Abstract The Onion Router (Tor), a cornerstone of online privacy, is increasingly exploited for malicious purposes, creating an urgent need to distinguish its traffic from benign web streams. In response to detection efforts, Tor deploys pluggable transports like Obfs4, which obfuscates traffic using randomized padding and artificial timing delays to evade traditional analysis. Although these transformations obscure surface-level patterns, Obfs4 traffic retains subtle yet exploitable statistical divergences from standard web behavior. Critically, existing detection approaches often fail to achieve the throughput necessary for practical, real-time deployment in high-speed network environments, presenting a significant performance gap. To bridge this performance gap, we introduce CTS-OD : A C ascad-ed T wo- S tage framework for high-throughput O bfs4 D etection, engineered for both speed and precision. Our methodology is founded on a compact yet potent set of expressive features selected from early-flow packet data. The first stage implements a label-guided clustering strategy to generate class centroids; these centroids are then indexed using Facebook AI Similarity Search for exceptionally rapid similarity matching, allowing for the immediate classification of the majority of samples. The second stage employs a highly optimized tree-based fallback classifier, which is specifically trained to resolve complex instances that remain ambiguous after the initial assessment. This synergistic architecture achieves an F1-score surpassing 99% and an inference throughput exceeding million samples per second, satisfying the demanding requirements of high-precision, ultra-high-speed inference and making it eminently suitable for real-world deployment.

Web page tampering detection is crucial in web threat perception. Current methods rely on monitoring historical changes of web pages to identify anomalies. These approaches often struggle to effectively distinguish between tampering and benign changes, especially in the presence of numerous dynamic pages. Furthermore, the increasing complexity of website structures places more resource demands on tampering monitoring and makes some malicious alterations more covert and challenging to detect. We propose a web page tampering detection based on pretraining with dynamic temporal graphs. The core of the method involves constructing a website temporal graph model based on evolutionary information, and enhances the graph feature perturbations to expose concealed tampering behaviors. Specifically, the framework's autoencoder is composed of enhanced DySAT, enabling it to handle dynamic data. We introduce DySAT, bolstered with GATv2, to capture dynamic attention. Additionally, we design a temporal masking mechanism and prediction error to improve the effectiveness of generative self-supervised learning in temporal graph pretraining. Experimental results on Webpage Tampering Dataset (WPT-Dataset) demonstrate that our method outperforms other comparative approaches in terms of both detection efficacy and stability. Furthermore, the research findings on the anomaly detector and model performance provide direction for the practical application of our method.

As an increasing number of reusable packages are available in software development, package ecosystems are becoming more mature. Python is one of the most popular programming languages today. PyPI, as the primary repository of Python packages, serves a critical role in Python software development. While PyPI enables registered users to publish open-source packages, attackers can disguise themselves as de velopers to distribute malicious packages. We present a hybrid malicious python package detection framework named PCPD, which combines static anomaly detection and dynamic running analysis to detect lurking malicious packages. Using PCPD, we analyze a real-world dataset containing 414,880 PyPI packages and successfully narrow the inspection scope to 324 suspicious packages, reducing the manual review workload for repository managers by 99.48%. We have identified 121 packages with malicious behavior using PCPD and made all samples publicly available for security researchers to help mitigate these risks and protect the community. Additionally, we discover potential factors that enable malicious packages to evade scrutiny from repositories and associated threat signals.

Containerization is the mainstream of current software development, which enables software to be used across platforms without additional configuration of running environment. However, many images created by developers are redundant and contain unnecessary code, packages, and components. This excess not only leads to bloated images that are cumbersome to transmit and store but also increases the attack surface, making them more vulnerable to security threats. Therefore, image slimming has emerged as a significant area of interest. Nevertheless, existing image slimming technologies face challenges, particularly regarding the incomplete extraction of environment dependencies required by project code. In this paper, we present a novel image slimming model named δ–SCALPEL. This model employs static data dependency analysis to extract the environment dependencies of the project code and utilizes a directed graph named command link directed graph for modeling the image’s file system. We select 30 NPM projects and two official Docker Hub images to construct a dataset for evaluating δ-SCALPEL. The evaluation results show that δ–SCALPEL is robust and can reduce image sizes by up to 61.4% while ensuring the normal operation of these projects.

