Deep learning is widely used in vulnerability detection due to its high accuracy. However, existing models often fail to capture both token-level and function-level features. To address this limitation, a BERT-based Multi-Granularity Attention Network (BMGANet) is proposed. In the BMGANet model, Program Dependence Graphs (PDGs) are first constructed using the Joern tool, and Abstract Syntax Trees (ASTs) are extracted according to predefined vulnerability rules. Cross-user-defined-function program slicing and code normalization are then applied to enhance analysis efficiency. Processed code slices are fed into a BERT network to extract initial token-level and function-level features. To overcome BERT’s limitation in modeling temporal dependencies, an LSTM network and a multi-head attention mechanism are sequentially employed to refine token-level features. The refined token-level features are then fused with function-level features for accurate vulnerability detection. Two pretraining tasks, namely the dynamic masked token prediction and the inter-code-line logical correlation prediction, are introduced to strengthen the model’s ability to handle semantic gaps and weak logical connections. Experimental results on both synthetic and real-world datasets show that BMGANet outperforms state-of-the-art methods.

In recent years, the approach of identifying brand logos from webpages and applying them to detect phishing attacks (referred to as "logo-based phishing detection") has become a state-of-the-art solution. A number of logo-based phishing detection models have been proposed, with the aim of enhancing performance metrics including accuracy, precision, recall, F1-score, and time efficiency. However, the scalability of detection models to adapt to new brand logos and their robustness against subtle adversarial perturbations in logo images are critical consider ations for logo-based phishing detection. This study proposes the PDOS (Phishing Detection with Object detection and Similarity computation), a comprehensive phishing detection model that combines object detection and sim ilarity computation on web logos. In PDOS, the Squeeze and Excitation (SE) attention mechanism is embedded into the YOLOv5s network to accurately capture brand logos on webpages. To generate an interpretable phishing detection report, two steps are performed sequentially: (1) Computing the visual similarity between the logos to be tested and those of legal websites; (2) Checking whether the target URL domain name is consistent with that of legal websites. Four new datasets containing samples with shape rotation, scale variations, and noise addi tion are constructed for comprehensively evaluating the phishing detection performance of the proposed model. Experimental results show that the PDOS model outperforms other related and representative schemes in terms of conventional metrics. The performance analysis also demonstrates that PDOS is scalable for new brand logos and robust against subtle adversarial perturbations in logo images.

Deep learning (DL) methods have been extensively applied in phishing detection, owing to their powerful feature-learning and classification capabilities. Nevertheless, generating deep feature vectors that can precisely characterize phishing behaviors is essential to effectively recognize and detect phishing attacks within the cyber realm. This study proposes DL phishing detection with multilevel features (DPMLF), a novel model crafted to boost phishing detection performance by integrating uniform resource locator (URL) character-level and HyperText Markup Language (HTML) word-level semantic features. DPMLF uses character embedding along with parallel convolutional kernels of diverse sizes to extract local URL features. HTML text adopts word-level embedding and stacked convolutional layers to capture both local and long-range dependencies. Subsequently, a fully connected layer merges these multilevel features into a fine-grained vector for classification. Moreover, DPMLF incorporates an incremental learning mechanism, enabling it to continuously update its knowledge base with new data. When evaluated on three public datasets sourced from GitHub, Kaggle, and Zenodo, DPMLF attained an average accuracy of 0.9900, precision of 0.9901, recall of 0.9899, and an F1-score of 0.9900.

As a state-of-the-art approach, the application of deep learning for logo-based phishing website detection has been considered in recent researches. At present, many of the existing detection methods have achieved good results in conventional metrics such as accuracy, precision, recall, F1-score and time cost. This study proposes a comprehensive phishing detection model combing object detection on web logos. First, use YOLOv11 to capture the logo in the web page, then get the list of legitimate domain names corresponding to that category according to the obtained logo category, and finally match the string of url. Only if the domain name matches successfully will it be considered as a legitimate website, otherwise it will be a phishing site.We made a dataset containing five brands of logo to train and verify yolov11, obtained effective phishing URLs from Phishtank, and made a test set for YOLOv11 and a test set for phishing detection.The experimental results show that the average accuracy, accuracy, recall, F1 score and time cost of YOLOv11 model are 0.979, 0.99,0.973, 0.981 and 0.07s, respectively, indicating that YOLOv11 can quickly and accurately identify logo in web pages and give the judgment of phishing.

