Federated learning (FL) is widely used in Internet-of-Things (IoT) systems, but its distributed training process also exposes it to backdoor attacks. Existing studies mainly consider single-target or centralized multi-target settings, while coordinated distributed multi-target attacks remain underexplored. In practical IoT scenarios, one adversarial entity may control multiple distributed malicious clients and assign each client distinct triggers and target labels. Under this setting, existing distributed backdoor methods often fail to preserve the effectiveness of all backdoors because malicious updates conflict during aggregation. To address this issue, we propose a Distributed Multi-Target Backdoor Attack (DMBA) for FL. DMBA introduces a Backdoor Replay (BR) mechanism to reduce discrepancies among malicious gradients and a Channel-Frequency Composite Trigger (CFCT) strategy to improve trigger distinguishability and alleviate local interference. Experiments on multiple datasets show that DMBA ensures attack success rates above 80% for all implanted back-doors, whereas some baseline backdoors fall below 50% and may even approach 0.

To analyze the massive social networks for providing personalized services, community search is widely studied to find the densely connected subgraph that can reflect the network properties for a given query. The existing community search methods adopt single community model to make structural constraints on communities, which can only describe single interaction mode. Since they fail to capture the semantics of the network with multiple interaction modes, they struggle to find the representative communities. To solve this issue, we design a novel community model called ( τ, ρ )-camp to flexibly capture complex network semantics in any level of granularity. We propose the unified support maximized community search problem to find the communities with the densest network semantics, which is proven a NP-hard problem. By constructing a hierarchical index structure, we propose an approximate community search algorithm with approximation ratio of 2 and linear time complexity of the query size. Extensive experiments are conducted on two public datasets and two crawled datasets. The experimental results prove the effectiveness and efficiency of our method.

With the deployment of the QUIC protocol, website fingerprinting attacks targeting QUIC traffic are becoming a growing concern. Since the deployment is incremental, attackers must continuously crawl the QUIC traffic of new QUIC-enabled websites to update their attack models. For the latency caused by data crawling and classifier training, existing few-shot website fingerprinting (FSWF) attacks rely on representation learning to mitigate data dependency. To further achieve zero-latency identification, TCP traffic can be applied to construct the attack model before QUIC deployment. However, the different protocol semantics of TCP and QUIC lead to differences in the latent features. As representation learning models cannot eliminate the website feature differences, classifiers trained on TCP-based features are difficult to adapt to QUIC traffic. To address the issue, we propose a novel cross-protocol FSWF attack method to fuse cross-protocol website features. The proposed method forces TCP features and QUIC features to be in the same feature space by sharing model parameters, and reduces cross-protocol website feature differences through inter-protocol adversarial representation learning. Meanwhile, it utilizes a non-linear classifier to fit the fused features. The proposed method enables zero-latency identification for QUIC traffic based on a few TCP traffic. We conducted comprehensive evaluation experiments on public datasets from both closed-world and open-world settings. The proposed method outperforms state-of-the-art methods in zero-latency identification.

Due to the cache’s capacity of forwarding information, Named Data Networking (NDN) has become a promising networking architecture. Since distributed caching is susceptible to cache pollution attacks (CPAs), researchers pay more attention to CPAs detection and defense. The current detection schemes seriously rely on an assumption that the content popularity remains stable over time. However, the change in interests of legitimate users in the network is unavoidable, which makes content popularity change dynamically. Thus, it is difficult to detect CPAs based on a static content popularity distribution. To address this issue, we propose a novel scheme to detect CPAs by analysing latency instead of popularity. The proposed scheme constructs the probability transfer matrix based on the Markov process of contents transfer and detects CPAs by the convergence states of the matrix. Once a CPA is detected, the affected router recognizes the attack type and adopts a specific defense method according to the attack type. This defense method can improve the network Quality of Service (QoS) by leveraging particular methods for different routers rather than the broadcasted global method. Extensive simulations in ndnSIM show that our scheme can effectively detect CPAs with higher detection ratio and defense CPAs with acceptable impacts on the overall network in network scenarios with dynamically changing content popularity.

