Temporal Knowledge Graphs (TKGs) model dynamic events, and understanding temporal evolution is crucial for effective reasoning. While existing methods leverage Graph Neural Networks (GNNs) to model structural dependencies, they often rely on Recurrent Neural Networks (RNNs) to process sequence of graph structures. They struggle to (1) incorporate contextual information, (2) explicitly model long-term effects, and (3) handle in-equidistant data. To address these challenges, we propose Context-Aware Hawkes Graph Network (CoHN), a novel TKG reasoning approach based on the Hawkes process. CoHN features a tailored conditional intensity function that models TKG event occurrences. It is characterized by two additive terms: base intensity and historical influence, representing spontaneous tendency and influence of past events at in-equidistant time intervals. Firstly, we design a Contextual Encoder (CE) to encode contextual information for all entities and compute the base intensity. We then present an attention-based Evolutionary Encoder that captures local structural information and explicitly models long-term dependencies across the TKG. A self-exciting fusion module further aggregates historical evolutionary dependencies at all timestamps to quantify the final historical influence. Extensive experiments on common benchmarks demonstrate the superiority, robustness, and efficiency of our method.

Selfish mining, one of the most renowned attack in Bitcoin, involves a selfish miner withholding discovered blocks and broadcasting them at an opportune moment to gain higher rewards than honest mining. However, selfish mining and its variants rely on two assumptions: the attacker solely engages in infiltration mining within the victim pool (attack assumption) and the system operates in a perfect network environment (network assumption). In this paper, we propose a novel attack called Selfish in Innocent Mining (SIM). SIM expands the range of attacker’s behaviors by incorporating selfish mining into the traditional framework of innocent and infiltration mining, without increasing the attacker’s computational power. Initially, we analyze all possible states of chains in the system and their transition probabilities in the context of the SIM attack using Markov Chain. We determine the attacker’s rewards in one victim pool, multiple victim pools, and the miner’s dilemma within different cases. Subsequently, we examine the impact of an imperfect network environment on the attacker’s rewards within the SIM framework, focusing on the influence of unintentional fork rates on rewards. Our quantitative analysis demonstrates that the attacker’s rewards in SIM exceed those in power-adjusting withholding (PAW) by$1.9\times $and$2.7\times $in different network environments, respectively. The attacker’s rewards threshold reduced to 12.38% compared to other benchmarks.

While the anonymous communication system Tor can protect user privacy, website fingerprinting (WF) attackers can still identify the websites that users access over encrypted network connections by analyzing the metadata generated during network communication. Despite the emergence of new WF attack techniques in recent years, most research in this area has focused on pure traffic traces generated from single-tab browsing behavior. However, multi-tab browsing behavior significantly degrades the performance of WF classification models based on the single-tab assumption. As a result, some research has shifted its focus to multi-tab WF attacks, although most of these works have limited utilization of the mixed information contained in multi-tab traces. In this paper, we propose an end-to-end multi-tab WF attack model, called Transformer-based model for Multi-tab Website Fingerprinting attack (TMWF). Inspired by object detection algorithms in computer vision, we treat multi-tab WF recognition as a problem of predicting ordered sets with a maximum length. By adding enough single-tab queries to the detection model and letting each query extract WF features from different positions in the multi-tab traces, our model's Transformer architecture capitalizes more fully on trace features. Paired with our new proposed model training approach, we accomplish adaptive recognition of multi-tab traces with varying numbers of web pages. This approach successfully eliminates a strong and unrealistic assumption in the field of multi-tab WF attacks - that the number of tabs contained in a sample belongs to the attacker's prior knowledge. Experimental results in various scenarios demonstrate that the performance of TMWF is significantly better than existing multi-tab WF attack models. To evaluate model performance in more authentic scenarios, we present a dataset of multi-tab trace data collected from real open-world environments.

Cross-view geo-localization is to retrieve the most relevant images from different views. The biggest challenge is the visual differences between different views and the location shifts in practical applications. Existing methods usually extract fine-grained features of the retrieval target and match them by semantic alignment. The Transformer-based approach can focus on more contextual information than the CNN-based approach and also learn the geometric correspondence between two viewpoint images directly through the location encoding information. However, the existing methods need to fully utilize the information from different viewpoints, and the model needs to understand the context information sufficiently. To address these issues, we propose an efficient method to fully use image information from cross-views and feature fusion, divided into two branches: Aerial-View Local-Feature Cross-Fusion(ALCF) and Multi-View Global-feature Cross-Fusion(MGCF). By observing the characteristics of the aerial and street views, we perform a targeted fusion of global and local features from different viewpoints. In addition, we introduce a multi-view semantic alignment module, which can solve the problem that more noise information is introduced when the aerial view and street view images are semantically aligned. Experiments show that our proposed method achieves excellent performance in both the drone viewpoint target localization and drone navigation tasks on the University-1652 dataset.

