Abstract With the rapid development of cloud computing, enterprises have increasingly migrated their servers and services from internal networks to cloud environments. Traditional boundary-based protection mechanisms are no longer sufficient for addressing the security requirements of modern cloud-based systems. As cyberattacks continue to evolve, ensuring the long-term, secure, and reliable operation of increasingly complex IT systems has become a significant challenge. Consequently, researchers have proposed various fine-grained access control approaches. Fine-grained access control remains a significant challenge in complex cloud-edge-endpoint collaboration scenarios. Existing approaches often rely on intricate policy definitions to achieve granular control, which can lead to increased computational overhead and degraded system performance. In this paper, we propose a lightweight, Zero-Trust-based Cloud-Edge-Endpoint Access Control System—TLBAC. By embedding trusted labels into TCP packets at the security endpoint (Endpoint), TLBAC enables traffic blocking and forwarding through access control policies issued by the Security Cloud Brain (Cloud) via the Edge Decision Gateway (Edge). This framework achieves fine-grained access control through trusted labels in a cloud-edge-endpoint architecture. To evaluate the effectiveness of TLBAC, four experiments are designed. The first experiment examines the impact of trusted labels insertion on TCP traffic packet transmission behavior. The experimental results show that even under high-latency, significant jitter, and high packet loss conditions in an LTE network, TCP packets with embedded trusted labels maintain stable and reliable data transmission. The second experiment assesses the resource consumption of TLBAC, focusing on CPU and memory overhead. The experimental results indicate that TLBAC’s resource consumption rate is only ± 0.2%. The third experiment simulates a realistic attack environment by launching attacks against the protected system from an adversarial perspective to validate TLBAC’s defensive capabilities. The experimental results demonstrate that TLBAC successfully detected and blocked all attacks in over thirty vulnerability cases involving different components, versions, and exploitation methods. The fourth experiment evaluates the practical operational capability of TLBAC in a multi-tenant environment. The results show that TLBAC can achieve connection-oriented fine-grained access control with low latency, while maintaining policy accuracy and isolation in multi-tenant scenarios.

Java frameworks such as Spring simplify the development process and enhance productivity, but they also introduce new security risks, particularly in handling flexible development paradigms like entity parameter passing and configuration, which increase the potential for injection attacks. However, existing vulnerability detection tools often focus on code slicing or taint propagation analysis, and struggle with framework complexity, such as their inability to parse data flows in configuration files or correctly handle entity parameter passing paths, leading to many potential vulnerabilities going undetected, while also struggling to address developer-defined sanitizers, resulting in a higher false positive rate. To address these challenges, we developed iDetector , a static analysis tool specifically designed to detect injection vulnerabilities in Java frameworks. First, iDetector constructs a comprehensive code graph using a Code Property Graph (CPG), enabling it to flexibly handle scenarios that require dynamic structural modifications, such as XML configuration injection and dynamic method call resolution. Next, iDetector employs LLM-assisted sanitizer analysis techniques to reduce false positives caused by developer-defined sanitizers substantially. In a comprehensive evaluation of real-world Java projects and existing state-of-the-art tools, iDetector demonstrates superior precision and recall. It has uncovered 172 previously unknown vulnerabilities, of which 51 have been assigned CVE identifiers.

With the rapid evolution of cyber threats, malware increasingly exploits encrypted protocols for covert communication. The emergence of the QUIC protocol and widespread adoption of HTTP/3 have expanded the mainstream protocol combinations from [TCP-TLS] to [TCP-TLS, UDP-QUIC]. This enables malware to adopt more diverse evasion strategies at different lifecycle stages, thus rendering traditional detection methods insufficient for QUIC-enabled scenarios. To address this challenge, we propose QMTA, a multi-protocol malware traffic analysis framework that constructs flow behavior graph representations for infected hosts. Our approach models flow features from heterogeneous protocol stacks as graph nodes and their spatiotemporal correlations as edges, then leverages graph representation learning to generate low-dimensional embeddings that capture complex behavioral patterns across protocols. We construct a novel dataset containing QUIC-enhanced encrypted malware traffic through systematic simulation across critical lifecycle stages. Experimental results demonstrate that QMTA significantly outperforms five SOTA baselines in detecting both conventional and QUIC-enhanced encrypted malware traffic, achieving an AUC of 0.9412 and F1-score of 90.51% on our novel dataset with robust generalization against unknown threats.