IP attribution plays a crucial role in the domain of network measurement and cyber threat intelligence, as it enables the traceback of malicious activities and the analysis of IP-Autonomous System Number (ASN) relation. This process provides critical evidence and intelligence for cyber law enforcement. However, current IP attribution method, Whois, face significant challenges because of IPv4 exhaustion and the privacy regulations. Consequently, an efficient and adaptable approach is needed to address these limitations. In this paper, we propose Scaling-RotatE, a novel IP attribution method based on knowledge graph link prediction, designed to infer the ASN ownership of IP addresses. Firstly, we extract multi-dimensional asset features and construct a IP-ontology knowledge graph. To enhance feature embedding, we introduce an innovative strategy with learnable modulus, embedding entities and relationships in the complex vector space to capture varying relationship strengths. A self-adversarial negative sampling technique is employed to enhance the model's generalization capability. Finally, leveraging knowledge graph link prediction techniques, we uncover latent IP-ASN relations, enabling more accurate IP attribution. Experimental results demonstrate that our model achieves a HITS@10 score of 0.831, outperforming numbers of previous methods and establishing a new state-of-the-art performance in IP attribution.

Open source components (OSCs) have become a vital part for developing modern applications. The security of these components could affect the overall security of the software depends on them. Thus, the security of an OSC should be evaluated first before integrating to the software. However, the existing models lack generality, and cannot be easily automatic applied to OSCs developed in different programming language. To this end, we propose a security assessment model for OSCs, called the CRAM, which features generality and automation. The proposed model is constructed under the hypothesis that OSC with a larger and more active community is more likely to disclose more vulnerabilities. And it evaluates the security of OSC from its performance in size as well as activities of open source community and vulnerability disclosures. In the experiment section, we present validation and application experiments. In the validation experiment, we find that the basic hypothesis of the proposed model is valid, and there is a positive correlation between the community size as well as activities and vulnerability risk of OSCs. In the application experiment, we further evaluate our approach with large-scale open source components. Our hypothesis is further validated. The most of OSCs in the ecosystem are in line with the hypothesis. Finally, we successfully build the security baseline according to the hypothesis, and 5 vulnerable OSCs classified as vulnerable by our model are analyzed. The result proves the effectiveness of our model to identify a vulnerable open source ecosystem around the ecosystem.

As the rapid advances of mobile internet and Internet of Things (IoT), Android has become one of the most widely used operating systems in mobile terminals and IoT devices. However, the massive growth of Android malware poses challenging security problems to these terminals and devices. In this paper, we propose a novel heterogeneous information network (HIN)-based method, called FDroid, for fast and accurate detection of Android malware. Specifically, we first design a fine-grained HIN to model the relationship between APKs and APIs and then extract finer-grained path information, including code blocks, packages and call patterns compared to traditional HIN-based methods, which can effectively improve the detection accuracy without increasing the number of paths. Second, we devise a TF-IWF-based contribution calculation algorithm to select a small number of sensitive APIs calls with high representativeness, which can effectively save the detection time and storage space. Third, we develop an expanded matrix-assisted support vector machine (SVM) classifier for Android malware detection. Experimental results show that the FDroid can achieve 97.43% detection accuracy. Meanwhile, compared with the other related HIN-based malware detection methods, the training time of FDroid is less than 0.1% of them, and the detection time is less than 10% of them.

Vulnerability is a significant security threat to information systems, drawing widespread concern from researchers. In recent years, owing to continuous advancements in defense technologies, the success rate of exploiting a single N-day vulnerability for attacking has gradually decreased. Attackers are now attempting to exploit multiple vulnerabilities simultaneously to achieve their objectives. This phenomenon is referred to as the vulnerability co-exploitation. Limited by strict vulnerability triggering conditions, successful attacks via vulnerability co-exploitation are infrequent. Due to the low proportion of co-exploitation cases among all vulnerabilities, few studies have focused on co-exploitation relationships or investigated co-exploitation under the condition of extreme data imbalance. In additon, existing work lacks sufficient multidimensional features, which are crucial for accurately identifying and understanding co-exploitation scenarios. However, the prediction of vulnerability co-exploitation remains valuable as it aids practitioners in identifying potential critical risk points within the system. In this article, we propose a framework named CoExpMiner, based on the attributed heterogeneous information network, for mining potential vulnerability co-exploitation under the extreme data imbalance condition. CoExpMiner utilizes structure and attribute features of the attributed heterogeneous graph to predict vulnerability co-exploitation, with employing a prefilter structure to accelerate the process and reduce the computational cost. Experimental results demonstrate that CoExpMiner can effectively predict co-exploitation despite the challenges posed by extreme data imbalance.

