The Domain Name System (DNS) is a critical internet infrastructure that translates human-readable domain names into machine-routable IP addresses. However, DNS is inherently vulnerable to manipulation, with hijacking attacks growing in both frequency and sophistication. Existing detection methods primarily rely on traffic analysis at specific network points. However, they suffer from limited coverage and low accuracy in complex environments, such as when CDN is employed. While recent approaches employ graph-based techniques, they still suffer from detection inaccuracy issues due to their failure to account for the complex interdependencies among multiple types of nodes. To address these limitations, we propose a novel heterogeneous graph-based detection framework. Based on the collected DNS records from distributed scanners, our method extracts activity and security features and constructs a heterogeneous graph to capture resolution patterns and cross-entity relationships. We further design a time-decay graph neural network TNHAN that enhances traditional Heterogeneous Graph Attention Networks (HAN) by dynamically weighting recent records. This network improves adaptability to legitimate DNS changes. For evaluation, we conduct experiments on real-world resolvers and domain datasets. Experiment results demonstrate the effectiveness of our method. Our method can achieve an F1-score of 0.96, outperforming the best baseline by 0.057 on average, and up to 0.113 under low label proportion. Moreover, we conduct several case studies on detected incidents, including cases related to geopolitical conflicts, censorship-related hijacking, and manipulation by malicious resolvers. These cases demonstrate the method’s effectiveness in identifying diverse hijacking behaviors in practice.

In the existing blockchain copyright storage systems,various ring signatures occupied too much storage space,and the efficiency of the data consensus algorithm needed to be improved.The public keys of the ring members were accumulated using a dynamic accumulator in order to solve these issues.Various algorithms were then designed,including initialization,system selection,key generation,signature generation,and signature verification,to create an ID-based short verifiable ring signature scheme with multiple private key generators(PKG).The credit threshold was set for the primary node selection,the maximum number of nodes allowed to participate in the consensus was reduced,and the existing consortium blockchain consensus algorithm was improved.Using the new ring signature scheme constructed and the improved consensus algorithm,a new blockchain copyright storage protocol was proposed.Finally,the unforgeability and anonymity of the signature scheme were formally proved.The consensus algorithm and fault tolerance of the system were assessed experimentally,and the computational effectiveness and storage capacity of the signature scheme were examined and simulated.The results show that the proposed protocol saves the signature time and storage space,and improves the consensus efficiency and fault tolerance.

In the field of cybersecurity, the deluge of alerts presents a significant challenge to human review capabilities. Despite existing solutions, there is still an urgent need for more advanced methods to improve the effectiveness and accuracy of false alerts filtering. In this paper, we propose FAF-BM, a cutting-edge approach that integrates the BERT model, semi-supervised learning and active learning to enhance alert filtering capabilities. FAF-BM leverages the fine-tuned BERT model to fully exploit the deep semantics of alerts without being constrained by the format of the alerts. Subsequently, the semi-supervised learning is dedicated to mining the hidden potential within unlabeled data, thus expanding the learning scope beyond the confines of labeled datasets. In addition, the active learning strategically utilizes the expertise of security professionals to guide the learning process, ensuring that the approach adapts to the evolving threat landscape. Through a series of experiments, it has been demonstrated that FAF-BM not only improves the effectiveness of the filter but also enhances the generalization ability of dealing with the heterogeneity of alerts.

Advanced Persistent Threats (APTs), due to their stealthiness and complexity, have become a significant security challenge for modern enterprises, often causing severe economic losses. To address these threats, researchers have proposed using provenance graphs to model system entities and their dependencies, aiming to capture the complex scenarios of APT attacks. However, existing Provenance-based Intrusion Detection Systems (PIDS) still suffer from the following challenges: (1) Historical interaction information loss due to the truncation of long-term interaction scenarios; (2) The difficulty in capturing long-distance dependencies leads to the loss of crucial contextual information; (3) Existing methods struggle to balance detection efficiency and granularity. We introduce PanThreat, an online detection system that performs fine-grained, real-time analysis of host system logs to identify malicious activities. PanThreat combines attributes encoding through Word2Vec and position encoding using Laplacian feature matrices, while retaining long-term interaction histories and effectively modeling long-range dependencies within provenance graphs. This integrated approach significantly enhances detection accuracy. Additionally, PanThreat leverages the parallel processing capabilities of Graph Transformers to improve detection efficiency. Evaluations on the DARPA E3 dataset and StreamSpot database demonstrate PanThreat's effectiveness in detecting complex APT attacks, outperforming four state-of-the-art methods while maintaining an average processing speed of 58,140 events per second.

