Provenance-based threat hunting identifies Advanced Persistent Threats (APTs) on endpoints by correlating attack patterns described in Cyber Threat Intelligence (CTI) with provenance graphs derived from system audit logs. A fundamental challenge in this paradigm lies in the modality gap —the structural and semantic disconnect between provenance graphs and CTI reports. Prior work addresses this by framing threat hunting as a graph matching task: 1) extracting attack graphs from CTI reports, and 2) aligning them with provenance graphs. However, this pipeline incurs severe information loss during graph extraction and demands intensive manual curation, undermining scalability and effectiveness.

Abstract In recent years, Living off the Land (LotL) attacks have been drawing attention due to their flexibility and difficulty in detection. These attacks exploit legitimate tools already in the system to conduct malicious activities, hiding their malicious intent behind normal benign programs. However, detection methods for such attacks largely rely on expert rules. While rule tags can effectively detect known attacks, this also leads to a high false positive rate, resulting in low detection accuracy for the models. To address these issues, we propose a detection system called LOTLDetector, which combines deep learning methods with expert rules to detect malicious command lines in LotL attacks from both data and knowledge perspectives. LOTLDetector learns the semantics of command line text through neural networks and combines rule tags from expert knowledge, enabling a more comprehensive detection of LotL attacks. We extensively evaluated our method, validated it on a Windows dataset containing 27,448 command lines and a Linux dataset containing 27,093 command lines, and compared it with existing methods. The results show that our method significantly outperforms existing methods in detecting malicious command lines. For the Linux dataset, the detection system achieved a detection performance with an accuracy of 0.9728; for the Windows dataset, the system’s detection accuracy also reached 0.9598, which is about 8% higher than the best existing method. In addition, our project has been open-sourced at https://github.com/csedikaf/LOTLDetector .

Federated recommendation systems (FedRecs) enable multiple clients to collaboratively train recommendation models without directly sharing private user data, providing a promising solution for privacy protection. However, recent studies reveal that the collaborative mechanism in FedRecs still faces serious privacy leakage risks. To systematically assess these vulnerabilities, this article proposes CiCo-MIA, aCausalinference-basedCollaborativeMembershipInferenceAttack designed to quantify the privacy risks of FedRecs through a shadow recommendation model. CiCo-MIA utilizes interaction data from multiple clients to train a shadow model that mirrors the behavior of the target FedRecs. By constructing a causal graph and introducing counterfactual reasoning, we develop a user–item impact elimination module that enhances the robustness and interpretability of the attack. Additionally, a dynamic aggregation strategy is proposed to balance attack effectiveness and recommendation performance. Extensive experiments on six real-world datasets under two FedRec frameworks demonstrate that CiCo-MIA achieves state-of-the-art performance, improving F1 scores by about 20% and HR@10 by at least 20% compared with baseline attacks. Even under effective defense mechanisms such as local differential privacy, the attack remains effective, maintaining around 30% of its original performance. These results highlight that FedRecs are still vulnerable to collaborative inference attacks, emphasizing the urgent need for stronger privacy-preserving defenses.

Advanced Persistent Threats (APTs) commonly manifest through a sequence of attack steps, known as Tactics, Techniques, and Procedures (TTPs). Recent studies identify TTPs by converting audit logs into causal provenance graphs and applying expert-driven mappings that correlate low-level system events with high-level TTP patterns. However, these methods face persistent challenges: determining the impact boundaries of TTP activities, adapting to evolving TTP stacks, and recognizing fine-grained TTP semantics for deeper forensic insights. To address these challenges, we presentZoomer, a novel TTP recognition framework that segments provenance graphs into multiple TTP subgraphs with multi-granular annotations (i.e., tactics, techniques, and sub-techniques). First, we devise a heuristic subgraph sampling algorithm guided by anomalous node detection to precisely delineate the scope of TTP activities. Second, we introduce a dual-tower Deep & Wide architecture that integrates contextual behavior semantics from provenance graphs and domain-informed features to learn expressive TTP representations. Finally, we adopt a prototypical network that reformulates TTP recognition as a few-shot pattern matching task, thereby enhancing adaptability and accuracy under limited supervision. To advance future research, we built and released the first TTP-annotated provenance dataset, encompassing the most comprehensive collection of TTP instances to date. Extensive experiments show thatZoomerachieves TTP recognition with 88% accuracy at the sub-technique level and 94% at the tactic level, significantly outperforming state-of-the-art baselines.

As Advanced Persistent Threats (APTs) become more complex and destructive, attack investigation has gained importance. Analysts use provenance graphs for causality analysis on Point-Of-Interest (POI) events to capture critical events. However, existing methods suffer from problems of high false positives, high overhead, and high latency due to the vast size of the provenance graph and the rarity of critical events. We proposeSPARSEfor constructing critical component graphs (i.e., consisting of critical events) from streaming logs in real time. Our approach is based on two key observations: 1) Critical events exist in suspicious semantic graphs (SSGs) composed of interaction flows between suspicious entities, and 2) Information flows accomplishing the attacker's goal exist as paths.SPARSEuses a two-stage framework that first constructs the SSG using a state-based mode with semantic transfer rules and storage strategies. Then, it identifies suspicious flow paths (SFPs) related to the POI event and quantifies each path's influence to filter irrelevant events. Evaluation on a large-scale attack dataset shows our system generates a critical component graph ($\sim$113 edges) in 1.6 seconds, which is 2014 × smaller than the backtracking graph ($\sim$227,589 edges). It is also 25 × more effective in filtering irrelevant edges compared to other state-of-the-art techniques.

