5G mobile networks are becoming new targets for Advanced Persistent Threat (APT) attacks. While existing provenance-based intrusion detection systems (PIDS) show promise for APT detection, they are inadequate for complex 5G networks due to the absence of explainable investigation results. They generate alert graphs with numerous false positive nodes, imposing substantial cognitive burdens on security analysts. This paper presents SAGE, the first end-to-end framework for automated APT investigation in 5G networks. SAGE presents a two-stage approach. For improved detection precision, SAGE constructs global heterogeneous provenance graphs integrating system and 5G application logs with semantic embeddings for efficient node-level anomaly detection. For automated investigation, SAGE introduces a novel self-reflective and self-reasoning LLM framework with domain-specific Retrieval Augmented Generation (RAG). Through carefully designed APT investigation workflows, it reduces detection false positives and automatically generates comprehensive natural language reports explaining attack tactics, techniques and procedures (TTPs) and impacts, bridging the critical gap between alerts and human-friendly intelligence. Extensive experiments on the constructed 5G APT dataset demonstrate that SAGE’s investigation framework improves node-level detection precision by an average of 12% and generates high-quality investigation reports, achieving superior TTP-level detection performance with over 80% precision, significantly outperforming state-of-the-art methods.

Abstract This paper aims at the requirement of multi-phase controllable excitation signals in plasma processing, designs and implements a high precision multi-channel synchronous pulse waveform generator based on the GD32F407 microcontroller. The system adopts a technical scheme combining timer interrupt driving and a waveform look-up table, which can simultaneously generate 7 channels of independently configurable synchronous pulse waveforms. Each channel contains non-inverting and inverting phase outputs, with a total of 14 output channels. Subsequently, this paper presents a hardware implementation. Tests showed that its maximum frequency could reach 150 KHz, and the 7-channel synchronous pulses could all be freely configured. Finally, this device was connected to drive a tailored wave generator, providing a reliable hardware platform for the subsequent research on plasma energy distribution regulation.

TEE-shielded secure inference offers an efficient solution to protect valuable edge-deployed models from potential thefts. Nevertheless, existing methods are lack of theoretical security analysis, failing to achieve the optimal security. Furthermore, while feasible for small models, existing methods are excessively heavyweight for Large Language Models (LLM). For LLaMA-7B, they introduce GB-level secure memory requirement and hundredfold inference latency, severely compromising real-time utility. To solve these problems, we first present a Bayesian theory framework of Model Stealing (MS) attacks, which decomposes MS into prior and posterior knowledge leakage. Based on this framework, LLMGuard is proposed, which presents two components: First, Intrinsic Parameters Shielding is designed to shield all private parameters, preventing prior knowledge leakage. This approach significantly decreases the secure memory usage and achieves inference speedup. Second, since OTP is not applicable to LLMs, Random Slices Composition is developed to obfuscate intermediate distributions with no computational overhead, minimizing posterior knowledge leakage efficiently. Experimental results demonstrate that LLMGuard downgrades model to black-box inference with negligible accuracy loss, while delivering \(43\times\) inference speedup on LLaMA compared to fully-shielded methods. The proposed LLMGuard effectively addresses concerns related to intellectual property theft on edge, boosting the secure deployment of LLMs on untrusted devices.

has become a critical driver of innovation in artificial intelligence and the evolution of 6G technologies. The explosive growth of data volume accelerates the convergence of cloud and edge computing, while simultaneously posing heightened challenges to data security and privacy. The emerging cloud-edge-device collaborative paradigm enables dynamic and large-scale data circulation across heterogeneous entities, exposing systems to complex threats such as malicious edge nodes and eavesdropping over untrusted communication channels. In response to these issues, we propose EdgeGuard, a secure and decentralized framework for cloud-edge-device data circulation. EdgeGuard is specifically designed for highly dynamic environments and ensures robust data confidentiality, integrity, traceability, and resilience against both malicious external attackers and compromised edge servers. To underpin its cryptographic foundation, we develop two core primitives. Specifically, we introduce an Aggregatable Publicly Verifiable Secret Sharing (APVSS) scheme that enables efficient sharing of field elements while supporting aggregation and public verifiability. Furthermore, we construct AggDKG, a distributed key generation (DKG) protocol. AggDKG achieves public verifiability and bias resistance with an expected total communication cost of O(kappa n(3)), effectively overcoming the scalability limitations inherent in traditional complaint-based protocols. Collectively, these components form a comprehensive framework that strengthens secure and efficient data circulation in cloud-edge-device systems. Experimental data show that AggDKG delivers clear performance gains: across all tested scales, its total running time is only about 8%-65% of that of the DKG of Gurkan et al. and at n = 256, it reduces per-node runtime by approximately 27% compared with the DKG of Gennaro et al. These results highlight EdgeGuard's superior scalability, lower latency, and stronger Byzantine resilience for secure large-scale deployments.

