Kernel density estimation (KDE), a flexible nonparametric technique unconstrained by specific data distribution assumptions, is extensively employed in fault modeling. However, its effectiveness is often constrained by the challenges associated with bandwidth selection. This study introduces GC-KDE, an improved kernel density estimation method leveraging the Gram-Charlier series to enhance modeling precision and efficiency. The method improves probability density estimation by incorporating higher-order derivatives of the normal distribution, coupled with an adaptive bandwidth optimization algorithm. Experimental findings reveal that the GC-KDE method achieves a 2.81% improvement in estimation accuracy while reducing computation time to 4.66% of that required intelligent algorithmic approaches. This method significantly reduces errors and enhances simulation credibility compared to conventional nonparametric methods. To further evaluate the method's generalizability, experiments were conducted on non-smooth, skewed, and multi-peak distribution datasets. The results demonstrate that GC-KDE excels in modeling accuracy and efficiency across diverse complex distributions, affirming its robustness and wide applicability. The approach provides an innovative framework for modeling and predicting faults effectively.

Currently, deep learning-based software vulnerability detection methods often perform poorly in real-world applications. Through an analysis of 13 real-world projects and 4 open-source vulnerability datasets, we identify two key factors contributing to this performance degradation: (i) unreliable labels of benign code in existing datasets and (ii) high similarity between the vulnerable code and its corresponding patched code (i.e., high code overlap). To address these challenges, we propose the contrastive analysis-based software vulnerability detection (CA-SVD) method. Specifically, (i) we automatically extract a contrastive vulnerability–patch dataset from open-source vulnerability datasets and apply a contrastive pruning algorithm to remove code irrelevant to the corresponding vulnerability in each sample. This strategy not only increases the relevance of extracted code but also mitigates the issue of unreliable labels. (ii) We design a Siamese GGNN model, where a GRU module captures long-range dependencies between vulnerability code and distant code segments. The GGNN is trained on the contrastive dataset using a contrastive loss function to maximize the distance between vulnerabilities and their patches in the embedding space. Furthermore, we use pairwise accuracy to select model parameters that can simultaneously identify vulnerabilities and their corresponding patches, thus capturing their key differences more effectively. Experiments on 4 open-source datasets show that our method outperforms 7 state-of-the-art methods, achieving improvements in accuracy of at least 10.98%, 11.12%, 10.05%, and 16.75%. Additionally, in 13 real-world projects, our method achieves at least a 9.55% improvement in accuracy and a 17.43% improvement in recall compared with the 7 baseline methods.

Out-of-domain (OOD) detection plays an important role in spoken language understanding (SLU). It can help dialog systems reduce confusion between in-domain (ID) and OOD utterances. Many dialog systems train their model to achieve this goal by collecting annotated OOD and ID data. However, acquiring large-scale OOD datasets can be costly. Recent generative adversarial networks (GANs) based OOD detection methods aim to mitigate this problem. However, their performance in low-resource scenarios remains limited due to a lack of diversity in generated samples and the information contained in the distribution of real samples doesn’t get fully exploited. To address these issues, we propose an Anchor-guided GAN with Contrastive Loss (AGCL) for low-resource OOD detection. In this model, two distinct anchor distributions are established as ground-truth distributions to guide GAN training, which prevents the model from collapsing to a narrow criterion. Furthermore, we introduce an extra contrastive loss for the generator to increase the distinction between the features of generated OOD samples and the limited real OOD samples provided by the dataset, thereby enhancing their diversity. This modification subsequently results in better performance of the anchor-guided GAN. Experimental results demonstrate that our proposed method outperforms existing methods in low-resource scenarios.

One of the innovations brought by Mirai and its derived malware is the adoption of self-contained loaders for infecting IoT devices and recruiting them in botnets. Functionally decoupled from other botnet components and not embedded in the payload, loaders cannot be analysed using conventional approaches that rely on honeypots for capturing samples. Different approaches are necessary for studying the loaders evolution and defining a genealogy. To address the insufficient knowledge about loaders' lineage in existing studies, in this paper, we propose a semantic-aware method to measure, categorize, and compare different loader servers, with the goal of highlighting their evolution, independent from the payload evolution. Leveraging behavior-based metrics, we cluster the discovered loaders and define eight families to determine the genealogy and draw a homology map. Our study shows that the source code of Mirai is evolving and spawning new botnets with new capabilities, both on the client side and the server side. In turn, shedding light on the infection loaders can help the cybersecurity community to improve detection and prevention tools.

Android platform is facing serious malware threats due to its popularity, as evidenced by the drastic increase on the number of mobile malware families and variants in recent years. Detecting malware variants and zero-day malware is a critical challenge that must be addressed to protect mobile devices against malware attacks. In this study, we present AndroCreme, a novel network intrusion detection system (NIDS) that can identify unseen malware by analyzing the network behavior of Android malware. To address the temporal bias issue in NIDS, we propose a method for rapid iterative update of the model based on data selection and data size limitation. The selection of effective data is carried out by induction and conformal technology, and the data scale is controlled by the method of time window and data cycle selection. To further achieve fast training speed and high efficiency, we leverage a gradient boosting framework that uses a tree-based learning algorithm, namely, LightGBM, as the meta predictor. We evaluate the performance of AndroCreme over 400K real-world network flows, which are collected from over 30K Android benignware and 21K malware applications. The experimental results show that, compared with the retraining method using all data, AndroCreme requires only a small amount of datareduce more than 3x to obtain better detection performance, which effectively solves the temporal bias.

Hand gestures are expressive motions that convey meaningful information. The ability for machines to extract and process the underlying meanings of these gestures is critical to many human-interactive applications. Various methods have been proposed, but the development of a more accurate, and simpler system could enable the machine and its user to exchange useful information more effectively. In this paper, a barometric-pressure-sensor-based wristband is presented as an initial proof of such concept. The wristband is composed of an array of 10 barometric pressure sensors spaced evenly around the wrist to estimate pressure profiles as tendons and muscles change with various hand gestures. Subject testing was performed to quantify classification accuracy for three groups of hand gestures: group 1) six wrist gestures, group 2) five single finger flexions, and group 3) ten Chinese number gestures. Leave-one-out cross-validation was used to compute classification accuracy. Results demonstrated classification accuracies of 98% for the wrist gestures, 95% for the single finger flexions, and 90% for Chinese number gestures. The presented pressure sensing wristband could potentially be used for a variety of applications including gesture-controlled devices, health-monitoring devices, and assistive devices for deaf-mute individuals.