The evolution of Internet of Vehicles (IoV) technologies, encompassing wireless communications and Artificial Intelligence (AI), has advanced the collaborative “Pedestrian-Vehicle-Road-Cloud” IoV edge services, enhancing road efficiency and driving safety. Operating in an open-edge environment with vast sensory data, IoV faces significant privacy risks from unauthorized access and data breaches. Consequently, privacy-preserving computation (PPC) is crucial for secure IoV services. This paper reviews PPC techniques in IoV edge services, exploring network characteristics and potential privacy attacks. It categorizes and evaluates techniques such as differential privacy, homomorphic encryption, and secure multi-party computation based on data security, utility, and overhead. Summarizing their pros and cons, the challenges and future research directions for IoV edge services are outlined.

With the widespread adoption of microservice architectures, the security threats they face have become increasingly sophisticated. Existing anomaly detection methods based on system calls exhibit significant limitations in three key aspects: multidimensional data fusion, temporal causality modeling, and forensic analysis of anomalies. This paper proposes MADGuard, a provenance graph-based anomaly detection system for microservices. MADGuard addresses these challenges through three key innovations: (1) It constructs a native provenance graph by integrating multisource services and multidimensional data, employing feature hashing and positional encoding for efficient graph representation; (2) The system introduces a Temporal Graph Network (TGN) model combined with edge reconstruction error and Inverse Document Frequency (IDF) weighting, achieving a 15. 07% improvement in the F1 score compared to existing methods; (3) For the first time in microservice security, an integrated forensic analysis module is implemented, allowing rapid anomaly path reconstruction through aggregated anomaly subgraphs. Comprehensive evaluations on typical microservice benchmarks (TeaStore, RobotShop, SockShop) demonstrate MADGuard’s superior performance: 94.08% detection accuracy, significantly outperforming state-of-the-art approaches while maintaining practical operational efficiency.

DevOps enhances software production through IT automation, continuous integration, and deployment, with Docker as a key tool that packages applications and their environments into standardized images for consistent and efficient deployment. Dockerfiles, which are text-based configuration files, define the composition and runtime actions of these images. Mismanagement of dependencies between Dockerfile instructions can cause build failures, highlighting the need for accurate dependency parsing. Current methods often miss implicit dependencies due to the complex syntax and logic of Dockerfile instructions. To address this, we propose DockInsight, a novel tool that uses a rule-based approach and semantic analysis to determine Dockerfile dependencies accurately. DockInsight features a unified feature structure representation, DVector, and a dependency type table to facilitate precise dependency determination. Evaluations demonstrate that DockInsight achieves 99.44% accuracy, significantly outperforming keyword matching and large language model methods by 64.84% and 55.74%, respectively. Additionally, DockInsight maintains stable processing times across various Dockerfile lengths, proving its efficiency and scalability. Our ablation study further highlights the importance of semantic information supplementation, particularly for RUN instructions, in enhancing accuracy. DockInsight’s robust performance makes it a valuable tool for developers and DevOps engineers, contributing to more reliable and maintainable Dockerfiles.

An electrocardiogram (ECG) is a crucial noninvasive medical diagnostic method that enables real-time monitoring of the electrical activity of the heart. ECGs hold a significant position in the rapid diagnosis and routine monitoring of cardiac diseases due to their user-friendly operation, prompt detection, broad range of diagnosable problems, and cost-effectiveness. However, thorough comprehension of ECG readings requires a high level of medical expertise due to the complex variations in ECG patterns, substantial interindividual differences, and numerous interfering factors. Consequently, current ECG machines and ECG Holters typically provide simplistic indications of ECG anomalies. Nonetheless, current ECG anomaly detection (EAD) algorithms lack precision; therefore, these medical devices cannot accurately report the specific types of diseases reflected in ECG results. In response to these challenges, this paper proposes enhancing the accuracy of electrocardiogram detection by improving algorithms. Therefore, we propose SAPTSTA-AnoECG, a PatchTST-based ECG anomaly detection method with subtractive attention and data augmentation. This method introduces a subtractive attention mechanism to make the Transformer architecture more suitable for time series data. We also use data augmentation to increase the robustness of the model. In addition, a patch-based approach is employed to reduce the algorithm’s computational complexity of the model. Furthermore, we introduce a new publicly available ECG dataset named HCE in this paper and conduct comparative experiments using this dataset along with the PTB-XL and CPSC 2018 datasets. The experimental results demonstrate the effectiveness of this method.

