To address the limitations of existing clean-label backdoor attacks, particularly concerning feature space heterogeneity, we propose a novel feature-distance-guided clean-label backdoor attack method. Specifically, we first introduce a sample selection strategy based on feature discrepancy and recognizability constraints. This strategy involves calculating the mean feature vector for each class within the dataset and subsequently employing the Fréchet Inception Distance to quantify the deviation of individual sample feature vectors from their respective class mean, thereby identifying samples significantly diverging from the class distribution. Subsequently, we present an innovative noise generation technique termed Feature Displacement-Driven Noise Iteration. For each selected training sample, we iteratively adjust the intensity of the added noise to effectively amplify its feature distribution divergence while rigorously preserving the recognizability of the sample’s original label, ultimately yielding highly optimized adversarial noise. Finally, this iterated noise, along with a pre-defined trigger, is embedded into the chosen training samples to construct poisoned samples, which are then utilized for model training. Experimental results unequivocally demonstrate that, compared to existing techniques, our proposed method significantly enhances the attack success rate by 0.88% to 13.99%, while maintaining nearly identical classification accuracy on benign samples. This conclusively validates the superior performance of our approach.

In response to the limitations of traditional fuzzing approaches that rely on static mutators and fail to dynamically adjust their test case mutations for deeper testing, resulting in the inability to generate targeted inputs to trigger vulnerabilities, this paper proposes a directed fuzzing methodology termed DocFuzz, which is predicated on a feedback mechanism mutator. Initially, a sanitizer is used to target the source code of the tested program and stake in code blocks that may have vulnerabilities. After this, a taint tracking module is used to associate the target code block with the bytes in the test case, forming a high‐value byte set. Then, the reinforcement learning mutator of DocFuzz is used to mutate the high‐value byte set, generating well‐structured inputs that can cover the target code blocks. Finally, utilizing the feedback mechanism of DocFuzz, when the reinforcement learning mutator converges and ceases to optimize, the fuzzer is rebooted to continue mutating toward directions that are more likely to trigger vulnerabilities. Comparative experiments are conducted on multiple test sets, including LAVA‐M, and the experimental results demonstrate that the proposed DocFuzz methodology surpasses other fuzzing techniques, offering a more precise, rapid, and effective means of detecting vulnerabilities in source code.

The malicious domains generated by domain generation algorithm (DGA) are a threat to network security and the existing DGA domain detection methods commonly represent domain features by scalars, resulting in damage to the feature structure. To cope with the above issues, an improved capsule network for DGA domain detection was proposed. Firstly, the original samples were numerically processed and converted to the domain word vectors. Secondly, we built a n-grams feature extraction network based on residual network to extract domain features. Thirdly, we designed an improved capsule network to classify the domains according to the domain features. The domain features were converted to primary capsules. Finally, an improved dynamic routing algorithm was used to generate high-level capsules, whose lengths were used as auxiliary information for detecting domains. The experimental results show that compared with state-of-the-art methods, our method has remarkable detection performance.

Machine learning technology has achieved excellent results in Android malware detection, however, existing detection methods ignore the frequent changes of API in malware, resulting in their detection performance continuing to decline over time. In this paper, we propose an evolved Android malware detection method (EAMDM). Two components comprise EAMDM: API clustering and malware detection. Before malware detection, we perform API clustering to obtain cluster centers representing the function of each API. we employ Bert to comprehensively extract the semantic information contained in API features such as method name, exception, and permission. Bert generates feature vectors for clustering that represent the similarity of API functions. In malware detection, EAMDM abstracts the API into cluster centers in order to maintain resilience against the frequent changes of API in both malware and Android framework. We evaluate the effectiveness of EAMDM on a dataset of 85K apps developed over seven years. The experimental results show that EAMDM greatly outperforms the existing classic methods and has a significantly slower aging speed.

The domain name features used in the existing domain name detection methods about domain generation algorithm (DGA) are generally easy to evade, which results in some common DGA domain name detection methods failing to effectively detect the DGA domain name. To solve the issues, we propose a DGA domain name detection method based on two-stage feature reinforcement. Firstly, we encode the domain name to obtain the domain name word vector. Secondly, the slice pyramid network (SPN) is used to process the word vector to extract the domain name feature. Thirdly, we reinforce the domain name feature by using the two-stage reinforcement method we proposed. The two-stage reinforcement method reinforces the domain name feature by adding domain name semantic information to the extracted features and reducing feature information redundancy to improve the stability of the domain name feature, meanwhile, we convert the reinforced domain name feature to the primary capsules to reduce feature loss. Finally, we use the dynamic routing algorithm to process the primary capsules to generate digital capsules, and then the digital capsules are used to detect domain names. Experimental results on domain name detection and domain name family classification both show that compared with the state-of-the-art methods, our method has better detection performances.

