Federated Class Incremental Learning (FCIL) has emerged as a new paradigm due to its applicability in real-world scenarios. In FCIL, clients continuously generate new data with unseen class labels and do not share local data due to privacy restrictions, and each client’s class distribution evolves dynamically and independently. However, existing work still faces two significant challenges. Firstly, current methods lack a better balance between maintaining sound anti-forgetting effects over old data (stability) and ensuring good adaptability for new tasks (plasticity). Secondly, some FCIL methods overlook that the incremental data will also have a non-identical label distribution, leading to poor performance. This paper proposes CGoFed, which includes relax-constrained gradient update and cross-task gradient regularization modules. The relax-constrained gradient update prevents forgetting the knowledge about old data while quickly adapting to the new data by constraining the gradient update direction to a gradient space that minimizes interference with historical tasks. The cross-task gradient regularization also finds applicable historical models from other clients and trains a personalized global model to address the non-identical label distribution problem. The results demonstrate that the CGoFed performs well in alleviating catastrophic forgetting and improves model performance by 8% -23% compared with the SOTA comparison method.

Although a variety of models have been proposed for urban spatio-temporal forecasting, most existing forecasting models are developed manually for specific tasks. By investigating the correlation between multi-order derivative and spatio-temporal data, we propose a generic yet simple plug-in structure, namedTaylorS, to improve the performance and generalization of existing forecasting models. The TaylorS converts the non-linear regression problem into a multi-order non-linear approximation problem by plugging a Taylor expansion into the forecasting task. To achieve this, we design a two-step training framework, including a training step and an adjusting step. During training, we train a given forecasting model as a base model to be equipped with prior knowledge. During adjusting, we fine-tune the base model while plugging an adjustment model into the base model. The adjustment model, as a multi-order expansion, takes the multi-order derivative of data to evaluate data uncertainty for further forecasting approximation and adjustment. Extensive experimental results demonstrate that the proposed TaylorS framework can consistently improve the performance of existing state-of-the-art methods and generalize these methods to different forecasting tasks.

Multi-task learning (MTL) has succeeded in various industrial applications by utilizing common knowledge among joint training tasks to enhance the generalization of MTL models, resulting in improved performance across all training tasks simultaneously. Unfortunately, training all tasks simultaneously often causes performance degradation compared to single-task models since different tasks might conflict with each other. Despite existing MTL methods that aim to mitigate task conflicts by manipulating task gradients at each iteration, they ignore the potential influence of noisy data from different batches on task gradients. Consequently, the current iteration's task gradient may not accurately reflect the task itself, leading to inadequate alleviation of the dilemma of task conflicts. Moreover, existing works seldom explore the potential source of task conflicts and merely pose an assumption. In this paper, we conduct an in-depth empirical investigation into the potential sources of performance degradation of MTL and find that task gradient conflict is one of the primary reasons for the performance degradation of tasks. Then, to address the task conflicts problem, we propose a novel gradient manipulation approach, namely MoCoGrad, which manipulates task gradients by leveraging the momentum information of the task to calibrate the gradients of conflicting tasks. In addition, we derive theoretical guarantees for the con-vergence of our proposed MoCoGrad and theoretically analyze the convergence rate of MoCoGrad. Finally, to evaluate the effectiveness of MoCoGrad, extensive experiments are conducted on six real-world datasets from different domains. Our approach yields the best performance across all tasks in all six MTL benchmarks, demonstrating the effectiveness and superiority of our method.

Graph contrastive learning (GCL) has gained increasing interest as a solution for graph representation learning. In GCL, graph augmentation is essential to generate contrastive samples used for contrastive learning. Recently, most existing methods employ learnable graph view generators to augment graphs based on the node probability distribution adaptively. However, these methods cannot ensure that semantic-related nodes are preserved during graph augmentation, leading to performance degradation. To tackle this issue, we propose a novel approach called Semantic-aware Graph Contrastive Learning (SGCL), which can generate high-quality contrastive samples by only augmenting semantic-unrelated nodes so as to facilitate the performance of GCL on downstream tasks. Specifically, we first design a Lipschitz constant generator to compute the Lipschitz constants that measure the semantic relevance of each node. Then, we propose the Lipschitz graph augmentation to augment graphs while only dropping these semantic-unrelated nodes with small Lipschitz constants. Furthermore, we propose semanticaware contrastive learning to obtain more refined representations by contrasting the graph-level representation of anchor graphs and high-quality generated samples. Experimental results on unsupervised learning and transfer learning demonstrate the effectiveness of SGCL compared to state-of-the-art methods.

