With growing volumes of anomaly traffic and increasingly stealthy attack types, anomaly detection becomes more challenging due to unclear inter-class boundaries and imbalanced intra-class characteristics. To address these issues, we propose DAMA, an effective network traffic anomaly detection framework based on Dimension-Aware Multi-view Alignment. Specifically, our method first partitions network traffic into seven expert-defined dimensions, then utilizes LLMs to generate both flow-level and dimension-level semantic summaries for comprehensive understanding of traffic features. Secondly, we adopt contrastive learning to align network traffic representations between feature space and semantic space, thus enhancing inter-class separability. Finally, dimension-aware prior guidance provides per-dimension supervision by highlighting key features during alignment, which effectively mitigates intra-class bias. Extensive experimental results on two benchmark datasets demonstrate that our proposed method significantly outperforms baselines in both accuracy and F1-score, while providing interpretable insights for traffic anomaly patterns.

Privacy policies serve as the primary mechanism for companies to disclose their data processing practices. However, vague language in these policies may expose users to risks. Existing methods for evaluating vagueness often struggle to capture fine-grained distinctions in vagueness among terms, lack sufficient consideration for domain-specific terminology, and neglect the phenomenon of false vagueness. To this end, we propose VASH, a VAgueness evaluation method for privacy policies based on the Semantic Hierarchy graph (SHGraph). We first extract terms from privacy policies across 475 industries to ensure comprehensive domain coverage. Leveraging these extracted terms and their hypernym–hyponym relationships, we construct a SHGraph to quantify the vagueness of individual terms based on their position within the semantic hierarchy. Subsequently, we identify false vagueness using the SHGraph and cue words, adjusting term vagueness scores accordingly. Finally, we apply attention weights to capture the influence of terms, thereby deriving sentence-level vagueness scores. To evaluate the effectiveness of VASH, we construct a large-scale dataset of 75,145 privacy policies. Extensive evaluations demonstrate that VASH effectively identifies both vagueness-related terms and false vagueness, yielding results highly consistent with human judgment. Moreover, through the application of VASH to our constructed dataset, we derive four findings that offer insights for enhancing privacy policy clarity. The source code and implementation details are available in our repository [4].

Data connectors are key components for enabling controllable data exchange in data marketplaces and constitute one of the foundational technologies for realizing data sovereignty. To support controllable data exchange in lightweight data connectors, it is crucial to design an efficient and scalable access control mechanism. However, user-space access control suffers from high decision latency, whereas kernel-space access control is limited by constrained policy capacity and inflexible policy updates. To address these challenges, we propose an efficient user–kernel access control scheme for lightweight data connectors. The scheme leverages extended Berkeley Packet Filter (eBPF) to load high-frequency access control rules into the kernel while retaining low-frequency rules in user space. To further improve access control efficiency, we design a Bloom-filter-based kernel admission filter to block invalid requests before they enter the policy decision point (PDP). To prevent long-tail requests from polluting the kernel cache, we develop a set-associative, access-frequency-aware cache replacement mechanism. To determine the optimal memory allocation between these two kernel-side components, we model access control decisions as an M/D/1 queueing system, and analyze the relationship between end-to-end policy decision latency and cache miss probability to guide the memory partitioning between the two kernel-side components. We implement a prototype based on eBPF. Experimental results show that, under the same policy set size, our system reduces the average service time by approximately 25 10^6 policies, it reduces the average service time by up to 85.6 γ > 80% , the proposed design reduces latency by up to 65

Satellite computing systems (SCSs), with their enormous economic value, are suffering from increasing attacks. Moving Target Defense (MTD), which changes the attack surface to create an asymmetric situation between attacks and defenses, can be used to improve the safety of the SCS. Defense timing selection is crucial for enhancing the defense capability of MTD and reducing its cost. However, existing MTD defense timing selection strategies do not consider limited defense resources and periodic user traffic in the SCS, which leads to significant resource consumption and impacts a large volume of traffic, making them unsuitable for the SCS. We propose a Markov Game-based Defense Timing Selection (MGDTS) approach to protect the SCS. We divide the orbital cycle of the SCS into several time periods with different traffic rates. For each period, we formulate the attack-defense adversarial relationship as a Markov game with incomplete information. In the game, we use explicit costs to define the resource consumption of a defender. Further, we employ Markov decision processes to construct the defense timing decision equation and use real-time dynamic programming to solve the equation. Experimental results show that compared with the existing MTDs, our scheme can enhance security while reducing resource consumption and the influence on user traffic. This work is an extended version of the ICCS-2024 conference paper (Lin Zhang et al., 2024).

