Mixture-of-Experts (MoE) architecture with experts parallelism scales LLMs efficiently by activating only a subset of experts per input, avoiding proportional training costs. However, the intensive and heterogeneous communication substantially hinders the efficiency and scalability of MoE training in the resource-constrained scenario. Existing communication compression techniques fall short in MoE training due to: (i) Intensive training amplifies compression overhead, compromising training efficiency; (ii) Accumulated compression errors propagate through the network, degrading training quality. In this paper, we propose RCMoE, a communication-efficient Random Compression framework for MoE training with two core modules: (1) Local-Stochastic Quantization compresses the all-to-all communication by stochastically quantizing each row of the expert's intermediate computing results in parallel, effectively improving the compression efficiency and reducing compression error; (2) Probabilistic Thresholding Sparsification compresses the all-reduce communication by probabilistically sampling large gradients at high probability, thereby reducing the computational complexity and maintaining the convergence efficiency. Experiments on four typical MoE training tasks prove that RCMoE achieves higher 5.9x-8.1x total communication compression ratios and 1.3x-10.1x training speedup compared with the state-of-the-art compression techniques while maintaining the MoE training accuracy.

Current methods for deploying cyber deception do not consider the impact of time delays on the effectiveness of actions by both attackers and defenders, nor can they make real-time decisions on the deployment of deception assets in complex network environments. To address these issues, this paper proposes a deception resource deployment method based on deep reinforcement learning with time-delay differential game theory. First, we constructed the security evolution process of nodes in complex network environments by analyzing the threat models of attackers and defense models of defenders, presenting time-delay differential state equations for nodes with varying degrees. Furthermore, we introduced a cyber deception time-delay differential game model, quantifying the gains for both sides. We then designed a deep reinforcement learning algorithm, employing proximal policy optimization (PPO) to determine the optimal deception deployment strategy, based on the analysis of the network deception time-delay differential game model. Finally, the effectiveness of the proposed method in determining the optimal deception deployment strategy was validated through the construction of a scale-free complex network. Experimental results show that the proposed model could effectively discern the evolutionary processes of nodes with different degrees and the strategies of both attackers and defenders. Compared with other methods, the proposed method showed distinct advantages in stability and effectiveness. The results indicate that the proposed method can be effectively deployed in cyber deception.

Advanced Persistent Threats (APTs) have become one of the most prominent cybersecurity risks globally. The external network-facing (ENF) services (e.g., e-commerce platforms) within a system are particularly vulnerable, as they are directly exposed to the Internet and often serve as the primary targets for attackers. By deploying deception resources to protect these ENF services, defenders can detect threats early, block potential attacks, and enhance overall system resilience. However, most existing studies on cyber deception strategies assume simultaneous moves by both attacker and defender. Furthermore, few works have considered the evolution of the system state resulting from APT attacks on the ENF services. To address these limitations, this paper proposes a Cyber Deception Stackelberg Markov Game (CDSMG) for protecting ENF services, which dynamically captures state transitions and accurately characterizes the strategic interactions between defenders and APT attackers. In CDSMG, the defender acts as the leader, who proactively selects a subset of services to deploy the deception resources based on the current system state, while the APT attacker plays as the follower, making a best response which incorporates the defender’s policy into its own strategy. To overcome the challenge of the combinatorial optimization problem of selecting a subset of services, we propose a revised version of the PPO algorithm by using no-replacement sampling to select multiple services at once, thereby significantly reducing the action space size. Finally, experimental results demonstrate that our approach effectively defends against APT attacks. It not only outperforms several baseline methods but also exhibits better scalability and robustness under varied model parameter settings.

Intent vulnerabilities pose a significant threat as they allow attackers to exploit unverified intent messages, leading to sensitive data leaks, privilege escalations, or unauthorized actions that compromise user privacy and system security. Fuzzing methods, as traditional Intent vulnerability detection methods, are guided by the edge coverage of the program‐directed graph and do not focus on sensitive information, resulting in a lack of ability to discover vulnerabilities related to sensitive information, especially long‐path vulnerabilities. This article proposes PathFuzzer, which is an intent‐sensitive information flow path‐guided fuzzing method designed to efficiently detect intent vulnerabilities in Android applications. It leverages intent‐sensitive information flow paths to guide fuzzing by sending test cases along these paths and mutating test cases based on the parameter within the paths. Additionally, PathFuzzer utilizes unique long path encoding and key node identification technology to enable test cases to efficiently test along sensitive information flow paths, while monitoring the test status to form a feedback mechanism for long paths. The evaluation results show that PathFuzzer successfully detected 131 intent vulnerabilities across 500 popular applications from Google Play. Compared to traditional methods, PathFuzzer achieved a 92% average path coverage rate on sensitive paths while improving detection efficiency by an average of up to 64%. In summary, PathFuzzer provides an efficient, accurate, and comprehensive method for detecting Intent vulnerabilities.