Network intrusion detection (NID) plays a crucial role in cybersecurity by identifying network attacks from network traffic. In recent years, the deep learning technique has become a tendency for the NID problem. However, a major drawback of deep learning is the lack of interpretability, making NID systems (NIDSs) difficult to diagnose and response to the detected network attacks. At the same time, the existing interpretable deep learning techniques cannot adapt to the NID problem due to its specific challenges, including the cross‐feature effect and the absence of self‐interpretable features. To this end, this article proposes a decision Tree enhanced deep Attention Network (TAN), an interpretable deep learning model specifically designed for the NID problem by integrating a decision tree (DT) into a deep attention network. TAN utilizes a DT to extract self‐interpretable features and then uses a deep hierarchical attention network to capture the cross‐feature effect and pinpoint the most important self‐interpretable features. A series of experiments and case studies were performed on public datasets, including KDD99, NSL‐KDD, UNSW‐NB15, and CICIDS2017. The results indicate that TAN achieves competitive detection performance compared to existing deep learning models, while offering a more intuitive interpretation.

HID (host intrusion detection) is a security mechanism for detecting malicious activities performed in a host (e.g., a server, an edge device). Recent research has recast HID as a provenance graph learning problem thanks to the advancement in deep learning techniques, especially the GNNs (graph neural networks). Although the provenance graph learning based HID methods show promise, they are vulnerable to adversarial attacks, where the attackers can bypass the HID models by carefully modifying their attack behaviors. In this paper, we reveal that an adversarial sample generated against one HID model may not be necessarily able to attack another HID model, and we further explore the success rate of adversarial attacks between different HID models by evaluating the mutual transferability. Based on the evaluation, we propose ProvADShield, a framework designed to defend against adversarial attacks on provenance graph learning based HID models. The core idea of ProvADShield is to combine multiple HID models by leveraging the mutual transferability. We evaluate ProvADShield based on a provenance dataset collected and made public by our team. The experiment results show that ProvADShield outperforms state‐of‐the‐art defense systems against adversarial attacks.

Open source software has evolved into a fundamental element of the contemporary information sector; however, security threats within its supply chain are persistently rising. Within the collaborative development framework of open source, the introduction of malicious code can lead to significant security vulnerabilities. Conventional methods for detecting these vulnerabilities, which rely on machine learning, face challenges such as a lack of sufficient datasets, inadequate deep semantic understanding, and limitations to single-vulnerability detection. To address these challenges, we introduce a novel approach named VulnTrace, which analyzes historical records of submissions in open source projects to construct a high-quality dataset of vulnerabilities with accurate labels. VulnTrace employs Word2Vec alongside Abstract Syntax Tree (AST) technologies to capture both the semantic and structural details of code segments and utilizes a Transformer model for precise vulnerability identification, thereby enhancing accuracy and interpretability in detection. Experimental results indicate that VulnTrace achieves approximately 93% accuracy, 95% precision, 83% recall and an F1 score of 88% in vulnerability detection tasks, significantly reducing false positives and demonstrating remarkable robustness.

Mobile device user authentication technologies have been studied for decades in the context of personal information security. To strike a balance between security, privacy, and usability, authentication methods based on motion sensors have gained widespread attention in recent years. However, these methods still face several challenges, such as the limited training samples, the finite scene coverage, and the high-cost models. Therefore, there is an urgent need to develop more efficient and reliable solutions to enhance the user experience. To address these challenges, we introduce, which offers the following features: 1) It uses a novel data augmentation method (AUTHGANS) to expand the dataset. 2) It employs a differential attention mechanism to reduce noise interference, improve model scene coverage, and simultaneously reduce the model size during the model training phase, and improve the model’s accuracy. 3) It uses a model distillation strategy (AuthFusion), ensuring high accuracy while reducing the model’s computational requirements on devices. Experiments on a dataset with 1,513 users and noise show that achieves high accuracy while requiring less computational power than other state-of-the-art authentication methods.

Hardware Trojans (HTs) present significant security threats to integrated circuits. Detecting and locating HTs is crucial for mitigating these threats. Thus, this article proposes a method called HTs-GCN, which utilizes a graph convolutional network (GCN) to identify HTs. First, it extracts two novel features of gate nodes using a depth-first search strategy and topological logical analysis to enrich the feature information of circuit nodes. Second, through a message-passing mechanism, it designs a local feature aggregation method based on the GCN and a global feature fusion method based on an attention mechanism to improve the representation capability of circuit node features. Then, leveraging the concept of stochastic gradient descent and incorporating mini-batch oversampling and under-sampling techniques, it employs a dataset imbalance handling method to address the scarcity of HT nodes in circuits. These approaches significantly enhance the distinguishability between gate nodes with HTs and other gate nodes while reducing computational complexity. Experimental results indicate that HTs-GCN outperforms the recently proposed NHTD-GL method in terms of recall: it achieves approximately 7.8% points higher recall while maintaining similar accuracy. HTs-GCN demonstrates exceptional generalizability, with an average recall and accuracy of 93.0% and 100%, respectively, on infrequently used circuits in the Trust-Hub benchmark. In addition, on the TRIT-TC benchmark, HTs-GCN achieves excellent average true positive rate (TPR) and true negative rate (TNR) of 95.1% and 94.4%, respectively. Furthermore, HTs-GCN exhibits robust performance under gate modification attacks, with average TPR and TNR reaching 82.1% and 92.5%, respectively.

