Logs serve as an effective data source for recording and judging system states and abnormal events in complex systems. Current deep learning-based methods have proven effective in detecting anomalies in these system logs. However, existing anomaly detection methods, which predominantly rely on template-based and global window-based approaches, still face challenges in terms of flexibility and practicality. Template-based methods, while widely adopted for their simplicity and efficiency, overlook parameter information and fail to capture the true execution semantics. And global window-based methods, despite their effectiveness in modeling global dependencies, cannot simultaneously capture both global and local dependencies, leading to the obscuration of important local features. To address these issues, we propose aLoganomaly detection method based onMUlti-scaleSEmantic representation,LogMUSE. Specifically, LogMUSE obtains template and parameter information through log parsing, employs a pre-trained Bidirectional Encoder Representations from Transformers (BERT) model for template semantic embedding, and enhances log entry representations via cross-attention mechanisms to effectively capture different parameter features under the same template. Additionally, we design the multi-scale Transformer model to capture global and local anomaly patterns, which enable fixed-length log sequences to focus on features at different scales. Extensive experiments on real-world benchmark datasets, including BGL, Thunderbird and Spirit, show that LogMUSE outperforms existing methods in log anomaly detection, achieving F1-scores of 98.62%, 94.32%, and 99.20% respectively. These results surpass the performance of current state-of-the-art methods and demonstrate the strong generalization across different system scenarios.

With the increasing sophistication of cyber attacks, traditional defense mechanisms have become inadequate due to information asymmetry between attackers and defenders. While threat intelligence sharing helps bridge this gap, existing entity recognition methods face two critical challenges: (1) difficulty in handling domain-specific features and entity ambiguity in cybersecurity texts; and (2) ineffective alignment of heterogeneous entities across multi-source threat intelligence. To address these issues, we propose the Semantic Entity Recognition and Alignment (SERA) framework, which employs SecureBERT to construct security-domain semantic representations and learn specialized threat intelligence features. The framework combines bidirectional long short-Term memory (BiLSTM) to capture contextual dependencies, incorporates an attention mechanism to enhance key semantic modeling, and finally utilizes a Conditional Random Field (CRF) layer to improve label sequence consistency. To resolve entity naming inconsistencies and representation redundancy, we integrate three types of information—semantic similarity, structural embedding similarity, and contextual similarity—and perform multi-source entity alignment through weighted scoring, effectively improving cross-source entity unification. Experimental results on the DNRTI dataset demonstrate that the SERA model achieves superior performance compared to baseline models, with an F1-score of 0.7821, precision of 0.7625, recall of 0.8152, and entity recognition accuracy of 0.9387.

Virtualization has been widely used in various scenarios, such as cloud computing. As its core technology, virtualization hypervisor brings up the efficiency of sharing the physical machine's resources via virtual devices. However, virtualization hypervisor also introduces significant security risks due to defective design or implementation schemes on virtual devices. Although several methods have been proposed to detect vulnerabilities in virtual devices, they still cannot effectively discover them because of missing critical information related to the MMIO/PIO and DMA operations to guide their dynamic methods. In this paper, we propose a hybrid method, VD-GUARD, to detect vulnerabilities in virtual devices. Specifically, it first leverages static control flow analysis to track call traces from various data entry points of virtual devices (MMIO/PIO functions) to the critical dispatcher points (DMA functions), and generate seeds that can trigger this call trace via static analysis and limited fuzzing test. And then, it takes these seeds as input and leverages DMA guided fuzzing to discover bugs. To verify the effectiveness of Vd-guard, we build a dataset, including 10 bugs in QEMU, based on previous works, and Vd-guardoutperforms the state-of-the-art hypervisor fuzzer Morphuzz. Vd-guardalso has found 4 new vulnerabilities in QEMU and VirtualBox, all of which have been confirmed and fixed (have been assigned 3 CVE IDs).

Asynchronous or partially synchronous Byzantine fault-tolerant (BFT) protocols can tolerate up to one-third Byzantine faults, while synchronous Byzantine fault-tolerant protocols can tolerate up to one-half Byzantine faults. The existing synchronous Byzantine fault-tolerant protocols are leader-based protocols, which may lead to unbalanced load between nodes, and constitute a bottleneck that influences the performance of the whole system. In addition, the synchronous BFT protocols rely on a strong assumption: every message sent by an honest node will arrive at its destination within a known bounded time. In this work, in order to obtain better fairness and allow some degree of asynchrony while tolerating one-half faults, we designed LWSBFT, a leaderless BFT protocol in a weakly synchronous model where the synchronous assumption does not have to hold for all nodes all the time. The leaderless BFT protocol is comprised of the weakly synchronous Byzantine reliable broadcast (RBC) protocol and the weakly synchronous binary Byzantine agreement (BA) protocol, both of which can tolerate one-half faults. The weakly synchronous RBC protocol is used by each node to propose its input, and the weakly synchronous binary BA protocol is used to make a decision for each proposed value. The proposed leaderless BFT protocol can ensure both safety and liveness in a weakly synchronous model. We implement our consensus mechanism in Go, and evaluate the proposed consensus mechanism’s performance in terms of throughput and latency.

Cryptographic primitive of timed-release encryption (TRE) enables the sender to encrypt a message which only allows the designated receiver to decrypt after a designated time. Combined with other encryption technologies, TRE technology is applied to a variety of scenarios, including regularly posting on the social network and online sealed bidding. Nowadays, in order to control the decryption time while maintaining anonymity of user identities, most TRE solutions adopt a noninteractive time server mode to periodically broadcast time trapdoors, but because these time trapdoors are generated with fixed time server’s private key, many “ciphertexts” related to the time server’s private key that can be cryptanalyzed are generated, which poses a big challenge to the confidentiality of the time server’s private key. To work this out, we propose a concrete scheme and a generic scheme of security-enhanced TRE (SETRE) in the random oracle model. In our SETRE schemes, we use fixed and variable random numbers together as the time server’s private key to generate the time trapdoors. We formalize the definition of SETRE and give a provably secure concrete construction of SETRE. According to our experiment, the concrete scheme we proposed reduces the computational cost by about 10.8% compared to the most efficient solution in the random oracle model but only increases the almost negligible storage space. Meanwhile, it realizes one-time pad for the time trapdoor. To a large extent, this increases the security of the time server’s private key. Therefore, our work enhances the security and efficiency of the TRE.

In the past decades, the ever-increasing popularity of the Internet has led to an explosive growth of information, which has consequently led to the emergence of recommendation systems. A series of cloud-based encryption measures have been adopted in the current recommendation systems to protect users’ privacy. However, there are still many other privacy attacks on the local devices. Therefore, this paper studies the encryption interference of applying a differential privacy protection scheme on the data in the user’s local devices under the assumption of an untrusted server. A dynamic privacy budget allocation method is proposed based on a localized differential privacy protection scheme while taking the specific application scene of movie recommendation into consideration. What is more, an improved user-based collaborative filtering algorithm, which adopts a matrix-based similarity calculation method instead of the traditional vector-based method when computing the user similarity, is proposed. Finally, it was proved by experimental results that the differential privacy-based movie recommendation system (DP-MRE) proposed in this paper could not only protect the privacy of users but also ensure the accuracy of recommendations.