Accurate forecasting of traffic flow plays a crucial role in building smart cities in the new era. Previous work has achieved success in learning inherent spatial and temporal patterns of traffic flow. However, existing works investigated the multiple periodicities (e.g., hourly, daily, and weekly) of traffic via entanglement learning, which has not yet dealt with distribution shift and interaction shift problems in traffic flow. In this paper, we propose a novel disentanglement learning network, called MUSE-Net, to tackle the limitations of entanglement learning by simultaneously factorizing the exclusiveness and interaction of multi-periodic patterns in traffic flow. Grounded in the theory of mutual information, we first learn and dis-entangle exclusive and interactive representations of traffics from multi-periodic patterns. Then, we utilize semantic-pushing and semantic-pulling regularizations to encourage the learned representations to be independent and informative. Moreover, we derive a lower bound estimator to tractably optimize the disentanglement problem with multiple variables and propose a joint training model for traffic forecasting. Extensive experimental results on several real-world traffic datasets demonstrate the effectiveness of the proposed framework. The code is available at: https://github.com/JianyangQin/MUSE-Net.

The complexity and ongoing evolution of Advanced Persistent Threats (APTs) compromise the efficacy of conventional cybersecurity measures. Firewalls, intrusion detection systems, and antivirus software, which are dependent on static rules and predefined signatures, are increasingly ineffective against these sophisticated threats. Moreover, the use of system audit logs for threat hunting involves a retrospective review of cybersecurity incidents to reconstruct attack paths for attribution, which affects the timeliness and effectiveness of threat detection and response. Even when the attacker is identified, this method does not prevent cyber attacks. To address these challenges, we introduce ThreatInsight, a novel early-stage threat detection solution that minimizes reliance on system audit logs. ThreatInsight detects potential threats by analyzing IPs captured from HoneyPoints. These IPs are processed through threat data mining and threat feature modeling. By employing fact-based and semantic reasoning techniques based on the APT Threat Intelligence Knowledge Graph (APT-TI-KG), ThreatInsight identifies and attributes attackers. The system generates analysis reports detailing the threat knowledge concerning IPs and attributed attackers, equipping analysts with actionable insights and defense strategies. The system architecture includes modules for HoneyPoint IP extraction, Threat Intelligence (TI) data analysis, attacker attribution, and analysis report generation. ThreatInsight facilitates real-time analysis and the identification of potential threats at early stages, thereby enhancing the early detection capabilities of cybersecurity defense systems and improving overall threat detection and proactive defense effectiveness.

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system calledHinCTIis developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. WithHinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

In many advanced network analysis applications, like social networks, e-commerce, and network security, hotspots are generally considered as a group of vertices that are tightly connected owing to the similar characteristics, such as common habits and location proximity. In this article, we investigate the formation of hotspots from an alternative perspective that considers the routes along the network paths as the auxiliary information, and attempt to find the route hotspots in large labeled networks. A route hotspot is a cohesive subgraph that is covered by a set of routes, and these routes correspond to the same sequential pattern consisting of vertices' labels. To the best of our knowledge, the problem of Finding Route Hotspots in Large Labeled Networks has not been tackled in the literature. However, it is challenging as counting the number of hotspots in a network is #P-hard. Inspired by the observation that the sizes of hotspots decrease with the increasing lengths of patterns, we prove several anti-monotonicity properties of hotspots, and then develop a scalable algorithm called FastRH that can use these properties to effectively prune the patterns that cannot form any hotspots. In addition, to avoid the duplicate computation overhead, we judiciously design an effective index structure called RH-Index for storing the hotspot and pattern information collectively, which also enables incremental updating and efficient query processing. Our experimental results on real-world datasets clearly demonstrate the effectiveness and scalability of our proposed methods.