Cyber Threat Intelligence (CTI) reports are factual records compiled by security analysts through their observations of threat events or their own practical experience with attacks. In order to utilize CTI reports for attack detection, existing methods have attempted to map the content of reports onto system-level attack provenance graphs to clearly depict attack procedures. However, existing studies on constructing graphs from CTI reports suffer from problems such as weak Natural Language Processing (NLP) capabilities, discrete and fragmented graphs, and insufficient attack semantic representation. Therefore, we propose a system called CRUcialG for the automated reconstruction of Attack Scenario Graphs (ASGs) by CTI reports. First, we use NLP models to extract systematic attack knowledge from CTI reports to form preliminary ASGs. Then, we propose a four-phase attack rationality validation framework from the tactical phase with attack procedure to evaluate the reasonability of ASGs. Finally, we implement the relation repair and phase supplement of ASGs by adopting a serialized graph generation model. We collect a total of 10,607 CTI reports and generate 5,761 complete ASGs. Experimental results on CTI reports from 30 security vendors and DARPA show that the similarity of ASG reconstruction by CRUcialG can reach 84.54%. Compared with SOTA (EXTRACTOR and AttackG), the recall of CRUcialG (extraction of real attack events) can reach 88.13% and 94.46% respectively, which is 40% higher than SOTA on average. The F1-score of attack phase validation is able to reach 90.04%.

Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false positives. In order not to affect normal operations, analysts need to investigate and filter detection results before taking countermeasures, in which heavy manual labor and alarm fatigue cause analysts miss optimal response time, thereby leading to information leakage and destruction. Therefore, we propose Endpoint Forecasting and Interpreting (EFI), a real-time attack forecast and interpretation system, which can automatically predict next move during post-exploitation and explain it in technique-level, then dispatch strategies to EDR for advance reinforcement. First, we use Cyber Threat Intelligence (CTI) reports to extract the attack scene graph (ASG) that can be mapped to low-level system logs to strengthen attack samples. Second, we build a serialized graph forecast model, which is combined with the attack provenance graph (APG) provided by EDR to generate an attack forecast graph (AFG) to predict the next move. Finally, we utilize the attack template graph (ATG) andgraph alignment plus algorithmfor technique-level interpretation to automatically dispatch strategies for EDR to reinforce system in advance. EFI can avoid the impact of existing EDR false positives, and can reduce the attack surface of system without affecting the normal operations. We collect a total of 3,484 CTI reports, generate 1,429 ASGs, label 8,000 sentences, tag 10,451 entities, and construct 256 ATGs. Experimental results on both DARPA Engagement and large scale CTI dataset show that the alignment score between the AFG predicted by EFI and the real attack graph is able to exceed 0.8, the forecast and interpretation precision of EFI can reach 91.8%.

Detecting advanced persistent threats (APTs) at a host via data provenance has emerged as a valuable yet challenging task. Compared with attack rule matching, machine learning approaches offer new perspectives for efficiently detecting attacks by leveraging their inherent ability to autonomously learn from data and adapt to dynamic environments. However, the scarcity of APT samples poses a significant limitation, rendering supervised learning methods that have demonstrated remarkable capabilities in other domains (e.g., malware detection) impractical. Therefore, we propose a system called TAGAPT, which is able to automatically generate numerous APT samples with provenance-level granularity. First, we introduce a deep graph generation model to generalize various graph structures that represent new attack patterns. Second, we propose an attack stage division algorithm to divide each generated graph structure into stage subgraphs. Finally, we design a genetic algorithm to find the optimal attack technique explanation for each subgraph and obtain fully instantiated APT samples. Experimental results demonstrate that TAGAPT can learn from existing attack patterns and generalize to novel attack patterns. Furthermore, the generated APT samples 1) exhibit the ability to help with efficient threat hunting and 2) provide additional assistance to the state-of-the-art (SOTA) attack detection system (Kairos) by filtering out 73% of the observed false positives. We have open-sourced the code and the generated samples to support the development of the security community.

As the scope and impact of cyber threats have expanded, analysts utilize provenance graphs constructed from kernel logs to hunt for threats and investigate attacks. The high frequency of kernel events and the persistence of attacks pose challenges for the efficient storage of provenance graphs. Current approaches can be categorized into two types: pruning-based storage (e.g., LogGC, CPR, and NodeMerge) and encoding-based storage (e.g., DeepZip, SLEUTH, ELISE, and Leonard). However, none of these methods simultaneously satisfy the following three requirements: 1) lossless content, 2) storage efficiency, and 3) query support. To address this gap, we proposeDehydrator, an efficient provenance graph storage system that fulfills all these requirements. For the logs generated by auditing frameworks,Dehydratoruses field mapping encoding to filter field-level redundancy, hierarchical encoding to filter structure-level redundancy, and finally learns a deep neural network to support batch querying. We have conducted evaluations on seven datasets totaling over one billion log entries. Experimental results show thatDehydratorreduces the storage space by 84.55%.Dehydratoris$7.36\times $more efficient than PostgreSQL,$7.16\times $than Neo4j, and$16.17\times $than Leonard (the work most closely related toDehydrator, published at Usenix Security’23).

Intelligent parking recommendations are essential for enhancing parking space utilization and alleviating traffic congestion. Current parking recommendation systems are mostly based on collecting a large amount of raw parking-related data. However, this often imposes a significant communication and computing burden on resource-constrained edge vehicles and roadside facilities, resulting in high communication overhead, latency, and particularly privacy risks. In this article, a lightweight privacy-aware edge intelligent parking recommendation scheme (FuzzyTop) is proposed. Raw parking data is converted into fuzzy information on the edge sides using intuitionistic fuzzy sets (IFSs), and then a fuzzy multiattribute ranking algorithm is devised to determine the top$k$optimal parking lots for drivers. We evaluated our scheme using real-world data sets collected from Hangzhou and Shanghai in China. The experimental results show that the FuzzyTop algorithms outperform the state-of-the-art benchmarks in terms of data transmission, accuracy, and real-time performance.