With the development of HTML5, tracking technologies have evolved dramatically and gradually moved from cookies to browser fingerprinting. Previous research has shown that there are more serious privacy threats associated with tracking behavior on third-party websites. However, by focusing on third-party websites that are loaded in the browser, the researchers overlooked the fact that third-party websites are also present in Android applications, where tracking is easy to perform and definitely covert to detect. In this study, we propose WTDetect, an Android third-party website tracking detection framework. Based on the parsing of view tree and the generation of function call stack, WTDetect automatically locates and captures the source code of third-party websites. To explore the direction of sensitive data flow, WTDetect performs static taint analysis on the program dependency graph for each JavaScript file. Finally, a fine-grained classification model is used to detect the tracking behavior. WTDetect is used to perform a measurement study of tracking behavior on 1090 captured Android third-party websites. The result outlines that 14.68% of third-party websites in Android applications tracking users without any access warnings and user authorization, which directly leads to the risk of privacy leakage.

Advanced Persistent Threats (APTs) are continuously evolving, leveraging their stealthiness and persistence to put increasing pressure on current provenance-based Intrusion Detection Systems (IDS). This evolution exposes several critical issues: (1) The dense interaction between malicious and benign nodes within provenance graphs introduces neighbor noise, hindering effective detection; (2) The complex prediction mechanisms of existing APTs detection models lead to the insufficient utilization of prior knowledge embedded in the data; (3) The high computational cost makes detection impractical. To address these challenges, we propose Vodka, a lightweight threat detection system built on a knowledge distillation framework, capable of node-level detection within audit log provenance graphs. Specifically, Vodka applies graph Laplacian regularization to reduce neighbor noise, obtaining smoothed and denoised graph signals. Subsequently, Vodka employs a teacher model based on GNNs to extract knowledge, which is then distilled into a lightweight student model. The student model is designed as a trainable combination of a feature transformation module and a personalized PageRank random walk label propagation module, with the former capturing feature knowledge and the latter learning label and structural knowledge. After distillation, the student model benefits from the knowledge of the teacher model to perform precise threat detection. Finally, Vodka reconstructs attack paths from anomalous nodes, providing insight into the attackers' strategies. We evaluate Vodka through extensive experiments on three public datasets and compare its performance against several state-of-the-art IDS solutions. The results demonstrate that Vodka achieves outstanding detection accuracy across all scenarios and the detection time is 1.4 to 5.2 times faster than the current state-of-the-art methods.

Machine learning (ML) based malware classifiers are widely deployed in web applications. Training such classifiers often relies on crowdsourced threat feeds, creating a natural attack point. Recent studies show that attackers can misguide models by injecting trigger embedded samples during training. In the malware domain, attackers are typically limited to clean-label attacks, where they lack control over data labeling. However, clean-label attacks often suffer from suboptimal performance due to competition between trigger features and original clean features during training. Existing studies typically construct poisoned samples by embedding triggers into randomly selected benignware (a method referred to as "random selection"). However, not all benignware are equally suitable for trigger embedding, as the degree of competition between trigger features and original clean features may vary among different benignware. To enhance the effectiveness of clean-label attacks, we propose a simple yet effective sample selection method, called $\textbf{P}$oisoning $\textbf{M}$alware-$\textbf{S}$imilar $\textbf{B}$enignware $\textbf{(PMSB)}$, to identify samples to be poisoned. It reduces the competition between trigger features and original clean features during model training, thereby enhancing the influence of trigger features on the model's decision-making. Additionally, to identify malware-similar benignware, we introduce three distance metrics from different perspectives for sample selection, allowing it to adapt to varying data distributions. Extensive evaluations on three datasets under different attack settings demonstrate the superiority and broad applicability of PMSB, achieving an improvement in attack success rate of over 23.97%.

