Advanced Persistent Threats (APTs) have become increasingly sophisticated and covert, necessitating the acquisition of an overall view of the rapidly evolving cyber threat landscape by security defenders. However, integrating threat intelligence from diverse sources poses significant challenges due to limited labeled data and noise interference. To address the requirement for the early detection of APT attacks, this paper introduces a lightweight framework named Warning-Graph, based on threat intelligence modeling. Warning-Graph leverages a limited set of IoCs to infer the type of ongoing APT attack. Initially, attack-related infrastructure nodes are modeled as a heterogeneous information network. Subsequently, heterogeneous graph contrastive learning is employed for pre-training. Two asymmetric graph encoders are constructed to obtain node embeddings without the need to generate negative samples or labeled data. In addition, a loss function based on the information bottleneck is specifically employed to reduce the noise in the original graph. In downstream tasks, multiclass classifiers are trained using embedding representations with fewer labeled samples. Experimental results demonstrate that the proposed framework achieves a 3- to 5-point increase in identification performance for APT attack types compared to baselines, while utilizing fewer labeled samples.

The Domain Name System (DNS) is a critical Internet service that translates domain names into IPs, but it is often targeted by attackers, posing a serious security risk. Graphbased models for detecting malicious domains have shown high performance but are vulnerable to adversarial attacks. To address this issue, we propose RMD-Graph, which is characterized by its ability to resist adversarial attacks and its low dependency on labeled data. A dual denoising module is specifically designed based on two autoencoders to generate the reconstructed graph, where SVD, TOP-k and reconstruction loss are introduced to enhance the denoising capability of autoencoders. Subsequently, residual connections are employed to generate an optimized graph that retains essential information from the original graph. The reconstructed graph and the optimized graph are then utilized as two views for graph contrastive learning, thereby achieving an self-supervised representation learning task without labels. In the downstream malicious domain detection, the denoised node representations are employed for machine learning classification. Extensive experiments are conducted on publicly available DNS datasets, and the results demonstrate that RMD-Graph significantly outperforms known baseline methods, especially in adversarial scenarios.

Vertical federated graph learning (VFGL) is a distributed graph learning scheme that addresses data isolation and privacy protection in scenarios where different clients hold the same nodes with distinct feature sets. However, VFGL is also vulnerable to poisoning attacks, while current defense methods based on horizontal federated learning and vertical federated learning are not effective in this context. To address this, this paper proposes APVFGL (Anti-Poison Vertical Federated Graph Learning), a robust VFGL framework resilient to poisoning attacks. APVFGL utilizes dual graph encoders and graph contrastive learning during the local training phase to derive robust node representations. The loss function, based on information bottleneck theory, reduces redundant information in the data to enhance the robustness of the model against poisoning attacks without the complexity of constructing negative samples. Additionally, a Shapley-based aggregation method is introduced on the server side to dynamically assign weights to each client, mitigating the impact of malicious feature manipulation. Experimental results on benchmark datasets demonstrate the superior performance of APVFGL against various poisoning attacks. Even in the case where more than half of the clients are poisoned, APVFGL can still achieve an F1 score of 81.6% and 71.5% on the Cora and Citeseer datasets, with an average reduction of 23.6% in attack success rate, highlighting its robustness and practicality in vertical federated graph learning scenarios.

The widespread deployment and open nature of the Android system have led to a rapid increase in Android malware, presenting significant challenges to mobile device security. Both static and dynamic analysis methods exhibit inherent limitations while hybrid detection approaches that combine static and dynamic features struggle with efficiency. To address these issues, this paper proposes MPDroid, a multimodal pre-training enabled detection approach. MPDroid effectively learns the critical characteristics of malicious behavior during the pre-training phase and achieves efficient single-modality detection in the downstream tasks. MPDroid utilizes an API call graph to represent dynamic features and a function call graph for static features. During pre-training, MPDroid employs graph convolutional networks and multimodal fusion techniques to capture the relationships between static and dynamic features. We also address the unimodal bias problem in multimodal tasks through modality alignment and model-level fusion. Furthermore, MPDroid significantly reduces the training and inferencing time for downstream tasks by implementing a multimodal pre-training framework with static features-based downstream tasks, thereby enhancing detection efficiency. Experimental results demonstrate that MPDroid achieves an average accuracy of 98.3% and an F1-score of 97.6%, with less than 7.39 s of detection duration, indicating superior overall performance compared to existing detection methods.