APT (Advanced Persistent Threat) with the characteristics of persistence, stealth, and diversity is one of the greatest threats against cyber-infrastructure. As a countermeasure, existing studies leverage provenance graphs to capture the complex relations between system entities in a host for effective APT detection. In addition to detecting single attack events as most existing work does, understanding the tactics / techniques (e.g., Kill-Chain, ATT&CK) applied to organize and accomplish the APT attack campaign is also important for security operations. Existing studies try to manually design a set of rules to map low-level system events to high-level APT tactics / techniques. However, the rule based methods are coarse-grained and lack generalization ability. Thus, they can only recognize APT tactics and have difficulty in identifying APT techniques. They also cannot adapt to mutant behaviors of existing APT tactics / techniques.

As an integral component of the Advanced Driver Assistance System (ADAS), intelligent car following plays a vital role in decreasing the accident rate on hazardous roads. Existing car-following methods have issues such as undesired real-time performance and privacy protection. To this end, this paper proposes a privacy-aware fuzzy prediction of the front car braking and fuzzy decision-making of the rear car braking based on dynamic uncertain traffic conditions. Sensitive data, such as location and speed, are transformed into fuzzy information before transmission. This information is then utilized to predict the braking behavior of the front vehicle. Fuzzy rules are developed to facilitate real-time car-following decisions in a lightweight manner. Extensive experimental results show that the overall prediction accuracy of fuzzyFollow reaches 90.4%, outperforming the state-of-the-art work. The proposed scheme outperforms the compared counterparts in terms of communication cost, real-time performance, and privacy protection.

The collaborative model of open-source software (OSS) development significantly enhances efficiency and fosters innovation by enabling diverse global contributors to collaborate seamlessly.Core contributors, who provide the majority of code commits, are crucial for maintaining project direction, quality, and momentum.Despite their importance, there is limited research on the dynamics and prediction of changes in core contributors over time, which is essential for sustaining project growth and stability.To bridge this gap, we introduce CoreCast, an innovative predictive model designed to forecast future core contributor numbers using comprehensive project data.By analyzing multidimensional metrics from high-quality OSS projects, CoreCast trains models that outperform traditional methods, achieving a mean absolute error (MAE) of 0.7866.Our findings reveal seven significant growth trends that are crucial for understanding and sustaining OSS project development.All data and scripts are open-sourced, providing valuable resources for future research and further advancements in the field.

Abstract Smart contracts have significant losses due to various types of vulnerabilities. However, traditional vulnerability detection methods rely extensively on expert rules, resulting in low detection accuracy and poor adaptability to novel attacks. To address these problems, in this paper, deep learning methods are combined with smart contract vulnerability code detection approaches. Abstract syntax trees (ASTs), which are special isomorphic graph structures, are an important bridge between source code and graph neural networks. By learning the AST, the model can understand the semantics of the source code. Moreover, graph neural networks have an increasing ability to address complex heterogeneous graphs. Therefore, control flow graphs are fused with data flow graphs on the basis of the ASTs to build heterogeneous graphs with richer code semantics. Furthermore, multigranularity analysis of the vulnerability detection results is performed, including coarse-grained contract-level vulnerability detection and fine-grained line-level vulnerability detection. Through this multigranularity detection approach, vulnerabilities in contracts can be identified and analysed more comprehensively, providing a richer perspective and more solutions for vulnerability detection. The experimental results show that the proposed multigranularity vulnerability detection method based on heterogeneous graphs (MVD-HG) improves both the accuracy and range of the detected vulnerability types in contract-level vulnerability detection tasks; moreover, in the line-level vulnerability detection task, the MVD-HG model achieves significant results and addresses the shortcomings of existing methods. In addition, based on code generation methods used in related fields, a data enhancement method based on the source code is developed, which effectively expands the experimental dataset to address the reduced credibility of the results due to insufficient amounts of data.

The authentication technology of mobile device users has been studied for decades. To balance security, privacy, and usability, motion sensors-based user authentication methods are widely investigated in recent years. However, existing studies meet the problems such as scarcity of training samples, underutilization of data, poor de-noising ability, insufficient transferability, privacy leakage, and low accuracy. To overcome these difficulties, we propose a system, calledTrapCog, with the following capabilities: 1) In the phase of data collection,TrapCogcan eliminate man-made noise (mislabeling) through differential training based on down-sampling. 2) In the model training stage, the siamese neural network with Long Short-Term Memory (LSTM) as the sub-network is used to achieve sufficient coverage of sample patterns and the transferability of the model. 3) In the phase of real-world authentication, the privacy of the user is tremendously protected through end-side model deployment and local authentication. Experimental results on a dataset composed of 1,513 users with real-world noise show thatTrapCoghas high accuracy and strong transferability, which is much better than state-of-the-art studies.