As a critical hub connecting users and 5G networks, 5G UE control plane protocols undertake core functions such as network connection establishment, mobility management, and security authentication. Therefore, studying the security requirements of 5G UE control-plane protocols and constructing corresponding security testing methods are important components of improving the 5G network security protection system, and safeguarding user data security. In this paper, we first use LLM and RAG technologies to parse 3GPP specifications, extract security requirements of 5G UE control-plane protocols, and generate formal LTL assertions. We then adopt a passive-active collaborative state machine learning method to construct state machines for multiple 5G UEs. By selecting a reference state machine for model checking and performing differential testing between other state machines and the reference state machine, we obtain all violation cases of the UEs. The proposed security testing method has extracted 55 security requirements, including 10 new ones, and discovered 5 new violations.

While Large Language Models (LLMs) have gained remarkable success, they are consistently at risk of being stolen when deployed on untrusted edge devices. As a solution, TEE-based secure inference has been proposed to protect valuable model property. However, we identify a statistical vulnerability in existing protection methods, and furtherly compromise their security guarantees by proposed Model Stealing Attack with Prior. To eliminate this vulnerability, LoRO is presented in this paper, which leverages dense mask to completely obfuscate parameters. LoRO includes two innovations: (1) Low Rank Mask, which uses low-rank factors to generate dense masks efficiently. The computing complexity in TEE is hence reduced by an exponential amount to achieve inference speed up, while providing robust model confidentiality. (2) Factors Multiplexing, which reuses several cornerstone factors to generate masks for all layers. Compared to one-mask-per-layer, the secure memory requirement is reduced from GB-level to tens of MB, hence avoiding the hundred-fold latency introduced by secure memory paging. Experimental results indicate that LoRO achieve a $0.94\times$ Model Stealing (MS) accuracy, while SOTA methods presents $3.37\times$ at least. The averaged inference latency of LoRO is only $1.49\times$, compared to the $112\times$ of TEE-shielded inference. Moreover, LoRO results no accuracy loss, and requires no re-training and structure modification. LoRO can solve the concerns regarding model thefts on edge devices in an efficient and secure manner, facilitating the wide edge application of LLMs.

Deep gradient inversion attacks expose a serious threat to Federated Learning (FL) by accurately recovering private data from shared gradients. However, the state-of-the-art heavily relies on impractical assumptions to access excessive auxiliary data, which violates the basic data partitioning principle of FL. In this paper, a novel method, Gradient Inversion Attack using Practical Image Prior (GI-PIP), is proposed under a revised threat model. GI-PIP exploits anomaly detection models to capture the underlying distribution from fewer data, while GAN-based methods consume significant more data to synthesize images. The extracted distribution is then leveraged to regulate the attack process as Anomaly Score loss. Experimental results show that GI-PIP achieves a 16.12 dB PSNR recovery using only 3.8% data of ImageNet, while GAN-based methods necessitate over 70%. Moreover, GI-PIP exhibits superior capability on distribution generalization compared to GAN-based methods. Our approach significantly alleviates the auxiliary data requirement on both amount and distribution in gradient inversion attacks, hence posing more substantial threat to real-world FL. Our code is available at https://github.com/D1aoBoomm/GI-PIP.