APIs are now central to digital transformation, carrying the core business logic and sensitive data of enterprises. Attackers can gain access to important information systems and sensitive data by attacking APIs, allowing them to steal high-value data. Besides being vulnerable to traditional attacks, APIs also face unique threats tailored to their characteristics, such as attacks targeting API business logic threats. This type of API attacks are complex, and the attack requests are very similar to legitimate traffic, making them difficult to distinguish from benign requests. Therefore, traditional single-request detection methods are ineffective against such complex attacks. By employing intelligent context-aware natural language processing techniques, we can understand API call behavior and establish a baseline of normal API call behavior to identify anomalies. In this paper, we propose DAB-LLM, a model for Detecting Anomalies in API call Behavior based on Large Language Model. Our approach utilizes extraction and representation methods for API call chains and API call graphs, prompt optimization algorithm, and LoRA fine-tuning technique to enable the model to deeply understand of API call behavior and enhance detection capabilities. Experimental results indicate that DAB-LLM excels in detecting attack behaviors and anomalies in API calls, achieving an f1-score of 97.35% along with significant improvements in recall rate, accuracy and precision. The overall performance of the model shows that our proposed model significantly outperforms other models in API call behavior anomaly detection.

Advanced Persistent Threats (APTs) have emerged as one of the most challenging security issues due to their stealthy nature, sophisticated techniques, and use of zero-day exploits. While provenance graph analysis has shown promise in APT detection, current methods suffer from three critical limitations: (1) loss of contextual information in graph embeddings, (2) insensitivity to processes with minimal malicious behavior, and (3) lack of automated root cause analysis. To address these challenges, we propose LCA-PRCA, a novel root cause-preserving detection framework that precomputes the lowest common ancestor (LCA) for all process nodes—where the LCA represents the root node—and embeds this root node information directly into the provenance graph. By connecting each process to its root node, LCA-PRCA preserves long-range contextual relationships, enhancing sensitivity to subtle anomalies and enabling automated root cause analysis. This approach significantly improves the detection of APTs by linking malicious activities to their origins, even for processes with minimal deviations from normal behavior. We evaluate LCA-PRCA on the DARPA OPTC dataset across three attack scenarios: Plain PowerShell Empire, Custom PowerShell Empire, and Malicious Upgrade. Results show that LCA-PRCA achieves higher true positive rates (TPR) and lower false positive rates (FPR) compared to state-of-the-art methods, demonstrating its effectiveness in precise APT detection and efficient root cause analysis.

The non-cooperative and interdependent nature of network attack-defense links it closely to game theory. Current game-theoretic decision-making methods construct game models for attack-defense scenarios and use reinforcement learning (RL) to compute optimal strategies. However, RL relies on the "trial and error" exploration and is likely to fall into the local optimum in some cloud storage environment without game equilibrium. First, in cloud storage systems, the resource investment of attack and defense players has a "winner-takes-all" characteristic. Thus, we employ the Colonel Blotto game to model the attack-defense scenario in cloud storage systems, extending it to a multi-player, heterogeneous battlefield model with asymmetric resources. Second, RL's reliance on trial-and-error exploration leads to suboptimal convergence in sparse-reward, non-equilibrium conditions. We leverage Large Language Models (LLMs) to inject attack-defense context knowledge, addressing the cold start problem of RL. Finally, we propose the RL-LLM-KI algorithm featuring a precomputation-retrieval mechanism that mitigates the inference speed discrepancy between LLMs and RL agents, enabling real-time defense decisions. Experiments show that our work increases utility by 140% and 136.36% compared to MADRL and DRS-DQN respectively in typical experimental scenarios. To our best knowledge, this study is the first to reveal the significant effect of knowledge injection in enhancing decision-making efficacy in highly adversarial cloud storage attack-defense scenarios.