In recent years, software supply chain attacks have become increasingly prevalent, prompting considerable research into detecting malicious packages within relevant repositories. With the popularity bolstered by the widespread adoption of open-source practices, Java become one of the preferred languages among modern developers. However, the issue of malware detection in Java components remains unresolved. Most prior approaches suffer from insufficient code coverage and coarse-grained representation, making them unsuitable for Java components.In this paper, we propose an innovative solution calledSheartailored for detecting malicious Java components.Shearfirstly analyzes all methods in the component and locates potential malicious code snippets based on sensitive calls, as slice-level analysis provides a better understanding of the specific malicious activities. Secondly, statements depending on sensitive call sites are extracted and embedded into vectors for further detection instead of function-level representation which is coarse-grained facing the dynamic features in Java. The corresponding experimental results show thatSheareffectively identifies the malicious semantics hidden in the code slices by leveraging the neural network model, outperforming currently available tools to a great extent. Through real-world validation,Sheardetected 51 components with malicious characteristics out of 68,273, demonstrating its practical feasibility. This study introduces the first Java malicious component detection method suitable for real-world scenarios, carrying considerable practical significance in bolstering defenses within the software supply chain.

Automated code generation has revolutionized software development, enabling developers to accelerate project timelines and reduce manual coding errors significantly. As reliance on these technologies grows, the inherent weaknesses of generated code become increasingly apparent. Recent studies have shown that code produced by AI is not inherently safer or of higher quality than human-written code, often replicating existing vulnerabilities.To this end, we propose SECURECODER, which integrates Retrieval-Augmented Generation (RAG) with Common Weakness Enumeration (CWE). SECURECODER first utilizes the advanced reasoning capabilities of large language models (LLMs) to generate natural language descriptions of the code’s core business logic and functionality. Then, from a semantic perspective, it matches the requirements of the code generation task with the CWE descriptions through a multi-label classification process. Finally, based on the matched CWE, SECURECODER generates a list of security guidelines the code generation model must adhere to. Breaking down end-to-end code generation tasks into single-target tasks that LLMs excel at ensures that the generated code not only meets functional requirements but also adheres to best security practices, thereby enhancing the interpretability of the automated code generation process. After evaluating 2 programming languages and 7 LLMs on Coploit-generated code, SECURECODER has great generalization capability and could be applied to more programming languages and vulnerability types. SECURECODER could significantly decrease the security weakness in the AI-generated code and is able to mitigate more than 65% of vulnerabilities exposed to software developers. Compared to the baseline open-source LLMs, code vulnerabilities were reduced by at least 14% and the code business logic was not affected.

PyPI provides a convenient and accessible package management platform to developers, enabling them to quickly implement specific functions and improve work efficiency. However, the rapid development of the PyPI ecosystem has led to a severe problem of malicious package propagation. Malicious developers disguise malicious packages as normal, posing a significant security risk to end-users. To this end, we conducted an empirical study to understand the characteristics and current state of the malicious code lifecycle in the PyPI ecosystem. We first built an automated data collection framework and collated a multi-source malicious code dataset containing 4,669 malicious package files. We preliminarily classified these malicious code into five categories based on malicious behaviour characteristics. Our research found that over 50 % of malicious code exhibits multiple malicious behaviours, with information stealing and command execution being particularly prevalent. In addition, we observed several novel attack vectors and anti-detection techniques. Our analysis revealed that 74.81 % of all malicious packages successfully entered end-user projects through source code installation, thereby increasing security risks. A real-world investigation showed that many reported malicious packages persist in PyPI mirror servers globally, with over 72 % remaining for an extended period after being discovered. Finally, we sketched a portrait of the malicious code lifecycle in the PyPI ecosystem, effectively reflecting the characteristics of malicious code at different stages. We also present some suggested mitigations to improve the security of the Python open-source ecosystem.