As a distributed machine learning approach that preserves data ownership while releasing data usage rights, federated learning overcomes the challenge of data silos that hinder large-scale modeling with big data. However, the characteristic of only sharing gradients without training data during the federated training process does not guarantee the confidentiality of users' training data. In recent years, novel deep gradient inversion attacks have demonstrated the ability of adversaries to reconstruct private training data from shared gradients, which poses a serious threat to the privacy of federated learning. With the evolution of gradient inversion techniques, adversaries are increasingly capable of reconstructing large volumes of data from deep neural networks, which challenges the Privacy-Preserving Federated Learning (PPFL) with encrypted gradients. Effective defenses mainly rely on perturbation transformations to obscure original gradients, inputs, or features to conceal sensitive information. Firstly, the gradient inversion vulnerability in PPFL is highlighted and the threat model in gradient inversion is presented. Then a detailed review of deep gradient inversion attacks is conducted from the perspectives of paradigms, capabilities, and targets. The perturbation-based defenses are divided into three categories according to the perturbed objects: gradient perturbation, input perturbation, and feature perturbation. The representative works in each category are analyzed in detail. Finally, an outlook on future research directions is provided.

As a privacy-preserving enhancement to the Federated Learning (FL) framework, Secure Aggregation (SA) enables multiparty summation without any party needing to reveal their updates to the aggregator in Internet of Things applications. However, conventional threat model underestimates the potential inversion attacks on aggregated gradients from an honest-but-curious client, due to the considering information loss caused by SA. This study for the first time, demonstrates the gradient inversion attack against SA schemes in which gradients are quantized and aggregated. Then an enhanced gradient inversion from client side is proposed to address two roadblocks caused by SA, i.e., aggregation information loss and quantization rounding error. To countermeasure the information loss, we utilize class-wise representation matching to achieve category-level decomposition. This relies on a prior restoration of the class-wise representations and instance-wise labels, whose numerical accuracy is cyclically calibrated through prior-based offset estimation. Since cryptographic operators involved in SA schemes usually operates in the integer domain, gradient quantization is introduced. Regarding the rounding errors from gradient quantization, quantization-aware gradient matching is presented to align with a more precise optimization objective. Extensive experiments demonstrate that a semi-honest client is sufficient to infer sensitive data from the aggregated gradients after even 8-bit quantization. Moreover, a defense scheme based on 1-bit gradient quantization is proposed. The new attack from client side in SA-based FL urges the community to take necessary defensive measures.

针对现阶段网络空间安全专业操作系统课程存在的问题,提出面向网络空间安全人才培养的PRIDE教学模式和面向网络空间安全专业的操作系统课程改革方案,从如何融入国产操作系统安全与思政教育、如何增强课程的网络安全特色、如何完善后续课程体系3方面介绍课程建设的内容以及具体实施路径,最后说明课程教学改革成效.

Gradient inversion attacks have posed a serious threat to the privacy of federated learning. The attacks search for the optimal pair of input and label best matching the shared gradients and the search space of the attacks can be reduced by pre-restoring labels. Recently, label restoration technique allows for the extraction of labels from gradients analytically, but even the state-of-the-art remains limited to identify the presence of categories (i.e., the class-wise label restoration). This work considers the more real-world settings, where there are multiple instances of each class in a training batch. An analytic method is proposed to perform instance-wise batch label restoration from only the gradient of the final layer. On the basis of the approximate recovered class-wise embeddings and post-softmax probabilities, we establish linear equations of the gradients, probabilities and labels to derive the Number of Instances (NoI) per class by the Moore-Penrose pseudoinverse algorithm. Our experimental evaluations reach over 99% Label existence Accuracy (LeAcc) and exceed 96% Label number Accuracy (LnAcc) in most cases on three image datasets and four classification models. The two metrics are used to evaluate class-wise and instance-wise label restoration accuracy, respectively. And the recovery is made feasible even with a batch size of 4096 and partially negative activations (e.g., Leaky ReLU and Swish). Furthermore, we demonstrate that our method facilitates the existing gradient inversion attacks by exploiting the recovered labels, with an increase of 6-7 in PSNR on both MNIST and CIFAR100. Our code is available at https://github.com/BUAA-CST/iLRG.