Provenance-based intrusion detection systems achieve near-perfect recall for Advanced Persistent Threats but generate tens of thousands of alerts within hours, overwhelming security analysts. We observe that case-based reasoning (CBR) offers a promising approach to reducing massive false alarms. Unlike static whitelists or fixed rules, CBR maintains a dynamically evolving case base, enabling the system to automatically retrieve and reduce false alarms. We present CBR-PAR, the first framework to formalize provenance alert reduction as a complete CBR cycle. CBR-PAR models an alerted process as a graph-text case representation through rarity-guided subgraph extraction and enhanced evidence completion, then follows the complete CBR cycle for alarm elimination and intrusion detection. It retrieves benign source cases from the case base by jointly analyzing structural and behavioral similarity. LLM reuses the retrieval results as benign baseline to assess the threat of given case. Security analysts dynamically revise and selectively retain new cases that exhibit significant deviation from existing ones. Evaluation on three DARPA benchmarks shows that CBR-PAR reduces raw alerts by 700 × to 3,800 × while preserving 86.7 × , confirming that grounding judgments in retrieved experience is the primary driver of noise elimination. The local-online split further cuts cloud API costs by 50 × . Beyond quantitative gains, CBR-PAR’s case-based comparative reasoning uncovers ground-truth labeling errors and discovers previously unlabeled attack components—demonstrating that decisions anchored in concrete past cases are both more transparent and more robust than opaque anomaly scores.

Managed cloud-identity services issue short-lived credentials so that mobile and web clients can access storage, database, and serverless APIs without passing through application servers. These services are layered on top of a security-token engine and an account-wide policy system, yet prior work has examined each layer in isolation. We present the first end-to-end analysis of this multi-plane workflow, using Amazon Cognito as a representative case. Treating Cognito, the Security Token Service and IAM as a single security graph, we (i) provide the first in-depth security analysis of session-bypass risk and (ii) uncover two additional design flaws that allow users to exploit overly permissive or divergent trust policies and to assume “hanging” roles left behind after reconfiguration. A crawl of $\mathbf{8 4 4}$ Cognito-backed Android apps reveals these flaws in 179 deployments, affecting at least 1.7 million users. To detect such drift automatically, we build C-Verifier, a tool that converts an account snapshot into Satisfiability Modulo Theories formulas spanning all three control planes and checks five security properties. C-Verifier yields precise counter-examples, outperforms four state-of-the-art tools, and analyzes 400 identity pools with 1,400 roles in under 40 s. We release both the tool and a curated benchmark, Cognito Configuration Bench, to facilitate reproducible cross-service policy research.

Web applications remain prime targets for cyber attacks, yet existing detection methods struggle against sophisticated payload obfuscation and fail to establish fine-grained associations between attack traffic and specific CVE identifiers. To bridge this semantic gap, we propose IA-VulD, a Web vulnerability detection framework for robust attack identification and accurate cross-modal CVE association. At its core, IA-VulD adopts a two-level instruction-aware embedding strategy, using symmetric instructions for precise same-modality payload retrieval and asymmetric instructions to align traffic patterns with natural language vulnerability descriptions. We further introduce a multi-stage fine-tuning mechanism that leverages LoRA and LLM-generated high-fidelity obfuscated samples to refine decision boundaries against evasion tactics. A dual-recall mechanism then fuse the two retrieval paths. Experiments on real-world datasets show that IA-VulD achieves 91.88

Provenance-based Intrusion Detection Systems (PIDS) have emerged as a promising defense against sophisticated cyberattacks, but their performance is often constrained by inadequate semantic representations. Existing approaches face two primary challenges that limit their representational power: (a) the semantic poverty of coarse-grained node types, which fails to capture the diverse functional roles of system entities, and (b) the ineffective fusion of heterogeneous features. To address these, we present AEGIS, a novel PIDS framework that enhances graph representation learning with two key components. First, we introduce a cost-effective pipeline that leverages Large Language Models (LLMs) to refine coarse-grained node types into fine-grained subcategories. Second, a cross-attention fusion module aligns categorical attributes with literal features to produce discriminative node embeddings, which are then trained within a masked graph autoencoder. On two public datasets, AEGIS attains up to 1.00 precision and 0.99 F1 with 0.23% FPR.