When distribution shifts occur between testing and training graph data, out-of-distribution (OOD) samples undermine the performance of graph neural networks (GNNs). To improve adaptive OOD generalization of GNNs, this paper introduces a novel generative invariant graph learning framework, named GI-Graph. It consists of four modules: subgraph extractor, generative environment subgraph augmentation, generative invariant subgraph learning, and query feedback module. The subgraph extractor decomposes a graph sample into an environment subgraph and an invariant subgraph and improves extraction accuracy through query feedback. GI-Graph uses a diffusion model to generate diverse environment subgraphs, augmenting the OOD data. By combining diffusion models, contrastive learning, and attribute prediction networks, GI-Graph also generates augmented invariant subgraphs with significant identically distributed features and consistency of labels. Experimental results demonstrate that the controllable environment subgraph and invariant subgraph augmentation effectively improve the OOD generalization capability of GI-Graph, especially in capturing invariant features and maintaining category consistency across environments. Additionally, the contrastive learning-based finetuning method enables GI-Graph to quickly adapt to evolving environments. This paper verifies the effectiveness of the generative invariant graph learning scheme in graph OOD generalization.

Recent advancements in stylish content generation technologies have revolutionized image synthesis, enabling the creation of high-resolution images with precise control. Motivated by this progress, we present BirdsSong, a novel audio steganography framework. BirdsSong aims to improve steganalysis resistance, increase steganographic capacity, enhance audio quality, and diversify styles compared to traditional methods. The framework includes an audio style extractor to separate content and style, a generator to combine style and content vectors without damaging audio quality, and a message extractor to recover the secret message accurately. Experimental results demonstrate that BirdsSong outperforms baseline methods in steganographic capacity, audio quality, style diversity, and resistance to steganalysis tools.

PowerShell is frequently utilized by attackers in the realm of Windows system security, particularly in cyberattack activities such as information stealing, vulnerability exploitation, and password cracking. To evade detection, attackers often employ code obfuscation techniques on their scripts. Current detection solutions face challenges due to limited deobfuscation methods and a predominant focus on identifying static and local features. This limitation hinders the ability to capture fine-grained code features and long-distance semantic relationships, resulting in reduced robustness and accuracy. To address these issues, this paper presents a novel malicious script detection method, Power-ASTNN, which integrates deobfuscation and a tree neural network. Initially, the method utilizes AMSI memory dump to deobfuscate PowerShell scripts, yielding fully deobfuscated samples. Subsequently, a subtree splitting algorithm tailored for abstract syntax trees extracts fine-grained code features from subtree fragments. Finally, a two-layer neural network model encodes representations based on subtree node semantics and sequence semantics, effectively capturing the semantic characteristics of the code. Experimental results demonstrate the effectiveness of Power-ASTNN, achieving an accuracy of 98.87% on a self built dataset collected from multiple publicly available sources, while maintaining a low false negative rate and a high area under the curve (AUC) value exceeding 0.995. Furthermore, Power-ASTNN demonstrates superior detection performance against adversarial samples compared with existing detection models.

In recent years, adversarial evasion attacks against log-based anomaly detection systems have been proven to pose severe threats. Existing detection models lack targeted defense mechanisms against such attacks, enabling malicious actors to conceal anomalous activities. This not only prevents timely detection of system failures or intrusions, but also significantly elevates security risks and potential losses. To address this challenge, this paper proposes AAR-log, a novel adversarial-resilient log anomaly detection framework. The key innovations of AAR-log include: (1) integrating various types of features including log components, log levels, and log templates to construct a more comprehensive representation of log sequences; (2) employing ensemble learning to enhance model diversity and mitigate the vulnerability of single-model approaches; and (3) incorporating adversarial training to constrain the adversarial sample space, thereby significantly improving the framework's robustness under adversarial conditions. Extensive experiments on benchmark log datasets demonstrate that AAR-log exhibits superior adversarial robustness. Its ensemble learning mechanism and adversarial training strategy effectively enhance resistance against evasion attacks, achieving higher TPR and F1 scores compared to baseline models. Notably, AAR-log also maintains strong generalization performance in non-adversarial environment. In the HDFS dataset, AAR-log improves TPR by 2.8%-9.5% and F1-score by 4.6%-14.3% over baseline models. In the BGL dataset, it achieves even greater gains, increasing TPR by 17.1%-26.7% and F1-score by 3.9%-28.4%. These results validate the effectiveness and robustness of AAR-log in log-based anomaly detection.

