The combination of Deep Learning (DL) and Federated Learning (FL) makes it a popular paradigm to train powerful models securely on large-scale data in a distributed way. However, current solutions face challenges such as significant communication overheads for clients with limited resources, potential privacy risks arising from FL's distributed nature, and the inability to maintain model accuracy without loss under high compression ratios. To solve these issues, we propose a lightweight Communication-efficient and Privacy-preserving FL scheme CPFL by designing Cyclic Segmented Compressive Sensing (CSCS) and using efficient Symmetric Homomorphic Encryption (SHE), which greatly reduces the number of transmitted model weights without sacrificing model accuracy. Formal analysis shows the security of CPFL against known-plaintext attacks and ensures model convergence. Extensive experiments demonstrate that CPFL achieves remarkable model accuracy under more than 200 & times; compression ratio, and even reduces the communication cost by 99.5% compared with previous solutions.

Abstract Wall shear stress (WSS) is a key hemodynamic parameter associated with atherosclerotic plaque development in coronary arteries. In this study, we developed a physics-informed graph neural network (PI-GNN) for efficient prediction of WSS distributions on stenotic coronary surfaces. Leveraging 40 subject-specific geometries reconstructed from coronary CT angiography, we employed statistical shape modeling to generate a cohort of 1000 synthetic models encompassing systematic variations in stenosis morphology (concentric and eccentric lesions, round and oval cross-sections, single and dual stenoses). Full computational fluid dynamics (CFD) simulations were performed to obtain ground-truth WSS data, which were then mapped onto vessel-surface graphs to train the proposed PI-GNN. The PI-GNN outperformed U-Net (R = 0.85) and multilayer perceptron (R = 0.24) baselines, achieving superior global performance (MAE = 1.05 Pa, RMSE = 5.63 Pa, R = 0.94) while maintaining robust accuracy across all stenosis scenarios. Node-wise Bland–Altman analysis demonstrated negligible mean bias (|bias|< 2 Pa) and narrow 95% limits of agreement, indicating reliable local agreement with CFD, even in complex severe and dual-lesion cases. With inference times reduced to seconds, the proposed PI-GNN serves as a computationally efficient surrogate for real-time clinical decision support and large-scale coronary hemodynamic studies.

Machine learning (ML)–based static malware detectors are widely deployed for Portable Executable (PE) files due to their scalability and efficiency, yet they remain vulnerable to carefully crafted adversarial perturbations. Existing black-box evasion methods either rely on transfer attacks, which break down when surrogate and target decision boundaries diverge, or on query-driven searches, which require impractically many queries. We present Flash, a two-phase adversarial framework tailored for static PE malware detection that integrates the strengths of both approaches. In the first phase, a generative adversarial network is trained against heterogeneous surrogate detectors to generate function-preserving PE modifications with inherent evasiveness. In the second phase, an evolutionary optimizer refines these sequences directly against the target model with a dual-objective fitness that balances evasion success and minimal perturbation cost. Experiments on 12,039 VirusShare PE files and six state-of-the-art static detectors demonstrate that Flash reduces query counts by 86% while maintaining bypass rates above 95.8%. Furthermore, adversarial training with Flash-generated samples reduces attack success rates by 82.4%, highlighting Flash’s utility for both exposing vulnerabilities and strengthening the robustness of static PE malware detectors.

In the metaverse, XR devices collect real-time data, such as hand movement trajectories, to provide immersive audiovisual experiences and interactive functions. However, this data collection poses privacy risks, as demonstrated by keystroke inference attacks that deduce user inputs by analyzing head movements during XR device use. For service providers, detecting malicious privacy attacks at the data level is often impractical. To address this, we propose XRwatcher, a detection scheme for XR privacy speculation attacks based on traffic analysis. XRwatcher uses XR application type, device type, and malicious traffic type as joint criteria to ensure accurate attack detection. To overcome the issue of insufficient labeled XR traffic samples, we employ transfer learning and domain adaptation strategies to classify XR application traffic and detect malicious traffic. Additionally, we design a lightweight XR device identification method based on location-sensitive hashing for low-overhead device type discrimination. We collect traffic data from three major XR devices in a LAN environment and simulate various attacks. Our evaluation results show that XRwatcher outperforms existing detection methods.

IL-17 family cytokines are central regulators of tissue immunity. Here, we review recent advances in defining the cell- and tissue-specific activities of IL-17, emphasizing the signaling pathways engaged by IL-17 receptor (IL-17R) complexes and their associated downstream pathways. We highlight the intersecting transcriptional and posttranscriptional mechanisms that determine IL-17-driven responses and that underlie functional diversity across tissues. Last, we discuss emerging roles for IL-17 signaling in immunometabolism, neuroimmune interactions, cancer, and the latest approaches for targeted therapies.