As the complexity of cyberattacks continues to increase, multistage combination attacks have become the primary method of attack. Attackers plan and organize a series of attack steps, using various attack tools to achieve specific goals. Extracting knowledge about these tools is of great significance for both defense and tracing of attacks. We have noticed that there is a wealth of security tool‐related knowledge within the open‐source community, but research in this area is limited. It is challenging to achieve large‐scale automated security tool information extraction. To address this, we propose automated knowledge graph construction architecture, named SecTKG, for open‐source security tools. Our approach involves designing a security tool ontology model to describe tools, users, and relationships, which guides the extraction of security tool knowledge. In addition, we develop advanced entity recognition and classification methods, ensuring efficient and accurate knowledge extraction. As far as we know, this work is the first to construct the large‐scale security tool knowledge graph, containing 4 million entities and 10 million relationships. Furthermore, we investigate the tendencies and particularities of security tools based on the SecTKG and developed a security tool influence‐measuring application. The research fills a gap in the field of automated security tools’ knowledge extraction and provides a foundation for future research and practical applications.

As the defense shifts from vulnerability-centric to threat-centric and efficient security architecture can exclusively be constructed with adequate comprehension of the threat of the critical assets. In order to classify and identify the assets, the recognition and naming of the Web applications are the fundamental approaches. At present, the traditional Web application identification methods mainly rely on rules matching, which are extracted from the Web pages by manual analysis. This low coverage and labor-consuming method, which is not suitable for this time of explosive growth in Web applications and inevitably leaves some uncommon applications unrecognized and at risk. In this paper, we propose WAIN, an automatic method for Web application identification and naming, it first clusters different types of applications in numerous samples using K-Means algorithm, and then leverages a novel TF-IDF calculation method to extract keyword. After that, LDA is applied to explain why some parts of data are similar and extract possible fingerprints. Finally, WAIN utilizes filters and a statistic means to generate possible names for clusters. When evaluating, data from 30,000 instances of eight kinds of Web applications is processed, and the generated fingerprints and names can distinguish each type of application in the dataset. We manually checked all the results and found that fingerprints and at least one name that summarizes at least one of the product names, manufacturers, and functions are successfully generated for each kind of application.

To provide users with personalized services, the website collects and tracks user’s activity data. At the same time, each website uses a privacy policy to ensure the legality of these actions. The purpose of the implementation of the General Data Protection Regulation (GDPR) is to protect the privacy of user data. Because GDPR is a programmatic regulation, there is no specific guidance on what a privacy policy should contain. Therefore, there may still be potential violations on the website, thus cause a risk of leak users’ private data. In this paper, we define a violating behavior that data collected by the website without a declaration in the privacy policy is illegal. To complete the violating behavior detection, we first interpret the GDPR and analyze 1000 website privacy policies to present a personal data classification including eight categories. Based on this, we propose a privacy policy annotation scheme including these eight categories and collect 145 related Web APIs. Then we propose an automated method to detect GDPR suspected compliance violations in websites. On the one hand we use the multi-label text classification model to extract data collection stated in the privacy policy, with a precision of 0.9817. For another, we dynamically monitor the JavaScript calls of the website related to personal data collection during user visits. Finally, we compare the two results to determine whether violating behaviors appeared. We use this method to detect the European top 500 websites (actually 451 websites). A total of 159 (35.3%) websites appear in violation of the GDPR. We analyze the detection results from different perspectives, including statistics on the types of data declared in the privacy policy, statistics on data collected by the website, and which data collection is likely to cause violations. Then we classify the violating websites and find that websites in the Social category present the most violations. Finally, we count the rankings of the offending websites. Surprisingly, top-ranking sites are even more prone to breaches. There are even some globally well-known websites with violations, such as BBC, Nokia, Ebay, Google etc.

Python has gradually become one of the most important programming languages through artificial intelligence's development. PIP, a package management tool for Python, offers one-click installation, allowing developers to utilize other people's code to speed up development. However, any registered member can easily upload packages to the repository that stores third-party packages. This functionality is used by attackers to poison the package index, i.e., to publish enormous malicious pip packages for installing backdoor, gathering information, etc. To know the situation of third-party packages in the Python community ecosystem, we establish the criteria for judging packages' suspicious or malicious behavior by analyzing the code logic in disclosed malicious packages. With the gained findings, we propose and implement Pip Poisoning Detector (PPD), an approach based on anomaly detection. PPD evaluated 228,723 packages, and after human inspection, we found 63 malicious and 238 suspicious ones among the output 5,699 results. The experimental results prove that our approach is effective and can significantly reduce review workload by 97.51%.