Web shell detection has become increasingly crucial with the expansion of cloud computing, where automated malware analysis serves as a foundational approach. A key challenge in malware detection lies in balancing the reduction of false positives with maintaining detection accuracy amid rapid software ecosystem evolution. Existing methods require substantial expert intervention to mitigate false positives and often neglect the resource-intensive measures required to address model degradation caused by software updates. This study introduces ASTBAR, a novel method that extracts fine-grained AST fragments to distill benign behavioral knowledge from webserver software. By leveraging program structure and semantic analysis, ASTBAR generates fragment-level representations of benign samples and employs fragment matching to identify malware. Unlike prior techniques, ASTBAR achieves simultaneous improvements in precision, recall, and adaptability to software evolution. The evaluation results demonstrate that ASTBAR achieves an F1 score of 65. 35%, outperforming the state-of-theart methods by 10.39%. In a 12-month industrial deployment spanning over one million users, ASTBAR maintained a 97.63% recall rat while reducing false positives by 700+ cases daily (equivalent to 30 expert hours).

The higher audio quality of steganography is directly correlated with the increased resistance to steganalysis tools. The advancement of generative AI technologies, particularly those that decouple style features from content, has shown promising developments by facilitating the creation of superior media content. This paper introduces the concept of audio decoupling and presents HIFI-Stego, an embedding audio steganography technique that aims to improve security while maintaining elevated stego audio quality. HIFI-Stego comprises a generator based on the encoder-decoder architecture and a secret message extractor. The encoder of the generator decouples the original audio, yielding the content vector, while the vocoder WORLD is employed to extract the style vector to preserve high-quality audio related features such as timbre and tone. Subsequently, the decoder embeds the secret vector into the decoupled content vector and then couples it with the style vector to generate high-fidelity stego audio. As embedding is not done in traditional time domain or frequency domain, existing analysis tools targeted at traditional steganographies fail to effectively detect the presence of the hidden message. The secret message extractor reuses the generator encoder and augments it with a single-layer convolutional neural network, resulting in a simplified structure suitable for lightweight deployment. Experimental results demonstrate that HIFI-Stego outperforms traditional generative and embedding steganographies in terms of audio quality, steganographic capacity, anti-analysis ability, and concealment.

The domain name system (DNS) serves as a fundamental component of the Internet infrastructure, but it is also exploited by attackers in various cyber-crimes, underscoring the significance of malicious domain detection (MDD). Recent advances show that graph-based models exhibit potential for inferring malicious domains and demonstrate superior performance. However, acquiring large-scale and high-quality graph datasets for MDD proves challenging for individual security institutes. Hence, a promising research direction involves employing vertical federated graph learning scheme to unite diverse security institutes and enhance local datasets resulting in more robust and powerful detection models. Nonetheless, directly applying vertical federated graph neural networks for MDD confronts challenges posed by noisy labels and noisy edges among security institutes, which ultimately diminish detection performance. This paper introduces a novel vertical federated learning framework, called MDD-FedGNN, that applies contrastive learning with two different encoders to deal with noisy labels and employs a new loss function based on the information bottleneck theory to handle noisy edges. Comparative experiments are conducted on a publicly available DNS dataset to evaluate the effectiveness of MDD-FedGNN in addressing the challenges of noisy labels and edges in vertical federated graph learning. The results demonstrate that MDD-FedGNN outperforms baseline methods, confirming the feasibility of training more powerful malicious domain detection models through data sharing and vertical federated learning among different security agencies.