The Satellite Computing System (SCS) faces an increasing number of attacks. Although Moving Target Defense (MTD) can effectively mitigate attacks in ground networks, it is not well-suited for SCS due to the highly dynamic nature of both SCS traffic and attackers’ scanning behaviors. In this paper, we propose a dynamic MTD strategy optimization scheme using Advantage Actor-Critic (A2C) reinforcement learning. Specifically, we formulate the MTD strategy optimization for SCS as a Markov Decision Process (MDP). Furthermore, by accounting for the uncertainty in attack behavior changes, we apply A2C reinforcement learning to optimize the MTD strategy within the MDP framework. Experimental results demonstrate that our scheme effectively reduces the frequency of scanning hits, shortens the duration attackers can hold addresses, and minimizes the impact of MTD on quality of service.

Protocol Reverse Engineering (PRE) is used to analyze protocols by inferring their structure and behavior. However, current PRE methods mainly focus on field identification within a single protocol and neglect Protocol State Machine (PSM) analysis in mixed protocol environments. This results in insufficient analysis of protocols' abnormal behavior and potential vulnerabilities, which are crucial for detecting and defending against new attack patterns. To address these challenges, we propose an automatic PSM inference framework for unknown protocols, including a fuzzy membership-based auto-converging DBSCAN algorithm for protocol format clustering, followed by a session clustering algorithm based on Needleman-Wunsch and K-Medoids algorithms to classify sessions by protocol type. Finally, we refine a probabilistic PSM algorithm to infer protocol states and the transition conditions between these states. Experimental results show that, compared with existing PRE techniques, our method can infer PSMs while enabling more precise classification of protocols.

LEO satellite non-terrestrial networks (NTN) utilize satellites in Low Earth Orbit (LEO) to dynamically establish global communication service and own significant promise. The dynamic nature of LEO satellite NTN necessities efficient handover authentication protocols. However existing schemes cannot be directly applied in LEO satellite NTN because of their low efficiency and security. To address these problems, we propose a handover authentication protocol to quickly and securely authenticate the user’s identity during the handover process. In our scheme, we incorporate an implicit session-bound random challenge to facilitate mutual authentication and key agreement between the User Equipments (UEs) and satellites. To improve authentication efficiency, we propose a batch handover mechanism to transfer the necessary security contexts, largely reducing the handover authentication cost. We verify our protocol’s security using BAN logic and Tamarin prover. The performance evaluation shows that SEHAP outperforms other schemes in both communication and computational efficiency in LEO satellite NTN.

Private protocols are widely used on the network to improve efficiency and protect privacy. However, it lacks standard protocols to unify the communication process and improve security. Protocol Reverse Engineering (PRE) aims to infer the syntax, semantics, and timing of the unknown protocol. In detail, it always infers the field information and the state machine. Yet, the results of existing PRE methods focus byte-level, and the target setting is an empirical process. To overcome the shortage, we proposed BitInfer for binary protocols. BitInfer uses a set of field detectors, including Length Detector, Timestamp Detector, Entropy Detector, Sequence Detector and Reserve Detector to divide the protocols into bit-level field and get the confidence of them. Then we randomly choose the combination of detector tuples to get the init population by repeating the process for a specific times. Finally, we use NSGA2 as the intergrade algorithm to deal with the field conflict. Experiments show that the result of BitInfer precisely solve the conflict and extend to bit level.

Topological modeling and simulation of interactive behaviors are fundamental issues in the simulation of satellite internet. Although existing solutions can effectively simulate the satellite motion model, there are limitations in terms of the topological scale of network simulation and the functions of network simulation. To address the above problems, we designed a time-varying topology simulation and data interaction method for satellite internet. Firstly, we analyze the Two-Line Element (TLE) data of satellites to calculate the topology of each time slice, achieving the fine-grained construction of the satellite's time-varying topology. Based on the generated topology, and relying on the discrete event mechanism, we designed a scheduling mechanism for sequential simulation. By combining the construction and management methods of the executing entities, we realized the sequential simulation of the interactive behaviors of entities in the satellite internet. The effectiveness of the method proposed in this paper has been verified through real TLE datasets and a series of simulation experiments.