The rapid proliferation of encrypted communication strengthens data confidentiality and integrity but also creates blind spots for security monitoring, as adversaries increasingly abuse encrypted channels to conceal malicious activity. Existing approaches typically rely on very large models trained on massive labeled attack datasets, hindering rapid response to novel threats and stable deployment in high-throughput or edge environments; moreover, learning-based methods can suffer performance degradation when attack types, protocol compositions, and deployment environments change. To address these issues, we present MambaTIG, a fast and robust detection framework that couples self-supervised masked graph learning with selective state-space modeling. MambaTIG is pretrained solely on benign traffic to learn discriminative representations from unlabeled data, and it introduces a node-importance–driven masking strategy to improve robustness under distribution shifts; in the graph representation stage, a Mamba module replaces attention with linear state-space modeling, efficiently capturing long-range dependencies while reducing inference overhead. Comprehensive evaluations on four public datasets show that MambaTIG achieves competitive and best-or-tied-best mean F1 performance under the standard detection setting. Additional evaluations further show that MambaTIG achieves an average relative F1 improvement of 56.29% across the evaluated cross-task, cross-domain, and cross-scenario distribution-shift settings, and improves adversarial-setting F1 by 37.63% on average compared with the remaining methods. In addition, MambaTIG reduces average inference time by 66.7% compared to the remaining methods.

Federated learning based on homomorphic encryption has attracted widespread attention for its strong security and enhanced protection of user data privacy. However, the nature of encrypted computation introduces three major challenges: computation efficiency, attack defense, and contribution assessment. The first concerns the efficiency of encrypted computation during model aggregation, the second involves defense malicious attacks under encryption, and the third addresses the fairness of contribution assessment for encrypted local models. This paper presents an Efficient and Secure Federated Learning Model with Homomorphic Encryption (ESFLM) to protect model privacy and tackle the aforementioned challenges. First, we leverage multiple nodes to perform parallel aggregation of local models, thereby improving the efficiency of encrypted model aggregation. Second, we introduce trusted supervise nodes to inspect local models when the global model is under attack, enabling effective defense of malicious behavior under homomorphic encryption. Finally, we fairly reward local training nodes based on their verified training time, even when local models remain encrypted. Experiments on three real-world datasets demonstrate that our model significantly outperforms baseline approaches in terms of both efficiency and security.

Privacy-preserving data aggregation (PDA) enables an edge server to securely perform aggregation tasks on data generated by terminal devices in edge intelligence (EI) systems, revealing only the result without exposing individual inputs. However, most existing solutions, such as homomorphic encryption and federated learning, support only basic functions (e.g., SUM or AVG). They often fail to achieve privacy protection, fault tolerance, and lightweight terminal-side operations when the server colludes with compromised devices. In this work, we propose PrivEI, a practical PDA scheme for EI systems. It uses a proposed collusion-resistant symmetric masking scheme that enables an untrusted edge server to collect and decode masked inputs from n terminal devices while supporting arbitrary computations. The scheme allows the server to collude with k <= n-2 terminal devices and has a lightweight mechanism to tolerate device dropouts during aggregation. PrivEI further leverages the Chinese Remainder Theorem to avoid frequent mask updates when aggregating multi-dimensional data, and ensures data integrity using a signer-efficient multiple-time elliptic curve signature algorithm. We formally prove that PrivEI ensures input privacy and achieves (n-k)-source anonymity. Both theoretical analysis and experimental results confirm that it offers superior functionality with performance comparable to existing approaches. We have open-sourced the implementation.

Fibroblast growth factor 1 (FGF1) is recognized for its role in regulating vertebrate energy metabolism, yet its impact on metabolic fatty liver disease in fish remains unexamined. This study investigates the regulatory mechanism of the autocrine/paracrine cytokine FGF1 on systemic lipid metabolism in rainbow trout ( Onco- rhynchus mykiss) subjected to a high-fat diet (HFD). Experimental fish (540 in total) were divided between two dietary groups (low-fat diet (LFD) and HFD) and categorized into three treatment groups: LFD + PBS (LFD injected with PBS), HFD + PBS (HFD injected with PBS), and HFD + rFGF1 (HFD injected with recombinant FGF1 protein). Over a 6-week period on the HFD, rainbow trout demonstrated weight gain and signs of metabolic dysregulation. However, compared to the HFD + PBS group, exogenous rFGF1 administration significantly lowered hepatosomatic index (HSI), whole-body, muscle, and liver crude fat content, hepatic vacuole formation, serum triglyceride (TG), serum LDL-c, and the expression levels of fatty acid synthesis (fas) and transport genes ( cd36 , fatp6), while elevating HDL-c and the expression levels of fatty acid oxidation genes ( cpt1a , ppar alpha, and acox1) (P < 0.05), thereby alleviating HFD-induced lipid accumulation without a significant impact on body weight (P > 0.05). Serum metabolomic analysis indicated that rFGF1 significantly elevated serum uridine levels (P < 0.05), with uridine demonstrating a capacity to regulate hepatocyte lipid metabolism effectively. Furthermore, rFGF1 was shown to enhance hepatic uridine biosynthesis through the AMPK signaling pathway, concurrently modulating uridine catabolism by downregulating interferon regulatory factor 1 (irf1) and altering its transcriptional control of uridine phosphorylase 2 (upp2). These findings suggest that rFGF1 mitigates hepatic lipid accumulation in rainbow trout under an HFD by promoting uridine synthesis via the AMPK pathway and partially inhibiting uridine catabolism through IRF1-UPP2 signaling.