With the widespread use of the Tor network, attackers who control malicious relays pose a serious threat to user privacy. Therefore, identifying malicious relays is crucial for ensuring the security of the Tor network. We propose a malicious relay detection model called hybrid multi-scale CNN-LSTM with Attention model (MSC-L-A) for the Tor network. The MSC layer uses one-dimensional convolutional neural networks with different convolution kernels to capture complex multi-scale local features and fuse them. The LSTM layer leverages memory cells and gate mechanisms to control the transmission of sequence information and extract temporal correlation information. The attention mechanism automatically learns feature importance and strengthens the weights of parameters that have a substantial impact on the results. Finally, the Sigmoid function is used to classify the data. Experimental results demonstrate that our proposed model achieves higher prediction accuracy and more accurate classification of Tor relays compared to other baseline models.

In order to better evaluate the anonymity of the Tor network, this paper evaluates the degree of the Tor network anonymity by calculating the probability of routing links being hijacked when users communicate under different node labels. According to the official routing node algorithm, we discuss the results of link establishment from the perspective of node labeling separately and calculate the hijacked rate of different links based on the established evaluation model. The experimental results based on the real data of nodes provided by the official CollecTor website show that the Tor network can resist the intrusion of 10% of malicious nodes, and the anonymity of the Tor network decreases rapidly when the malicious nodes in the routed nodes exceed 20%. In a collection of nodes with different labels, nodes with exit labels have a greater impact on system anonymity when subjected to the same level of attack.

For the past few years, Internet of Things (IoT) has developed rapidly and been extensively used. However, its transmission security and privacy protection are insufficient, which limits the development of IoT to a certain extent. As a technology of IoT information transmission, anonymous communication technology comes into being as an important means to ensure the security of healthcare data, which can better protect users’ privacy in some ways. Nowadays, a variety of attack techniques for anonymous communication systems have been proposed by the academic community to track senders and receivers or discover communications between two users. Thus, the MSFA (Multiple System Fingerprint Attack) scheme for anonymous communication systems is presented in this paper where the MSFA scheme architecture, implementation in the Tor environment, and experimental data processing are described. Through a comparative analysis between two traces of visiting the same website based on the edit distance, it is shown that the longer the length of the site traffic data, the greater the edit distance of the site access traffic and the larger the range.

Software assurance in software development process becomes an important part of ICT supply chains risk management, and also has been one of the most advanced information security technologies. Based on the researches of software assurance, this paper studies the development and current research of software security assurance in the background of software security being concerned by more and more people, then proposes a software security assurance model in software development process based on SDLC model, summarizes security activities during the development phase, analyzes the risk management of software assurance. Finally, the paper also indicates new research directions.

Network anomaly detection is a classically difficult research topic in intrusion detection. However, existing research has been solely focused on the detection algorithm. An important issue that has not been well studied so far is the selection of normal training data for network anomaly detection algorithm, which is highly related to the detection performance and computational complexity. Based on our previous proposed TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) anomaly detection method, which can detect anomalies with high detection rate and low false positive rate, we develop an instance selection mechanism for TCM-KNN based on EFCM (Extended Fuzzy C-Means) clustering algorithm in this paper, aiming at limiting the size of training dataset, thus reducing the computational cost of TCM-KNN and boosting its detection performance. We report the experimental results over real network traffic. The results demonstrate the instance selection method presented in this paper is effective for TCM-KNN and thus optimizing it as an effectively lightweight network anomaly detection scheme.

In this poster, based on our previous work in building a lightweight DDoS (Distributed Denial-of-Services) attacks detection mechanism for web server using TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) and genetic algorithm based instance selection methods, we further propose a more efficient and effective instance selection method, named E-FCM (Extend Fuzzy C-Means). By using this method, we can obtain much cheaper training time for TCM-KNN while ensuring high detection performance. Therefore, the optimized mechanism is more suitable for lightweight DDoS attacks detection in real network environment.