Aiming at the problems that the sample-based category imbalance methods were prone to the loss of important data and the current software defect prediction methods did not identify defect potential risks based on the dichotomous classification results, a defect risk identification method on the premise of the sample category perception was proposed. Firstly, noise samples, feature distributions, high-dimensional features, and category imbalance of multi-source sample sets were processed to obtain cleaned samples. Then, the category perception and perception coefficients of the cleaned samples were calculated to obtain the category perception product, and the defect risk identification (DRI) model was constructed by the category perception product. Finally, the risk identification probabilities were calculated using the DRI model to identify potential risks. The experimental results show that the proposed method performs well with accuracy, F1-score, and Matthews correlation coefficient. The obtained risk identification probabilities and defect risk levels are consistent with the actual situation of real samples, which can accurately reflect the severity of defects and identify potential risks.

Aiming at the fact that the existing source code vulnerability detection methods did not explicitly maintain the semantic information related to the vulnerability in the source code, which made it difficult for the vulnerability detection model to extract the vulnerability sentence features and had a high detection false positive rate, a source code vulnerability detection method based on the vulnerability dependency graph is proposed. Firstly, the candidate vulnerability sentences of the function were matched, and the vulnerability dependency representation graph corresponding to the function was generated by analyzing the multi-layer control dependencies and data dependencies of the candidate vulnerability sentences. Secondly, abstracted the function name and variable name of the code sentences node and generated the initial representation vector of the code sentence nodes in the vulnerability dependency representation graph. Finally, the source code vulnerability detection model based on the heterogeneous graph transformer was used to learn the context information of the code sentence nodes in the vulnerability dependency representation graph. In this paper, the proposed method was verified on three datasets. The experimental results show that the proposed method have better performance in source code vulnerability detection, and the recall rate is increased by 1.50%~22.27%, and the F1 score is increased by 1.86%~16.69%, which is better than the existing methods.

This paper introduces a malware detection method based on the reorganisation of API instruction sequence and image representation in an effort to address the challenges posed by current methods of malware detection in terms of feature extraction and detection accuracy. In the first step, APIs of the same type are grouped into an API block. Each API block is reorganised according to the first invocation order of each type of API. As a measure of the API's devotion to the software sample, the number of API block entries is recorded. Second, the API codes, API devotions, and API sequential indexes are extracted based on the reorganised API instruction sequence to generate the feature image. The feature image is then fed into the self-built lightweight malware feature image convolution neural network. The experimental results indicate that the detection accuracy of this method is 98.66% and that it has high performance indicators and detection speed for malware detection.

The existing botnet detection methods have the problems of uneven sampling, poor feature selection, and weak generalization ability, resulting in low detection and classification results and poor adaptability to the internet of things (IoT) environment with limited computing and storage resources. This paper proposes an IoT botnet detection method using feature reconstruction and interval optimization to solve the above problems. Through the designed address triple and time window-based IP aggregation and feature reconstruction method (ATTW-IP-FR), the network traffic samples obtained from the IoT gateway are integrated, and the flow features are reconstructed to attain the reconstructed sample set. The proposed self-corrected hybrid weighted sampling algorithm balances the normal and botnet flow samples in the reconstructed sample set to get the resampling sample set. The introduced multiattribute decision-making and adjacency relation chain-based sequential forward selection algorithm is applied to eliminate the redundant features in the resampling sample set, and the optimal feature subset is obtained. The resampling sample set filtered by the optimal feature subset is detected and classified through the designed two-stage hybrid heterogeneous model optimized by the intermittent chaos and bald eagle search algorithm-based interval optimization algorithm. The experimental results show that the proposed method effectively detects the botnet in two real IoT scenarios. The detection accuracy is 99.17 % $ \% $ , the Matthews correlation coefficient is 98.35 % $ \% $ , the false positive rate is 0.25 % $ \% $ , and the false negative rate is 1.27 % $ \% $ , which are better than the existing methods. This method can effectively reduce sampling and feature selection time and space overhead and better adapt to the resource-constrained IoT environment.