Vehicular trajectory data can be widely used in applications such as traffic prediction and congestion control. However vehicular trajectory data is voluminous and requires significant storage and processing resources, which contradicts the resources-constraint vehicular networks. Existing compression methods suffer either low compression effects or privacy leakage. A privacy-aware Trajectory Compression scheme based on Fuzzy markovian Prediction (TCFP) is proposed in this paper, which consists of two steps of fuzzy compression. The first-step compression is achieved by converting the raw trajectory data into fuzzy information on the edge vehicle sides. Further compression is performed at edge RSUs through fuzzy multi-order Markovian prediction combined with new-devised fuzzy deviation filtering rules. Extensive experimental evaluation based on real-world data sets demonstrates the proposed TCFP scheme achieves desired QoS performance in terms of compression rate, compression time and information loss.

Vehicular Ad Hoc Networks (VANETs) hold the opportunity to help improve safe driving and road efficiency. There are great uncertainty and unpredictability in VANETs due to rapid vehicle movement and changeable road conditions, which makes designing a Quality of Service (QoS) aware data forwarding protocol for VANETs remain a significant challenge. In this paper, A novel fuzzy decision based data forwarding scheme is proposed to meet the QoS requirements of high reliability and low latency. Unlike the existing routing methods, fuzzy information instead of raw vehicular data is used for data forwarding decisions. Besides, fuzzy decision strategies based on fuzzy non-dominate optimization and fuzzy rules are devised for selecting roads at junctions and determining relay vehicles at edge vehicles. Experimental results show that our fuzzy forwarding scheme achieves desirable QoS performance in terms of packet arrival rate, end-to-end delay and communication overhead.

Advanced Persistent Threat (APT) attacks have caused massive financial loss worldwide. Researchers thereby have proposed a series of solutions to detect APT attacks, such as dynamic/static code analysis, traffic detection, sandbox technology, endpoint detection and response (EDR), etc. However, existing defenses are failed to accurately and effectively defend against the current APT attacks that exhibit strong persistent, stealthy, diverse and dynamic characteristics due to the weak data source integrity, large data processing overhead and poor real-time performance in the process of real-world scenarios. To overcome these difficulties, in this paper we propose APTSHIELD, a stable, efficient and real-time APT detection system for Linux hosts. In the aspect of data collection, audit is selected to stably collect kernel data of the operating system so as to carry out a complete portrait of the attack based on comprehensive analysis and comparison of existing logging tools; In the aspect of data processing, redundant semantics skipping and non-viable node pruning are adopted to reduce the amount of data, so as to reduce the overhead of the detection system; In the aspect of attack detection, an APT attack detection framework based on ATT&CK model is designed to carry out real-time attack response and alarm through the transfer and aggregation of labels. Experimental results on both laboratory and Darpa Engagement show that our system can effectively detect web vulnerability attacks, file-less attacks and remote access trojan attacks, and has a low false positive rate, which adds far more value than the existing frontier work.

Subspace clustering has attracted much attention because of its ability to group unlabeled high-dimensional data into multiple subspaces. Existing graph-based subspace clustering methods focus on either the sparsity of data affinity or the low rank of data affinity. Thus, the quality of data affinity plays an essential role in the performance of subspace clustering. However, the real-world data are generally high-dimensional, complex, and heterogeneous multi-source data, so that the data affinity learned by these methods cannot be completely dependent. Moreover, since these approaches always ignore the intrinsic structure of data, their grouping effect is relatively low. In this paper, we propose a novel unsupervised algorithm, called Structure-Aware Subspace Clustering (SASC), to address the above issues. SASC considers local and global correlation structures simultaneously to capture the intrinsic structure. Further, it integrates the captured structure into representation learning to gain a relatively precise data affinity. It is powerful to promote an all-around grouping effect and enhances the robustness and applicability of subspace clustering. Experiments on various benchmark datasets, including bioinformatics, handwritten digit, object image, and speech signal, demonstrate the effectiveness of the proposed algorithm.

Range query processing is a common edge computing and service in the Internet of things, which can extract user-interest information from distributed edge devices. How to design lightweight privacy-preserving range query processing methods remains a challenging task. Existing secure range query approaches suffer from both high communication cost and long response time, which makes them unsuitable for edge computing over resource-constrained edge devices. In this article, we propose two privacy-aware fuzzy query processing schemes based on fuzzy theory. Linguistic range variables, fuzzy overlap information, and its recovery mechanism are introduced. In addition, two distributed privacy-aware fuzzy range query processing algorithms are devised. Our approaches not only serve for privacy protection, but also aim to provide other optimal performances in terms of reliability, energy efficiency, and real-time response. Theoretical analysis and experimental evaluations based on real-world datasets validated our motivation.

Trajectory prediction for mobile phone users is a cornerstone component to support many higher-level applications in LBSs (Location-Based Services). Most existing methods are designed based on the assumption that the explicit location information of the trajectories is available (e.g., GPS trajectories). However, collecting such kind of trajectories lays a heavy burden on the mobile phones and incurs privacy concerns. In this paper, we study the problem of trajectory prediction based on cell-id trajectories without explicit location information and propose a deep learning framework (called DeepCTP) to solve this problem. Specifically, we use a multi-graph embedding method to learn the latent spatial correlations between cell towers by exploiting handoff patterns. Then, we design a novel spatial-aware loss function for the encoder-decoder network to generate cell-id trajectory predictions. We conducted extensive experiments on real datasets. The experiment results show that DeepCTP outperforms the state-of-the-art cell-id trajectory prediction methods in terms of prediction error.