This paper concerns the observer-based dual-memory control for Lurie-type cyber-physical systems (CPSs) subject to denial of service (DoS) attacks. First, an augmented switching Lurie-type CPSs model is established to analyze the impact of DoS attacks and synergy time delays on controller performance. Second, the memory-dynamic event-triggered scheme (MDETS) efficiently utilizes bandwidth resources by adapting the number of historical data packets transmitted based on system state fluctuations, meanwhile, the controller design incorporates constant time-delay compensation to improve system stability. Third, the exponential stability conditions for the closed-loop Lurie-type CPSs are derived via Lyapunov theory. Additionally, the co-design of the observer gain, controller gain, and event-triggering matrices is formulated using linear matrix inequalities (LMIs). Finally, the effectiveness of the proposed control scheme is validated through application to a DC motor system.

Currently, there are various problems in the field of network attack-defense analysis and deception asset deployment of game theory-based, such as difficulties in constructing attack and defense models and determining real-time attack and defense strategies. To address these problems, this study proposes a differential game deception asset selection algorithm based on multi-agent deep reinforcement learning. Specifically, by analyzing the attack and defense strategies, the infectious disease model is developed to conduct the evolution analysis of the network security state, and the differential equation of the node state in the deception defense system is derived. In addition, a differential game model for the cyber deception attack-defense process is constructed, and the reward functions of the attacker and defender are designed. A deception asset selection algorithm is established based on the deep Q network method to solve optimal deception assets. The effectiveness of the proposed model is validated through a microservices attack-defense example in a cloud-native environment. The results show that compared to the deception asset selection algorithms based on the Fictitious Self Play and Policy Space Response Oracles, the convergence speed of the proposed algorithm is improved by 77.8% and 95.6%, respectively.

Most defense strategies in complex networks are developed from the defense perspective, overlooking the key attack-defense characteristics in cybersecurity. A defense decision algorithm is ineffective when dealing with dynamic attacking behaviors, and when based on attack-defense analysis, stochastic uniform network models are generally used to model the target network, while most networks are large and complex. Thus, the algorithms and their results do not well suit small-world, scale-free, and high-aggregation networks. In this study, considering the structural characteristics of complex networks and the attack-defense characteristics of cybersecurity, potential differential game theory is integrated with complex networks, and a global optimal defense decision algorithm is proposed according to the overall network defense objective. Based on the evolutionary analysis of network security states, a network attack-defense potential differential game model is constructed. Adversarial analysis is carried out on the overall attack-defense strategy, and a defense decision algorithm is designed based on a saddle point equilibrium strategy. Simulation tests are carried out on small-world and scale-free networks to evaluate the effectiveness of the proposed method by comparing its performance with that of random defense strategies and classic decision algorithms.

The existing cyber deception decision‐making model based on game theory primarily focuses on the selection of spatial strategies, which ignores the optimal defense timing and can affect the execution of a defense strategy. Consequently, this paper presents a method for selecting deception strategies based on a multi‐stage Flipit game. Firstly, based on the analysis of cyber deception attack and defense, we propose a concept of moving deception attack surface and analyze the characteristics of deception attack and defense interaction behaviors based on the Flipit game model. The Flipit game model is then utilized to create a single‐stage deception spatial‐temporal decision‐making model. Additionally, we introduce the discount factor and transition probability based on a single‐stage game model and construct a multi‐stage cyber deception model. We provide the utility function of the multi‐stage game model, and design a Proximal Policy Optimization algorithm based on deep reinforcement learning to compute the defender’s optimal spatial‐temporal strategies. Finally, we utilize an application example to validate the effectiveness of the model and the advantages of the proposed algorithm in generating the multi‐stage cyber deception strategy.

