The vast number of devices and the complexity of requirements present significant challenges in ensuring the security of nonterrestrial Internet of Things (NT-IoT). Although existing studies have proposed methods to defend against data theft and network interference attacks, there is still a need for more in-depth research on detecting data-level attacks in NTNs. Moreover, the vast and diverse nature of network traffic presents significant challenges in traffic modeling and feature extraction. Hypergraph neural networks have gained considerable attention because of capabilities in data modeling and feature extraction. However, most existing hypergraph neural networks are tailored for specific applications and are not adaptable to the detection of malicious encrypted traffic. To address these challenges, we first propose a hypergraph neural network-based malicious encrypted traffic detection framework to enhance the resilience of NT-IoT, enabling attack detection across uncrewed aerial vehicles, base stations and satellites. Then, we introduce a multidimensional encrypted traffic hypergraph network (METHGN). METHGN models the encrypted traffic from network, connection and time dimensions using hypergraph and uses hypergraph convolution network to extracts and fuse features. We conducted comparative experiments on IoT and The Onion Router Network encrypted traffic datasets for different classification tasks. Extensive experiments demonstrate the effectiveness and superiority of our approach.

Uncrewed aerial vehicle (UAV) networks are increasingly exposed to widespread and various network attacks due to their fully distributed nature and the limited defensive capabilities of individual devices. Existing defense strategies rely on network connectivity and UAV status information, which overlook information of network traffic. Malicious traffic detection offers a promising solution to achieve fine-grained attack detection. However, the dynamic nature and complexity of UAV networks limit the effectiveness of traditional traffic detection methods. Current approaches either fail to fully exploit the raw characteristics of traffic or do not consider the timeliness requirements of UAV networks. To address these challenges, we propose a novel twin graph encoder neural network, which can extract features of raw traffic bytes for efficient traffic detection. First, we propose a decoupled architecture for model training and inference to enable efficient detection of malicious traffic in UAV networks. Second, we propose a novel modeling method that models traffic as the co-occurrence graph and word frequency graph based on raw bytes. Then, we propose TGE-ETD, a Twin Graph Encoder for Encrypted Traffic Detection. TGE-ETD consists of a set of twin graph encoders that effectively extract intrinsic traffic features from graphs constructed from raw bytes. In addition, TGE-ETD employs a global attention pooling mechanism to effectively distinguish the feature contributions of different bytes. Finally, we conducted extensive experiments on a real UAV traffic dataset and four real-world network traffic datasets. TGE-ETD achieved an improvement of 1%-20% over the baseline methods by reducing the number of parameters by 20 times. Tested on multiple UAV hardware devices, TGE-ETD can achieve millisecond-level traffic detection.

Federated learning (FL) enables a central server to collaboratively train a global model with multiple clients while preserving data privacy. However, the distributed nature of FL makes the paradigm vulnerable to backdoor attacks, as proved by numerous recent studies. Although existing studies improve the effectiveness of backdoor attacks through optimized triggers, they have two limitations: (1) they ignore the heterogeneous contribution of individual model layers to the success of a backdoor; (2) they induce conspicuous differences between backdoor and clean models in the early stages of poisoning. The limitations cause backdoor models to exhibit significant discrepancies from clean models, making them easily detectable. To fill these gaps, we propose LaySelFL, a novel layer-selective method to eliminate distance differences induced by the backdoor to conceal attacks in FL. Our central insight is that different layers contribute unequally to backdoor attacks, by localizing poisoning to layers that are most sensitive to backdoor objectives, an attacker can reduce the model differences substantially between the backdoor and clean models. Concretely, LaySelFL identifies sensitive layers via both dynamic and static evaluations of parameter differences between backdoor and benign models, and then applies a targeted training protocol and a regularized loss that constrains differences from the global model in each round. Finally, LaySelFL performs clipping on non-poisoning layers to further mask residual differences introduced by the attack. This strategy yields a more covert and resilient backdoor attack. Extensive experiments show that LaySelFL increases the effectiveness of attacks by 25\% and reduces the effectiveness of defense methods to 4\%.