Mobile authentication is a fundamental factor in the protection of user’s private resources. In recent years, motion sensor-based biometric authentication has been widely used for privacy-preserving. However, it faces with the problems including low data collection efficiency, insufficient authentication scenario coverage rate, weak de-noising ability, and poor robustness of models, rendering existing methods difficult to meet the security, privacy, and usability requirements jointly in the real-world scenario. To overcome these difficulties, we propose a system calledEspialCog, which is able to 1) collect the sensor data embedded in mobile devices self-adaptively, unobtrusively and efficiently through the evolutionary stable participation game mechanism (ESPGM) with a high scenario coverage rate; 2) minimize noise from collected data by analyzing three types of abnormalities; and 3) authenticate the ownership of mobile devices in real-time by adopting optimized LSTM model with an enhanced stochastic gradient descent (SGD) algorithm. The simulation experiment on 6000 users shows that the efficiency and coverage rates increase dramatically by deploying our ESPGM. Moreover, we conduct experiments on a large-scale real-world noisy dataset with 1513 users and two other small pure real-world datasets. The experimental results show the high accuracy and favorable robustness ofEspialCogin the noisy environment.

Drivers always confront parking difficulties when driving on urban roads, especially in crowded downtown or beauty spots. Some of the existing literatures concentrate on multi-consideration optimization for parking decision by collecting the nearby real-time parking-related data. Others provide online parking navigation services through outsourced storage and cloud computing. Massive (raw) data transmission and complex processing are always involved in the existing methods, which results in undesired QoS such as real-time performance and privacy protection. In this paper, we propose a fuzzy skyline parking recommendation scheme for real-time parking recommendation based on roadside traffic facilities. Linguistic parking information instead of raw parking-related data is used in fuzzy skyline fusion. We evaluated our solution with real-world data sets collected from edge parking facilities in Wulin downtown, Hangzhou city, China. The evaluation results show that our approaches achieve an average accuracy of parking recommendation over 91%, low data transmission, and quick response time with privacy protection.

Gait authentication, especially sensor-based patterns, has been studied by researchers for decades. Nowadays, gait authentication has become an important facet of biometric systems due to the so-called unique characteristics of each user. With the development of various technologies (i.e., hardware, data processing, features extraction, and learning algorithms), the performance of sensor-based authentication methods is gradually improving. But we have found that the vulnerability of most existing methods can be compromised easily. In this paper, we propose a novel attack model, called one cycle attack, to bypass existing gait authentication methods. Firstly, the gait sequence is divided into multiple gait cycles. By adopting the K-mean algorithm, we get the average distance of each feature sample (extracted from the gait cycle) to its closest cluster center, and its result confirms that independent individuals may have similar gait cycles. Secondly, using six state-of-the-art models it was found that the adversarial gait cycle found with the clustering method can bypass the victim’s model rapidly. Furthermore, to improve the accuracy of sensor-based gait authentication methods to fight against attacks, we present a WPD-LSTM (Wavelet Packet Decomposition and Long Short-Term Memory) multi-cycle defense model which considers the contextual contents of the neighboring gait cycles in the gait sequence. Experimental results on two datasets (the largest public sensor-based gait database OU-ISIR and new dataset from our laboratory) show that our attack model can bypass most of the victims’ models within a limited number of attempts. Specifically, we can compromise 20%–80% of users within 5 attempts by utilizing imitation. On the contrary, the success rate of attackers has been greatly mitigated by deploying our multi-cycle defense model.

The damage caused by Advanced Persistent Threat (APT) attacks to governments and large enterprises is gradually escalating. Once an attack event is detected, forensic analysis will use the dependencies between system audit logs to rapidly locate intrusion points and determine the impact of the attacks. Due to the high persistence of APT attacks, huge amounts of data will be stored to meet the needs of forensic analysis, which not only brings great storage overhead, but also sharply increases the computing costs. To compact data without affecting forensic analysis, several methods have been proposed. However, in real-world scenarios, we meet the problems of weak cross-platform capability, large data processing overhead, and poor real-time performance, rendering existing data compaction methods difficult to meet the usability and universality requirements jointly. To overcome these difficulties, this paper proposes a general, efficient, and real-time data compaction method at the system log level; it does not involve internal analysis of the program or depend on the specific operating system type, and it includes two strategies: 1) data compaction of maintaining global semantics (GS), which determines and deletes redundant events that do not affect global dependencies, and 2) data compaction based on suspicious semantics (SS). Given that the purpose of forensic analysis is to restore the attack chain, SS performs context analysis on the remaining events from GS and further deletes the parts that are not related to the attack. The results of the real-world experiments show that the compaction ratios of our method to system events are as high as$4.36\times $to$13.18\times $and$7.86\times $to$26.99\times $on GS and SS, respectively, which is better than state-of-the-art studies.

