Network traffic classification is essential for application identification and malicious behavior detection. However, the widespread use of encryption protocols hides payloads and reduces the availability of high-quality labeled data, both of which constrain the effectiveness of current models. To address these challenges, we propose CL-ViME, a self-supervised encrypted traffic classification framework that integrates Contrastive Learning and Vision Mixture of Experts. First, we design a packet-temporal matrix that preserves fine-grained packet headers and flow-level temporal structure. Second, we introduce a Vertical Vision Transformer-Mixture of Experts model to extract dual-view features through vertical patching and dynamic expert routing. Third, we develop a dual-granularity contrastive learning framework that aligns packet-level and flow-level representations via an MoE projector, followed by lightweight classifier-head fine-tuning. Experiments on three public datasets show that CL-ViME significantly outperforms state-of-the-art self-supervised and supervised baselines across accuracy, macro-precision, macro-recall, and macro-F1. It also demonstrates strong generalization and stability.

In legal AI, prompt engineering unlocks legal knowledge by bridging experts and LLMs. These prompts, often not following human language conventions, boost LLMs' NLP performance with minimal data, yet task-specific optimization remains challenging. Current soft-prompt methods lack interpretability and cross-linguistic adaptability, while general optimization approaches prove time-consuming and fail to integrate legal reasoning. This paper proposes LAC-APO, a multi-agent collaborative framework based on Toulmin's model that incorporates judges' implicit knowledge. Through Logical combing—Knowledge injection—Error induction—Prompt adjustment process, it systematically converts implicit expertise into explicit LLM outputs. Experiments show LAC-APO outperforms manual optimization and existing competitiveness prompt optimization methods, enhancing efficiency while maintaining legal reasoning integrity.

Despite great progress in fuzzing browser APIs, systematic approaches for testing web storage techniques remain absent. IndexedDB, the most popular NoSql database in modern browsers, brings unique challenges for fuzzing its API due to its asynchronous event-driven feature and strict phase separation. Current browser fuzzing techniques frequently struggle to generate nested event flows and invocations, which significantly impacts semantic correctness. Moreover, they often rely heavily on the try-catch block to suppress exceptions, which introduces substantial performance overhead. We propose IDBFuzz, the first fuzzing approach tailored for the IndexedDB API, which effectively tackles the challenge of capturing the execution context and event semantics inherent to IndexedDB, as well as handling large persistent objects. We design a seed generator based on intermediate representation (IR) that decouples layered IR skeletons from input object generation. With the aid of a global database snapshot, IDBFuzz can generate semantically controllable seeds, enabling the efficient production of high-quality test cases that significantly improve coverage.

Neural machine translation (NMT) systems have been widely deployed in real-world applications. However, despite the great translation performance, these systems inevitably face robustness issues and sometimes produce erroneous outputs, particularly in complex and ambiguous scenarios. In this work, we propose a Fuzzing framework with Differential Testing for NMT systems, namely, DiFuzzNMT. DiFuzzNMT employs a heuristic strategy to continuously search inputs that produce greater output differences across various NMT systems for error detection. Specifically, DiFuzzNMT establishes token mappings between outputs of different NMT systems for the same input through word alignment. To guide the test input generation process of fuzzing, we design specific testing guidance that takes into account the differences between outputs, including word alignment differences and token semantic differences. All the test inputs are generated based on “seed” inputs (inputs to generate new inputs) by applying a mutation operator. Test inputs exhibiting higher testing guidance values are selected as new seeds, while the others are discarded. A potential translation error is reported when the same test input exhibits significant differences across different NMT systems. By iteratively retaining seeds and generating test inputs, DiFuzzNMT can effectively detect translation errors. To evaluate the effectiveness of DiFuzzNMT, we conduct experiments on two widely used NMT APIs (Baidu Translate and Tencent Translate), using a publicly available dataset of 800 original sentences across 8 thematic categories. The experimental results show that DiFuzzNMT detects more translation errors than baselines and exhibits greater diversity. Furthermore, the results show that the proposed testing guidance improves the method's ability to detect translation errors.