Loss-of-function variants in the ferredoxin reductase (FDXR) gene result in a primary mitochondrial disease in humans, involving abnormal mitochondrial iron accumulation. However, the molecular mechanism is not fully understood. To better understand the underlying pathology of FDXR-related disease, we generated a mouse model corresponding to the hotspot variant found in humans. We demonstrated increased lipid peroxidation in the inner mitochondrial and plasma membranes, resulting in susceptibility to ferroptosis. Closer examination revealed that disruption of the NRF2 pathway and its target gene SLC7A11 appear to play important roles in this pathogenic process. Finally, administration of the NRF2 activator omaveloxolone, which was recently approved by the FDA for treatment of Friedreich’s ataxia, helps mitigate the pathogenesis. Together, our results suggest that ferroptosis is a novel underlying mechanism of FDXR-related disease and that activation of NRF2 could be an immediate, viable treatment option for individuals with FDXR-related disease and other conditions involving aberrant iron metabolism.

Cybersecurity experts are actively exploring and implementing automated technologies to extract and present attack information from Cyber Threat Intelligence. However, there are multiple relations among security entities within Cyber Threat Intelligence, a feature that existing technologies often overlook. Additionally, integrating external security knowledge into cyber threat intelligence intuitively during analysis and presentation poses challenges. We propose the Hyper Attack Graph (HAG) framework, the first work to apply hypergraph data structures in the analysis of cyber threat intelligence. Our approach uses a joint extraction model that incorporates a multi-head selection mechanism, effectively addressing the extraction of multiple relations among security entities. We use hypergraph to display tactics and techniques in cyber threat intelligence. Our evaluation of the HAG framework on 685 real-world cyber threat intelligence reports shows an increase in the F1 score for security entity extraction by 11.12% and for relation extraction by 6.71% over existing efforts. Furthermore, HAG’s ability to visually represent external security knowledge on hypergraphs demonstrates its potential as a valuable tool in cybersecurity analysis.

Honeypots are commonly used tools in network security protection. However, low-interaction honeypots cannot obtain in-depth attack information, while the deployment of high-interaction honeypots is costly. This paper presents LLM-Pot, a novel high-interaction honeypot architecture powered by the Large Language Model (LLM), which explores the direction of intelligent honeypots and addresses the limitations of conventional honeypot solutions. LLM-Pot utilizes LLM to generate dynamic, context-aware responses that accurately simulate the behaviors of real operating systems. To demonstrate the effectiveness of LLM-Pot, this work used offline and online evaluations. The offline evaluation compared LLM-Pot and Cowrie by analyzing their responses to selected commands, and the results demonstrated LLM-Pot’s superior ability in handling complex operations. Online evaluation deployed honeypots in the cloud and captured extensive attack data over two weeks. The evaluation results demonstrate that our LLM-driven approach outperforms traditional honeypots across multiple key metrics, validating LLM-Pot’s superior deception capabilities.

Advanced Persistent Threats (APTs) pose significant security risks to the community. Researchers thereby propose techniques to capture the complex and stealthy scenarios of APT attacks through the use of provenance graphs to model system entities and their dependencies. Particularly, to mitigate the dependency explosion problem in attack investigation using provenance graphs, tag-based and priority-based provenance graphs are frequently utilized for analyzing attacks. These methods use threat tag propagation and threat prioritization to reduce the size of the provenance graph for faster analysis. Unfortunately, these methods can allow more complex and potential attacks to evade detection. To overcome these difficulties, we propose an APT attack investigation system, ProTaging, for APT detection and forensic analysis. By using Tactics, Techniques, and Procedures (TTPs) rules to assign and update the node's threat tag, splittable tag propagation to control the scope of threat information, and threat weight aggregation and prioritized backward analysis during the forensic analysis phase, ProTaging effectively reconstructs attack paths in seconds without dependency explosion. Experimental results on both the simulation dataset, DARPA TC E3, E5 dataset, and DARPA OpTC dataset demonstrate that ProTaging generates smaller dependency graphs (2.5 times smaller) and has fewer false positives (6.7 times fewer) compared to state-of-the-art solutions. Additionally, ProTaging significantly reduces manual investigation effort by approximately 99.9%.