Deep learning has become a prominent approach for automated code vulnerability detection. However, state-of-the-art models often struggle with complex vulnerabilities due to their inability to simultaneously capture both fine-grained token-level semantics and function-level structural features. To address this limitation, we propose BMGANet, a novel deep learning model that integrates multi-granularity features for effective vulnerability detection. Our framework begins by using Joern to construct Program Dependence Graphs (PDGs) and Abstract Syntax Trees (ASTs), followed by cross-function slicing and code normalization. A BERT-based network then extracts token-level and function-level features, which are further refined by an LSTM and a multi-head attention mechanism to model complex code contexts. These enhanced features are subsequently fused for final prediction. Furthermore, BMGANet is pre-trained on two auxiliary tasks—masked token prediction and inter-code-line logical correlation prediction—to improve its semantic understanding of code syntax and logic. Evaluated on widely-used benchmarks, BMGANet demonstrates superior performance and significantly outperforms existing methods.

Phishing poses a critical cyber security threat. Although machine learning-based detection methods have achieved notable success, visual similarity-based detection techniques still face the core challenge of complex visual feature extraction processes. This work innovatively introduces CLIP-series large models as image encoders. our approach achieves efficient phishing detection without requiring additional training. Experimental results demonstrate that our model achieves a classification-related accuracy rate of 91.21% on the VisualPhish dataset, significantly outperforming traditional models (more than 35% improvement). In phishing detection tasks, it attains a peak performance of 83%, surpassing the current state-of-the-art VisualPhishNet by 2%.

With the widespread adoption of QR(Quick Response) codes in people's daily networking environment such as mobile payments, information retrieval, and public transportation, phishing attacks have grown more sophisticated and covert. Attackers not only disguise malicious links to resemble legitimate URLs, but also exploit QR codes to lure users into visiting phishing websites or downloading malware. Building upon traditional URL-based phishing detection methods, this study extends the detection scope to include QR code-based phishing attacks. To improve the comprehensiveness of phishing detection, we propose a deep learning model based on multimodal features, termed QR code and URL Detection based on Multi-Modal Fusion Network (QUD-MFNet).QUD-MFNet adopts a dual-branch architecture: the image branch leverages Data-efficient Image Transformer (DeiT) to extract global visual features from QR codes, while the text branch employs Bidirectional Encoder Representations from Transformers (BERT) for semantic encoding of URLs, and further integrates Bidirectional Long Short-Term Memory (BiLSTM) networks to model sequential information. The multimodal features from both branches are fused through an adaptive attention mechanism, thereby enhancing detection capability. Experiments show that QUD-MFNet outperforms traditional unimodal methods and some existing ones. It proves that multimodal learning works effectively for phishing detection.

Due to the ability to automatically extract phishing features without relying on expert knowledge, deep learning methods have been widely applied in the research of phishing email classification and detection. However, the unique structure of emails and the complexity of publishing strategies mean that current deep learning-based phishing email detection studies still require further performance enhancement. To effectively detect phishing emails, this paper proposes TFW-CNBL (Term Frequency and Word2Vec-CNN and BiLSTM), a deep detection model for phishing emails based on the fusion of term frequency and contextual semantic multi-features. The TFW-CNBL model generates a hybrid feature vector that comprehensively understands the characteristics of phishing emails by integrating term frequency and contextual information. The model combines a convolutional neural network (CNN) with an attention mechanism and a bidirectional long short-term memory network (BiLSTM), creating an underlying architecture capable of rapid text classification. The paper utilized a publicly available dataset from Kaggle containing 18,650 samples to train and test the TFW-CNBL model. Experimental results indicate that the TFW-CNBL model can effectively detect phishing emails, achieving an average accuracy, precision, recall, and F1 score of $0.984,0.986,0.989$, and 0.987, respectively.

Currently, the increasing number of high-volume phishing attacks is among the largest threats to networking environments on a daily basis. During such a severe attack, researchers prefer to extract numerous features to improve the accuracy of phishing detection. However, the redundant features that may exist in the extracted feature set may be adapted by phishing attackers, not only degrading detection performance but also shortening the effective time of the constructed detection models. To address these problems, this study proposes phishing detection based on hybrid features (PDHF), a novel phishing detection model based on a combination of optimal artificial and automatic deep learning features. The optimal artificial phishing features are obtained by removing redundant features based on the newly designed feature importance evaluation index and an improved bidirectional search algorithm. To extend the effective time of phishing detection, deep features are learned from URLs using a one-dimensional character convolutional neural network (CNN) and a disorderly quantized attention mechanism. The experimental results show that PDHF outperforms many state-of-the-art methods and achieves an accuracy of 0.9965, precision of 0.9942, recall of 0.9940, and F1-score of 0.9941. These results can help in the development of a security plug-in for clients, browsers, and various instant messaging tools that run on network edges, personal computers, smartphones, and other personal terminals.

