As the most widely used server-side programming language for web applications, PHP has a large number of SQL injection (SQLI) and cross-site scripting (XSS) vulnerabilities that are exploited maliciously, making the detection of such vulnerabilities increasingly critical. Existing source code detection methods suffer from issues such as uncleaned redundant information, limited representation dimensions and poor detection performance. To address these challenges, we propose a PHP vulnerability detection method based on RGB image representation and hybrid attention mechanisms — PHP ResNet with Hybrid Attention (PRWHA). First, PRWHA marks the input sources and sensitive functions, constructs data flow and control flow graphs between source and sink points and adds function call edges. This method uniquely identifies nodes in the graph using filenames and line numbers to enable inter-procedural and cross-file detection. Next, it leverages both the topological information (including data flow, control flow and function call relationships) and textual information of the code’s graph structure to generate RGB images. These images are then processed by a ResNet-50 model enhanced with a hybrid attention layer to detect SQLI and XSS vulnerabilities. To validate the effectiveness of PRWHA, we evaluated it on both publicly available datasets and real-world software datasets. The results demonstrate that PRWHA outperforms traditional methods as well as other machine learning, deep learning and Large Language Model (LLM)-based detection approaches. On the public dataset, PRWHA achieved an accuracy of 99.00% and an F1-score of 97.13% on the test set. On the real-world software dataset, it achieved an accuracy of 73% and a vulnerability detection rate of approximately 83.67%.

Heap vulnerabilities pose a significant risk to software, leading to stability issues such as slowdown and resource depletion. These vulnerabilities can potentially disrupt critical operations and compromise the overall system performance, especially in the case of automated control systems implemented in C/C[Formula: see text] language. While various artificial intelligence-based detection methods have been studied, there has been limited analysis of the detection process and the structural and semantic features, resulting in lower detection efficiency. This paper proposes a novel heap vulnerability detection (HVDet) method based on the Pointer Program Dependency Graph (P-PDG) representation and Bidirectional Gated Recurrent Unit (Bi-GRU) algorithm for software. Through inter-procedural analysis, the P-PDG serves as an innovative code representation model that places emphasis on pointer operations, which are closely associated with heap vulnerabilities. It leads to a reduction in code size while simultaneously capturing a broader range of structural and semantic features of the source code. Subsequently, a mixed feature matrix incorporating these features from code slices is generated as input for the Bi-GRU algorithm. When compared with 7 state-of-the-art (SOTA) vulnerability detection tools, HVDet demonstrates superior performance. It successfully identified three heap vulnerabilities in real-world software such as Linux Kernel, Espruino and LibreDWG.

Adaptive knowledge transfer from pretrained source models to unlabeled target domains has emerged as a key paradigm in the Industrial Internet of Things. Such frameworks effectively mitigate distribution discrepancies between domains and ensure data privacy in cross-condition fault diagnosis. However, most existing methods require extensive parameter tuning for each source backbone, resulting in high computational costs, especially as the number of source domains or the complexity of models increases. Moreover, current methods typically learn the transferable weights of each source model at domain-level, inevitably causing instance-level bias. Thus, we propose a new idea of Specificity and Consistency Ensemble (SpeConE) for efficient multiple-source fault diagnosis, which avoids parameter tuning for each source backbone. SpeConE balances instance-specific and domain-consistent weights by jointly considering feature-feature and feature-output similarities. By fine-tuning the source bottlenecks guided by the specificity and consistency weights, SpeConE effectively achieves multi-source-free cross-domain adaptation. Additionally, a novel pseudo-label smoothing strategy is introduced to prevent overfitting in the target domain. Experiments show that, when adopting Swin Transformer, SpeConE outperforms similar methods (e.g., ∼+3% on single-device diagnosis and ∼+10% on cross-device diagnosis) while tuning only about 5% of the parameters.

As the world’s most widely used operating system, Windows has long been a primary target for malware attacks, causing severe economic losses and threats to data security for users and enterprises. Existing detection methods often struggle with low accuracy when dealing with complex malware, suffering from high false-negative and false-positive rates. Additionally, malware detection in Windows faces challenges such as limited datasets, a lack of benign sample contrast and insufficient original feature information. To address these issues, we propose a malware detection method based on RGB image representation and heterogeneous neural network (MalRGBDet). First, we collected malware samples from the GitHub and VirusShare platforms, along with benign software from Windows systems, to build a dataset named MalDet. This data set contains unprocessed malicious and benign samples, providing original feature information and addressing the lack of benign samples in existing data sets. Next, we extracted three key features from the malware samples: code sections, data sections and API call sequences. These features closely relate to the behavior of malware and accurately describe its operations. We then transformed these features into uniformly sized RGB images, which helped reveal hidden patterns. Finally, we employ a heterogeneous neural network that integrates ResNet and AlexNet for classification. ResNet, with its deep architecture and residual learning mechanism, significantly enhances the model’s representation capability and classification performance, thereby improving detection accuracy. Meanwhile, AlexNet’s Dropout regularization strategy effectively boosts the model’s generalization ability. In our data set of 1952 Windows software samples, MalRGBDet achieved more than 95% in accuracy, precision, recall and F1-score, improving these metrics by up to 4% compared to the latest methods. Furthermore, false-negative and false-positive rates were kept below 5%.