The proliferation of Android multimedia applications highlights the critical role of mobile sensors. Inherent manufacturing defects enable implicit device identification without consent, facilitating covert tracking. This bolsters security through reliable malicious actor tracking, unlike spoof-vulnerable explicit methods. However, prior sensor-based identification suffers from signal noise and device degradation, compromising robustness.In this paper, we propose AMSensorFP, a novel Android implicit device tracking framework. We develop an application to collect device information and multi-sensor data to construct device fingerprints. Subsequently, we build a dataset by performing pairwise difference calculations on the collected fingerprints. And then enhance the dataset with Gaussian noise to improve data diversity and robustness. An autoencoder reduces feature dimensionality, and the processed features are fed into a BiLSTM model with a multi-head attention mechanism, enabling effective fingerprint recognition. Experimental results show that AMSensorFP achieves 99.88% accuracy and 97.34% true positive rate(TPR), significantly outperforming existing methods. Ablation analysis further highlights the contributions of each module and feature in the framework. AMSensorFP delivers a reliable solution for device tracking and security enhancement.

Matter is emerging as an IoT industry-unifying standard, aiming to enhance the interoperability among diverse smart home products, enabling them to work securely and seamlessly together. With many popular IoT vendors increasingly supporting Matter in consumer IoT products, we perform a systematic study to investigate how and whether vendors can integrate Matter securely into IoT systems and how well Matter as a standard supports vendors ' secure integration. By analyzing Matter development model in the wild, we reveal a new kind of design flaw in user-facing Matter control capabilities and interfaces, called UMCCI flaws, which are exploitable vulnerabilities in the design space and seriously jeopardize necessary control and surveillance capabilities of Matter-enabled devices for IoT users. Therefore we built an automatic tool called UMCCI Checker, enhanced by the large-language model in UI analysis, which enables automatically detecting UMCCI flaws without relying on real IoT devices. Our tool assisted us with studying and performing proof-of-concept attacks on 11 real Matter devices of 8 popular vendors to confirm that the UMCCI flaws are practical and common. We reported UMCCI flaws to related vendors, which have been acknowledged by CSA, Apple, Tuya, Aqara, etc. To help CSA and vendors better understand and avoid security flaws in developing and integrating IoT standards like Matter, we identify two categories of root causes and propose immediate fix recommendations.

With the development of HTML5, tracking technologies have evolved dramatically and gradually moved from cookies to browser fingerprinting. Previous research has shown that there are more serious privacy threats associated with tracking behavior on third-party websites. However, by focusing on third-party websites that are loaded in the browser, the researchers overlooked the fact that third-party websites are also present in Android applications, where tracking is easy to perform and definitely covert to detect. In this study, we propose WTDetect, an Android third-party website tracking detection framework. Based on the parsing of view tree and the generation of function call stack, WTDetect automatically locates and captures the source code of third-party websites. To explore the direction of sensitive data flow, WTDetect performs static taint analysis on the program dependency graph for each JavaScript file. Finally, a fine-grained classification model is used to detect the tracking behavior. WTDetect is used to perform a measurement study of tracking behavior on 1090 captured Android third-party websites. The result outlines that 14.68% of third-party websites in Android applications tracking users without any access warnings and user authorization, which directly leads to the risk of privacy leakage.

Website Fingerprinting (WF) attacks, a methodology that allows observers to infer visited websites through encrypted traffic analysis, are usually employed for evaluating the security of anonymous networks like Tor. Although deep learning-based methods have demonstrated significant success in recent studies, existing approaches exhibit limitations. They are insufficient in modeling the intricate characteristics of traffic patterns, which leads to compromised accuracy in identifying challenging samples. To address these limitations, we propose CTF, a novel WF attack comprising three key components: (1) extraction of Hybrid Multi-scale Traffic Features (HMTF) integrating spatio-temporal information, (2) a novel deep learning framework that synergizes CNN for spatial pattern recognition and Transformer for temporal dependency modeling within HMTF, and (3) a supervised contrastive learning mechanism to enhance discriminative capability across website fingerprints. Experimental evaluations across multiple benchmark datasets reveal that CTF achieves 99.09% accuracy in Closed-World scenarios, showing enhanced robustness against four SOTA WF defense mechanisms.