ABSTRACT Deep neural networks (DNNs) possess potent feature learning capability, enabling them to comprehend natural language, which strongly support developing dialogue systems. However, dialogue systems usually perform incorrect behaviours in some corner cases, which may cause misunderstanding or economic loss. To test and debug dialogue systems, a popular fuzzing framework by metamorphic testing with Gini impurity guidance is proposed, namely, DialTest. However, DialTest treats all seeds (the initial test inputs to generate the mutated test inputs) equally during the fuzzing process and does not differentiate seeds, resulting in a certain limitation to its incorrect behaviour detection capability. In this paper, we propose to enhance the DialTest by applying a lightweight energy adjustment strategy called DialTest with Energy Adjustment (DialTest‐EA). DialTest‐EA employs the ant colony optimization algorithm (ACO) to adjust the mutation energy of each seed adaptively, ensuring that potential seeds have more opportunities to generate subsequent test inputs. To evaluate the effectiveness of the proposed DialTest‐EA, we conduct a series of comparisons with the original DialTest and random mutation strategy. The experimental results show that the proposed DialTest‐EA outperforms the compared methods both in the intent detection and slot filling tasks. Compared with the original DialTest, the intent detection accuracy of generated test cases by the proposed method is reduced by more than 14%, and the slot filling accuracy is reduced by more than 8%.

Mutation-based greybox fuzzing is an efficient and widely used software testing technique, and its performance heavily depends on the mutation strategy. Existing solutions guide the seed mutation by using program-adaptive mutation strategies or constraint solving techniques. However, they disregard the characteristic that the execution information of seeds with similar behavior contains general strategies for solving specific constraints. In this paper, we propose the FMUZZ, a lightweight fuzzing approach based on mutation strategy optimization. FMUZZ first clusters the seeds based on their execution information into different seed groups and then learns the byte mutation scheduling strategies applicable to different program paths to improve efficiency in generating seeds that satisfy specific branch constraints. Meanwhile, FMUZZ removes the redundant seeds during the learning process by using the customized multi-objective optimization algorithm, thereby improving the efficiency of learning byte mutation scheduling strategies for different program paths. We test the effectiveness of FMUZZ on 9 real-world programs with the comparison of 3 state-of-the-art mutation-based fuzzers. Extensive experimental results show that compared to the benchmark fuzzers, FMUZZ achieves 8.9% higher branch coverage and outperforms 35.3% in discovering unique crashes on average.

Coverage-guided Greybox fuzzing is regarded as a practical approach to detect software vulnerabilities, which targets to expand code coverage as much as possible. A common implementation is to assign more energy to such seeds which find new edges with less execution time. However, solely considering new edges may be less effective because some hard-to-find branches often exist in the complex code of program. Code complexity is one of the key indicators to measure the code security. Compared to the code with simple structure, the program with higher code complexity is more likely to find more branches and cause security problems. In this paper, we propose a novel fuzzing method which further uses code complexity to optimize power schedule process in AFL (American Fuzzy Lop) and AFLFAST (American Fuzzy Lop Fast). The goal of our method is to generate inputs which are more biased toward the code with higher complexity of the program under test. In addition, we conduct a preliminary empirical study under three widely used real-world programs, and the experimental results show that the proposed approach can trigger more crashes as well as improve the coverage discovery.

Network intrusion detection identifies malicious activity in the network by analyzing the behavior of network traffic. As an important part of network intrusion detection, feature extraction plays a crucial role in improving the performance of intrusion detection. This research proposes a novel secondary feature extraction method called L-KPCA based on the Liner Discriminant Analysis (LDA) and Kernel Principal Component Analysis (KPCA), to provide efficient features for network intrusion detection. While maintaining the effectiveness of processing nonlinear data in network traffic, the use of LDA effectively compensates for the problem that KPCA only focuses on the analysis of features in terms of variance and ignores the performance of features in terms of mean. Extensive experimental results verify that the use of the proposed, L-KPCA can make the intrusion detection classification model perform better in terms of recognition accuracy and recall.