Malicious domains serve as significant resources for adversaries to execute cyber attacks and are crucial indicators for detecting network intrusions. In practical scenarios, malicious domains associated with various attacks are intermingled within DNS traffic, leading to variability in the performance of machine learning-based detection methods. To address this challenge, we have collected extensive DNS traffic data spanning 12 months from a real-world large-scale network with 1 million users. From this dataset, we have extracted numerous requested domains, encompassing 267 attacks that exploit malicious domain names. Furthermore, we have observed that the distinct properties of malicious domains associated with different attacks contribute to the fluctuating performance of machine learning-based detection models. Consequently, we have introduced a spatiotemporal hypergraph network model, which establishes high-order relationships among domain properties to enhance the generalization capability and robustness of the detection model. The results of extensive testing experiments demonstrate that our model achieves remarkable performance, with an average precision of 97% and recall of 98%.

The vulnerability of Named Data Network (NDN) causes a series of privacy problems. Path inference provides network privacy protection and network security improvement in NDN via obtaining the content transmission paths. The traditional path inference methods ignore the influence of in-network cache, leading to a lacking consideration of the confusion issue between content sources and cached copies. To facilitate the effectiveness and robustness of the path inference, we have proposed a novel method that reduces the influence of incomplete and misleading information. The proposed method consists of two parts. First, the hybrid attack method based on hop count variation is used for collecting complete request feedback information and merging all information to infer paths. Second, the benefit-driven evolutionary game is adopted to promote the cooperation of the timing attack and the cache pollution attack. The combination of the two types of attacks alleviates the restriction of in-network cache. The simulations in ndnSIM indicate that our proposed method infers paths with higher precision, recall, and F1-Score compared to other advanced methods.

In recent years, social media has become one of the most popular ways of news dissemination. There is a phenomenon that numerous fake news are spreading rampantly on public social media platforms, posing a serious threat to the credibility of social media. Moreover, more and more social media news posts carry multimodal contexts, i.e., utilize not only text but also abundant images to describe the news. However, existing methods only involve the first image along with text in multimodal fake news detection. It severely hampers the extraction of global image semantic information and consequently damages the effectiveness of multimodal fake news detection. To address this issue, we propose a Cross-Image Semantic Fusion based multi-modal fake news detection method (CISF for short). The method uses an adaptive attention diffusion module to model semantic correlations among different images, fully leveraging the contextual dependencies between different images to achieve semantic interaction and fusion among images. On the basis, a global image semantic representation is generated to represent the entire image modality. Finally, the fake news detection is performed based on the multimodal fusion of the text and the global image semantic representation. We conduct experiments on two real-world datasets and demonstrate the effectiveness of the proposed method.

Summary This research introduces a comprehensive suite of neural network models designed to tackle the challenging task of rumor stance detection within the framework of simulating complex rumor propagation systems. Our objective centers on accurately modeling the intricate structures of rumor dialogues and propagation patterns to identify user stances—whether they are in support, denial, questioning, or commenting on rumors. Unlike conventional methods that rely on simplistic keyword targeting and fail in the nuanced context of social networks, our models delve into the complexities of dialogue and propagation structures, offering a more precise and insightful analysis of rumor dynamics. In addressing the simulation and modeling of complex systems, our approach specifically focuses on the elaborate interaction networks that underpin rumor spread and reception. While our methodology does not directly engage with brain‐like computing paradigms, it reflects a similar level of sophistication in handling layered and complex information flows, analogous to cognitive processes in understanding and interpreting human communications. Employing a hierarchical attention mechanism, our models adeptly parse through multitiered dialogue sequences, effectively distinguishing between various indicators of user stances. This allows for a nuanced and detailed representation of the rumor ecosystem, significantly enhancing the accuracy of stance detection. Through rigorous testing on diverse datasets, our approach has demonstrated superior performance over existing models, thereby establishing a new benchmark in the field.

Few-shot website fingerprinting (FSWF) attacks attempt to identify whether the users have access to specific websites based on a few training data. Existing FSWF attack methods focus on adapting to variable network conditions in real scenarios. They use various techniques to transfer the model to adapt to test data which has a different distribution from training data. However, recent methods ignore the impact of pre-training data diversity on adaptability. The poor data diversity caused by the user-specific data crawl limits representation ability, and further hinders rapid adaptation to new network conditions. Due to the extreme Non-IId between multiple attackers’ datasets, it is not feasible to mix multiple datasets or perform traditional federated learning methods to improve representation ability. To address the issue, we propose a novel method based on a joint learning framework to achieve the collusion FSWF attacks. The proposed method fuses the feature spaces of multiple user-side attackers to enhance the representation ability of the local model, and constructs a virtual fusion center to mitigate the impact of Non-IID. It improves the adaptability under variable network conditions for the local attacker. This paper conducts comprehensive experiments to evaluate the performance of the proposed method in both closed-world and open-world settings. Compared with the state-of-the-art method, the proposed method improves the accuracy by up to 13.02% in the closed-world setting and the AUC by up to 0.085 in the open-world setting, respectively.