Intelligent applications can be significantly impacted by incorrectly categorized data. Recently, artificial intelligence technology has been deployed in an increasing number of security-related scenarios, but the issue of data mislabeling has received little attention. We concentrate on the problem of malware mis-labeling in this paper. Unfortunately, in the security field, the mislabeling issue of malware is not taken seriously. Existing work attempts to aggregate the AV labels to alleviate malware mislabeling. This will mislead the security analyst and pass the error to subsequent data-driven applications. Therefore, we conduct an in-depth analysis to explore the severity of the malware mislabel issue, and try to rectify the description of malware generated from anti-virus engines. We first propose a malware label correction tool called RecMaL. It employs hybrid analyses for malware label rectifying.According to the thorough exploratory analysis, we figure out the core reasons for mislabeling issues and summarize them into 3 types. To verify the effectiveness and how RecMaL benefits the downstream applications (e.g., malware classification), we evaluate RecMaL through a series of experiments and show that the main components of RecMaL improve the performance, which proves our method effectively alleviates the mislabeling issue.(c) 2023 Elsevier Ltd. All rights reserved.

Deep learning allows building high-accuracy malware detectors without complicated feature engineering. However, research shows that the deep learning model is vulnerable and can be deceived if attackers add perturbation to input samples to craft adversarial examples deliberately. By altering the pixel values of the images, attackers have been able to generate adversarial examples that can fool state-of-the-art deep learning based image classifiers. However, Windows malware is a structured binary program file. Therefore, arbitrarily altering its contents will often break the program's functionality. In order to solve this problem, a standard but inefficient method is to run the sample in the sandbox to verify whether its functionality is preserved. This paper proposes a multi-strategy adversarial attack method, which can generate malware adversarial examples with functionality-preserving. Our method manipulates the redundant or extended space in the Windows malware binary, so it will not break functionality. Experiments show that our method has a high attack success rate and efficiency.

The existing dynamic malware detection methods based on API call sequences ignore the semantic information of functions. Simply mapping API to numerical values does not reflect whether a function has performed a query or modification operation, whether it is related to network communication, the file system, or other factors. Additionally, the detection performance is limited when the size of the API call sequence is too large. To address this issue, we propose Mal-ASSF, a novel malware detection model that fuses the semantic and sequence features of the API calls. The API2Vec embedding method is used to obtain the dimensionality reduction representation of the API function. To capture the behavioral features of sequential segments, Balts is used to extract the features. To leverage the implicit semantic information of the API functions, the operation and the type of resource operated by the API functions are extracted. These semantic and sequential features are then fused and processed by the attention-related modules. In comparison with the existing methods, Mal-ASSF boasts superior capabilities in terms of semantic representation and recognition of critical sequences within API call sequences. According to the evaluation with a dataset of malware families, the experimental results show that Mal-ASSF outperforms existing solutions by 3% to 5% in detection accuracy.

个性化的分析报告格式阻碍了不同来源恶意软件信息的自动关联分析,使得建立统一的恶意软件特征描述标准成为必要.目前,虽然恶意软件属性枚举和表征(Malware Attribute Enumeration and Characterization,MAEC)已提供了一种共享标准,但当下沙箱输出的分析报告中却普遍含有大量低级别实体数据而缺乏高层语义信息.因此,对前人工作进行了研究,基于MAEC构建本体进行恶意软件知识抽取,并结合语义网规则语言(Semantic Web Rule Language,SWRL)推理提取隐含的高级知识,收集了1047个恶意样本的报告进行测试,发现平均可从每份报告中推理得到10条高层语义信息.

议题一:在会议上占有一席之地 确保IT领导层是学校战略规划中的全面合作伙伴. "技术发挥着重要作用.事实上,在那些非常困难的时刻,技术部门一直是支撑学校从课堂到整个校园顺利运营的重要部门."北卡罗来纳州中央大学校长约翰逊·阿金莱耶(Johnson O.Akinleye)表示. 数字能力已经成为高校成功的关键因素.如果一个高校想要成功,需要让信息技术领导者也参与到学校的战略规划和决策中,因为他们既了解学校,又了解技术和数据.仅仅让信息技术领导者执行学校的战略和优先事项是不够的;相反,首席信息官(CIO)在制定学校战略时必须在场,并且必须能够推动学校的发展愿景和数字化可能性之间的对话交流.

