Abstract Modern systems generate massive amounts of logs during operation, which are the key foundation for anomaly log analysis. However, existing research typically breaks down log analysis into multiple isolated tasks, which lacks flexibility in complex application scenarios and requires significant manpower. Furthermore, the increasing diversity and complexity of log formats place higher demands on the accuracy of log analysis. To achieve a more robust, accurate, and comprehensive log analysis method, we propose an integrated framework, called LogLAA. We construct a log parser based on length and word frequency that runs stably in most log systems with minimal parameter tuning, supporting both offline and online parsing in various scenarios. By introducing variable substitution and combining it with a similarity prefix tree, we achieve high accuracy and efficiency. We introduce counting embeddings, sequence embeddings, and semantic embeddings, and combining them with a CNN-LSTM model based on a dual-attention mechanism, we significantly improve the precision of anomaly detection. To ensure the interpretability of anomaly logs, we combine them with a large language model (LLM) for analysis. Experimental results show that our log parsing method achieves a 0.8% improvement over the SOTA model and anomaly detection achieves 6% improvement over the average precision of other advanced methods. We use the weighted matching score to evaluate anomaly analysis. LogLAA scores 0.7, placing it at an upper-middle level.

Hierarchical text classification (HTC) is an important yet challenging task in natural language processing (NLP), primarily due to the complexity of its taxonomic label hierarchy. Existing methods often utilize graph neural networks (GNNs) to model the hierarchical label structure, with the aim of integrating hierarchical information to improve model performance. However, these methods typically fail to fully exploit the topological features of hierarchical labels and are largely dependent on prior knowledge, which limits the generalization ability of the model. To address this limitation, we explore a model with strong generalization ability that improves HTC performance by leveraging topological features, without relying on prior statistics or label semantics. In this paper, we formalize the hierarchical structure as a disconnected graph and introduce a Persistent Homology-based Graph Attention Network (PHGAT) to capture the multi-scale topological features of hierarchical label structure. Building upon this, we propose HiGATA, which exclusively utilizes the topological information of the label hierarchy. By integrating persistent homology-based topological features into node representations, HiGATA further improves text classification performance. We validate the effectiveness of HiGATA through experiments on three widely used datasets.

With the extensive deployment and application of Internet of Things (IoT) devices, vulnerable edge nodes have emerged as primary targets for Advanced Persistent Threat (APT) attacks. Attackers compromise IoT terminal devices to establish an initial foothold and subsequently exploit lateral movement techniques to progressively infiltrate core business networks. Prior investigation methods struggle with fragmented threat intelligence and sparse attack samples in heterogeneous audit logs, resulting in incomplete attack chain reconstruction and high false positives. We propose a novel approach to APT attack investigation, FALCON, which captures complex causal relationships between entities from discrete audit logs and constructs cross-domain provenance graphs, enabling rapid and accurate identification of potential APT activities. FALCON trains an adaptive edge-side local model with cross-domain behavior sequences containing extensive and remote contextual information, and employs a bidirectional transformer pre-trained model to learn latent representations from unlabeled sequences. To the best of our knowledge, FALCON is the first APT investigation method to conduct causal provenance based on cross-domain audit logs while ensuring privacy protection. The experimental results demonstrate that FALCON effectively detects APT attacks with accuracy 99.71% and reconstructs attack scenarios with accuracy 87.4%.

In the field of fake news detection, deep learning techniques have emerged as superior performers in recent years. Nevertheless, the majority of these studies primarily concentrate on either unimodal feature-based methodologies or image-text multimodal fusion techniques, with a minimal focus on the fusion of unstructured text features and structured tabular features. In this study, we present SGAMF, a Sparse Gated Attention-based Multimodal Fusion strategy, designed to amalgamate text features and auxiliary features for the purpose of fake news identification. Compared with traditional multimodal fusion methods, SGAMF can effectively balance accuracy and inference time while selecting the most important features. A novel sparse-gated-attention mechanism has been proposed which instigates a shift in text representation conditioned on auxiliary features, thereby selectively filtering out non-essential features. We have further put forward an enhanced ALBERT for the encoding of text features, capable of balancing efficiency and accuracy. To corroborate our methodology, we have developed a multimodal COVID-19 fake news detection dataset. Comprehensive experimental outcomes on this dataset substantiate that our proposed SGAMF delivers competitive performance in comparison to the existing state-of-the-art techniques in terms of accuracy and$F_{1}$score.