The rapid evolution of cyber threats demands efficient entity extraction from Cyber Threat Intelligence (CTI) reports to support proactive analysis and sharing. Current methods for CTI extraction falter due to a lack of domain knowledge, which can lead to the overlooking of critical entities. Moreover, the hallucinations in LLM’s outputs result in insufficient accuracy. To address these limitations, we propose a zero-shot, self-improving NER method for CTI via knowledge injection. The framework consists of four modules: a domain knowledge extractor, a reliable data annotator, a high-consistency annotation filter, and a self-retrieval reasoner. The domain knowledge extractor enhances LLM comprehension of specialized threat intelligence, while the others work in a multi-stage reasoning process to mitigate hallucinations by generating, filtering, and reasoning upon high-consistency data. These modules collaborate to improve the model’s entity recognition ability through continuous in-context learning. Experimental results show that under strict zero-shot conditions, the proposed method achieves F1 scores of 67.7%, 61.41%, 74.56%, and 65.83% on the LLM-TIKG, APT-NER, LADDER, and CDTier datasets, respectively. This represents an improvement of 7.66% over the average F1 score of other baseline methods, demonstrating superior adaptability in low-resource security scenarios.

In recent years, the evolving browser fingerprinting technology has posed significant challenges and constant demands on detection methods. Research related to malicious code shows that cross-file techniques, which disperse code into multiple files, can resist current detection methods. To address this challenge, we introduce cross-file tracking technology into browser fingerprinting, constructing cross-file browser fingerprinting (XFP). The dispersion of files and features in XFP effectively circumvents detection methods that primarily focus on single-file tracking. In this paper, we propose XFP-Recognizer, a Random Forest-based detection method for identifying XFP behaviors. XFP-Recognizer aggregates code files and dynamic APIs by constructing function call relationship graphs (FCRgraphs). It extracts dynamic and static features to train random forest models for detecting and classifying the aggregated files, and then backtracks based on FCRgraphs to mark original scripts. To validate our method, we implement a code-splitting algorithm and constructed a cross-file tracking dataset to address the lack of XFP in real-world scenarios. We combine this dataset with the dataset of Alexa Top-10K websites in different proportions to verify the effectiveness of XFP-Recognizer. The results show that XFP-Recognizer achieved an Accuracy of 92.25%, a Precision of 97.01% and an AUC of 0.9152 in recognizing browser fingerprinting, demonstrating superior performance in both single-file and cross-file tracking. XFP-Recognizer complements existing detection methods, and the constructed split dataset also serves as a foundational resource for future research.

With the evolution of modern software development paradigms, component reuse, and low-code approaches have emerged as mainstream in software development. However, developers often lack an in-depth understanding of reused code. The inability of components to operate autonomously leads to insufficient testing of software functionalities and security, further exacerbating the contradiction between the increasing complexity of software architectures and the demand for accurate and efficient software automation testing. This, in turn, increases the frequency of software supply chain security incidents. This paper proposes a test-driven generation framework, LLM4TDG, based on large language models (LLMs). By formally defining the constraint dependency graph and converting it into context constraints, LLMs’ ability to understand natural language descriptions such as test requirements and documents is enhanced. Constraint reasoning and backtracking mechanisms are then used to generate test drivers that satisfy the defined constraints automatically. Using the EvalPlus dataset, we evaluate the comprehensive capabilities of LLM4TDG in test case generation using four general-domain LLMs and five code-generation-domain LLMs. The experimental results indicate that our approach significantly enhances LLMs’ ability to comprehend constraints in testing objectives, achieving a 47.62% increase in constraint understanding across 147 testing tasks. Employing LLM4TDG significantly improves the average pass@k metric of all LLMs by 10.41%. The pass@k metric for CodeQwen-chat has improved by up to 18.66%. The metric surpasses the state-of-the-art GPT-4, with a performance of 92.16% on HUMANEVAL and 87.14% on HUMANEVAL+, which enhances the error correction and functional correctness in test-driven code generation. Meanwhile, Our experiments were conducted on a dataset of Python third-party libraries containing malicious behavior in the context of security testing tasks, validating the effectiveness of our method in real-world applications and its generalization capabilities.