Anchor link prediction enhances the effectiveness of digital forensics through the identification of multiple social network users. The current methods based on deep learning are characterized by both the exaggerated similarity between adjacent nodes in the same latent space and the variation in the feature spaces caused by semantics. A novel approach is developed to fuse the semantic features of different networks in this paper. The proposed method is divided into two stages. Firstly, representation learning pays more attention to the influence of uncertainty on the equivalence of node network structure, and introduces the difference between adjacent nodes from the latent space. Secondly, a joint representation learning framework trains and exchanges the parameters depending on known anchor links. The joint representation learning framework injects fused features into the representation learning processes of different networks. The combination of enhanced discrimination and cross-network feature fusion reduces the feature space differences caused by the semantics of different social networks. This paper conducts comprehensive experiments on social networks in the real world. The outcome shows that the proposed approach is more efficient and robust compared to the existing state-of-theart methods.

Anchor link prediction exacerbates the risk of privacy leakage via the de-anonymization in edge computing. The predictive effect of traditional unsupervised learning methods is too dependent on user attributes and supervised learning methods are sensitive to network structure noise. Anchor link prediction methods based on graph embedding are restricted by the sparsity of the observable anchor links which can be used for training. To facilitate the effectiveness and robustness of the anchor link prediction, we have proposed a novel method which reduces the restrictions on the observable anchor links used for training. The proposed method consists of two phases. First, graph embedding based on network structural roles is used to generate the latent feature space, reconciling the distinction and similarity between nodes. Second, the supervised learning for optimizing the Wasserstein distance which estimates the minimum amount of work to change one distribution into the other. The combination of the reconciled latent feature space and the estimate for the amount of change alleviates the restriction on observable overlapping parts. Extensive experiments on real-life social networks have demonstrated that the proposed method significantly outperforms the state-of-the-art methods in terms of both precision and robustness.

Facing the explosive growth of data, the introduction of cloud computing in the Space-Air-Ground Integrated Internet of Things (SAGIIoT) can solve the problem of limited computing power of the terminals. At the same time, data security on the cloud is also a focus that cannot be ignored. Secure outsourcing computing is helpful in improving privacy preserving. Due to the wide applicability of$K $-means clustering, outsourcing computing for$K $-means has become a major research hotspot in industry and academia. Most of the existing work on outsourcing$K $-means clustering is based on homomorphic encryption, which has a high computational overhead due to the mathematical puzzles’ nature of homomorphic encryption. In addition, the high computational overhead of designing a verification algorithm based on homomorphic encryption is unacceptable. To address the above issues, we design a${K}$-means clustering outsourcing algorithm by sparse matrix transformation, which can verify the deceptive behavior of cloud while achieving high efficiency. In this article, we theoretically prove the accuracy, security, efficiency, and verifiability of the proposed algorithm. Extensive experiments indicate that our algorithm is efficient.

Anchor link prediction exacerbates the risk of privacy leakage via the de-anonymization of social network data. Embedding-based methods for anchor link prediction are limited by the excessive similarity of the associated nodes in a latent feature space and the variation between latent feature spaces caused by the semantics of different networks. In this article, we propose a novel method which reduces the impact of semantic discrepancies between different networks in the latent feature space. The proposed method consists of two phases. First, graph embedding focuses on the network structural roles of nodes and increases the distinction between the associated nodes in the embedding space. Second, a federated adversarial learning framework which performs graph embedding on each social network and an adversarial learning model on the server according to the observable anchor links is used to associate independent graph embedding approaches on different social networks. The combination of distinction enhancement and the association of graph embedding approaches alleviates variance between the latent feature spaces caused by the semantics of different social networks. Extensive experiments on real social networks demonstrate that the proposed method significantly outperforms the state-of-the-art methods in terms of both precision and robustness.