APIs are now central to digital transformation, carrying the core business logic and sensitive data of enterprises. Attackers can gain access to important information systems and sensitive data by attacking APIs, allowing them to steal high-value data. Besides being vulnerable to traditional attacks, APIs also face unique threats tailored to their characteristics, such as attacks targeting API business logic threats. This type of API attacks are complex, and the attack requests are very similar to legitimate traffic, making them difficult to distinguish from benign requests. Therefore, traditional single-request detection methods are ineffective against such complex attacks. By employing intelligent context-aware natural language processing techniques, we can understand API call behavior and establish a baseline of normal API call behavior to identify anomalies. In this paper, we propose DAB-LLM, a model for Detecting Anomalies in API call Behavior based on Large Language Model. Our approach utilizes extraction and representation methods for API call chains and API call graphs, prompt optimization algorithm, and LoRA fine-tuning technique to enable the model to deeply understand of API call behavior and enhance detection capabilities. Experimental results indicate that DAB-LLM excels in detecting attack behaviors and anomalies in API calls, achieving an f1-score of 97.35% along with significant improvements in recall rate, accuracy and precision. The overall performance of the model shows that our proposed model significantly outperforms other models in API call behavior anomaly detection.

Advanced Persistent Threats (APTs) pose significant cybersecurity challenges through stealthy, multi-stage attacks that leverage zero-day exploits and evasive tactics. While provenance graph-based methods show promise for APT detection, existing approaches face three critical limitations: (i) inappropriate granularity levels, (ii) insufficient critical context, and (iii) lack of interpretable output. To address these challenges, we propose Prov-LLM, a novel LLM-enhanced detection system that leverages process-centric behavioral subgraphs. Our approach first decomposes large provenance graphs into process-centered graphs, enriching them with key attributes such as process names, execution paths, and command-line arguments. Prov-LLM then utilizes a Retrieval-Augmented Generation (RAG) framework to establish a baseline of benign behavior, enabling LLMs to perform context-aware anomaly detection via semantic reasoning. Finally, the system reconstructs anomalous process behavior subgraphs and generates human-readable explanations of attacks, offering security analysts intuitive insights for investigation. We evaluate Prov-LLM on three DARPA OPTC attack datasets: Plain PowerShell Empire, Custom PowerShell Empire, and Malicious Upgrade. Results demonstrate that Prov-LLM outperforms state-of-the-art methods in accuracy, precision, and recall. Notably, the synergy between process behavior subgraphs and LLMs significantly reduces analysts’ workload during attack investigations.

In recent years, web application development has become more efficient, yet vulnerabilities still pose significant risks. Traditional static and dynamic detection techniques are prone to false positives and negatives, making it challenging for small and medium-sized developers with limited security knowledge to accurately assess the results. To address these challenges, we introduced VulKiller, an automated vulnerability detection tool powered by large language models (LLM). VulKiller leverages static analysis to convert application code into Code Property Graphs (CPG) and utilizes Neo4j to identify high-risk method call chains. By designing structured interactions with ChatGPT, these call chains and corresponding code are transformed into Proofs of Concept (PoCs), which are then parsed into attack payloads and evaluated by a vulnerability monitor for effectiveness. In comparison with traditional tools, VulKiller excels in reducing false positives and negatives. Additionally, in zero-day vulnerability detection experiments, VulKiller identified 12 zero-day vulnerabilities. Our results offer significant encouragement for using LLM to enhance vulnerability detection.

Kubernetes has emerged as the de facto standard for container orchestration. However, existing container scheduling strategies prioritize QoS, leading to the co-location of pods with varying permission levels on the same node. This not only introduces risks of privilege escalation but also facilitates the spread of pods with risky permissions across the cluster, exacerbating the potential for attackers to elevate their privileges. In this work, our goal is to mitigate permission disparity among pods on each node, thereby reducing the risk of privilege escalation from co-location attack and curbing the spread of high-risk permissions across the cluster. We introduce a novel metric, Extraneous Risk Privileges (ERP), to quantify additional privileges derived from the combination of RBAC permissions and cluster parameters that are utilized by other pods on the node but not by the target pod itself. The RBAClock scheduling framework is designed to minimize ERP increase during pod placement, prioritizing the aggregation of pods with similar risk profiles and isolation of those with divergent privileges. Experimental evaluations across 24 CNCF applications demonstrate that, compared to the default scheduler, RBAClock alone achieves an average reduction of 41.46% in aggregated privileges in cluster, 64.63% in privilege escalation risk, and 34.59% in high-privilege nodes proportion, with an 8% performance tradeoff. Notably, our investigation uncovered privilege escalation risks in the Kubernetes services of two major cloud providers, Alibaba Cloud and Tencent Cloud, and demonstrated that RBAClock can effectively mitigate these threats.

