In cross-domain recommendation, the cold-start recommendation problem often arises in scenarios where users have interacted with items in a source domain but not in a target domain. A key challenge in this cross-domain recommendation setting is how to effectively transfer user preferences from the source domain to the target domain. Most existing transfer learning models address this challenge but typically require extensive computations and incremental operations, which limit their scalability and efficiency. To overcome these limitations, we propose a novel similarity-based framework, called Similarity-based Transfer Graph Convolution Network (SimTranGCN), designed specifically for cold-start users. Our approach combines item-KNN, deep learning, and graph convolutional models such as LightGCN. SimTranGCN first constructs a similarity matrix across domains, and then uses this matrix to infer user preferences in the target domain based on their interactions in the source domain. Empirical experiments demonstrate that SimTranGCN is highly competitive against existing methods, achieving state-of-the-art performance on two paired domain transfer tasks.

To discover and defend against APT attacks more efficiently, we need to conduct binary analysis and source tracing research on APT malicious codes. This paper attributes APT groups for malicious codes from the perspective of binary similarity. First, we innovatively select the local features of the binary functions for classification and apply time series mining techniques to the mining of sequences of basic blocks (called paths). The Shapelet model selects path shapelets, which are path fragments that can best represent paths and are used to distinguish paths. Path shapelets can provide path-level interpretability for classification. Second, we use API calls to filter functions and generate paths of interest to reduce resource consumption. To evaluate the proposed method, we collect APT malicious codes based on publicly available threat intelligence reports. Our method filters 92.82% of functions and generates an average of 1.37 paths per function. The classification effect has obvious advantages over other methods.

There are many review articles on malware analysis, which provide a comprehensive summary of the features, methods, and challenges of malware analysis. But these are limited to a theoretical overview. The purpose of this paper is to take malware family classification as an example, to restore and display the malware analysis in real scenarios.In this paper, the measurement of malware family classification is carried out on a large-scale dataset in the real world. We use the BODMAS dataset, which contains a total of 57,293 malware samples, with carefully curated family information (581 families). Referring to the common features (including static features and dynamic features) and machine learning methods mentioned in the review articles, we conduct feature extraction and classification experiments. Then, we summarize the classification results. Static features can efficiently classify a large number of samples, even with 10% packed samples. In real scenarios, the family distribution is extremely unbalanced, and the family classification results with a large number of samples are better. Different evaluation methods have different interpretations of the classification results. These measurement results provide a basis for further malware analysis in real applications.

A recommendation engine that relies solely on interactions between users and items will be limited in its ability to provide accurate, diverse and explanation-rich recommendations. Side information should be taken into account to improve performance. Methods like Factorisation Machines (FM) cast recommendation as a supervised learning problem, where each interaction is viewed as an independent instance with side information encapsulated. Previous studies in top-K recommendation have incorporated knowledge graphs (KG) into the recommender system to provide rich information about the relationships between users, items and entities. Nevertheless, these studies do not explicitly capture the preference of users for the side information. Furthermore, some studies explain the recommendation, but there is no unified method of measuring explanation quality.

APT attribution for malware refers to the process of identifying characteristics that are related to the APT group of an anonymous malware. This paper presents a novel approach for APT attribution. Our approach innovatively combines code features and string features for APT attribution, using paragraph vectors and bag-of-words vectors to represent function semantics and behavior reports, respectively. We apply the model interpretation to APT attribution for the first time, using Random Forest Classifier (RFC) and Local Interpretable Model-agnostic Explanations (LIME) to interpret the model results. We evaluate the method on a data set collected from threat intelligence reports. The results show that our method has advantages in feature selection, method application, and accuracy. Importantly, this article provides a detailed description and examples about the process of model interpretation. Model interpretation improves the trust of cyber security personnel in the model, and facilitates the analysis of network attacks and threat intelligence.

Federated learning (FL) is quickly becoming the de facto standard for the distributed training of deep recommendation models, using on-device user data and reducing server costs. In a typical FL process, a central server tasks end-users to train a shared recommendation model using their local data. The local models are trained over several rounds on the users' devices and the server combines them into a global model, which is sent to the devices for the purpose of providing recommendations. Standard FL approaches use randomly selected users for training at each round, and simply average their local models to compute the global model. The resulting federated recommendation models require significant client effort to train and many communication rounds before they converge to a satisfactory accuracy. Users are left with poor quality recommendations until the late stages of training. We present a novel technique, FedFast, to accelerate distributed learning which achieves good accuracy for all users very early in the training process. We achieve this by sampling from a diverse set of participating clients in each training round and applying an active aggregation method that propagates the updated model to the other clients. Consequently, with FedFast the users benefit from far lower communication costs and more accurate models that can be consumed anytime during the training process even at the very early stages. We demonstrate the efficacy of our approach across a variety of benchmark datasets and in comparison to state-of-the-art recommendation techniques.