Anchor link prediction across social networks plays an important role in multiple social network analysis. Traditional methods rely heavily on user privacy information or high-quality network topology information. These methods are not suitable for multiple social networks analysis in real-life. Deep learning methods based on graph embedding are restricted by the impact of the active privacy protection policy of users on the graph structure. In this paper, we propose a novel method which neutralizes the impact of users’ evasion strategies. First, graph embedding with conditional estimation analysis is used to obtain a robust embedding vector space. Secondly, cross-network features space for supervised learning is constructed via the constraints of cross-network feature collisions. The combination of robustness enhancement and cross-network feature collisions constraints eliminate the impact of evasion strategies. Extensive experiments on large-scale real-life social networks demonstrate that the proposed method significantly outperforms the state-of-the-art methods in terms of precision, adaptability, and robustness for the scenarios with evasion strategies.

One of the advantages of multiphase machine is the capability of fault tolerance. Variety of post-fault control methods based on hysteresis, proportional-integral (PI), proportional resonant (PR) and model predictive controller (MPC) have gradually been developed. Due to simple structure and decoupling of reduced-order matrix, it is used as an alternative to the Clarke matrix in the healthy mode when the fault happens. Although a lot of control methods adopted a reduced-order matrix as the basic derived technology, the performance of controllers is different, and they need to be compared in term of specific applications in fault tolerance. For this propose, the paper deals with the steady-state and dynamic performance of four current control methods, hysteresis control, PI control, PR control and model predictive control in open-circuit fault. The results shows that the PR control method has low torque ripple, copper loss and derating in healthy and post-fault stage, and the MPC control method has low torque ripple in fault stage and fast response capability after applying fault-tolerant methods.

Recent years have witnessed lots of attacks targeted at the widespread Internet of Things (IoT) devices and malicious activities conducted by compromised IoT devices. After some notorious IoT malware released their source code, many new variants emerge, which are usually more powerful and stealthy. Although numerous existing studies have analyzed some exposed families, there is a lack of systematic study to make full use of them, which can be a fundamental step for provenance, triage, labeling, lineage analysis, and authorship attribution. The key challenge of conducting an IoT malware evolutionary study is how to collect sufficient and accurate information about malware and identify the relationships among them. In this article, we take the first step to investigate the IoT malware evolution by leveraging the information from two sources that complement each other. First, we crawl online articles about IoT malware and employ natural language processing techniques to extract the features of malware samples and their relationships with other malware family, which allow us to form the basic lineage graph. Second, we collect real malware samples through our widely deployed honeypots and design a new classifier to group them into families and identify lineage relationships among them. Such results are used to enhance the basic lineage graph. Eventually, we construct the final lineage graph for 72 IoT malware families by correlating the information from the aforementioned sources, which can help the research community better understand and fight IoT malware now and in the future. Our study has been incorporated into the threat awareness system of NSFOCUS company.

With the rapid development of smart devices, mobile phones have permeated many aspects of our life. Unfortunately, their widespread popularization attracted endless attacks that are serious threats for users. As the mobile system with the largest market share, Android has already become the hardest hit for years. To Detect Android Malware by ORGB Analysis, in this paper, we present DAMBA, a novel prototype system based on a C/S architecture. DAMBA extracts the static and dynamic features of apps. For further analyses, we propose TANMAD algorithm, a two-step Android malware detection algorithm, which reduces the range of possible malware families, and then utilizes subgraph isomorphism matching for malware detection. The key novelty of this paper is the modeling of object reference information by constructing directed graphs, which is called object reference graph birthmarks (ORGB). To achieve better efficiency and accuracy, in this paper, we present several optimization strategies for hybrid analysis. DAMBA is evaluated on a large real-world dataset of 2239 malicious and 1000 popular benign apps. The detection accuracy reaches 100% in most cases, and the average detection time is less than 5 s. Experimental results show that DAMBA outperforms the well-known detector, McAfee, which is based on signature recognition. In addition, DAMBA is demonstrated to resist the known malware attacks and their variants efficiently, as well as malware that uses obfuscation techniques.

Smartphone usage has been continuously increasing in recent years. In addition, Android devices are widely used in our daily life, becoming the most attractive target for hackers. Therefore, malware analysis of Android platform is in urgent demand. Static analysis and dynamic analysis methods are two classical approaches. However, they also have some drawbacks. Motivated by this, we present Demadroid, a framework to implement the detection of Android malware. We obtain the dynamic information to build Object Reference Graph and propose λ -VF2 algorithm for graph matching. Extensive experiments show that Demadroid can efficiently identify the malicious features of malware. Furthermore, the system can effectively resist obfuscated attacks and the variants of known malware to meet the demand for actual use.