Deep neural networks are increasingly vulnerable to physically deployable backdoor attacks, which manipulate real-world objects to induce targeted model failures. However, current physical backdoor attacks predominantly rely on perpetually visible triggers appended to target objects. These methods inevitably expose attack traces during the deployment phase, risking human suspicion prior to activation. In this paper, we propose a conditionally-visible physical backdoor attack, which can only be activated under specific optical conditions and thereby overcomes the risk of being detected after deployment and before the attack. Specifically, to ensure robust and reliable activation, we design irregular polygonal pattern as triggers to against across environmental variations. Moreover, we introduce a dual-phase mechanism (dormant and activated) to enable stealthy deployment. Our trigger remains invisible and dormant under non-attack conditions, leaving no physical traces. It activates instantaneously under specific illumination, inducing the target model to perform the desired behavior. We conduct experiments on traffic sign recognition tasks to compare our attack with six digital and seven physical attacks, and assess its performance against potential defenses. Extensive experimental results demonstrate the effectiveness, stealthiness, and robustness of our attack.

Recent studies show that deep learning-based traffic sign recognition (TSR) systems are vulnerable to backdoor attacks. These compromised models can be activated to misclassify traffic signs when exposed to specific backdoor patterns during inference. Nevertheless, existing attack methods rely on exogenous triggers (e.g., stickers or patches) that introduce external features to associate backdoor patterns with target labels, significantly increasing attack complexity. In this article, we propose FlipBAT, a stealthy endogenous backdoor attack method that uses the image's self-flipping as the built-in trigger, eliminating the need for external trigger patterns. Our attack supports two distinct attack modes: a multiclass backdoor attack (MCBA) that enables flexible target diversification via cyclic mappings, and a single-class backdoor attack (SCBA) that achieves higher stealthiness by minimally perturbing the source class. Extensive experiments conducted on two standard TSR datasets (GTSRB and BelgiumTS) across three different victim models demonstrate that FlipBAT effectively establishes robust mappings between backdoor images and target classes. Notably, our method achieves efficient backdoor attacks with significantly lower poisoning rates compared to conventional approaches. Our method has also been shown to be robust against state-of-the-art backdoor defenses.

Ensuring fairness in incentive mechanisms for federated learning (FL) is essential to attracting high-quality clients and building a sustainable FL ecosystem. Most existing fairness-aware incentive mechanisms distribute rewards to FL clients by quantifying their contributions to the performance of the global model. Essentially, these mechanisms pursue contribution fairness, namely a constant contribution-reward ratio across FL clients, with an implicit assumption that clients would be satisfied with the contribution fairness. However, research in social psychology has confirmed that this assumption may not hold in many real-world scenarios. According to equity theory proposed by Adams, an individual's assessment and perception of receiving fair treatment significantly depend on the input-outcome ratio, where outcome simply refers to the rewards, while input is far more complex because it involves a bunch of subtle factors such as enthusiasm, experience and tolerance as well as the estimated contributions. Inspired by Adams' equity theory, in this work, we expand the notion of contribution fairness to input fairness and propose a new fairness-aware incentive mechanism named FairReward that distributes rewards under the joint consideration of self-reported inputs and computed contributions. FairReward employs a reputation mechanism to enhance the credibility of self-reported inputs and leverages blockchains to eliminate the need of a trusted FL server and monetarily incentivize/penalize clients. In addition, FairReward adopts techniques including distributed differential privacy and locality-sensitive hashing to address privacy and non-IID issues in FL. Moreover, we conduct a comprehensive security and privacy analysis. Finally, we evaluate FairReward through extensive experiments. The comprehensive experimental results demonstrate that FairReward is effective, scalable and attack-resistant, and provides the input fairness required.

Deep reinforcement learning (DRL) has been widely used in many important tasks of communication networks. In order to improve the perception ability of DRL on the network, some studies have combined graph neural networks (GNNs) with DRL, which use the GNNs to extract unstructured features of the network. However, as networks continue to evolve and become increasingly complex, existing GNN-DRL methods still face challenges in terms of scalability and robustness. Moreover, these methods are inadequate for addressing network security issues. From the perspective of security and robustness, this paper explores the solution of combining GNNs with DRL to build a resilient network. This article starts with a brief tutorial of GNNs and DRL, and introduces their existing applications in networks. Furthermore, we introduce the network security methods that can be strengthened by GNN-DRL approaches. Then, we designed a framework based on GNN-DRL to defend against attacks and enhance network resilience. Additionally, we conduct a case study using an encrypted traffic dataset collected from real IoT environments, and the results demonstrated the effectiveness and superiority of our framework. Finally, we highlight key open challenges and opportunities for enhancing network resilience with GNN-DRL.

