The security of web services increasingly relies on accurate detection of advanced, previously unseen attacks hidden within complex host activities. Provenance-based intrusion detection systems (PIDSes) offer a promising foundation for this task by capturing rich causal and structural relationships across processes, files, and network interactions. However, recent studies show that these graph-driven methods remain vulnerable to graph manipulation attacks, where adversaries subtly alter provenance graphs to evade detection, which limits their practical deployment.

While the web interfaces of remotely managed devices offer convenience, their unstructured content can inadvertently leak geographic locations, posing a significant security risk. We aim to assess the feasibility of automatically exploiting this leakage, serving as a clear warning to cybersecurity regulators. To this end, we propose WebGeoInfer, a framework that does not rely on page structure. It extracts clues through page clustering and differential analysis to overcome the challenge of information heterogeneity. It also leverages search engines and large language models to augment sparse clues and infer precise coordinates, addressing the challenge of information sparsity. In large-scale experiments, WebGeoInfer successfully located 5,435 devices across 94 countries and 2,056 cities, achieving accuracy rates as high as 96.96% at the country level, 88.05% at the city level, and 79.70% at the street level. These findings provide the first conclusive evidence of the reality and scale of this threat. Furthermore, our analysis offers new insights and mitigation strategies for affected devices, establishing a key benchmark for future security research.

Advanced Persistent Threats (APTs) have become increasingly frequent, presenting substantial challenges to the management of network services. Using provenance graphs for log analysis has become a common approach in APT detection. However, existing research has two shortcomings: it does not fully utilize richer contextual semantic information and fails to effectively respond to unknown attacks. This paper presents SGAM, an accurate and fast APT detection framework. SGAM enhances accuracy through a training process driven by a masking strategy. The masking strategy includes the selection of masked nodes and a more robust training approach. SGAM incorporates the importance of provenance graph nodes into the masking strategy, gradually increasing the significance of the masked information during training, allowing the model to learn more critical node features. This enables the model to extract deeper contextual semantic information. In anomaly detection, SGAM employs an unsupervised method to ensure effective detection of unknown attacks while improving detection efficiency. We evaluated SGAM on three widely used datasets, and the results indicate that SGAM demonstrates outstanding detection performance across all scenarios, outperforming existing methods. Additionally, experiments show that SGAM can mitigate the impact of concept drift to some extent.

To achieve high-performance identification for remote management device, this paper proposes MME4RMD, a novel BERT-ResNet-based multi-modal embedding model that integrates visual, textual, and HTML structural features to generate distinctive device embedding. By employing triplet network training, our method significantly enhances feature discrimination and generalization capability for cluster-based identification. Comprehensive evaluations on manually curated real-world datasets containing 25 known and 20 unknown device classes demonstrate superior performance, achieving 98% and 93% F1-scores for known and unknown device identification respectively, substantially outperforming conventional approaches.

As the complexity and frequency of cyberattacks, such as Advanced Persistent Threats (APTs) and ransomware, continue to escalate, traditional anomaly detection methods have proven inadequate in addressing these sophisticated, multi-faceted threats. Recently, Host Provenance Graphs (HPGs) have played a crucial role in analyzing system-level interactions, detecting anomalous behaviors, and tracing attack chains. However, existing provenance-based detection methods primarily rely on single-dimensional feature analysis, which fails to capture the dynamic and multi-dimensional patterns of modern APT attacks, resulting in insufficient detection performance. To overcome this limitation, we introduce STGAN, a model that integrates spatial-temporal graphs into host provenance graph modeling. STGAN applies temporal and spatial encoding to dynamic provenance graphs to extract temporal, spatial, and semantic features, constructing a comprehensive feature representation. This representation is further fused and enhanced using a multi-head self-attention mechanism, followed by anomaly detection. Through extensive evaluations on three widely-used provenance graph datasets, we demonstrate that our approach consistently outperforms current state-of-the-art techniques in terms of detection performance. Additionally, we contribute to the research community by releasing our datasets and code, facilitating further exploration and validation.

Malware poses a significant threat to network and information system security, particularly in industrial Internet of Things (IIoT) environments, where embedded systems and edge devices often rely on general-purpose operating systems. Although machine learning (ML) techniques have advanced malware detection, they remain vulnerable to adversarial attacks. Current research primarily focuses on adversarial examples targeting single ML detectors, but the widespread use of ensemble learning necessitates generating adversarial examples that can simultaneously evade multiple detectors. To address this challenge, we propose GanGenetic, a novel framework that combines generative adversarial networks (GANs) with genetic algorithms (GAs) to generate adversarial malware examples targeting import address table features in portable executable files. GanGenetic generates examples with minimal perturbations while simultaneously evaluating the robustness of multiple ML detectors. The framework first generates initial examples using GANs, then optimizes them through a GA to maximize evasion and minimize noise. Experiments on the VirusShare and Ember datasets show that GanGenetic can evade detection by seven ML models (including AdaBoost, Gradient Boosting Decision Trees, logistic regression, multilayer perceptron, random forest, support vector machine, and MalConv) with an average attack success rate exceeding 96%. In addition, in real-world tests, the framework successfully evaded detection while preserving malware functionality.