. The initialization and evolution of the population depend on the priority of actions, as well as the proposed novel evolutionary operator. The experimental results demonstrate that our attack strategy effectively bypasses the detection mechanisms and outperforms most state-of-the-art malware adversarial frameworks. Our hope is to help researchers understand the intentions of attackers and explore more powerful defense mechanisms.

Large Language Models (LLMs) are increasingly capable of aiding in tasks such as content generation, yet they also pose risks, particularly in generating harmful spear-phishing emails. These emails, crafted to entice clicks on malicious URLs, threaten personal information security. This paper proposes an adversarial framework, SpearBot, which utilizes LLMs to generate spear-phishing emails with various phishing strategies. Through specifically crafted jailbreak prompts, SpearBot circumvents security policies and introduces other LLM instances as critics. When a phishing email is identified by the critic, SpearBot refines the generated email based on the critique feedback until it can no longer be recognized as phishing, thereby enhancing its deceptive quality. To evaluate the effectiveness of SpearBot, we implement various machine-based defenders and assess how well the phishing emails generated could deceive them. Results show these emails often evade detection to a large extent, underscoring their deceptive quality. Additionally, human evaluations of the emails' readability and deception are conducted through questionnaires, confirming their convincing nature and the significant potential harm of the generated phishing emails. Furthermore, we propose a mixup training strategy, which could significantly improve the detection of phishing emails in SpearBot.

Graph neural networks have been shown to have characteristics that make them susceptible to backdoor attacks, and many recent works have proposed feasible graph backdoor attack methods. However, existing graph backdoor attack methods only target one-to-one attack types and lack graph backdoor attack methods that can address one-to-many attack requirements. This paper is the first research work on one-to-many type graph backdoor attacks and proposes the backdoor attack method MLGB, which can achieve multi-target label attacks for GNN node classification tasks. We designed encoding mechanisms to allow MLGB to customize triggers for different target labels and ensure differentiation between triggers for different target labels through loss functions. Additionally, we designed an innovative poisoned node selection method to improve the efficiency of MLGB’s attacks further. Extensive experiments were conducted to validate MLGB’s effectiveness across multiple datasets and model architectures, demonstrating its robustness against graph backdoor attack defense mechanisms. Furthermore, ablation experiments and explainability analyses were conducted to provide deeper insights into MLGB. Our work reveals that graph neural networks are also vulnerable to one-to-many type backdoor attacks, which is important for practitioners to understand model risks comprehensively.

This paper addresses the critical task of hacker identification within the cyber traceability system. While the latest hacker group identification method based on the heterogeneous graph attention network (HGHAN) holds promise in discovering hacker groups, its potential is hindered by the underutilization of node information and poor training efficiency. Particularly, attribute information dilution during node feature extraction and lengthy training for node embedding vector reassignment when new nodes are added have been observed. To rectify these shortcomings, the paper presents an improved model for hacker group identification. This novel approach leverages dynamic heterogeneous graph node updating to significantly boost efficiency without compromising the original model’s classification accuracy. The key aspects of the method involve pre-learning for node attribute training vectors, LSTM (Long Short-Term Memory) and attention mechanisms for node feature vector refinement, and introducing a sparse matrix and dynamic node update scheme. The experimental results demonstrate marked improvements in training efficiency and graph update processes while maintaining classification accuracy. This advancement signifies the improved HGHAN model’s capacity to adeptly navigate real-world network dynamics, assisting researchers in pinpointing malicious attackers amid cyber incidents.