The large number of devices and complex communication requirements pose challenges to ensuring the security of Non-Terrestrial Internet of Things (NT-IoT). The large-scale data and complex communication requirements make accurate detection of malicious traffic even more challenging in NT-IoT. Hypergraph neural networks have strong performance in extracting multi-relational features. However, most existing hypergraph neural networks are tailored for graph data, and hyperedge construction methods are not well-suited. To address these challenges, we propose a malicious encrypted traffic detection method based on a hypergraph neural network. First, we propose an efficient hypergraph construction method for encrypted traffic named JointKNN. JointKNN calculates the Euclidean distance between traffic flows and adds the target nodes into the neighbor sets to form the hyperedges. Then, we propose an Encrypted Traffic HyperGraph Convolution Network (ETHGCN), which takes the encrypted traffic hypergraph as the input. ETHGCN extracts and fuses both connection and temporal features to accurately detect malicious traffic. We conduct comparative experiments on IoT and Onion Network encrypted traffic datasets for multi-class and binary classification tasks. Results indicate that ETHGCN achieves an accuracy exceeding 99.8% in IoT tasks and demonstrates an improvement of nearly 20% in Onion Network tasks.

Vertical Federated Learning (VFL) shows promise for enabling collaborative learning among Internet-of-Vehicle systems (IoVs) without requiring the sharing of private training data. However, existing work has exposed VFL’s vulnerability to privacy-stealing attacks, where an honest but curious server might reconstruct a client’s raw data from client-uploaded embeddings. In this work, we first elucidate the intrinsic mechanisms of privacy attacks from an information theory perspective, which provides a solid foundation for potential defensive strategies. Based on our findings, we introduce PriVFL, a defense mechanism based on information bottleneck theory. PriVFL is designed to safeguard the privacy of VFL-based IoVs by enabling shared embeddings to extract minimal information from input data, while preserving the information essential to target labels. Specifically, PriVFL restricts the information contained in embeddings by reducing the upper bound of mutual information between the raw samples and embeddings uploaded from local clients. Meanwhile, PriVFL ensures the effectiveness of the model by increasing the mutual information lower bound between embeddings and samples’ labels. Our evaluation includes 5 benchmark datasets and 4 different models. Experimental results demonstrate that PriVFL effectively mitigates privacy attacks while preserving the model’s effectiveness. These findings underscore that PriVFL can significantly enhance the privacy of VFL-based IoVs, thereby bolstering the development of practical IoV applications.

Vertical Federated Learning (VFL) is susceptible to various one-party hijacking attacks, such as Replay and Generation attacks, where a single malicious client can manipulate the model to produce attacker-specified results, thereby compromising its reliability in real-world deployments. In this paper, we first uncover the underlying mechanisms of these attacks and observe that successful attacks induce significant discrepancies in the embedding-label associations across different clients. We establish a theoretical framework demonstrating how these discrepancies can serve as reliable indicators for detecting hijacking attempts. Building upon this insight, we propose VFLMonitor, a robust defense mechanism that leverages these embedding-label discrepancies to detect and mitigate hijacking attacks. Specifically, VFLMonitor identifies suspicious queries by analyzing differences in label estimations from multiple clients and applies a majority voting rule to correct or filter out these malicious queries. Moreover, VFLMonitor introduces a novel regularization strategy during training to reduce intra-class variance in embeddings, thereby enhancing their discriminative power and improving defense effectiveness. Extensive experiments were conducted on 5 real-world datasets against 2 different attack types under 3 attack scenarios. The results demonstrate that VFLMonitor can effectively identify and exclude potential hijacked requests in all types of one-party hijacking attacks, while maintaining a meager false positive rate for legitimate queries.

Vertical Federated Learning (VFL) is a collaborative learning paradigm where participants share the same sample space while splitting the feature space. In VFL, local participants host their bottom models for feature extraction and collaboratively train a classifier by exchanging intermediate results with the server owning the labels. Both local training data and bottom models contain privacy-sensitive information and are considered the intellectual property of each participant, and thus should be protected by the design of VFL. Our study exposes the fundamental susceptibility of VFL systems to privacy leaks, which arise from the collaboration between the server and clients during both training and testing. Based on our findings, we propose PISTE , a model-agnostic framework of privacy stealing attacks against VFL. PISTE delivers three privacy inference attacks, i.e., model stealing, data reconstruction, and property inference attacks on five benchmark datasets and four different model architectures. We further discuss four potential countermeasures. Experimental results show that all of them cannot prevent all three privacy stealing attacks in PISTE. In summary, our study demonstrates the inherent yet rarely uncovered vulnerability of VFL on leaking data and model privacy.