False information detection on social media is challenging as it commonly requires tedious evidence-collecting but lacks available comparative information. Clues mined from user comments, as the wisdom of crowds, could be of considerable benefit to this task. However, it is non-trivial to capture the complex semantics from the contents and comments in consideration of their implicit correlations. Although deep neural networks have good expressive power, one major drawback is the lack of explainability. In this paper, we focus on how to learn from the post contents and related comments in social media to understand and detect the false information more effectively, with explainability. We thus propose a Quantum-probability based Signed Attention Network (QSAN) that integrates the quantum-driven text encoding and a novel signed attention mechanism in a unified framework. QSAN is not only able to distinguish important comments from the others, but also can exploit the conflicting social viewpoints in the comments to facilitate the detection. Moreover, QSAN is advantageous with its explainability in terms of transparency due to quantum physics meanings and the attention weights. Extensive experiments on real-world datasets show that our approach outperforms state-of-the-art baselines and can provide different kinds of user comments to explain why a piece of information is detected as false.

Forecasting the stock market trend is a vital component of financial systems. Traditional methods mainly rely on quantitative trading data to make predictions. With the increasing volume of Web information, researchers begin to extract effective indicators (e.g., the events and sentiments) from the Web to facilitate the prediction. It is beneficial to fuse the heterogeneous multi-sourced data to achieve superior performance. Existing solutions adopt simple data fusing methods with conventional machine learning models, which may fail to effectively model the complex interactions among the data. With the success of deep neural networks (DNN) in various fields, we propose a DNN-based model that considers the various interactions and complex correlations among the multi-sourced data into one unified framework. In such a framework, the low-and high-order feature interactions are modeled with the factorization machine and the deep neural network respectively, and stock correlations are incorporated with an attention-based feature embedding method. Evaluations on the stock data from the year 2015 to 2017 show that our model can outperform the state-of-the-art methods.

In networks, multiple contagions, such as information and purchasing behaviors, may interact with each other as they spread simultaneously. However, most of the existing information diffusion models are built on the assumption that each individual contagion spreads independently, regardless of their interactions. Gaining insights into such interaction is crucial to understand the contagion adoption behaviors, and thus can make better predictions. In this paper, we study the contagion adoption behavior under a set of interactions, specifically, the interactions among users, contagions' contents, and sentiments, which are learned from social network structures and texts. We develop an effective and efficient interaction-aware diffusion (IAD) framework, incorporating these interactions into a unified model. We also present a generative process to distinguish user roles, a co-training method to determine contagions' categories and a new topic model to obtain topic-specific sentiments. Evaluation on the large-scale Weibo dataset demonstrates that our proposal can learn how different users, contagion categories, and sentiments interact with each other efficiently. With these interactions, we can make a more accurate prediction than the state-of-art baselines. Moreover, we can better understand how the interactions influence the propagation process and thus can suggest useful directions for information promotion or suppression in viral marketing.

Network embedding has gained much attention in recent years. Embedding network into a low-dimensional vector space has shown promising performance in many graph mining tasks such as node classification, link prediction, and community detection. However, in many real-world applications, a variety of networks could be abstracted and presented in a multilayer fashion with rich information, such as user profiles of friendship networks and textual content of citation networks. Most existing algorithms focus on single-layer networks or homogeneous networks with a single type of nodes and edges. They fail to leverage the rich attributes and consider the rich semantic correlations of the nodes which are among within-layer or cross-layer. In this paper, we exploit the rich semantic information embedded in the multi-layer network by means of meta-path-based proximities and leverage the rich source of attributes in the multi-layer network to improve network embedding. Specifically, the semantic correlations come from both within-layer and cross-layer node connections, and attribute proximity is considered to refine the homogeneity of nodes that belong to the same type. We propose a generic Attributed Multi-layer Network Embedding framework, which learns representations for nodes by capturing both the rich semantic correlations and attribute information simultaneously in a unified optimization framework. Our extensive experimental evaluations on real-world multi-layer networks demonstrate that the proposed framework achieves better performance compared with the state-of-the-art embedding algorithms.

With the rapid development of big data analytics, mobile computing, Internet of Things, cloud computing, and social networking, cyberspace has expanded to a cross-fused and ubiquitous space made up of human beings, things, and information. Internet applications have evolved from Web 1.0 to Web 2.0 and Web 3.0, and web information has seen an explosive growth, which is strongly promoting the advent of a global era of big data. In this ubiquitous cyberspace, traditional search engines can no longer fully satisfy the evolving needs of various types of users. Therefore, search engines must make completely innovative, revolutionary changes for the next generation of search, which is referred to as “big search”. This paper first studies the development needs of big search. Then, big search is defined, and the 5S properties (Sourcing, Sensing, Synthesizing, Solution, and Security) of big search, which are different from those of traditional search engines, are elaborated. Also, the paper provides a system architecture for big search, explores the key technologies that support the 5S properties, and describes potential application fields of big search technology. Finally, the research opportunities of big search are discussed.