Deep learning methods, known for their powerful feature learning and classification capabilities, are widely used in phishing detection. To improve accuracy, this study proposes DPMLF (Deep Learning Phishing Detection Model with Multi-Level Features), which integrates URL character-level and HTML word-level semantic features. DPMLF utilizes character embeddings and parallel convolutional kernels to precisely extract local URL features. For HTML text, it employs word-level embeddings and stacked convolutional layers with dense connections to capture both local and long-range text information. The fully connected layer then fuses these features into a multi-level, fine-grained feature vector for classification. The results of experiments conducted on two public datasets with different scales show that DPMLF is accurate in phishing attack detection.

As one of the most import machine learning technique, clustering is widely used in many data classification areas. Due to the unsupervised learning feature, the quality of the clustering results needed to be evaluated. In this paper, the MPdist (midpoint-involved distance) based on the midpoint of centers between two clusters is firstly defined to measure the inter-cluster separation. Then, the MPC (MPdist based clustering validity index), a novel internal clustering validity index based on the combination of the new defined inner-cluster compactness and the inter-cluster separation, is proposed to effectively evaluate the validity of the clustering results of many clustering algorithms. Experimental results on testing many types of datasets have demonstrated that the MPC index proposed in this paper is able to quickly handle datasets like spherical datasets, non-spherical datasets and real large-scale datasets.

With the increasing availability of computational power, deep learning methods have been widely used for detecting software vulnerabilities in recent years. In contrast to traditional machine learning technology, deep learning methods have the merits of low computational overhead and high vulnerability detection accuracy, and they do not depend on expert knowledge to extract vulnerability features. However, the performance of many existing deep vulnerability detection methods is degraded by inadequate information about the syntax and semantics of source code. This paper proposes Vulnerability Detection based on Deep learning and Attention mechanisms (VDDA), an effective software vulnerability detection model based on deep learning and an attention mechanism. In VDDA, the bidirectional long short-term memory (BLSTM) deep model is used to alleviate the need for the feature engineering of traditional machine learning techniques. With the Joern analysis tool, the source code is converted to code property graphs (CPG) to retain the affluent syntax and semantic information. Several improvements, including depth-first traversal-based CPG optimization, three-direction code slicing, slice organization with code blocks, and the separation of function names from variable names in code symbolization, were made to effectively convert source code into vectors that could be taken as the only input to the underlying deep learning model. Meanwhile, because different parts of the vector play different roles in vulnerability detection, the attention mechanism was integrated with BLSTM to further improve vulnerability detection performance. The experimental results on two datasets of different scales demonstrated that the proposed VDDA outperforms many existing methods in vulnerability detection.

Many of software vulnerability detection methods suffer from problems of dependent on expert experience, rough detection granularity, and incomplete syntax and semantics information on source codes. This paper proposes the VDDA, Vulnerability Detection based on Deep learning and Attention mechanism, an effective software vulnerability detection model based on deep learning and the attention mechanism. In the VDDA, deep learning technology is used to construct the underlying classifier to avoid the feature engineering of traditional machine learning techniques. The Joren slice tool combined with the code attribute graph (CPG) optimization is used to simplify the source code before it is fed to the Bidirectional Long Short-Term Memory (BLSTM) deep model. Meanwhile, the attention mechanism is employed to improve the efficiency and accuracy of vulnerability detection. Experiment results have demonstrated that the proposed VDDA model is more effective than the existing vulnerability detection methods.

As a classical data mining technique,clustering is widely used in fields as pattern recognition,machine learning,artificial intelligence,and so on.By effective clustering analysis,the underlying structures of datasets can be identified.As a commonly used partitional clustering algorithm,K-means is simple of implementation and efficient on classifying large scale datasets.However,due to the influence of the convergence rule,the traditional K-means is still suffering problems as sensitive to the initial clustering centers,cannot properly process non-convex distributed datasets and datasets with outliers.This paper proposes the DC-Kmeans (density parameter and center replacement K-means),an improved K-means algorithm based on the density parameter and center replacement.Due to the gradually selecting of initial clustering centers and continuously update imprecision old centers,the DC-Kmeans is more accurate than the traditional K-means.Two novel methods are also proposed for optimally clustering:1)a novel clustering validity index (CVI),SCVI (Sum of the inner-cluster compactness and the inter-cluster separateness based CVI),is proposed to evaluate the results of the DC-Kmeans;2)a new algorithm,OCNS (optimal clustering number determination based on SCVI),is designed to determine the optimal clustering numbers for different datasets.Experimental results demonstrate that the proposed clustering method is effective for many kinds of datasets.