The existing masked face recognition algorithms almost tend to adopt synthetic masked face datasets for training. However, these models are limited as they rely on existing mask augmentation methods, which contain few mask patterns and cannot simulate shadows and textures in realistic scenes. To overcome this limitation, we propose a semi-supervised face recognition framework to fully exploit unlabeled real masked face samples, improving the mask robustness of the recognition model. More specifically, unlike the original face embedding network, we design a part-aware network to explore multi-region face representation based on the face structure. In this way, we obtain multiple face sub-embeddings, which correspond to different regions of the face, including the upper half, the lower half and the whole. Crucially, we use the norm of the sub-embedding to represent the activation state of the facial region features. For the input unlabeled masked face image, we restrict the sub-embedding norm of its lower half to weaken the face feature representation of the occluded area. For normal face samples, their partial features are kept activated by maintaining the sub-embedding norm, which guides the deep network does not ignore the available information. Moreover, we employ the margin-based recognition loss for normal samples to ensure that the model is sufficiently discriminative for normal facial features. Extensive experimental results on both normal and real masked face datasets show that our approach significantly outperforms the state-of-the-arts. Code is available at https://github.com/Baojin-Huang/UFace.

Pedestrian detection plays a crucial role in autonomous driving by identifying the position, size, orientation, and dynamic features of pedestrians in images or videos, assisting autonomous vehicles in making better decisions and controls. It’s worth noting that the performance of pedestrian detection models largely depends on the quality and diversity of available training data. Current datasets for autonomous driving have limitations in terms of diversity, scale, and quality. In recent years, numerous studies have proposed the use of data augmentation strategies to expand the coverage of datasets, aiming to maximize the utilization of existing training data. However, these data augmentation methods often overlook the diversity of data scenarios. To overcome this challenge, in this paper, we propose a more comprehensive method for data augmentation, based on image descriptions and diffusion models. This method aims to cover a wider range of scene variations, including different weather conditions and lighting situations. We have designed a classifier to select data samples for augmentation, followed by extracting visual features based on image captions and converting them into high-level semantic information as textual descriptions for the corresponding samples. Finally, we utilize diffusion models to generate new variants. Additionally, we have designed three modification patterns to increase diversity in aspects such as weather conditions, lighting, and pedestrian poses within the data. We conducted extensive experiments on the KITTI dataset and in real-world environments, demonstrating that our proposed method significantly enhances the performance of pedestrian detection models in complex scenarios. This meticulous consideration of data augmentation will notably enhance the applicability and robustness of pedestrian detection models in actual autonomous driving scenarios.

Backdoor attacks on traffic sign recognition are under intense investigation due to their profound security implications for intelligent driving. Currently, the state-of-the-art backdoor attack methods achieve the implantation of backdoors by embedding specific triggers in the training data or by modifying the model architecture. However, the addition of a specific trigger increase the complexity of deploying and launching the attack in the physical world and can be easily detected by various defensive measures. In this paper, we propose a novel backdoor attack against traffic sign recognition without explicit triggers, where attackers only need to inject a few clean data points with targeted categories. Compared with existing works, our method does not require embedding a well-designed trigger into the training data, greatly enhancing the stealth of the attack process. Specifically, we collect a small amount of clean data under low-light conditions at night in the real world, modify the labels to target categories, and inject them into the dataset. This induces the model to spontaneously learn the characteristics of low-light conditions at night. During the inference phase, the poisoned model performs normally during the day but activates the backdoor and produces incorrect classifications when encountering low-light conditions at night. We conduct extensive experiments on different model architectures, demonstrating that our proposed method is effective and stealthy.

Graph neural networks, effectively harnessing the extensive interactive data from Internet of Things (IoT) devices, significantly enhance service quality in IoT systems. However, traditional centralized training leads to the leakage of private data during the data collection and model training phases in IoT scenarios. Federated learning (FL) has emerged as a promising approach, facilitating collaborative model training across diverse IoT devices without sharing sensitive data. The intricate types and relationships among IoT devices from various institutions highlight the issues of class imbalance and graph heterogeneity across different clients. These issues decrease the performance of FL models. In this work, we focus on a more realistic scenario where the IoT institutions have only limited amount and types of data. We propose a cross-institutional federated heterogeneous graph learning method called FedHGL. It aims to mitigate the negative effects of class imbalance while maintaining the private data locally on clients during collaborative training. We employ a heterogeneous graph neural network as the training model for clients. FedHGL generates cross-client minority class samples to enhance the model performance. Additionally, it incorporates a compensation mechanism to prevent forgetting global information. FedHGL designs an adaptive aggregation coefficient that assigns weights to IoT institutions according to the class imbalance of their data, thereby optimizing the aggregation process. Extensive experiments demonstrate the effectiveness of FedHGL for class imbalance and heterogeneous graph data.

