Abstract In recent years, insider threat incidents have occurred with increasing frequency, leading to severe data breaches and substantial economic losses. Most existing insider threat detection methods rely primarily on single-modal features, such as system logs and registry data, while failing to fully exploit the rich semantic information embedded in instant messaging and email content of insider users. To address the above issues, we propose FusionITD, a cross-modal insider threat perception enhancement framework based on the fusion of behavioral and semantic features. This framework combines users’ temporal behavioral characteristics such as file operations and login device patterns with the semantic information derived from web browsing and email content. By modeling user behavior baselines from multiple dimensions, FusionITD enables more accurate anomaly detection when deviations from the baseline occur. Firstly, based on the temporal distribution of user behaviors, the behavior data is segmented and aggregated according to the time window to form a user behavior graph. We propose WR-GNN based on graph representation learning to capture temporal behavioral features, and introduce the Focal MSE loss function to address the data imbalance problem caused by sparse abnormal behavior data. Secondly, we propose a retrieval-augmented generation-based semantic analysis algorithm. We use cosine similarity to perform semantic matching and ranking between behavioral contents and historical behaviors. We extract features such as emotion, intention, and focus to achieve fine-grained anomaly detection for user behavior. Finally, we designed an adaptive weighting mechanism based on logistic regression to dynamically integrate the outputs of the previous two parts, enhancing the generalization ability for different threat scenarios. Experimental results conducted on the CERT datasets show that FusionITD outperforms other methods by achieving a 5% increase in AUC, a higher TPR, and a lower false positive rate.

Federated learning (FL), a promising paradigm for distributed machine learning, facilitates collaborative model training while preserving data locally for enhanced privacy. Nevertheless, its widespread application in edge computing scenarios is increasingly challenged by poisoning attacks, wherein malicious adversaries compromise model convergence through contamination of local datasets or model parameters. Currently, existing Byzantine-robust FL methods predominantly rely on idealized assumption of Independent Identical Distribution (IID) data or necessitate access to raw gradients—introducing significant privacy risks. To overcome these limitations, we propose PFLAP, a robust privacy-preserving FL method against poisoning attacks on non-IID data. Inspired by community detection principles, we adaptively partition edge nodes with non-IID data into clusters exhibiting similar data distributions. Building upon this foundation, we develop a novel poisoning defense scheme that integrates scaled dot-product attention with linear homomorphic encryption, enabling detection of encrypted poisoning gradients. Security analysis proves that PFLAP provides rigorous privacy preservation, and extensive experiments demonstrate that compared with existing defense schemes, PFLAP improves accuracy by 8.57%-34.42% under highly non-IID settings, exhibits stronger resistance against both targeted and untargeted attacks, reduces computational overhead by 6.1%–10.2% and communication overhead by 11.4%–17.4%.

Scanning attack is normally the first step of many other network attacks such as DDoS and propagation worm. Because of easy implementation and high returns, scanning attack especially cooperative scanning attack is widely used by hackers, which has become a serious threat to network security. In order to defend against scanning attack, this paper proposes an adaptive IP hopping in software defined network for moving target defense (MTD). In order to accurately respond to attacker’s behavior in real time, a light-weight convolutional neural network (CNN) detector composed of three convolutional modules and a judgment module is proposed to sense scanning attack. Input data of the detector is generated via designed packets sampling and data preprocess. The detection result of the detector is used to trigger IP hopping. In order to provide some fault tolerance for the CNN detector, IP hopping can also be triggered by a preset timer. The CNN driving adaptability is applied to a three-level hopping strategy to make the MTD system optimize its behavior according to real time attack. Experiments show that compared with existing technologies, our proposed method can significantly improve the defense effect to mitigate scanning attack and its subsequent attacks which are based on hit list. Hopping frequency of the proposed method is also lower than that of other methods, so the proposed method shows lower system overhead.

Emerging technologies such as network function virtualization (NFV) and software defined networking (SDN) provide a promising way to implement service function chain (SFC), a chain-ordered set of network functions, to support heterogeneous network services through a shared substrate network. A major challenge in this respect is the SFC embedding with respect to constraints of physical resources. Furthermore, for practical purposes, SFC embedding across multiple domains becomes essential. This challenge is referred to as the cross-domain SFC embedding problem, which is intractable due to various reasons, such as the confidentiality of intra-domain information and the domain's local autonomy. In this paper, we propose GDM, a general distributed method for cross-domain SFC embedding. Besides preserving the privacy and autonomy of domains, GDM guarantees fair competition among domains while balancing loads among domains. It first partitions SFC by utilizing an algorithm that can be instantiated to support different embedding goals. Then it allows domains to embed their assigned segments following their policies. Finally, to improve the capability of the whole substrate network to accommodate more SFCs, it implements domain-level load balancing by migrating the deployed VNFs while avoiding excessive influence on the SFC embedding solution. Evaluation results demonstrate that our method performs better in improving acceptance ratio and optimizing domains' embedding goals compared to the existing methods, and it has better scalability.

Due to the tight one-to-one binding relationship between the TPM and the single platform lacks of flexibility and scalability, the Trusted Platform Module (TPM) can not be directly applied to the cloud virtualization platform, on which concurrently running several user domains (VMs). For establishing the trust in the cloud, we propose the Trusted Service Domain (TSD), as a novel root of trust for the cloud. Being an independent functional domain, the TSD is able to provide the trusted service for the multiple user domains on the cloud virtualization platform. We firstly extend the existing trusted chain to secure the TSD, and generate the independent key hierarchies for the user domains in the TSD to support the cryptography service and secure storage. Then we design the secure communication mechanism to protect the inter-domain data, and present the migration scheme for the TSD in the cloud. Finally, we detailed our implementation of the prototype system and analyze the security of the TSD. Preliminary experiment results showed that the TSD has higher efficiency than the existing schemes on the trusted commands handling and the migration, which satisfied flexible deployment and rapidly migration requirements of the cloud virtualization platform.

The binary attestation mechanism is a basic remote attestation way for Trusted Platform Module (TPM) in Trusted Computing Group (TCG) specification. To improve the security and complexity of the binary attestation, the concept of property-based attestation (PBA) has been proposed by convincing the remote verifier that the platform satisfies the security properties without exposure of the configuration privacy. The existing PBA schemes have the disadvantage of the complex property revocations. To overcome this problem, we propose a simplified property based attestation model on the online TTP in this paper. During the attestation the prover attests the platform configuration property as well as the validation of the property certificate without verifying the property revocation. More concretely it presents a property based attestation protocol with variable privacy, which is provable security under the q-SDH assumption, discrete logarithm problem and the perfect hidden property of the commitment. We conduct the experiment to evaluate efficiency of our scheme in final. The experiment shows that the privacy parameter does not have the significant impacts on the performance, and we can adjust the parameter to make a trade-off between the performance and privacy.