Open-source code repositories play an important role in software development, but they also introduce a slew of security issues. Firstly, everyone can use open-source projects and libraries from the third-party ecosystem, which increases the risk of vulnerabilities attacking. Secondly, it may cause a domino effect and make these products inherit these vulnerabilities when referring to vulnerable repositories. Traditional technical methods were unable to detect these public flaws in a timely manner, leaving these developers in an insecure situation. Although vulnerability management institutes like CVE and NVD provide inadequate coverage, leading to a lack of timely, reliable, and detailed information about open-source projects' vulnerabilities. To better detect and repair vulnerability, we designed a vulnerability intelligence mining system named DeepVuler based on threads analysis and changed code in open-source communities using machine learning. We choose and define a series of effective features extracted from open-source communities to early infer vulnerability intelligence. Our result shows that two proposed models of DeepVuler achieve a detection rate of 0.979 in threads and 0.890 in changed codes. Besides, the detection from DeepVuler is often days or weeks ahead of official vulnerability disclosure.

Abstract Cybersecurity has gradually become the public focus between common people and countries with the high development of Internet technology in daily life. The cybersecurity knowledge analysis methods have achieved high evolution with the help of knowledge graph technology, especially a lot of threat intelligence information could be extracted with fine granularity. But named entity recognition (NER) is the primary task for constructing security knowledge graph. Traditional NER models are difficult to determine entities that have a complex structure in the field of cybersecurity, and it is difficult to capture non-local and non-sequential dependencies. In this paper, we propose a cybersecurity entity recognition model CyberEyes that uses non-local dependencies extracted by graph convolutional neural networks. The model can capture both local context and graph-level non-local dependencies. In the evaluation experiments, our model reached an F1 score of 90.28% on the cybersecurity corpus under the gold evaluation standard for NER, which performed better than the 86.49% obtained by the classic CNN-BiLSTM-CRF model.

Application security is essential in today’s highly development period. Backdoor is a means by which attackers can invade the system to achieve illegal purposes and damage users’ rights. It has posed a serious threat to network security. Thus, it is urgent to take adequate measures to defend such attacks. Previous research work was mainly focused on numerous PHP webshells, with less research on Python backdoor files. Language differences make the method not entirely applicable. This paper proposes a Python backdoor detection model named PBDT based on combined features. The model summarizes the common functional modules and functions in the backdoor files and extracts the number of calls in the text to form sample features. What is more, we consider the text’s statistical characteristics, including the information entropy, the longest string, etc., to identify the obfuscated Python code. Besides, the opcode sequence is used to represent code characteristics, such as TF-IDF vector and FastText classifier, to eliminate the influence of interference items. Finally, we introduce the Random Forest algorithm to build a classifier. Covering most types of backdoors, some samples are obfuscated, the model achieves an accuracy of 97.70%, and the TNR index is as high as 98.66%, showing a good classification performance in Python backdoor detection.

Zombie followers, a type of bot, are longstanding entities in Sina Weibo. Although the features and detection of zombie followers have been extensively studied, zombie followers are continuously increasing in social networks and gradually developing into a large-scale industry. In this study, we analyze the features of eight groups of zombie followers from different companies. The findings indicate that although zombie followers controlled by different companies vary greatly, some industries may be controlled by the same organization. Based on the feature analysis, we use multiple machine learning methods to detect zombie followers, and the results show that zombie follower groups with short registration time are more easily detected. The detection accuracy of zombie followers that have been cultivated for a long duration is low. Moreover, the richer the feature sets, the higher the recall, precision, and F1 of their detection results will be. Under a given rich feature set, the accuracy of the combined-group detection is not as high as that of the single-group detection. The random forest achieves the highest accuracy in both single- and combined-group detections, yielding 99.14% accuracy in the latter case.

