As software becomes widespread, malware poses a significant threat to information system security. Graph neural networks (GNNs) used in existing machine learning-based methods for malware detection ignore deeper semantic information in code graphs. These methods also lack feature extraction of global data information, resulting in incomplete feature for detection. To address these limitations, we propose a multi-modal fusion architecture, MultiMal, that combines function call graphs, control flow graphs, and entropy features to detect Portable Executable (PE) malware. MultiMal proposes a multi-head softmax module to effectively capture graph features in multiple representation spaces. It also constructs an entropy-based learning module to extract binary features related to data randomness and obfuscation, which are then fused with the graph encoding to better detect malware code pattern. For accurate evaluation, we also introduce a new PE malware dataset with evenly distributed samples over the years and detailed family and category labels. Experiments demonstrate that MultiMal outperforms three existing baselines in terms of effectiveness. At an FPR threshold of 0.1 %, the TPR and bACC exceed the best results of the baselines by 11.83 % and 5.54 %, respectively.

The rapid growth of Android malware calls for anti-malware systems to detect malware automatically. Detecting malware effectively is a non-trivial problem due to the high overlap in behaviors between malware and benign apps. Most existing automated Android malware detection methods use statistic features extracted from apps or graphs generated from method calls to identify malware. However, the methods that only use statistic features lead to false positives due to ignoring program semantics. Existing graph-based approaches suffer scalability problems due to the heavy-weight program analysis and time-consuming graph matching. In addition, graph-based approaches could be evaded by modifying dependencies among method calls. As a result, crafted malicious apps resemble the benign ones.In this paper, we propose a novel deep learning-based detection system, named RGDroid, which is capable of detecting malware under graph structural attacks. It combines API information extracted from Android document and learns behavior features from function call graph by graph neural network. Specifically, to defend against graph adversarial attacks, RGDroid reduces the connectivity of different functional parts to mitigate the effect of structural modifications on the final graph embedding. To comprehensively evaluate the robustness of RGDroid, we implement four influential graph adversarial attacks to simulate current capabilities and knowledge of Android malware attackers. The attack success rate (ASR) of two state-of-the-art detection systems (i.e., MaMaDroid, MalScan) is above 70.0% while the ASR of RGDroid under the four graph attacks is below 6.1%.

The problem of securely outsourcing computation has received widespread attention due to the development of cloud computing and mobile devices. In this paper, we first propose a secure verifiable outsourcing algorithm of single modular exponentiation based on the one-malicious model of two untrusted servers. The outsourcer could detect any failure with probability 1 if one of the servers misbehaves. We also present the other verifiable outsourcing algorithm for multiple modular exponentiations based on the same model. Compared with the state-of-the-art algorithms, the proposed algorithms improve both checkability and efficiency for the outsourcer. Finally, we utilize the proposed algorithms as two subroutines to achieve outsource-secure polynomial evaluation and ciphertext-policy attributed-based encryption (CP-ABE) scheme with verifiable outsourced encryption and decryption.

In an identity-based encryption (IBE) scheme, how to revoke users from the system is a difficult problem when their private keys are compromised. The private key generator (PKG) updates the private keys for all unrevoked users and has high computation load when a large number of users are included. We propose an IBE scheme with verifiable outsourced revocation based on the one-malicious model of two servers. In the proposed scheme, PKG delegates the key update operations to the two servers for all unrevoked users. The PKG can detect the failure with probability 1 if one of the servers misbehaves. Our scheme is proven fully secure and verifiable against chosen-plaintext attack (CPA) without random oracles. The servers cannot execute the key update operations for any revoked user even if they collude. The experiment shows the time cost for PKG in the outsourcing algorithm is much smaller than that for directly updating the private keys for all unrevoked users.

In order to protect the data privacy, cloud users usually outsource the encrypted form of their data to the cloud servers, which brings a challenge when they want to search their encrypted data in cloud. Searchable encryption techniques solve this problem by allowing the cloud servers to search on the encrypted data without decrypting the ciphertext or the searching keywords. In this paper, we propose a construction which can dramatically reduce the size of extra storage in the searchable symmetric encryption schemes and still remain efficiency. And security analysis shows that our construction can achieve non-adaptive secure. Further investigation and experiments show that our construction is suitable for not only single keyword search but also more complex search including conjunctive search, disjunctive search and phrase search.