As cloud-native technologies continue to evolve, containerization and orchestration have become fundamental for deploying microservices. However, this advancement introduces significant security vulnerabilities, particularly due to vulnerabilities and misconfigurations that grant attackers excessive control over clusters. Existing works, including model-based learning and static rule-based approaches, suffer from limitations such as false positives and maintenance overhead, which pose significant challenges to cloud-native security. To mitigate intrusion targeting container orchestration, we present ShadowKube, an innovative active defense framework tailored for Kubernetes. ShadowKube integrates behavioral monitoring with shadow honeypots to effectively detect and neutralize anomalous behavior. By establishing behavioral baselines to identify deviations and converting compromised nodes into honeypots, ShadowKube isolates and traps attackers, thereby mitigating the threats they pose. Comprehensive evaluations demonstrate ShadowKube’s ability to detect and migrate exploitations across 43 severe CVEs and 7 common misconfiguration types. Deployment in a live environment further validates its effectiveness, with ShadowKube identifying 635 attack attempts, successfully decoying 23 active attacks. Additionally, ShadowKube could isolate attackers and convert affected nodes into honeypots within seconds. These results highlight ShadowKube’s efficacy as a robust solution for enhancing security in Kubernetes clusters, offering a proactive defense mechanism against both current and emerging threats.

As a progressive security strategy, the zero trust model has attracted notable attention and importance within the realm of network security, especially in the context of the Internet of Things (IoT). This paper aims to evaluate the current research regarding zero trust and to highlight its practical applications in the IoT sphere through extensive bibliometric analysis. We also delve into the vulnerabilities of IoT and explore the potential role of zero trust security in mitigating these risks via a thorough review of relevant security schemes. Nevertheless, the challenges associated with implementing zero trust security are acknowledged. We provide a summary of these issues and suggest possible pathways for future research aimed at overcoming these challenges. Ultimately, this study aims to serve as a strategic analysis of the zero trust model, intending to empower scholars in the field to pursue deeper and more focused research in the future.

With the increasing importance of internal information security, detecting insider threats has become a critical issue to safeguard organizations' information systems. However, most of the previous studies either overlook temporal relationships or have difficulty attaining accurate performance. One of the primary factors contributing to this challenge is their approach, which lacks a holistic perspective. To our knowledge, none of these studies has considered the integration of statistical and sequential information in addressing this issue. Therefore, we propose a comprehensive framework for insider threat detection based on statistical and sequential analysis to address this challenge. Leveraging the strengths of both statistical analysis and sequential analysis, we deploy an efficient implementation for analyzing and modeling user data based on convolutional attention and a transformer encoder, referred to as CATE. First, user behavior logs are consolidated from diverse sources and preprocessed into a suitable format for subsequent analysis. Then, two parallel analysis modules analyze user data in two different dimensions. The analysis modules are entirely constructed using a neural network for its high adaptability and efficient integration of information from distinct dimensions. Specifically, a subnetwork structure based on convolutional attention is designed to effectively learn statistical information, while a separate subnetwork structure based on transformers is tailored for learning sequential information. Finally, we perform a series of solid experiments utilizing the publicly available CERT dataset to evaluate our framework's effectiveness and robustness in detecting insider threats and identifying malicious scenarios.