In the Internet of Things (IoT) scenario, the device diversity and data sparsity present a significant challenge for malicious traffic detection, notably the “small sample problem” where insufficient data hampers the performance of the deep learning methods that depend on large volumes of labeled data for training. Transfer learning (TL) has the capability to transfer knowledge from a label-rich but heterogeneous domain to a label-sparse domain, making it a powerful tool for addressing challenges in IoT malicious traffic detection. To address these challenges, we introduce the EMTD-SSC model, a novel enhanced malicious traffic detection model that leverages TL under small sample conditions in IoT environments. Initially, our approach includes a comprehensive labeled data set that merges a small-scale IoT intrusion detection domain with the traditional intrusion detection domain to enrich semantic information transfer from the source to target domains. The EMTD-SSC model employs dual residual convolutional autoencoders for robust feature extraction and transfer, incorporating skip connections to expedite the model convergence and minimize information loss. Furthermore, to optimize transfer efficiency, we minimize the multilayer multi kernel maximum mean discrepancy (MLMK-MMD) across corresponding network layers, facilitating effective domain adaptation. Through unsupervised training and subsequent fine tuning on the target domain data, the model significantly enhances anomaly detection capabilities. Extensive experiments on the two well-known public data sets demonstrate that the EMTD-SSC model’s effectiveness, achieving an impressive 94.8% accuracy in the binary classification tasks.

Insider threats represent a significant challenge in both corporate and governmental sectors. Most existing supervised learning based detection methods that rely on transforming user behavior into sequential data do not fully utilize structural information and require extensive labeled data. This reliance poses a challenge due to the scarcity of labeled data in real-world scenarios, leading to a few-shot learning situation. To address these limitations, we propose a novel Graph modularized-based Meta-learning Framework for Insider Threat Detection, named GMFITD. Specifically, GMFITD utilizes a structural reconstruction mechanism that combines a graph-based autoencoder with an attention mechanism to explore structural information and infer potential relationships between users. Additionally, we employ a graph prototype construction method coupling episodic meta-learning principle (MAML) to compute representative embeddings for few-shot learning scenarios. By leveraging MAML, the proposed method can capture prior knowledge of insider threat classification by training on similar few-shot learning tasks with few labeled samples. We further enhance the resilience of GMFITD to adversarial attacks through an edge importance estimation mechanism, which assigns higher weights to relevant edges. Extensive experiments demonstrate that our proposed GMFITD outperforms state-of-the-art methods in insider threat detection, achieving higher accuracy with fewer labeled samples and resisting adversarial attacks.

Federated learning aims to complete model training without private data sharing, but many privacy risks remain. Recent studies have shown that federated learning is vulnerable to membership inference attacks. The weight as an important parameter in neural networks has been proven effective for membership inference attacks, but it leads to significant overhead. Facing this issue, in this paper, we propose a bias-based method for efficient membership inference attacks against federated learning. Different from the weight that determines the direction of the decision surface, the bias also plays an important role in determining the distance to move along the direction. Moreover, the number of bias is way less than the weight. We consider two types of attacks: local attack and global attack, corresponding to two possible types of insiders: participant and central aggregator. For the local attack, we design a neural network-based inference, which fully learns the vertical bias changes of the member data and non-member data. For the global attack, we design a difference comparison-based inference to determine the data source. Extensive experimental results on four public datasets show that the proposed method achieves state-of-the-art inference accuracy. Moreover, experiments prove the effectiveness of the proposed method to resist some commonly used defenses.

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.

With the development of social media, multimodal hate speech that relies on images and text has become an emerging way of spreading hate. The detection of multimodal hate speech is gradually becoming an increasingly challenging task. While many works based on neural networks and multimodal machine learning were proposed to detect multimodal hate speech, only few attempts have been made in terms of the interpretability of the task. This leads to difficulties in analyzing prediction results and model improvement. Therefore, this paper investigates the interpretable multimodal hate speech detection task and develops an intrinsically interpretable deep learning method by leveraging the multimodal architecture. Specifically, we leverage a multimodal pretrained model as the backbone of the final detection results and parallel an interpretability module via a joint training approach, which calculates the input tokens and fine-grained tags through a filter-gate attention mechanism. The interpretability module provides an interpretable basis for the final result judgment. We conduct experiments on the hate speech detection dataset and demonstrate that our proposed method not only significantly outperforms other methods but also provides interpretable insights into the decisions of our model.