To solve the problems that existing network security situation assessment (NSSA) methods are difficult to extract features and have poor timeliness, an NSSA method with network attack behavior classification (NABC) is proposed. First, an NABC model is designed. The model combines features and advantages of a parallel feature extraction network (PFEN), a bidirectional gate recurrent unit (BiGRU), and the attention mechanism (ATT). The PFEN module is composed of parallel sparse autoencoders which extract key data from different network attack behaviors. The BiGRU module gets the time-series relationship from the state of three different time periods, finds potential representation rules from network attack behaviors. The ATT module pays more attention to the network traffic key information and improves the NABC accuracy. Second, the NABC detects and classifies attacks from network behaviors, the occurrence number of each attack behavior, and the error probability matrix are counted. Finally, the occurrence number of each attack behavior is corrected according to the error probability matrix, and the network security situation value is calculated through combining the severity factor of each attack behavior. The experimental results show that the precision and recall of the NABC model are improved by 5.28% and 5.65%, respectively, compared with the conventional method. The comparison experiment with the classical situation assessment method also proves that the proposed method can assess the overall situation of network security more effectively and comprehensively.

This paper investigates the problem of the existing information system security situation assessment models that are less concerned about fuzzy factors and lack of reasoning. First, Pythagorean fuzzy sets are adopted to deal with the ambiguity and uncertainty of the civil aviation airport security inspection information system security situation indicators, and a Pythagorean fuzzy Petri nets (PFPNs) model is established according to the indicator system. Then, based on the characteristics of PFPN, the propositions credibility reasoning algorithm and the security situation fuzzy reasoning algorithm are designed. Finally, the feasibility of the model is verified through the assessment experiment on the security inspection information system of a civil aviation airport. The experimental results show that the PFPN model has better stability and lower algorithm time complexity compared with other models.

Based on the research of business continuity and information security of the Internet of Things (IoT), a key business node identification model for the Internet of Things security is proposed. First, the business nodes are obtained based on the business process, and the importance decision matrix of business nodes is constructed by quantifying the evaluation attributes of nodes. Second, the attribute weights are improved by the analytic hierarchy process (AHP) and entropy weighting method from subjective and objective dimensions to form the combination weight decision matrix, and the analytic hierarchy process and entropy weighting VIKOR (AE-VIKOR) method are used to calculate the business node importance coefficient to identify the key nodes. Finally, according to the NSL-KDD dataset, the network security events of IoT network intrusion detection based on machine learning are monitored purposefully, and after the information security event occurs in the smart mobile phone, which impacts through IoT on the business system, the impact of the key business node on business continuity is analyzed, and the business continuity risk value is calculated to evaluate the business risk to prove the effectiveness of the model. The experimental results of the civil aviation departure business show that the AE-VIKOR method can effectively identify key business node, and the impact of the key business node on business continuity is analyzed, which further proves the efficiency and accuracy of the model in identifying the key business node.

With the wide application of network technology, the Internet of Things (IoT) systems are facing the increasingly serious situation of network threats; the network threat situation assessment becomes an important approach to solve these problems. Aiming at the traditional methods based on data category tag that has high modeling cost and low efficiency in the network threat situation assessment, this paper proposes a network threat situation assessment model based on unsupervised learning for IoT. Firstly, we combine the encoder of variational autoencoder (VAE) and the discriminator of generative adversarial networks (GAN) to form the V-G network. Then, we obtain the reconstruction error of each layer network by training the network collection layer of the V-G network with normal network traffic. Besides, we conduct the reconstruction error learning by the 3-layer variational autoencoder of the output layer and calculate the abnormal threshold of the training. Moreover, we carry out the group threat testing with the test dataset containing abnormal network traffic and calculate the threat probability of each test group. Finally, we obtain the threat situation value (TSV) according to the threat probability and the threat impact. The simulation results show that, compared with the other methods, this proposed method can evaluate the overall situation of network security threat more intuitively and has a stronger characterization ability for network threats.

The accuracy of the existing security situation assessment model of information system for smart mobile devices is affected by expert evaluation preferences. This paper proposes an information system security situation assessment model for smart mobile devices, which is based on the modified interval matrix-entropy weight-based cloud (MIMEC). According to the security situation assessment index system, the interval judgment matrix reflecting the relative importance of different indexes is modified to improve the objectivity of the index layer weight vector. Then, the entropy weight-based cloud is used to quantify the criterion layer and the target layer security situation index, and the security level of the system is graded. The evaluation experiment on the departure control system for smart mobile devices not only verify the validity of this model but also demonstrate that this model has higher stability and reliability than other models.