Feature engineering is a classical problem in recommender systems, and feature interactions is one of the most important parts of feature engineering. Factorization based models are widely used for explicit feature interactions. However, most current works utilize separate features to model cross features. Such a pattern limits the significance of cross features, since realistic recommendation scenarios are rich in associations between features. In this paper, we classify the basic feature interactions into sum-interaction and product-interaction, and improve the current general strategy of explicit feature interactions. Based on these theoretical studies, we propose a novel explicit feature interactions model Attentional Aggregative Interaction Network (AAIN), which models higher-order features using a cyclic explicit module. Specifically, we introduce attention mechanism for the reorganization of separate features, followed by product-interaction and higher-order features’ compression and output. The model is efficient since: 1) AAIN automatically learns high-order feature interactions and filters them with different weights. 2) AAIN optimizes the interaction between features into the interaction between feature groups, which allows for other relevant information to be considered when performing interactions. Furthermore, we integrate AAIN model with the classical deep neural network (DNN) model into a new model Deep Attentional Aggregative Interaction Network (DAAIN). Experiments on real-world datasets show that our models achieve state-of-the-art results.

Security vulnerability database research is an essential part of information security research. With the sharp increase in the number of vulnerabilities in recent years, it has become increasingly important to collect and organize information about existing vulnerability databases. However, there is heterogeneity and redundancy of data between the databases, which makes it challenging to share vulnerability information. In response to the above problems, a comprehensive security vulnerability collection model is proposed. A total of 1.005 million pieces of vulnerability data are collected and analyzed in 11 mainstream vulnerability databases. By introducing the idea of the collection of automation, problems such as the untimely update of vulnerability database information and the low efficiency of vulnerability collection, are solved effectively. The structural framework and functional modules of the automatic vulnerability collection system are introduced, and the specific implementation of the system is given. Based on the text processing technology, the rules of deduplication (95.6% accuracy) and the intelligent framework for vulnerability database (IFVD) are proposed and implemented. Finally, Experiments show the feasibility of the scheme.

Identifying influential nodes is important for software in terms of understanding the design patterns and controlling the development and the maintenance process. However, there are no efficient methods to discover them so far. Based on the invoking dependency relationships between the nodes, this paper proposes a novel approach to define the node importance for mining the influential software nodes. First, according to the multiple execution information, we construct a weighted software network (WSN) to denote the software execution dependency structure. Second, considering the invoking times and outdegree about software nodes, we improve the method PageRank and put forward the targeted algorithm FunctionRank to evaluate the node importance (NI) in weighted software network. It has higher influence when the node has lager value of NI. Finally, comparing the NI of nodes, we can obtain the most influential nodes in the software network. In addition, the experimental results show that the proposed approach has good performance in identifying the influential nodes.

Collaborative Anomaly Detection CAD is an emerging field of network security in both academia and industry. It has attracted a lot of attention, due to the limitations of traditional fortress-style defense modes. Even though a number of pioneer studies have been conducted in this area, few of them concern about the universality issue. This work focuses on two aspects of it. First, a unified collaborative detection framework is developed based on network virtualization technology. Its purpose is to provide a generic approach that can be applied to designing specific schemes for various application scenarios and objectives. Second, a general behavior perception model is proposed for the unified framework based on hidden Markov random field. Spatial Markovianity is introduced to model the spatial context of distributed network behavior and stochastic interaction among interconnected nodes. Algorithms are derived for parameter estimation, forward prediction, backward smooth, and the normality evaluation of both global network situation and local behavior. Numerical experiments using extensive simulations and several real datasets are presented to validate the proposed solution. Performance-related issues and comparison with related works are discussed.

Abstract In this paper, we present a practical framework to generate cartoon style animations of smoke, which consists of two components: a smoke simulator and a rendering system. In the simulation stage, the smoke is modelled as a set of smoothed particles and the physical parameters such as velocity and force are defined on particles directly. The smoke is rendered in flicker‐free cartoon style with two‐tone shading and silhouettes. Both the simulation and rendering are intuitive and easy to implement. In the most moderate scale scene, an impressive cartoon animation is generated with about a thousand particles at real‐time frame rate. Copyright © 2005 John Wiley & Sons, Ltd.