The limitations of the professional knowledge and cognitive capabilities of both attackers and defenders mean that moving target attack-defense conflicts are not completely rational, which makes it difficult to select optimal moving target defense strategies difficult for use in real-world attack-defense scenarios. Starting from the imperfect rationality of both attack-defense, we construct a Wright-Fisher process-based moving target defense strategy evolution model called WF-MTD. In our method, we introduce rationality parameters to describe the strategy learning capabilities of both the attacker and the defender. By solving for the evolutionarily stable equilibrium, we develop a method for selecting the optimal defense strategy for moving targets and describe the evolution trajectories of the attack-defense strategies. Our experimental results in our example of a typical network information system show that WF-MTD selects appropriate MTD strategies in different states along different attack paths, with good effectiveness and broad applicability. In addition, compared with no hopping strategy, fixed periodic route hopping strategy, and random periodic route hopping strategy, the route hopping strategy based on WF-MTD increase defense payoffs by 58.7%, 27.6%, and 24.6%, respectively.

Most current game theory-based cybersecurity analysis methods use traditional game models, which do not meet realistic conditions of continuous dynamic changes in attack-defense behaviors and decision makers without perfect rationality, and therefore they adapt with difficulty to the practical requirements of cybersecurity threat assessment. This paper draws on infectious disease dynamics methods to describe the cybersecurity threat propagation process. It constructs a dynamic game model of a cybersecurity threat based on continuous attack-defense confrontation and boundedly rational decision makers, combining qualitative differential and evolutionary game theories. Qualitative differential games are used to analyze the confrontation process of security threats, calculate attack-defense barriers, and construct a benchmark to measure the degree of a security threat. Evolutionary games are used to analyze the dynamic change of attack-defense strategy-selection probabilities based on replicator dynamics, and to deduce the evolutionary trajectory of the network security state. We then calculate the multidimensional Euclidean distance between the evolutionary trajectory and the attack-defense barrier metric benchmark, and use it as the basis for a dynamic threat assessment algorithm to improve the timeliness and objectivity of threat assessment. Simulation experiments show that the model and algorithm are effective and feasible.

In a real-world network confrontation process, attack and defense actions change rapidly and continuously. The network environment is complex and dynamically random. Therefore, attack and defense strategies are inevitably subject to random disturbances during their execution, and the transition of the network security state is affected accordingly. In this paper, we construct a network security state transition model by referring to the epidemic evolution process, use Gaussian noise to describe random effects during the strategy execution, and introduce a random disturbance intensity factor to describe the degree of random effects. On this basis, we establish an attack-defense stochastic differential game model, propose a saddle point equilibrium solution method, and provide an algorithm to select the optimal defense strategy. Our method achieves real-time defense decision-making in network attack-defense scenarios with random disturbances and has better real-time performance and practicality than current methods. Results of a simulation experiment show that our model and algorithm are effective and feasible.

The centralized control characteristics of software-defined networks (SDNs) make them susceptible to advanced persistent threats (APTs). Moving target defense, as an effective defense means, is constantly developing. It is difficult to effectively characterize an MTD attack and defense game with existing game models and effectively select the defense timing to balance SDN service quality and MTD decision-making benefits. From the hidden confrontation between the actual attack and defense sides, existing attack-defense scenarios are abstractly characterized and analyzed. Based on the APT attack process of the Cyber Kill Chain (CKC), a state transition model of the MTD attack surface based on the susceptible-infective-recuperative-malfunctioned (SIRM) infectious disease model is defined. An MTD attack-defense timing decision model based on the FlipIt game (FG-MTD) is constructed, which expands the static analysis in the traditional game to a dynamic continuous process. The Nash equilibrium of the proposed method is analyzed, and the optimal timing selection algorithm of the MTD is designed to provide decision support for the selection of MTD timing under moderate security. Finally, the application model is used to verify the model and method. Through numerical analysis, the timings of different types of attack-defense strategies are summarized.

As an active defense technique to change asymmetry in cyberattack-defense confrontation, moving target defense research has become one of the hot spots. In order to gain better understanding of moving target defense, background knowledge and inspiration are expounded at first. Based on it, the concept of moving target defense is analyzed. Secondly, literature analysis method is adopted to explain the design principles and system architecture of moving target defense. In addition, some relevant key techniques are introduced from the aspects of strategy generation, shuffling implementation, and performance evaluation. After that, the applications of moving target defense in different network architectures are illustrated. Finally, existing problems and future trend in this field are elaborated so as to provide a basis for further study.