Facing multidemand tasks and massive heterogeneous resources in an IoT edge computing environment, it is a challenge to obtain reliable and quick response service and allocate application tasks to resource nodes that meet task requirements and user preference. Since IoT edge computing is facing different types of severe attacks, such as message attacks, swing attacks, collusion attack, node attacks, etc., providing a reliable service environment, trust evaluation between edge nodes is necessary. Existing trust computing schemes, however, suffer from a long response period and low malicious detection rate in a dynamic environment. To alleviate these issues, we propose a reliable and efficient task offloading strategy based on the multifeedback trust mechanism (TOSMFTM). First, a reliable and efficient architecture of TOSMFTM is established, which can effectively improve the ability of trust computing and task offloading. Second, according to the broker’s dynamic monitoring of data, a multifeedback trust aggregation model based on time attenuation and interaction frequency is proposed to provide a trusted running environment. Third, a trust weight$k$-means (TWK-means) clustering algorithm is designed based on resource attributes to enhance the reliability of service, and quickly and accurately cluster out resource nodes required by the task. Finally, we construct a task offloading model based on trust clustering to ensure user experience quality and promote system efficiency. Different from existing task processing models, which only focus on task offloading, our method also carries out resource preprocessing, trust evaluation, and resource clustering before task processing. The experiment verifies the effectiveness and feasibility of our TOSMFTM scheme.

As a complementary technology to traditional network security, trust computing scheme has been playing an increasingly important role in providing cloud service. However, many organizations constantly face trust computing challenges; moreover, establishing a highly trustworthy cloud ecosystem can be costly and time-consuming. In this article, we originally propose the conceptual model and formal definitions for a trustworthy collaboration service ecosystem, and construct a Bi-trustworthy cloud collaboration service (Bi-TCCS), which is a scheme based on an innovative bilateral social feedback (referred to as “bi-feedback”) scheme. First, a trust-aware collaboration service model is proposed based on cloud service brokerages (CSBs), which can provide intermediation and aggregation capabilities to enable organizations to deploy their services across a collaborative cloud environment. Then, we propose a bi-feedback scheme based on the inherent social relationship among three network communities, which are composed of three types of network entities: cloud users, CSBs, and cloud service providers. The proposed scheme is effective and reliable against garnished and bad-mouthing attacks resulting from the traditional social feedback scheme. Moreover, we innovatively adopt an aggregating method for overall trust based on deviation analysis. This method can minimize errors and overcome the limitations of traditional schemes, where trust attributes are weighted manually. Theoretical analysis and experiments verify the effectiveness ofBi-TCCS. Compared with existing approaches, the service successful ratio ofBi-TCCSincreased by 12 percent under highly dishonest cloud environment. These results also indicate thatBi-TCCSis more adaptable both in the random walk and cheating profiles, which represents a substantial improvement in tracking the dynamic behavior of cloud services.

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system calledHinCTIis developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. WithHinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

The integration of trust system and recommendation system is a new hot spot in current research. Trust relationship has be exploited in social recommendation, which can effectively solve the problems of low recommendation quality, sparse data and cold start in the traditional recommendation system. Meanwhile, trust inference in social relations is necessary in completing trust information and expanding social recommendation knowledge base. In this work, we propose a new trust inference algorithm LWCTrust to improve the efficiency and accuracy of social recommendation. Firstly, we construct a local weighted centrality (LWC) metric based on the user's degree centrality and trust information, and propose a new adaptive breadth-first search algorithm. Then, based on the property of path decay, we compare two different trust decay strategies. In addition, considering inconsistencies and conflicts in trust opinion, we apply LWC metric to multi-path aggregation step and present a OWA dynamic aggregation strategy. A number of experiments are conducted on the real social network dataset Advogato, and the results validate the great performance of LWCTrust. Our work is the first to construct an efficient LWC metric using social graph trust information, and we explore the effect of attenuation functions on accuracy in path propagation.