Facing the high proportion of distributed generations incorporating in a single phase, the active distribution network has become more unbalanced with flexible topology. In this paper, a unified active and reactive power coordinated optimization (ARPCO) method, which is applicable in both radial and looped unbalanced distribution networks, is proposed. Aiming to reduce power losses and restrain undervoltage and overvoltage problems, the ARPCO model which regulates the active and reactive power output of distributed generations coordinately and optimally is constructed. A novel trust region sequential linear programming (SLP) method, which is effective in nonlinear and nonconvex model solving, is developed and employed in APRCO model solution. A multi-scenario case study based on the modified IEEE 123 node distribution system shows that the proposed method is able to reduce the system active power loss and solve undervoltage and overvoltage problems efficiently, at the same time maximizing the utilization of distributed generations.

Accuracy prediction of the yield strength and displacement of reinforced concrete (RC) columns for evaluating the seismic performance of structure plays an important role in engineering the structural design of RC columns. A new hybrid machine learning technique based on the least squares support vector machine (LSSVM) and the particle swarm optimization (PSO) algorithm is proposed to predict the yield strength and displacement of RC columns. In this PSO-LSSVM model, the LSSVM is applied to discover the mapping between the influencing factors and the yield strength and displacement, and the PSO algorithm is utilized to select the optimal parameters of LSSVM to facilitate the prediction performance of the proposed model. A dataset covering the PEER database and the available experimental data in relevant literature is established for model training and testing. The PSO algorithm is then evaluated and compared with other metaheuristic algorithms based on the experiment’s database. The results indicate the effectiveness of the PSO employed for improving the prediction performance of the LSSVM model according to the evaluation criteria such as the root mean square error (RMSE), mean absolute error (MAE) and coefficient of determination (R2). Overall, the simulation demonstrates that the developed PSO-LSSVM model has ideal prediction accuracy in the yield properties of RC columns.

伴随着互联网的普及和5G通信技术的快速发展,网络空间所面临的威胁日益增大,尤其是恶意软件的数量呈指数型上升,其所属家族的变种爆发式增加.传统的基于人工签名的恶意软件的检测方式速度太慢,难以处理每天数百万计新增的恶意软件,而普通的机器学习分类器的误报率和漏检率又明显过高.同时恶意软件的加壳、混淆等对抗技术对该情况造成了更大的困扰.基于此,提出一种基于多特征集成学习的恶意软件静态检测框架.通过提取恶意软件的非PE(Portable Executable)结构特征、可见字符串与汇编码序列特征、PE结构特征以及函数调用关系5部分特征,构建与各部分特征相匹配的模型,采用Bagging集成和Stacking集成算法,提升模型的稳定性,降低过拟合的风险.然后采取权重策略投票算法对5部分集成模型的输出结果做进一步聚合.经过测试,多特征多模型聚合的检测准确率可达96.99％,该结果表明:与其他静态检测方法相比,该方法具有更好的恶意软件鉴别能力,对加壳、混淆等恶意软件同样具备较高的识别率.

With the advancement of the deployment of IPv6 networks, the security problems brought by IPv6 have become increasingly serious. In order to fully understand the security vulnerabilities and risks existing in the IPv6 space, it is necessary to detect and scan IPv6 addresses, especially server addresses. As IPv6 has greatly expanded the address space compared with IPv4, the traditional scanning method is no longer applicable, and the current research on scanning of IPv6 lacks an effective method. In this paper, we collect an IPv6 address data set based on passive traffic collection, and explore the rules of IPv6 address deployment using this data set. By exploring the different characteristics of addresses caused by different address configuration methods, we filter and classify addresses, perform statistics and analysis on different types of addresses, and give the current education network deployment rules for different address configuration methods, which will help the IPv6 address scanning work to be carried out better.