Large-scale dynamic intranet environments are characterized by constantly changing configurations, evolving user behaviors, and diverse assets that increase vulnerability pathways. These factors undermine the effectiveness of Bayesian attack graphs and reveal the limitations of traditional security methods that rely on static assumptions. To address these challenges, this paper proposes a novel Bayesian attack graph method designed for large-scale, active intranet security assessments. It captures real-time intranet changes by extracting system audit logs and generates attack graphs with MulVAL, ultimately resulting in a time-spanning understanding of potential security risks. Furthermore, it identifies direct-risk paths by eliminating weak dependencies between actions and estimates the likelihood of action execution based on expectations, thereby substantially reducing the computational complexity of Bayesian security analysis. To validate the proposed method, this paper conducts dynamic threat modeling and quantitative security analysis on an enterprise intranet using logs from over 1,000 hosts. The results demonstrate that the proposed method not only provides internal network security risk values at any given time but also identifies specific and observable potential attack paths. Furthermore, this study provides a reference framework for prioritizing vulnerability remediation based on changes in internal network security conditions

This paper studies the detection and identification problem of malicious network traffic and proposes a rule extraction algorithm based on interpretable models. The algorithm utilizes interpretable greedy trees as the foundational model and extends its applicability to handle multi-classification problems, thereby enhancing interpretability and detection accuracy. This methodology furnishes a more dependable and secure framework for discerning attack categories within the domain of network security. The experiment results show that the proposed algorithm achieves better balance between interpretability and identification precision.

Traditional abnormal network traffic detection methods only consider statistical features and ignore structural relationships, which makes them difficult to detect advanced attacks. In this paper, we propose DyGCN(Dynamic Graph Convolution Network) for anomaly network traffic detection. Firstly, we represent the network at a given time with a graph using hosts as nodes and construct a graph stream according to the dynamic network. We propose a dynamic graph model with structural learning and temporal learning for hosts. Secondly, we put forward a normal traffic pattern-based contrastive learning method by analyzing the structural characteristics of normal traffic. Thirdly, we obtain the graph representation with edge anomaly probability-based graph embedding method to mine the anomalous substructures in the graph. Finally, we use an anomaly detection model to judge the anomaly of the current network. Experimental results on two datasets demonstrate that DyGCN outperforms traditional anomaly detection methods and state-of-the-art dynamic graph embedding methods.

This paper studies the secure and safe control problem of connected and automated vehicles (CAVs) with false data injection (FDI) attacks. A secure and safe controller with a novel surrounding vehicles’ state estimator and an attack detector is proposed. The state estimation for surrounding vehicles is collectively processed by combining the deep neural network-based predictions with model-based estimations. Additionally, a weight in the loss function is proposed for more accurate predictions of vehicles that are closer to the ego vehicle. For attack detection, a novel scheme that utilizes control outcomes to train detection actions is proposed. Different from the objectives of existing detectors, the reward for the proposed detector is designed to encourage the CAV to fully utilize the observations. A reward setting and the decision preference of the ego vehicle are theoretically analyzed. The effectiveness of the proposed algorithm is validated in an open simulation environment.

As the complexity of cyberattacks continues to increase, multistage combination attacks have become the primary method of attack. Attackers plan and organize a series of attack steps, using various attack tools to achieve specific goals. Extracting knowledge about these tools is of great significance for both defense and tracing of attacks. We have noticed that there is a wealth of security tool‐related knowledge within the open‐source community, but research in this area is limited. It is challenging to achieve large‐scale automated security tool information extraction. To address this, we propose automated knowledge graph construction architecture, named SecTKG, for open‐source security tools. Our approach involves designing a security tool ontology model to describe tools, users, and relationships, which guides the extraction of security tool knowledge. In addition, we develop advanced entity recognition and classification methods, ensuring efficient and accurate knowledge extraction. As far as we know, this work is the first to construct the large‐scale security tool knowledge graph, containing 4 million entities and 10 million relationships. Furthermore, we investigate the tendencies and particularities of security tools based on the SecTKG and developed a security tool influence‐measuring application. The research fills a gap in the field of automated security tools’ knowledge extraction and provides a foundation for future research and practical applications.

Access control is one of the most basic techniques to ensure the security of the information system. The traditional access controls of information systems are usually performed based on the traversals or queries of rules. However, with the increasing complexity of information systems, massive data, and open environments bring great workload and risk for the traditional methods. This study proposes a model of embedding-based computable access control (ECAC), by employing the idea of representation learning in artificial intelligence. According to ECAC, access control rules can be embedded into a Euclidean vector space, and the security of arbitrary behavior can be computed by numerical vector operations, without any traditional querying or traversing of rules, and thus the workload of access control is reduced. Furthermore, by the embedding-based computation, the security of unknown behaviors can be predicted. Potentially, due to the use of numerical vectors instead of traditional semantic symbols, the risk of privacy leakage via semantics can be reduced. Finally, as the first embedding-based access control model, the effectiveness of ECAC is evaluated and concluded by the experiment-based analyses and discussions.

The software-defined 5G networking is one of the most promising 5G network architectures. Software Defined Networking (SDN) is an essential technology in such network architecture, which interconnects the virtualized network functions and is responsible for creating data forwarding paths. In this paper, we propose a practical data forwarding path selecting method to effectively select high-quality main and backup paths. Specifically, we propose a modified LKH algorithm by adopting directed K-OPT operations to find a valid route path. Then, we introduce a single path searching algorithm and a dual path searching algorithm by combining a complexity reducing technique called node scaling and two types of penalties. The comparative results over a HUAWEI official data set and a real network data set demonstrate that the proposed path selecting method, compared with previous path selecting methods, achieves a much better overall performance in terms of the least overlapping directed edges, low total path cost and minimal path searching time.