Abstract The perpetual battle between defenses and attacks in computing systems keeps evolving. In response to the growing complexity of attacks, data provenance has emerged as a vital solution for analysing alarms and conducting attack investigation by capturing intricate relationships among system entities. Despite its potential, the challenges of dealing with large-scale provenance graphs and a high volume of alarms persist, leading to inefficiencies in alarm analysis and attack investigation. To tackle these challenges, we present TaintAttack, an innovative approach for attack investigation. When performing provenance graph construction, TaintAttack conducts real-time tagging for system entities. To emphasize the critical threats, TaintAttack quantifies the threat levels of alarms based on event rarity, contextual features, and impact severity. Furthermore, guided by information flow tagging, TaintAttack commences attack investigation from alarms with high threat levels, greatly enhancing the overall efficiency of the investigation process. The evaluation results on 12 multi-stage attacks show that TaintAttack performs better in attack investigation compared to existing studies, reducing the investigation time by 2 orders of magnitude.

The vulnerability of deep neural networks poses a significant challenge to their application in security-sensitive domains. In this paper, we propose the Search Robust and Adaptable Architecture (SRAA) to identify the robust architecture. Unlike previous NAS-based approaches that utilize a single network search space, we introduce a novel dual-input ensemble search space, enabling the searched structures to exhibit good robustness under different attacks. The results demonstrate that the optimal SRAA model excels in complex tasks, such as Imagenet, and exhibits superior performance against strong attacks, such as PGD. Remarkably, our NAS-based model surpasses hand-designed models in terms of adversarial accuracy under strong attacks for the first time. Furthermore, the experimental results on CIFAR10/100 and IMAGENET datasets highlight the comprehensive improvement achieved by SRAA over previous state-of-the-art (SOTA) models and baseline approaches in terms of accuracy against diverse attack scenarios.

Due to the security implications of adversarial vulnerability, it is essential to enhance the adversarial robustness of deep metric learning models. Existing defense approaches adopt Projected Gradient Decent (PGD) with handcrafted fixed attack strategies to generate adversarial triplets. They learn inefficiently from a weak adversary in order to avoid model collapse owing to extremely challenging adversarial triplets, thereby limiting the robustness of the deep metric model. In this paper, we propose a novel Adaptive Adversarial Strategy (AAS) for deep metric learning that can learn automatically to produce attack strategies for adversarial triplet generation of varying difficulties. We use a classical actor-critic network in the AAS framework, in which the actor network produces attack strategies to control adversarial triplet generation and the critic network utilizes adversarial triplets to enhance adversarial robustness. Comprehensive experiment results on two benchmark datasets indicate that our proposed adaptive adversarial strategy for deep metric learning overwhelmingly outperforms the most advanced defenses in terms of robustness as well as performance on benign triplets.

With the more attention to user privacy and communication security, encrypted traffic has expanded substantially, which has brought huge challenges to traditional traffic classification methods. Deep learning knowledge has great advantages in processing encrypted traffic classification. However, it is difficult for researchers to realize unknown encrypted traffic classification in time, due to the complex parameters optimization process. In order to solve the problems mentioned above, we propose a semi-autonomous encrypted traffic classification and self-labeling scheme to (i) automatically and fast achieve architecture search for known encrypted traffic classification based on simulated annealing and particle swarm optimization, (ii) accomplish unknown encrypted traffic self-labeling based on siamese network, and build a corresponding training dataset, and (iii) update encrypted traffic classifier with transfer learning. Specifically, to validate the feasibility and robustness of the proposed scheme, four specific scenarios are tested based on an open dataset. The results demonstrate that our proposed scheme accomplishes neural architecture search with an average detection rate of up to 99%, provides correct labels for unknown encrypted traffic, and generates the latest dataset. Then, the classifier is updated successfully with the self-labeling encrypted traffic dataset.

This article proposes a novel 5G Internet of Things (IoT) networks with High Altitude Platform Station (HAPS) in the sky. In this proposed method, the 5G HAPS that consists of airplane and uniform rectangular array (URA) can achieve reliable connections between ground gateway (GW) and user equipments (UEs), at the same time GW requires the relative position information of the HAPS. HAPS is susceptible to various factors in the sky, resulting in system capacity reduction. Correspondingly, we propose a direction of arrival (DoA) prediction method based on the latest Long Short-Term Memory (LSTM) model to solve the above problems. Simulation results show that our approach makes a significant improvement to the 5G Internet of Things networks with High Altitude Platform Station.