Phishing, in which social engineering techniques such as emails and instant messaging are employed and malicious links are disguised as normal URLs to steal sensitive information, is currently a major threat to networks worldwide. Phishing detection systems generally adopt feature engineering as one of the most important approaches to detect or even prevent phishing attacks. However, the accuracy of feature engineering systems is heavily dependent on the prior knowledge of features. In addition, extracting comprehensive features from different dimensions for high detection accuracy is time-consuming. To address these issues, this paper proposes a lightweight model that combines convolutional neural network (CNN), bi-directional long short-term memory (BiLSTM), and the attention mechanism for phishing detection. The proposed model, called the char-convolutional and BiLSTM with attention mechanism (CCBLA) model, employs deep learning to automatically extract features from target URLs and uses the attention mechanism to weight the importance of the selected features under different roles during phishing detection. The results of experiments conducted on two datasets with different scales show that CCBLA is accurate in phishing attack detection with minimal time consumption.

As a classical clustering algorithm, the K-means is widely applied and studied in the information retrieval. However, the performance of this algorithm is sensitive to the selection of initial clustering clusters. Improper selection of these centers will trap the algorithm into the problem of local optimum. Meanwhile, this algorithm cannot process the non-convex datasets effectively. In order to ease these problems, this paper proposes the DHKmeans, an improved K-means based on the dynamic initial clustering center determination and the hierarchical clustering. In the DH-Kmeans, a comprehensive measure which is based on the density parameter and the cluster distance is firstly designed to dynamically determine the initial clustering centers. By this, the problem of local optimum is avoided. Then, the Agglomerative Hierarchical Clustering (AHC) is integrated into the iteration procedures of the DH-Kmeans. In the iteration procedures, the similar small clusters are merged gradually to endow the DH-Kmeans with the ability of precisely processing more types of datasets. Experimental results on testing 25 artificial datasets and six real datasets have demonstrated that the DH-Kmeans is fast, stable, and accurate in data clustering.

To effectively boost computer usage, machine learning models are used in several phishing detection systems to classify enormous phishing datasets. Based on phishing patterns, researchers prefer to extract a considerable number of features to improve phishing detection performance. However, redundant and useless features in the feature set degrade the performance of the underlying classification models. In addition, several existing phishing detection models mainly focus on detection accuracy and overlook recall rates. However, in phishing detection, it is more harmful to falsely detect a phishing website as a legitimate website than it is to detect a legitimate website as a phishing website. This study proposes a novel phishing detection model, multi-objective evolution/random forest (MOE/RF), which is based on the revised multi-objective evolution optimization algorithm (MOE) and random forest (RF). The MOE/RF model uses accuracy as the detection target and minimizes the probability of false detection of phishing sites. In addition, two new strategies, the symmetric uncertainty-based population initialization and the population state-based adaptive environmental selection, are proposed to improve the performance of the MOE. Experimental results on testing five different phishing datasets demonstrated that the MOE/RF performs superior to several existing methods.

聚类分析是统计学、模式识别和机器学习等领域的研究热点.通过有效的聚类分析,数据集的内在结构与特征可以被很好地发掘出来.然而,无监督学习的特性使得当前已有的聚类方法依旧面临着聚类效果不稳定、无法对多种结构的数据集进行正确聚类等问题.针对这些问题,首先将K-means算法和层次聚类算法的聚类思想相结合,提出了一种混合聚类算法K-means-AHC;其次,采用拐点检测的思想,提出了一个基于平均综合度的新聚类有效性指标DAS(平均综合度之差,difference of average synthesis degree),以此来评估K-means-AHC算法聚类结果的质量;最后,将K-means-AHC算法和DAS指标相结合,设计了一种寻找数据集最佳类簇数和最优划分的有效方法.实验将K-means-AHC算法用于测试多种结构的数据集,结果表明:该算法在不过多增加时间开销的同时,提高了聚类分析的准确性.与此同时,新的DAS指标在聚类结果的评价上要优于当前已有的常用聚类有效性指标.

Recently, phishing emerges as one of the biggest threats to human’s daily networking environments. Phishing attackers disguise illegal URLs as normal ones to steal user’s private information with the social engineering techniques, such as emails and SMS, which calls for an effective method of preventing phishing attacks to relieve the loss by them. Neural networks can be used to detect and prevent phishing attacks because of their strong active learning abilities from massive datasets and high accuracy in data classification. However, duplicate points in the public datasets and negative and useless features in the feature vectors will trap the training of the neural networks into the problem of over-fitting, which will make the trained classifier weak when detect phishing websites. This paper proposes DTOF-ANN (Decision Tree and Optimal Features based Artificial Neural Network) to tackle this shortcoming, which is a neural-network phishing detection model based on decision tree and optimal feature selection. First, the traditional K-medoids clustering algorithm is improved with an incremental selection of initial centers to remove the duplicate points from the public datasets. Then, an optimal feature selection algorithm based on the new defined feature evaluation index, decision tree and local search method is designed to prune out the negative and useless features. Finally, the optimal structure of the neural network classifier is constructed through properly adjusting parameters and trained by the selected optimal features. Experimental results have demonstrated that DTOF-ANN exhibits higher performance than many of the existing methods.