Over-permissive access control policies, which grant users permissions beyond sysadmins' intended scope, are a primary cause of data breaches. Although policy verification serves as a critical defense mechanism by formalizing design intentions into verification goals and validating policies compliance with these goals, its effectiveness bounded by sysadmins' expertise and the comprehensiveness of predefined intentions. Consequently, over-granted permissions which fall outside the scope of verification goals often remain undetected. This paper introduces OPMonitor, a continuous monitoring tool that enables early detection of residual over-granted permissions overlooked by policy verification methods. OPMonitor operates by inferring a granting baseline from access logs, which serves as a reference model for identifying access violations in real time. To mitigate over-permissive results while ensuring correctness, we develop a two-phase framework based on approximate optimization for baseline inference. To facilitate real-time evaluation and incremental updates of the inferred baseline, we develop the locally abstract baseline tree, a tree structure that consolidates implicit authorization conditions to reduce the scale of states. Our experimental evaluation across 25 datasets, comprising both real-world and synthetic data, demonstrates the effectiveness of our approach. OPMonitor achieves a 1.5x higher detection rate for over-granted permissions compared to state-of-the-art solutions, while keeping the inference time under 30 s. Additionally, our locally abstract baseline tree enables microsecond-level evaluation and incremental updates that are 7x and 2x faster, respectively, than existing approaches.

Access control policies play a critical role in securing sensitive data and protecting personal rights in environments such as cloud computing and IoT. These policies, typically created by sysadmins, specify which users are authorized to access specific resources under certain conditions. However, the manual creation and revision of these policies to align with security objectives is often error-prone and labor-intensive. In this paper, we present Custominer, a policy mining tool designed to assist sysadmins in proactively generating and customizing access control policies that meet predefined security requirements. Custominer enables sysadmins to define security goals as constraints, and then automatically mines policies that satisfy these constraints from access logs. The policy mining task is framed as a local search optimization problem, utilizing a MaxSAT solver to efficiently eliminate suboptimal policy candidates. Our experiments, conducted on four real-world datasets, show that Custominer outperforms existing state-of-the-art methods in terms of both accuracy and efficiency.

The completion of missing network traffic is of great significance for network operation and maintenance. In recent years, the low-rank tensor completion (LRTC) techniques based on tensor ring (TR) decomposition have attracted much attention. In general, the LRTC model requires the stability of the whole tensor space. However, continuous mutation of network traffic is very common in real networks. At this time, existing completion work has difficulty in capturing the global low-rank feature of normal data and ignores the local continuous feature of mutation data, leading to a decrease in completion performance. To solve the above problems, we propose a low-rank tensor completion model that can adapt to various continuous mutation patterns of network traffic. The original tensor is represented as the sum of a normal tensor and a mutation tensor to extract their features respectively. Then, an algorithm based on the alternating direction method of multipliers (ADMM) is developed to solve the proposed model. Finally, our experimental results on both synthetic and real datasets indicate that our model can adapt to various missing data completion under different continuous mutation patterns, and has more accurate completion performance compared to advanced models.

Satellite computing system (SCS), with its huge economic value, is suffering from increasing attacks. Moving Target Defense (MTD) can create the asymmetric situation between attacks and defenses by changing the attack surface. As SCS’s limited defense resources, current MTD defense timing selection methods are not suitable for SCS. This paper proposes a Markov Game based Defense Timing Selection (MGDTS) approach for MTD in SCS. MGDTS formulates attack-defense adversarial relationship as a Markov game with incomplete information, and explicit costs are used to define the resource consumption of a defender. For defense timing decision, MGDTS uses a Markov decision process to construct the defense timing decision equation, and a real-time dynamic programming to solve the equation. Experimental results show that compared with other MTDs, MGDTS can improve the security of MTD while reducing its costs.

The distributed dynamic network is vulnerable to scanning attacks due to the openness of wireless channels. Traditional defense systems tend to be passive and exhibit delayed responses. A moving target defense approach, namely Distributed Network Address Shuffling (DNAS), is proposed to thwart attackers’ network scanning through the shuffling of network addresses. To resolve address conflicts resulting from this shuffling, DNAS employs a dynamic diffusion method of allocated addresses before the shuffling process to reduce the probability of conflict generation, and utilizes a passive detection based conflict elimination algorithm after the shuffling process to eliminate any generated conflicts. To select low-risk addresses, DNAS leverages an artificial feature selection based Fully Connected Neural Network (FCNN) to recognize the attacker’s scanning policy, and identifies low-risk addresses based on the scanning range of the policy. Empirical experiments and theoretical analysis indicate that DNAS significantly reduces the probability of address conflict generation at a minimal cost. It effectively eliminates all generated address conflicts within an average conflict resolution time of less than 500ms. Furthermore, DNAS exhibits an accuracy of 99.45% in recognizing scanning policies, surpassing pseudorandom address hopping in diminishing the success rate of sequential, local random, and mixed scanning.