As a distributed machine learning approach, federated learning enables multiple clients to collaboratively train a deep learning model for a common artificial intelligence task and share their gradients only. However, recent gradient inversion attacks demonstrate the possibility to reconstruct clients' training data from shared gradients and thus pose a severe threat to the privacy of federated learning. In this paper, we focus on the neuron-exclusivity-based gradient inversion attack, which is the first analytic attack based on the neuron exclusivity state. Since the key condition of sufficient exclusivity is required to construct the neuron-exclusivity-based attack, we propose a batch-perturbation-based targeted defense aiming to eliminate the exclusivity state of the training batches. The batch perturbation algorithm can be modeled as an optimization problem that aims to find the optimal perturbation on an input batch to satisfy the secure boundary condition. Then we transform the optimization problem into a linear programming problem and solve it with PuLP. We evaluate our proposed defense on two datasets: MNIST and OrganAMNIST. The experiment results demonstrate that our proposed defense can effectively prevent the neuron-exclusivity-based attack while having almost no negative impact on model training and model performance.

Current deep learning models have achieved significant performance advantages over traditional machine learning methods in encrypted traffic classification tasks. However, due to inherent black-box characteristic of the deep learning model, users cannot know the mechanism of classification decisions made by the model. In order to enhance the credibility of the deep learning model while ensuring the classification accuracy, an explainable method for deep learning model of encrypted traffic classification was proposed, including prototype-based traffic-level active explanation and feature similarity saliency map based packet-level passive explanation. Firstly, the prototype-based Flow Prototype Network（FlowProtoNet） was used to automatically extract typical segments of traffic during training, namely, traffic prototypes.Secondly, the similarity between the tested traffic and each prototype was calculated during testing to realize the classification and the traceability explanation of the training set. Thirdly, in order to further improve the visual explainability, Gradient Similarity Saliency Map（Grad-SSM） method was proposed, in which the irrelevant regions of classification decision were filtered out by weighting feature map with gradient, and then the Earth Mover’s Distance（EMD） between the tested traffic and the prototype extracted by FlowProtoNet was calculated to obtain the similarity matrix achieving further focus on attention heatmap by comparing the test traffic and this prototype. On ISCX VPN-nonVPN dataset, the accuracy of the proposed method reaches 96. 86%, which is similar with that of the inexplainable method. And FlowProtoNet can further provide classification basis by giving the similarity with the prototype. At the same time, the proposed method has stronger visual explainability and focuses more on the key packets in the traffic.

Accurate prediction of soil moisture and temperature is helpful to regulate agricultural planting parameters and optimize crop planting quality. In this paper, relevant issues are studied from two aspects: environmental data acquisition system based on Internet of Things technology and adaptive deep learning prediction model selection. An NB-IoT IoT data collection system is proposed for deep learning of long-period and equal-interval time series data collection. Using the obtained environmental temperature and humidity and soil moisture and temperature data, a deep learning model based on long short-term memory network (LSTM) is implemented to train and predict soil moisture and temperature, and the prediction effect of each deep learning method is analyzed under different step length conditions. The experimental results show that the system can effectively obtain and manage the data required for deep learning, and the deep learning-based prediction model can achieve reliable prediction of soil moisture and temperature by only relying on the environmental temperature and humidity time series data.

分析量子密码相关课程的国内外教学现状,提出量子密码课程的建设思路,既考虑从传统密码到量子密码的过渡,又考虑依据密码学体系进行教学建设.结合北京航空航天大学教学科研平台的基础,介绍面向信息类本科生的量子密码课程教学实施的具体做法,最后说明量子密码教学效果,尤其在人才培养方面的成果.

In recent years, the widely used deep learning technologies have always been controversial in terms of reliability and credibility. Class Activation Map (CAM) has been proposed to explain the deep learning models. Existing CAM-based algorithms highlight critical portions of the input image, but they don't go any farther in tracing the neural network's decision-basis. This work proposes Cross-CAM, a visual interpretation method which supports deep traceability for prediction-basis samples and focuses on similar regions of the category based on the input image and the prediction-basis samples. The Cross-CAM extracts deep discriminative feature vectors and screens out the prediction-basis samples from the training set. The similarity-weight and the grad-weight are then combined to form the cross-weight, which highlights similar regions and aids in classification decisions. On the ILSVRC-15 dataset, the proposed Cross-CAM is tested. The new weakly-supervised localization evaluation metric IoS (Intersection over Self) is proposed to effectively evaluate the focusing effect. Using Cross-CAM highlight regions, the top-1 location error for weakly-supervised localization achieves 44.95% on the ILSVRC-15 validation set, which is 16.25% lower than Grad-CAM. In comparison to Grad-CAM, Cross-CAM focuses on the key regions using the similarity between the test image and the prediction-basis samples, according to the visualisation results.