The folksonomies built from the large-scale social annotations made by collaborating users are perfect data sources for bootstrapping Semantic Web applications. In this paper, we develop an ontology induction approach to harvest the emergent semantics from the folksonomies. We propose a latent subsumption hierarchy model to uncover the implicit structure of tag space and develop our ontology induction approach on basis of this model. We identify tag subsumptions with a set-theoretical approach and model the tag space as a tag subsumption graph. While turning this graph into a concept hierarchy, we address the problem of inconsistent subsumptions and propose a random walk based tag generality ranking procedure to settle it. We propose an agglomerative hierarchical clustering algorithm utilizing the result of tag generality ranking to generate the concept hierarchy. We conduct experiments on the Delicious dataset. The results of both qualitative and quantitative evaluation demonstrate the effectiveness of the proposed approach.

A pseudo-random sequence generator (PRNG), L12RC4, inspired by the LZSS compression algorithm and RC4 stream cipher, was presented and implemented. The result of the NIST and Diehard test suite indicate that the L12RC4 is a good PRNG, and so it seems to be sound and may be suitable for use in some cryptographic applications. We also found that the probability distribution of the index value frequency is associated with the compression pass and INDEX_BIT_COUNT value. As for one pass mode, the greater INDEX_BIT_COUNT value, the more uniformly distributed, and the double pass mode has better uniformity than the one pass mode.

In this paper, we studied the block LZSS algorithm and investigated the relationship between the compression ratio of block LZSS and the value of index or length. We found that as the block size increases, the compression ratio becomes better. We also found that the bit of length has little effect on the compression performance, and the bit of index has a significant effect on the compression ratio. We showed that the more the bit of index is set, the bigger optimal block size is obtained.

In this paper we present a universal compression algorithm for English text, ERecode. The proposed scheme highlights the importance of pre-processing work for English text, and employs one or two bytes code values to recode the 511 most common used English words, sequences of symbols and ASCII codes based on their occurrence frequency. Acting as a pre-processing tool for English text by the popular compression utilities, ERecode can improve their compression ratio from 0.89% to 19.65%. The proposed method also is applicable to text files for other languages.

In order to prevent network bandwidth being uncontrolled occupied, various network traffic must be identified and then applied to responding controlling policy. To achieve this, this paper proposed a framework for network traffic identification. This framework uses the plug-in mechanism to manage the identification process. Since each plug-in can work independently, plug-ins can be easily updated or added so as to adapt the changing of applications or appearance of new applications. This paper also proposed priority based mechanism and competition based mechanism in the scheduling to eliminate redundant processing. The experimental results show that this framework is scalable and high efficient. It can provide effective management support for current high-speed network.

For protection of the confidentiality and integrity of the mobile codes, this paper proposes a new decentralized label model and a implementation of this model in Linux system, MCGuard. Using MCGuard, the owners can flexibly define their security policies to control the dissemination of their mobile codes just by labelling them. By intercepting system calls, MCGuard inserts an interposition layer between the processes and system calls to control the data flows of mobile codes and guarantee them not to be transmitted to insecure channels and manipulated by malicious principals. In MCGuard, the labelling and control of the mobile codes and their transmitting channels is performed at the level of standard operating system abstractions, and the labels can migrate between hosts. This makes the MCGuard applicable in mobile code systems composed of the stock Linux OS and existing mobile codes.

Most template detection methods process web pages in batches that a newly crawled page can not be processed until enough pages have been collected. This results in large storage consumption and a huge delay of data refreshing. In this paper, we present an incremental framework to detect templates in which a page is processed as soon as it has been crawled. In this framework, we don't need to cache any web page. Experiments show that our framework consumes less than 7% storage than traditional methods. And also the speed of data refreshing is accelerated because of the incremental manner.

Flash crowd events (FCEs) and malicious traffic including DDoS and worm attacks present a real threat to the stability of Web services. In this paper, we design a practical defense system that can provide some needed relief from the two types of events and protect the availability of Web services. A novel method of dynamic bandwidth arbitration using Generalized Vickrey auction based on microeconomics is proposed. By adopting this approach, not only the availability of Web services is improved but also the total utility of users can be maximized. Initial simulations have shown that this mechanism is promising direction to control both FCEs and malicious traffic. The presentation in this paper is a first step towards a more rigorous evaluation.