Matter is emerging as a unifying standard in the IoT industry, designed to enhance interoperability among diverse smart home products, ensuring secure and seamless integration. As major IoT vendors increasingly adopt Matter in consumer IoT products, we conduct a systematic study to investigate security risks in the Matter discovery process. By analyzing Matter controllers in the wild, we uncover a novel design flaw in the Matter discovery and connection process, termed MDB. This flaw represents exploitable vulnerabilities in the design space, significantly undermining the control and monitoring capabilities of Matter-enabled devices for IoT users. To facilitate the detection of MDB, we developed an automatic tool, MDB-Checker. Using our tool, we conducted proof-of-concept attacks on 16 real Matter controllers from 13 leading vendors, confirming that MDB is both practical and widespread. We responsibly disclosed the security risks of MDB to CSA and affected vendors, with acknowledgments received from CSA, Tuya, among others. Additionally, we proposed a fix for the Matter standard and developed a mitigation tool to address these security issues.

Advanced Persistent Threats (APTs) have emerged as one of the most challenging security issues due to their stealthy nature, sophisticated techniques, and use of zero-day exploits. While provenance graph analysis has shown promise in APT detection, current methods suffer from three critical limitations: (1) loss of contextual information in graph embeddings, (2) insensitivity to processes with minimal malicious behavior, and (3) lack of automated root cause analysis. To address these challenges, we propose LCA-PRCA, a novel root cause-preserving detection framework that precomputes the lowest common ancestor (LCA) for all process nodes—where the LCA represents the root node—and embeds this root node information directly into the provenance graph. By connecting each process to its root node, LCA-PRCA preserves long-range contextual relationships, enhancing sensitivity to subtle anomalies and enabling automated root cause analysis. This approach significantly improves the detection of APTs by linking malicious activities to their origins, even for processes with minimal deviations from normal behavior. We evaluate LCA-PRCA on the DARPA OPTC dataset across three attack scenarios: Plain PowerShell Empire, Custom PowerShell Empire, and Malicious Upgrade. Results show that LCA-PRCA achieves higher true positive rates (TPR) and lower false positive rates (FPR) compared to state-of-the-art methods, demonstrating its effectiveness in precise APT detection and efficient root cause analysis.

Over the past decade, PHP has consistently been one of the most popular server-side programming languages among developers for web development. To protect intellectual property, various PHP source code obfuscation and encryption methods have been developed, which has led to difficulties in performing security analysis on PHP source code. Previous work has demonstrated the feasibility of recovering source code by extracting bytecode from PHP during dynamic execution. However, there is still a lack of a universal decompilation method for this kind of bytecode, tailored to PHP's unique syntax. Thus, we propose a systematic decompilation framework for PHP bytecode. First, we design a unified intermediate representation that eliminates the differences between bytecodes from different PHP versions. Then, we introduce a structural analysis algorithm specifically for PHP syntax, improving upon existing methods to better accommodate PHP's unique syntax. We use over 3 million lines of PHP code as a dataset and compiled it into PHP bytecode. After decompiling it with our method, we successfully recovered 92% of the classes and 85% of the methods. Furthermore, from the encrypted dataset containing 37 SQL injection and 31 XSS vulnerability patterns, we fully restored the original vulnerability patterns and reconstructed the exploitation chains. Furthermore, we identified a series of vulnerabilities in real-world projects and were assigned 6 new CVE IDs(1), demonstrating the correctness of our method and its ability to assist in static analysis for vulnerability discovery.

The Matter protocol has rapidly become the new standard for secure and interoperable IoT connectivity, adopted by major industry players and integrated into millions of devices. A core feature of Matter is its ability to support device sharing across users and controllers. However, as vendors independently implement Matter and blend it with their proprietary ecosystems, significant inconsistencies emerge. These inconsistencies result in heterogeneous user capabilities depending on which Matter Controller (MC) or OEM app is used, introducing a new and largely unexplored class of security risks. In this work, we present the first systematic study on security risks stemming from heterogeneous Matter controller implementations in shared device environments. We analyze 18 major IoT vendors and uncover a novel category of vulnerabilities, which we term MCG (Matter Controller Gaps), where differences in controller capabilities can enable unauthorized access or stealthy device manipulation. To uncover these flaws at scale, we develop MCG-Checker, a semi-automated analysis tool that combines large language models and UI automation to detect control disparities across Matter controllers and OEM apps. Using MCG-Checker, we evaluate 14 Matter controllers and 8 OEM apps, discovering 5 previously unknown attack vectors affecting top vendors such as Google, Apple, and Amazon Alexa. Our work reveals critical design and implementation issues in current Matter deployments. We offer concrete recommendations for protocol designers, vendors, and end users to address these gaps, contributing to more secure and predictable IoT ecosystems.