Partial observability presents a significant challenge for Safe Reinforcement Learning (Safe RL), as it impedes the identification of potential risks and rewards. Leveraging specific types of privileged information during training to mitigate the effects of partial observability has yielded notable empirical successes. In this paper, we propose Asymmetric Constrained Partially Observable Markov Decision Processes (ACPOMDPs) to theoretically examine the advantages of incorporating privileged information in Safe RL. Building upon ACPOMDPs, we propose the Privileged Information Guided Dreamer (PIGDreamer), a model-based RL approach that leverages privileged information to enhance the agent’s safety and performance through privileged representation alignment and an asymmetric actor-critic structure. Our empirical results demonstrate that PIGDreamer significantly outperforms existing Safe RL methods. Furthermore, compared to alternative privileged RL methods, our approach exhibits enhanced performance, robustness, and efficiency. Codes are available at: https://github.com/hggforget/PIGDreamer.

While encrypted traffic improves security, it is also used by attackers to hide the transmission content to evade detection. Currently, traffic side-channel features combined with Deep Learning (DL) are widely used for malicious traffic classification, but traditional DL-based methods require large training samples and struggle with new threats. Prototypical networks in meta-learning have been effective in few-shot malicious traffic classification. However, existing methods face challenges such as "overlooking hierarchical traffic dependencies" and "bias in class prototype generation". The former means that the existing methods lack the representation design based on the hierarchical structure of traffic, resulting in insufficient feature extraction, and the latter indicates that the existing methods struggle to capture the diverse distribution of traffic features, resulting in unstable classification performance. To address the above problems, this paper proposes a few-shot encrypted malicious traffic classification method based on Hierarchical Semantics and Adaptive Prototype Learning Network (HANet). First, network traffic’s fine-grained features are represented in a multi-level matrix, with a hierarchical network structure designed to extract features comprehensively. Then, class prototypes are dynamically generated using a neighborhood partitioning method to balance simple and complex traffic feature distributions, enhancing generalization. Experiments on the CICandMal2017 dataset show that HANet offers significant performance over other few-shot malicious traffic classification methods. HANet has achieved a classification accuracy of more than 80% with only 5, 10, and 15 labeled traffic samples, realizing effective detection of few-shot encrypted malicious traffic.

Malware Knowledge Graph (MKG) serves as an essential auxiliary tool for malware detection and analysis. However, the construction of MKG faces several challenges, such as inadequate dataset quality, incomplete entity feature extraction, and the limitations imposed by deep learning techniques. To address these issues, we present an Efficient Framework for constructing a malware knowledge graph (EFwork). Firstly, we build a High-Quality Dataset (HQDataset) and introduce a metric for data quality assessment based on knowledge coverage, timeliness, and density. Subsequently, we develop a Named Entity Recognition (NER) model that extracts character features, part-of-speech features, and word features from the data, leveraging deep learning models to identify malware-related entities. Finally, we implement a rule-based filtering mechanism, utilizing a comprehensive Rule Database to eliminate entities that do not conform to predefined rules. Experimental result shows that our HQDataset demonstrates superior data quality when compared to other open-source datasets. Furthermore, our NER model combined with our Rule Database outperforms existing models, achieving improvements of 0.67%, 0.74%, and 0.69% in Precision, Recall, and F1-Score, respectively.