MOTIVATION: Metalloenzymes are attractive targets for therapeutic intervention owing to their central roles in various biological processes and pathological situations. The fast-growing body of structural data on metalloenzyme-ligand interactions is facilitating efficient drug discovery targeting metalloenzymes. However, there remains a shortage of specific databases that can provide centralized, interconnected information exclusive to metalloenzyme-ligand associations. RESULTS: We created a Metalloenzyme-Ligand Association Database (MeLAD), which is designed to provide curated structural data and information exclusive to metalloenzyme-ligand interactions, and more uniquely, present expanded associations that are represented by metal-binding pharmacophores (MBPs), metalloenzyme structural similarity (MeSIM) and ligand chemical similarity (LigSIM). MeLAD currently contains 6086 structurally resolved interactions of 1416 metalloenzymes with 3564 ligands, of which classical metal-binding, non-classical metal-binding, non-metal-binding and metal water-bridging interactions account for 63.0%, 2.3%, 34.4% and 0.3%, respectively. A total of 263 monodentate, 191 bidentate and 15 tridentate MBP chemotypes were included in MeLAD, which are linked to different active site metal ions and coordination modes. 3726 and 52 740 deductive metalloenzyme-ligand associations by MeSIM and LigSIM analyses, respectively, were included in MeLAD. An online server is provided for users to conduct metalloenzyme profiling prediction for small molecules of interest. MeLAD is searchable by multiple criteria, e.g. metalloenzyme name, ligand identifier, functional class, bioinorganic class, metal ion and metal-containing cofactor, which will serve as a valuable, integrative data source to foster metalloenzyme related research, particularly involved in drug discovery targeting metalloenzymes. AVAILABILITY AND IMPLEMENTATION: MeLAD is accessible at https://melad.ddtmlab.org. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.

Abstract Emails are often used to illegal cybercrime today, so it is important to verify the identity of the email author. This paper proposes a general model for solving the problem of anonymous email author attribution, which can be used in email authorship identification and email authorship verification. The first situation is to find the author of an anonymous email among the many suspected targets. Another situation is to verify if an email was written by the sender. This paper extracts features from the email header and email body and analyzes the writing style and other behaviors of email authors. The behaviors of email authors are extracted through a statistical algorithm from email headers. Moreover, the author’s writing style in the email body is extracted by a sequence-to-sequence bidirectional long short-term memory (BiLSTM) algorithm. This model combines multiple factors to solve the problem of anonymous email author attribution. The experiments proved that the accuracy and other indicators of proposed model are better than other methods. In email authorship verification experiment, our average accuracy, average recall and average F1-score reached 89.9%. In email authorship identification experiment, our model’s accuracy rate is 98.9% for 10 authors, 92.9% for 25 authors and 89.5% for 50 authors.

In recent years, the research on malware variant classification has attracted much more attention. However, there are still many challenges, including the low accuracy of classification of samples of similar malware families, high time, and resource consumption. This paper proposes a new method of malware classification based on multiple visual features of malware and deep learning algorithms. In prior research, visualization techniques and entropy demonstrated exemplary performance in many areas. This paper extracts numerous visual features from the raw bytes and entropy sequence of the malware, which makes it more sensitive to malware samples of similar families and endows it the ability to classify malware variants more accurately. To evaluate the proposed method, this paper conducted a series of experiments on two malware datasets with a total of more than 20,000 samples provided by the Malware Research Lab and Microsoft Research. Through experiments, the method showed its superiority compared with some leading malware visual classification methods, achieving good performance on the accuracy with at least 1% improvement. The accuracy of the method even could reach 99.73% and 99.54%, respectively, on the two datasets.

Search engine is critical in people’s daily life because it determines the information quality people obtain through searching. Fierce competition for the ranking in search engines is not conducive to both users and search engines. Existing research mainly studies the content and links of websites. However, none of these techniques focused on semantic analysis of link and anchor text for detection. In this paper, we propose a web spam detection method by extracting novel feature sets from the homepage source code and choosing the random forest (RF) as the classifier. The novel feature sets are extracted from the homepage’s links, hypertext markup language (HTML) structure, and semantic similarity of content. We conduct experiments on the WEBSPAM-UK2007 and UK-2011 dataset using a five-fold cross-validation method. Besides, we design three sets of experiments to evaluate the performance of the proposed method. The proposed method with novel feature sets is compared with different indicators and has better performance than other methods with a precision of 0.929 and a recall of 0.930. Experiment results show that the proposed model could effectively detect web spam.