Cross-site scripting (XSS) payloads are an important part of XSS attacks, which contain malicious code and are injected into Web pages. There have been many research results based on machine learning and deep learning for the detection of XSS attacks. However, the current widely used datasets suffer from a serious data imbalance in the field of XSS attack detection, with a very limited number of samples for most XSS payload categories. Unfortunately, this problem has been overlooked in existing research. Although existing methods generally show high detection performance, they have been experimentally proven to have poor detection and generalization performance for some XSS payload categories. However, since such samples have a sparse number, their classification errors do not significantly affect the overall performance. To solve this problem, a few-shot graph classification method FSXSS applicable to XSS attacks detection is proposed. FSXSS reduces obfuscated malicious code by anti-obfuscation means such as circular decoding and code stitching, and then transforms the sample data into homomorphic graphs using contextual relationships and external word embeddings. These homomorphic graphs are used as input to obtain a vector representation of the graph through graph representation learning, and then the classifier classifies the samples by computing the similarity between them and the prototype. In addition, since there is no publicly available dataset for the few-shot XSS attack detection problem, we processed and labeled the data from the XSSED project to create the dataset FSXSSED. Experiments proved that FSXSS has excellent capabilities for the few-shot XSS attack detection problem.

The explosive growth of cyber attacks today, such as malware, spam, and intrusions, has caused severe consequences on society. Securing cyberspace has become a great concern for organizations and governments. Traditional machine learning based methods are extensively used in detecting cyber threats, but they hardly model the correlations between real-world cyber entities. In recent years, with the proliferation of graph mining techniques, many researchers have investigated these techniques for capturing correlations between cyber entities and achieving high performance. It is imperative to summarize existing graph-based cybersecurity solutions to provide a guide for future studies. Therefore, as a key contribution of this work, we provide a comprehensive review of graph mining for cybersecurity, including an overview of cybersecurity tasks, the typical graph mining techniques, and the general process of applying them to cybersecurity, as well as various solutions for different cybersecurity tasks. For each task, we probe into relevant methods and highlight the graph types, graph approaches, and task levels in their modeling. Furthermore, we collect open datasets and toolkits for graph-based cybersecurity. Finally, we present an outlook on the potential directions of this field for future research.

The widespread use of web applications has also made them more vulnerable to hackers, resulting in the leakage of large amounts of application and personal privacy data. Cross-site scripting (XSS) attacks are one of the most significant threats to web applications. Attackers can inject scripts to control the victim’s browser to send data or execute commands, leading to the theft of privacy or the hijacking of login tokens. Therefore, we proposed a multi-feature fusion-based neural network vulnerability detection model for detecting XSS vulnerabilities in the JavaScript source code of websites (We termed our implementation of this approach MFXSS). We combine abstract syntax tree (AST) and code control flow graph (CFG) to convert the generalized sample data into graph structure and code string structure. Then, through the graph convolutional neural network, weighted aggregation, and the bidirectional recurrent neural network, the logical call features and the context execution relationship features of the source code are extracted and fused respectively. Finally, the fused feature vectors are used to detect and predict XSS vulnerabilities in JavaScript. In the experiment, we designed multiple control experiments to verify that the model construction is optimal, and the accuracy rates in the standard and variant datasets are 0.997 and 0.986. Moreover, in comparing similar detection schemes, MFXSS also performs better. Applying the model to an actual web environment, we successfully detected the presence of XSS vulnerabilities in websites.

PyPI provides a convenient and accessible package management platform to developers, enabling them to quickly implement specific functions and improve work efficiency. However, the rapid development of the PyPI ecosystem has led to a severe problem of malicious package propagation. Malicious developers disguise malicious packages as normal, posing a significant security risk to end-users. To this end, we conducted an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem. We first built an automated data collection framework and collated a multi-source malicious code dataset containing 4,669 malicious package files. We preliminarily classified these malicious code into five categories based on malicious behaviour characteristics. Our research found that over 50% of malicious code exhibits multiple malicious behaviours, with information stealing and command execution being particularly prevalent. In addition, we observed several novel attack vectors and anti-detection techniques. Our analysis revealed that 74.81% of all malicious packages successfully entered end-user projects through source code installation, thereby increasing security risks. A real-world investigation showed that many reported malicious packages persist in PyPI mirror servers globally, with over 72% remaining for an extended period after being discovered. Finally, we sketched a portrait of the malicious code lifecycle in the PyPI ecosystem, effectively reflecting the characteristics of malicious code at different stages. We also present some suggested mitigations to improve the security of the Python open-source ecosystem.