Advanced Persistent Threats (APTs) achieves internal networks penetration through multiple methods, making it difficult to detect attack clues solely through boundary defense measures. To address this challenge, some research has proposed threat detection methods based on provenance graphs, which leverage entity relationships such as processes, files, and sockets found in host audit logs. However, these methods are generally inefficient, especially when faced with massive audit logs and the computational resource-intensive nature of graph algorithms. Effectively and economically extracting APT attack clues from massive system audit logs remains a significant challenge. To tackle this problem, this paper introduces the ProcSAGE method, which detects threats based on abnormal behavior patterns, offering high accuracy, low cost, and independence from expert knowledge. ProcSAGE focuses on processes or threads in host audit logs during the graph construction phase to effectively control the scale of provenance graphs and reduce performance overhead. Additionally, in the feature extraction phase, ProcSAGE considers information about the processes or threads themselves and their neighboring nodes to accurately characterize them and enhance model accuracy. In order to verify the effectiveness of the ProcSAGE method, this study conducted a comprehensive evaluation on the StreamSpot dataset. The experimental results show that the ProcSAGE method can significantly reduce the time and memory consumption in the threat detection process while improving the accuracy, and the optimization effect becomes more significant as the data size expands.

APIs are increasingly prevalent in application environments, carrying the core business logic and sensitive data of enterprises, and have increasingly become the target of cyber attackers. The proportion of web attacks targeting APIs has exceeded half. The widespread use of APIs has expanded the attack surface, posing serious security challenges. Security risks, such as unauthorized access, misuse of business logic, data breaches, and complex cyber attacks, have intensified. Tr aditional security measures have proven inadequate in addressing API threats. There is an urgent demand for a more contextually aware and intelligent security mechanism capable of effectively mitigating API attacks. We proposed a novel model TAD-LLM based on Large Language Model for anomaly detection in API traffic. By using S2GS data transformation method, prompt optimization algorithm and LoRA fine-tuning technique, enables the model to acquire a profound comprehension of domain-specific knowledge in more elaborate detail, thereby enhancing the overall detection capability. Experimental results demonstrate that the proposed model TAD-LLM makes a significant advancement in securing APIs against cyber threats. The average f1-score of TAD-LLM reaches 99.27% in complex API attack scenarios. There are also notable improvements in precision, recall, and accuracy. Moreover, the overall performance of the model indicates that the model we proposed outperforms other models significantly and exhibits superior capability in handling complex API attack scenarios and advanced API attack techniques. It is worth noting that our model also shows strong performance on CSIC 2010, a widely used common http traffic dataset.

Internal network attacks pose a serious security threat to enterprises and organizations, potentially leading to critical information leaks and network system damage. Hosts, as the core data and service bearers, are often primary targets of cyber attacks. Therefore, accurately identifying hosts with malicious behavior in the network is crucial. However, detecting malicious hosts on this intranet presents several challenges. Firstly, the network state is unstructured data that dynamically changes in real-time. Secondly, the large amount of normal traffic in the network drowns out the traces generated by malicious behaviors, leading to the problem of category imbalance. Lastly, the traditional graph neural network model has limitations in processing edge information and is unable to directly learn the information in netflow. To overcome these challenges, this paper proposes a malicious host detection system. The system extracts the Host Communication Graph by time slicing and uses a random undersampling method to balance samples. For malicious host detection, this paper proposes the Relational-Edge Graph Convolutional Network (RE-GCN) model, which can directly aggregate and learn features on edges and use them to accurately classify nodes, compared to other GNN models. Comparative experiments were conducted on various netflow datasets, demonstrating the effectiveness of our approach. Our approach outperformed other common GNN models in detecting malicious hosts.

In the realm of cybersecurity, detecting multi-stage attacks is vital for uncovering the actual intentions and strategies of attackers. However, the detection of multi-stage attacks is fraught with challenges due to the proliferation of alerts from diverse sources, the heterogeneity of their formats, and the weak correlations among them. This study explores MAD-LLM, a novel approach for alert-based multi-stage attack detection using Large Language Model (LLM). Leveraging their advanced natural language processing capabilities, LLM demonstrates significant advantages in text comprehension and pattern recognition. This research attempts to aggregate and correlate security alerts using the prompt engineering capabilities of LLM to reconstruct multi-stage attack chain. Experimental results indicate that LLM exhibit excellent performance in the task of multi-stage attack detection, providing an innovative solution for cybersecurity defense. This study also offers insights and implications for the application of LLM in other fields.