Dynamic link prediction aims to predict future connections among unconnected nodes in a network. It can be applied for friend recommendations, link completion, and other tasks. Network representation learning algorithms have demonstrated considerable effectiveness in various prediction tasks. However, most network representation learning algorithms are based on homogeneous networks and static networks for link prediction that do not consider rich semantic and dynamic information. Additionally, existing dynamic network representation learning methods neglect the neighborhood interaction structure of the node. In this work, we design a neighbor-enhanced dynamic heterogeneous attributed network embedding method (NeiDyHNE) for link prediction. In light of the impressive achievements of the heuristic methods, we learn the information of common neighbors and neighbors’ interaction in heterogeneous networks to preserve the neighbors proximity and common neighbors proximity. NeiDyHNE encodes the attributes and neighborhood structure of nodes as well as the evolutionary features of the dynamic network. More specifically, NeiDyHNE consists of the hierarchical structure attention module and the convolutional temporal attention module. The hierarchical structure attention module captures the rich features and semantic structure of nodes. The convolutional temporal attention module captures the evolutionary features of the network over time in dynamic heterogeneous networks. We evaluate our method and various baseline methods on the dynamic link prediction task. Experimental results demonstrate that our method is superior to baseline methods in terms of accuracy.

Intelligent traffic signal systems, crucial for intelligent transportation systems, have been widely studied and deployed to enhance vehicle traffic efficiency and reduce air pollution. Unfortunately, intelligent traffic signal systems are at risk of data spoofing attack, causing traffic delays, congestion, and even paralysis. In this paper, we reveal a multivehicle collaborative data spoofing attack to intelligent traffic signal systems and propose a collaborative attack sequence generation model based on multiagent reinforcement learning (RL), aiming to explore efficient and stealthy attacks. Specifically, we first model the spoofing attack based on Partially Observable Markov Decision Process (POMDP) at single and multiple intersections. This involves constructing the state space, action space, and defining a reward function for the attack. Then, based on the attack modeling, we propose an automated approach for generating collaborative attack sequences using the Multi-Actor-Attention-Critic (MAAC) algorithm, a mainstream multiagent RL algorithm. Experiments conducted on the multimodal traffic simulation (VISSIM) platform demonstrate a 15% increase in delay time (DT) and a 40% reduction in attack ratio (AR) compared to the single-vehicle attack, confirming the effectiveness and stealthiness of our collaborative attack.

Ship instance segmentation in synthetic aperture radar (SAR) images is a hard and challenging task, which not only locates ships but also obtains their shapes with pixel-level masks. However, in ocean SAR images, because of the consistent reflective intensities of ships, the appearances of different ships are similar, thus making it far too difficult to distinguish ships when they are in densely packed groups. Especially when ships have incline directions and large aspect ratios, the horizontal bounding boxes (HB-Boxes) used by all the instance-segmentation networks that we know so far inevitably contain redundant backgrounds, docks, and even other ships, which mislead the following segmentation. To solve this problem, a novel ship instance-segmentation network, called SRNet, is proposed with rotated bounding boxes (RB-Boxes), which are taken as the foundation of segmentation. Along the directions of ships, the RB-Boxes can surround the ships tightly, but a minor deviation will corrupt the integrity of the ships’ masks. To improve the performance of the RB-Boxes, a dual feature alignment module (DAM) was designed to obtain the representative features with the direction and shape information of ships. On account of the difference between the classification task and regression task, two different sampling location calculation strategies were used in two convolutional kernels of the DAM, making these locations distributed dynamically on the ships’ bodies and along the ships’ boundaries. Moreover, to improve the effectiveness of training, a new adaptive Intersection-over-Union threshold (AIoU) was proposed based on the aspect-ratio information of ships to raise positive samples. To obtain the masks in the RB-Boxes, a new Mask-segmentation Head (MaskHead) with the twice sampling processes was explored. In experiments to evaluate the RB-Boxes, the accuracy of the RB-Boxes output from the Detection Head (DetHead) of SRNet outperformed eight rotated object-detection networks. In experiments to evaluate the final segmentation masks, compared with several classic and state-of-the-art instance-segmentation networks, our proposed SRNet achieved more accurate ship instance masks in SAR images. The ablation studies demonstrated the effectiveness of the DAM in the SRNet and the AIoU for our network training.