Traffic flow prediction plays an important role in ITS (Intelligent Transportation System). This task is challenging due to the complex spatial and temporal correlations (e.g., the constraints of road network and the law of dynamic change with time). Existing work tried to solve this problem by exploiting a variety of spatiotemporal models. However, we observe that more semantic pair-wise correlations among possibly distant roads are also critical for traffic flow prediction. To jointly model the spatial, temporal, semantic correlations with various global features in the road network, this paper proposes T-MGCN (Temporal Multi-Graph Convolutional Network), a deep learning framework for traffic flow prediction. First, we identify several kinds of semantic correlations, and encode the non-Euclidean spatial correlations and heterogeneous semantic correlations among roads into multiple graphs. These correlations are then modeled by a multi-graph convolutional network. Second, a recurrent neural network is utilized to learn dynamic patterns of traffic flow to capture the temporal correlations. Third, a fully connected neural network is utilized to fuse the spatiotemporal correlations with global features. We evaluate T-MGCN on two real-world traffic datasets and observe improvement by approximately 3% to 6% as compared to the state-of-the-art baseline.

Semantic human activity (SHA) refers to users' activities performed in their daily lives (e.g., having dinner, shopping, etc.). SHA recognition is a promising issue in wearable and mobile computing. Most existing methods represent a SHA based on a single view, e.g., representing a SHA as a combination of human body actions, representing a SHA as a distribution of latent semantics. Since SHAs are complicated in nature, single views lack the ability of comprehensively profiling SHAs. In this paper, we propose a bi-view semi-supervised learning based method for recognizing SHAs using accelerometers. First, we represent a SHA based on two different views. One view represents a SHA as a distribution of latent activities in an unsupervised manner, and the other view represents a SHA as a set of human crafted features extracted in a hierarchical way. Second, we use a semi-supervised learning framework, which exploits the complementary information provided by the two views, to improve the classification accuracy based on both labeled and unlabeled data. Extensive experiments show that representing SHAs based on bi-views is more effective than representing SHAs based on single views, and our method is able to yield a competitive SHA recognition performance.

In the arms race of attackers and defenders, the defense is usually more challenging than the attack due to the unpredicted vulnerabilities and newly emerging attacks every day. Currently, most of existing malware detection solutions are individually proposed to address certain types of attacks or certain evasion techniques. Thus, it is desired to conduct a systematic investigation and evaluation of anti-malware solutions and tools based on different attacks and evasion techniques. In this paper, we first propose a meta model for Android malware to capture the common attack features and evasion features in the malware. Based on this model, we develop a framework, MYSTIQUE, to automatically generate malware covering four attack features and two evasion features, by adopting the software product line engineering approach. With the help of MYSTIQUE, we conduct experiments to 1) understand Android malware and the associated attack features as well as evasion techniques; 2) evaluate and compare the 57 off-the-shelf anti-malware tools, 9 academic solutions and 4 App market vetting processes in terms of accuracy in detecting attack features and capability in addressing evasion. Last but not least, we provide a benchmark of Android malware with proper labeling of contained attack and evasion features.

The analysis of software architecture plays an important role in understanding the system structures and facilitate proper implementation of user requirements. Despite its importance in the software engineering practice, the lack of formal description and verification support in this domain hinders the development of quality architectural models. To tackle this problem, in this work, we develop an approach for modeling and verifying software architectures specified using Monterey Phoenix (MP) architecture description language. MP is capable of modeling system and environment behaviors based on event traces, as well as supporting different architecture composition operations and views. First, we formalize the syntax and operational semantics for MP; therefore, formal verification of MP models is feasible. Second, we extend MP to support shared variables and stochastic characteristics, which not only increases the expressiveness of MP, but also widens the properties MP can check, such as quantitative requirements. Third, a dedicated model checker for MP has been implemented, so that automatic verification of MP models is supported. Finally, several experiments are conducted to evaluate the applicability and efficiency of our approach.

One-Time Password (OTP) is always used as the strongest authentication scheme among all password-based solutions. Currently, consumer devices such as smart card have implemented OTP based two-factor authentications for secure access controls. Such solutions are economically sound without support of timestamp mechanisms. Therefore, synchronization of internal parameters in OTP models, such asmoving factor or counter, between the client and server is the key challenge. Recently, a novel phenomenon shows that two interacting neural networks, called Tree Parity Machines (TPM), with common inputs can finally synchronize their weight vectors through finite steps of output-based mutual learning. The improved secure TPM can well be utilized to synchronize parameters for OTP schemes. In this paper, TPM mutual learning scheme is introduced, then two TPM-based novel OTP solutions are proposed. One is a full implementation model including initialization and rekeying, while the other is light-weight and efficient suitable for resource-constrained embedded environment. Security and performance on the proposed protocols are at final discussed.

This paper presents a robust and efficient method to discover knowledge for classification problems through data summarization. It discretizes continuous features and then summarizes the data using a contingency table. Inconsistency rate for different subsets of features can then be easily calculated from the contingency table. Sequential search is then used to find the best feature subset. After the number of features is reduced to a certain extent, easy-to-understand knowledge can be intuitively derived from data summary. Another desirable feature of the proposed method is its capability to learn incrementally; namely, knowledge can be updated quickly whenever new data are obtained. Moreover, the proposed method is capable of handling missing values when used for prediction. The method is applied on two benchmark data sets showing its effectiveness on selecting discriminative features. The practical usefulness of this method in manufacturing is demonstrated through an application on welding fault diagnosis.