为提高无人机在观光农业混合型无线传感器网络中的数据采集效率,提出一种基于深度强化学习的无人机路径规划策略.基于社会力模型引入人流参量,结合Semi-Markov-Option分层强化学习方法以降低模型复杂度,基于Rainbow算法提出SMO-Rainbow(Semi-Markov-Option-Rainbow)路径规划策略.在ε-greedy探索策略中引入Tanh函数,提出AT-ε-greedy(adaptive-Tanh-greedy)策略,进一步平衡深度强化学习模型训练中的探索与利用阶段.实验结果表明,在观光农业场景中,所提路径规划策略与其它深度强化学习无人机路径规划策略相比,数据采集效率与训练稳定性均更优,有效降低了模型训练难度.

文中针对土壤水分温度预测的实际需求,从基于物联网技术的环境数据采集系统以及适配的深度学习预测模型选择两方面对相关问题进行研究,设计一种基于嵌入式系统及NB?IoT技术的物联网数据采集系统验证平台.基于采集到的数据,分析长短时记忆网络(LSTM)、门控循环单元(GRU)以及双向长短时记忆网络(Bi?LSTM)模型的预测效果.实验结果表明,所提出的数据采集系统可以有效获得深度学习所需数据,而基于该数据的深度学习预测模型可以实现仅依靠环境温湿度时间序列数据对土壤水分与温度的可靠预测.该研究可为相关领域的土壤水分温度预测系统设计提供参考.

With the wide application of embedded devices, the security problems caused by malware intrusion into embedded systems are increasing. Existing malware detection models are difficult to be deployed to a wide variety of resource-constrained embedded devices. Undetectable malware can cause devices to malfunction and potentially spread to other devices causing massive device failures. We propose a TPM-based remote auditing scheme for embedded device software, aiming at the problem that the existing malware detection models are difficult to be deployed on embedded systems. This paper analyzes the security threats faced by the existing embedded system malware detection schemes and raised the security objectives. We use Trusted Platform Module (TPM) to extract the software of IoT devices and send it to the back-end server for malware detection. We use federated learning combining adversarial learning and distributed training to improve the robustness of the model by adding adversarial samples for retraining, and effectively prevent the leakage of collected samples from becoming negative. Our scheme ensures the credibility of software extraction and the security of communication process through TPM. The scheme also solves the problem that existing malware detection models are difficult to be deployed. We finally analyze the security of the scheme, which can resist integrity destruction, forgery, replay attack and masquerade attack.

[目的]基于深度学习的钻蛀振动识别模型结合边缘计算可实现林业蛀干害虫钻蛀振动长期监测和实时预警,但要求大幅压缩智能识别模型的参数量和运算量.本研究采用深度学习模型压缩算法,在不损失精度的前提下,对已有的钻蛀振动识别模型进行压缩,减小模型的体积并提升模型在嵌入式平台的识别速度.[方法]首先采集双条杉天牛钻蛀振动和背景噪声两类信号训练人工设计的5层卷积神经网络BoringNet,得到钻蛀振动识别模型;然后分别使用不同裁剪率的滤波器裁剪、模型量化、多目标知识蒸馏对钻蛀振动识别模型进行压缩;最后设计上述压缩算法的组合策略,联合使用3种算法对蛀振动识别模型进行压缩,探究多种组合的模型压缩效果.[结果]3种模型压缩算法组合,裁剪率为60％时模型达到最优,此时模型计算量和参数量分别从原模型的18.06×106次和0.54×106个降低为3.01×106次和0.09×106个,模型体积从2200 kB压缩至134.9 kB,树莓派3B+上的识别时间由原模型的9.04 ms降低至1.65 ms,而模型精度仍能达到99.29％,提升了0.5％.[结论]本研究的深度学习模型压缩方法,可以针对钻蛀振动侦听场景大幅压缩模型参数量和运算量,在保证准确率的前提下实现嵌入式平台的实时识别,促进钻蛀振动识别模型从工作站试验到野外实地部署的转变,为钻蛀振动识别的边缘计算奠定基础.