Data aggregation is a critical operation in wireless sensor networks (WSNs). Many applications have strict requirements for the latency of data aggregation. This paper focuses on the latency problem of data aggregation. Two factors determine the latency of data aggregation. First, because of the existence of interference, efficient collision-free scheduling is crucial for reducing data aggregation latency. Second, the tree structure has an important impact on data aggregation latency. In this paper, we propose a novel approach called distributed and efficient data aggregation scheduling over multichannel links (DEDAS-MC). DEDAS-MC minimizes the latency in routing the aggregated data to the sink over multichannel links. In DEDAS-MC, we first present a scheduling algorithm to schedule sensors to avoid interference and minimize the latency of data aggregation on a given tree. Then, a distributed algorithm for constructing minimum-latency data aggregation trees is proposed by employing the Markov approximation method. In DEDAS-MC, the value of β is adaptive. The Markov approximation method-based adaptive-β is more flexible and efficient than the single β approximation. The experiments show that DEDAS-MC outperforms the existing competing schemes.

More and more organizations and individuals start to pay attention to real-time threat intelligence to protect themselves from the complicated, organized, persistent and weaponized cyber attacks. However, most users worry about the trustworthiness of threat intelligence provided by TISPs (Threat Intelligence Sharing Platforms). The trust evaluation mechanism has become a hot topic in applications of TISPs. However, most current TISPs do not present any practical solution for trust evaluation of threat intelligence itself. In this paper, we propose a graph mining-based trust evaluation mechanism with multidimensional features for large-scale heterogeneous threat intelligence. This mechanism provides a feasible scheme and achieves the task of trust evaluation for TISP, through the integration of a trust-aware intelligence architecture model, a graph mining-based intelligence feature extraction method, and an automatic and interpretable trust evaluation algorithm. We implement this trust evaluation mechanism in a practical TISP (called GTTI), and evaluate the performance of our system on a real-world dataset from three popular cyber threat intelligence sharing platforms. Experimental results show that our mechanism can achieve 92.83% precision and 93.84% recall in trust evaluation. To the best of our knowledge, this work is the first to evaluate the trust level of heterogeneous threat intelligence automatically from the perspective of graph mining with multidimensional features including source, content, time, and feedback. Our work is beneficial to provide assistance on intelligence quality for the decision-making of human analysts, build a trust-aware threat intelligence sharing platform, and enhance the availability of heterogeneous threat intelligence to protect organizations against cyberspace attacks effectively.

Data aggregation is widely used in wireless sensor networks (WSNs) due to the resource constraints of computational capability, energy and bandwidth. Because WSNs are often deployed in an unattended hostile environment, WSNs are prone to various attacks. The traditional security technologies such as privacy protection and encryption technology can not address the attacks from the internal nodes of network. Therefore, the trust management mechanism for data aggregation has become a hot research topic, and an efficient trust management mechanism plays an important role in data aggregation.

Mobile crowd sensing (MCS) arises as an appealing paradigm, which utilizes participants to contribute sensing data generated from sensors embedded in smart devices in the internet of things (IoT) for the people-centric service delivery and crowd intelligence extraction. Due to the inherent selfishness of human and network's openness, the quality of the data submitted by the participants is not always satisfying. To cope with this problem, a dynamic-trust-based recruitment framework (DTRF) for MCS system is proposed to recruit suitable participants who are trustworthy and always submit high-quality sensing data on time. In this model, we first give the definition of trust, and evaluate the overall trust degree of the participant from multi-dimensional trust evaluation factors: direct trust, feedback trust and incentive function. Then we develop an adaptive weight allocation approach based on information entropy theory, and the algorithm realization is given. Extensive simulations verifies that DTRF can achieve good performance in terms of trustworthy participants selection and task completion rate, compared with trust without feedback model.

Mobile Crowd Sensing (MCS) is a promising paradigm in which mobile users collect and share sensor data from their local environment using wireless mobile devices. The inherent openness of this platform and the selfishness of individuals make it easy to contribute low-quality sensor data, so the recruitment of suitable participants who are trustable and contribute high-quality sensor data, becomes a fundamental requirement for MCS system. In this paper, we propose a dynamic-trust-based recruitment framework (DTRF) for MCS system. Real-time direct trust and lightweight feedback aggregation trust are combined to select the well-suited participants. In addition, we adopt an adaptive weight allocation approach to calculate the overall trust degree of the participants. Theoretical analysis and extensive simulation confirm that DTRF can efficiently select the trustworthy participants and effectively stimulate the participants to contribute high-quality sensor data and thus get high task completion rate and data quality.