As Advanced Persistent Threat (APT) becomes increasingly frequent around the world, security experts are starting to look at how to observe, predict, and mitigate the damage from APT attacks. In the meantime, the Internet of things devices are also risky and heavily exposed to the Internet, making them more easily used by hacker organizations to launch APT attacks. An excellent attacker can take down millions of Internet of things devices in a short time. Once the IoT botnet is built, attackers can use it to launch complex attacks which could damage Internet infrastructure and cause network disconnection. This paper proposes GroupTracer, a framework for observing and predicting the Internet of things attacks. GroupTracer is designed to automatically extract the TTP profiles (i.e., tactics, techniques, and procedures) that can describe the behavior of attackers through their tactics, techniques, and processes and dig out the potential attacker groups behind complex attacks. Firstly, it captures attacks by IoT honeypots and extracts relevant fields from logs. Then, attack behaviors are automatically mapped to the ATT&CK framework to achieve automatic TTP profiles extraction. After that, GroupTracer presents four feature groups, including TTP profiles, Time, IP, and URL features, a total of 18 features, mines potential attack groups through hierarchical clustering algorithm, and compares the clustering results with two baseline algorithms. As the ground truth labels are unknown, we apply three internal validation indexes to evaluate the cluster quantity. Experimental results showed that the proposed framework has achieved an excellent performance in exploiting potential groups as the Calinski–Harabasz index reaches 3416.93. Eventually, attack trees are generated for each cluster where nodes indicate attack commands and edges represent command sequences. These attack trees could help better understand each attack group’s actions and techniques.

Traditional security strategies are powerless when facing novel attacks in the complex network environment, such as advanced persistent threat (APT). Compared with traditional security detection strategies, the honeypot system, especially on the Internet of things research area, is intended to be attacked and automatically monitor potential attacks by analyzing network packages or log files. The researcher can extract exactly threat actor tactics, techniques, and procedures from these data and then generate more effective defense strategies. But for normal security researchers, it is an urgent topic how to improve the honeypot mechanism which could not be recognized by attackers, and silently capture their behaviors. So, they need awesome intelligent techniques to automatically check remotely whether the server runs honeypot service or not. As the rapid progress in honeypot detection using machine learning technologies, the paper proposed a new automatic identification model based on random forest algorithm with three group features: application-layer feature, network-layer feature, and other system-layer feature. The experiment datasets are collected from public known platforms and designed to prove the effectiveness of the proposed model. The experiment results showed that the presented model achieved a high area under curve (AUC) value with 0.93 (area under the receiver operating characteristic curve), which is better than other machine learning algorithms.

Attackers upload webshell into a web server to achieve the purpose of stealing data, launching a DDoS attack, modifying files with malicious intentions, etc. Once these objects are accomplished, it will bring huge losses to website managers. With the gradual development of encryption and confusion technology, the most common detection approach using taint analysis and feature matching might become less useful. Instead of applying source file codes, POST contents, or all received traffic, this paper demonstrated an intelligent and efficient framework that employs precise sessions derived from the web logs to detect webshell communication. Features were extracted from the raw sequence data in web logs while a statistical method based on time interval was proposed to identify sessions specifically. Besides, the paper leveraged long short-term memory and hidden Markov model to constitute the framework, respectively. Finally, the framework was evaluated with real data. The experiment shows that the LSTM-based model can achieve a higher accuracy rate of 95.97% with a recall rate of 96.15%, which has a much better performance than the HMM-based model. Moreover, the experiment demonstrated the high efficiency of the proposed approach in terms of the quick detection without source code, especially when it only considers detecting for a period of time, as it takes 98.5% less time than the cited related approach to get the result. As long as the webshell behavior is detected, we can pinpoint the anomaly session and utilize the statistical method to find the webshell file accurately.

Domain names play a critical role in cybercrime, because they identify hosts that serve malicious content (such as malware, Trojan binaries, or malicious scripts), operate as command-and-control servers, or carry out some other role in the malicious network infrastructure. To defend against Internet attacks and scams, operators widely use blacklisting to detect and block malicious domain names and IP addresses. Existing blacklists are typically generated by crawling suspicious domains, manually or automatically analyzing malware, and collecting information from honeypots and intrusion detection systems. Unfortunately, such blacklists are difficult to maintain and are often slow to respond to new attacks. Security experts set up and join mailing lists to discuss and share intelligence information, which provides a better chance to identify emerging malicious activities. In this paper, we design Gossip, a novel approach to automatically detect malicious domains based on the analysis of discussions in technical mailing lists (particularly on security-related topics) by using natural language processing and machine learning techniques. We identify a set of effective features extracted from email threads, users participating in the discussions, and content keywords, to infer malicious domains from mailing lists, without the need to actually crawl the suspect websites. Our result shows that Gossip achieves high detection accuracy. Moreover, the detection from our system is often days or weeks earlier than existing public blacklists.