In order to reduce the impact of increasingly sophisticated cyberattacks on the satellite Internet security, it is necessary to assess the satellite Internet security. Most of existing assessment schemes for network security risk mainly rely on expert knowledge to subjectively weight assessment indicator and quantify security risks, thus leading to results of assessment which are not objective. To address this problem, combining rough set with fuzzy hierarchy analysis, we propose a combination scheme to evaluate the indicator weights for assessing the satellite Internet security. First, from the perspective of IPDR model, we propose IPDR-based evaluation indicator system, and fuzzy hierarchy analysis is designed to fuse the indicator scores of more than one experts into one final value and obtain the subjective weight. Second, rough set theory is adopted to reduce indicators and correct the subjective weight obtained in the first step, thus obtaining the comprehensive weight. Finally, a series of experiments are carried out to validate our scheme.

The Space-Ground Integration Information Networks (SGIIN) are facing increasing attacks and risks, highlighting the critical need to recommend network defense orchestration plans for the SGIIN in an efficient manner. However, due to the incompleteness of plans, dynamic topology of the SGIIN, and the non-isomorphism between the plan and topology, existing plan recommendation schemes are unable to effectively work in the SGIIN. To tackle these challenges, we propose a scheme that utilizes a comprehensive measurement to identify the optimal orchestration plan, considering the alignment between plans and the security requirement, the historical performance of plans, and their applicability to dynamic network topology. Moreover, we present a methodology to enhance the accuracy of alignment measurement, as well as an algorithm intended for the identification of plan-graph subgraphs in topology-graph matching. Experimental results demonstrate that the proposed scheme is effective, efficient, and scalable, even in the presence of dynamic changes in network topology.

Enterprise networks are divided into sub-domain structures for resource aggregation and trust dependency. However, the complex domain structure results in delayed and incomplete defenses from Intrusion Response Systems(IRS). This paper proposes a proactive intrusion response system specifically designed for multi-domain networks called ProMD. A Bayesian Risk Graph is designed to analyze and evaluate the risks dynamically. The paper formalizes the selection of countermeasures as a multi-objective optimization problem (MOOP) and proves it is NP-Hard. Therefore a genetic-based heuristic algorithm OPGA is designed to generate optimal response policy sets and an unique policy is selected based on the Entropy Weight method. Experimental results demonstrate that the OPGA outperforms benchmark algorithms.

The attack graph model is an effective method for analyzing multi-step attacks. Most existing related works only focus on networks with static topology and are unsuitable for the satellite Internet, whose backbone network periodically changes in topology. They are inefficient in path retrieval and unreasonable in attack path inference. To improve the retrieval efficiency of attack paths, we first propose a network logical attack graph with periodic changes. It can reduce retrieval space while preserving the exploitation relationship among hosts in a period. Then we design a hierarchical parallel search algorithm to quickly retrieve attack paths by dividing the path retrieval space into independent subspaces that can compute in parallel. To reasonably infer the attack paths, considering the impact of attack moment and topological connection duration on the selection probability of the attack path, we calculate it in combination with the basic exploitability probability, the total attack duration intention, the asset value, the time-based PageRank centrality, and the attack completion ratio. The experimental results demonstrate the effectiveness of our method.

Accurately constructing dynamic network topology is one of the core tasks to provide on-demand security services to the ubiquitous network. Existing schemes cannot accurately construct dynamic network topologies in time. In this paper, we propose a novel scheme to construct the ubiquitous network topology. Firstly, ubiquitous network nodes are divided into three categories: terminal node, sink node, and control node. On this basis, we propose two operation primitives (i.e., addition and subtraction) and three atomic operations (i.e., intersection, union, and fusion), and design a series of algorithms to describe the network change and construct the network topology. We further use our scheme to depict the specific time-varying network topologies, including Satellite Internet and Internet of things. It demonstrates that their communication and security protection modes can be efficiently and accurately constructed on our scheme. The simulation and theoretical analysis also prove that the efficiency of our scheme, and effectively support the orchestration of protection capabilities.