As the complexity and frequency of cyberattacks, such as Advanced Persistent Threats (APTs) and ransomware, continue to escalate, traditional anomaly detection methods have proven inadequate in addressing these sophisticated, multi-faceted threats. Recently, Host Provenance Graphs (HPGs) have played a crucial role in analyzing system-level interactions, detecting anomalous behaviors, and tracing attack chains. However, existing provenance-based detection methods primarily rely on single-dimensional feature analysis, which fails to capture the dynamic and multi-dimensional patterns of modern APT attacks, resulting in insufficient detection performance. To overcome this limitation, we introduce STGAN, a model that integrates spatial-temporal graphs into host provenance graph modeling. STGAN applies temporal and spatial encoding to dynamic provenance graphs to extract temporal, spatial, and semantic features, constructing a comprehensive feature representation. This representation is further fused and enhanced using a multi-head self-attention mechanism, followed by anomaly detection. Through extensive evaluations on three widely-used provenance graph datasets, we demonstrate that our approach consistently outperforms current state-of-the-art techniques in terms of detection performance. Additionally, we contribute to the research community by releasing our datasets and code, facilitating further exploration and validation.

To achieve high-performance identification for remote management device, this paper proposes MME4RMD, a novel BERT-ResNet-based multi-modal embedding model that integrates visual, textual, and HTML structural features to generate distinctive device embedding. By employing triplet network training, our method significantly enhances feature discrimination and generalization capability for cluster-based identification. Comprehensive evaluations on manually curated real-world datasets containing 25 known and 20 unknown device classes demonstrate superior performance, achieving 98% and 93% Fl-scores for known and unknown device identification respectively, substantially outperforming conventional approaches.

Cordyceps has been clinically used to treat atherosclerosis (AS) since the 1980s. However, the active components responsible for its effects and the underlying mechanisms remain poorly understood. In this study, we aimed to explore the anti-AS effects and mechanisms of action of wild Cordyceps polysaccharides (WCP). The molecular weight, monosaccharide composition, and structural characteristics of WCP were analyzed. Furthermore, the anti-AS effects of WCP were evaluated using apolipoprotein E knockout (Apoe-/-) mice fed high-fat diets. The mechanisms underlying WCP's anti-atherosclerotic activity were elucidated in Apoe-/- mice and oxidized low-density lipoprotein-loaded RAW264.7 macrophages. We found that WCP is composed of galactose, glucose, and mannose, with a molar ratio of 1:1.1:1.2. The average molecular weights of WCP are 1486 and 26 kDa. WCP significantly attenuated the progression of AS, as evidenced by reduced plaque formation in the aortic root valve area. Notably, WCP reduced cholesterol accumulation in macrophages by upregulating the expression of ATP-binding cassette transporter protein 1 (ABCA1) and ATP-binding cassette subfamily G member 1 (ABCG1), both in vivo and in vitro. Importantly, we identified peroxisome proliferator-activated receptor-gamma (PPARγ) as a critical target of WCP in macrophages, as confirmed by siRNA knockdown experiments. The ability of WCP to enhance the expression of cholesterol efflux-related genes in macrophages was markedly diminished upon suppression of PPARγ expression. In conclusion, our findings suggest that WCP mitigates the development of AS by activating the PPARγ-liver X receptor alpha (LXRα)-ABCA1/ABCG1 pathway, thereby reducing cholesterol accumulation in macrophages. This study provides new insights into how Cordyceps polysaccharide exerts anti-atherosclerotic effects and highlights its potential as a therapeutic agent for AS.

Free Fatty Acid Receptor 2 (FFA2), also known as GPR43, is a receptor activated by short-chain fatty acids (SCFAs) with fewer than six carbons in their aliphatic chains. This receptor is expressed in immune cells, adipose tissue, the gastrointestinal tract, and pancreatic islet cells, where it plays a crucial role in the modulation of inflammation, lipid metabolism, insulin secretion, and appetite regulation. Extensive research has been conducted to elucidate the structural attributes and physiological functions of FFA2. Furthermore, several synthetic agonists have been developed for FFA2 that can preferentially activate certain G-proteins, demonstrating potential pharmacological advantages in both in vivo and in vitro studies. Herein, we review the structure and physiological functions of FFA2 and its synthetic ligands, discussing the structural basis of FFA2's biased signaling and the potential role of biased ligands targeting this receptor in the treatment of metabolic and neurodegenerative diseases.