Alerts generated by Security Operations Centers (SOCs) are often numerous and scattered, requiring significant effort from security analysts to manage, which severely slows response times. While recent alert correlation graph methods can effectively reduce alert volume, these graphs are often too complex for analysts to understand. As a result, analysts are increasingly seeking ways to automatically correlate alerts and generate concise, human-readable attack path summaries. Recently, Large Language Models (LLMs) have demonstrated superior performance due to their advanced capabilities in knowledge reserve and reasoning. In this work, we propose GARNET, a framework that uses LLMs for reasoning on alert correlation graphs. GARNET addresses three key technical challenges: 1) modality alignment between alert graphs and logs; 2) semantic alignment between alert graphs and logs; 3) enabling LLMs reasoning along graph paths. Specifically, we first project the embeddings of the graph and logs into the same vector space using contrastive learning. Then, we design self-supervised graph-log instructions to bridge the semantic gap between the graph and logs by training a novel LLM. Finally, GARNET uses a novel Graph-of-Thought (GoT)-based interaction reasoning approach to guide LLM reasoning along graph paths, ultimately generating structured, concise, and human-readable attack path summaries. Experimental results across six attack scenarios show that GARNET reduces false positives by an average of 80%, lowering the false positive rate to below 0.0037. It outperforms the latest approaches and provides more explainable attribution.

Advanced Persistent Threats (APTs) are difficult to detect due to their complexity and stealthiness. To mitigate such attacks, many approaches model entities and their relationship using provenance graphs to detect the stealthy and persistent characteristics of APTs. However, existing detection methods suffer from the flaws of missing indirect dependencies, noisy complex scenarios, and missing behavioral logical associations, which make it difficult to detect complex scenarios and effectively identify stealthy threats. In this paper, we propose Sentient, an APT detection method that combines pre-training and intent analysis. It employs a graph transformer to learn structural and semantic information from provenance graphs to avoid missing indirect dependencies. We mitigate scenario noise by combining global and local information. Additionally, we design an Intent Analysis Module (IAM) to associate logical relationships between behaviors. Sentient is trained solely on easily obtainable benign data to detect malicious behaviors that deviate from benign behavioral patterns. We evaluated Sentient on three widely-used datasets covering real-world attacks and simulated attacks. Notably, compared to six state-of-the-art methods, Sentient achieved an average reduction of 44% in false positive rate(FPR) for detection.

While Tor's strong anonymity shields users' privacy, it also enables malicious activities, motivating attacks that bypass its protections. Website Fingerprinting (WF) has emerged as a primary threat in this domain. However, existing WF methods struggle with realistic multi-tab browsing scenarios, often relying on prior knowledge of the number of open tabs and lacking robustness against network noise and defenses.

Abstract Encrypted web traffic and evolving Internet technologies pose an increasing challenge to network traffic analysis. However, existing traffic classification methods, though effective, require large labeled datasets and complex training. This makes sustaining them prohibitively expensive and difficult in real-world scenarios. To narrow this gap, we propose a novel training-free few-shot network traffic classification framework based on large language models (LLMs). By integrating meta-learning with LLMs, it reduces reliance on labeled data, eliminates task-specific training, and improves performance. Specifically, we first apply an efficient feature extraction method to extract features from traffic flows. We then design meta-tasks that combine task descriptions with textualized features to produce natural language meta-task formulations. Building on these meta-tasks, the LLM performs reasoning to carry out traffic classification. Finally, to mitigate hallucination in the LLM outputs, we exploit the temporal characteristics of network traffic and aggregate predictions over samples within a defined time window. Extensive experiments on three widely-used encrypted traffic datasets demonstrate that our proposed framework outperforms the state-of-the-art methods, achieving an average absolute improvement in F1 score of 9.75, 9.82, and 12.06 percentage points on the three datasets, respectively.

Abstract System call security is crucial for host-based intrusion detection, as security-sensitive system calls (e.g., execve, mprotect) play a vital role in completing attacks. However, existing defense methods face significant limitations. Static analysis and system call filtering cannot prevent the malicious use of necessary syscalls, while runtime methods based on control-flow, syscall sequences, or parameter integrity are vulnerable to sophisticated attacks, such as data-only attacks, that mimic benign execution patterns. In this paper, we propose a novel contrastive learning framework, SysAlign, for system call security that ensures the semantic consistency between a system call’s macro-level and micro-level intents. SysAlign learns the macro-level intent by the sequence of system calls, which reflects the broader objective of a program phase. The micro-level intent is derived from the specific execution path, capturing the detailed execution context of system calls. Malicious system calls disrupt this consistency, leading to a detectable misalignment between the two intents. To minimize the overhead, we efficiently represent micro-level intent using critical points instead of tracking full execution paths. These points are extracted via dominator tree analysis on the program’s over-approximated control-flow graph, effectively balancing rich semantics with performance. Additionally, to address the scarcity of attack data, our framework incorporates a tailored negative sampling strategy, enhancing the model’s robustness. We evaluated SysAlign on real-world applications, including Nginx, NullHttpd, cURL, and SQLite3. The results demonstrate that our method effectively detects a diverse range of malicious system call behaviors, including those resulting from control-flow hijacking and data-only exploits. Our approach achieves an F1-score exceeding 96% with a performance overhead below 7%. This work presents a practical and effective advancement in system call security, significantly outperforming existing techniques.

Abstract Insiders threats typically originate from authorized personnel who are familiar with the organization’s insider security measures. They typically hide within vast amounts of normal operational logs, characterized by their covert nature, complexity, and diversity. These attributes make insider threat detection one of the most challenging tasks in cybersecurity protection for enterprises and organizations. Current methods for insider threat detection primarily fall into two categories: traditional machine learning methods and deep learning methods. Machine learning methods typically rely on feature engineering to extract features, which are then processed by shallow models. Deep learning methods typically operate by either feeding user feature vectors into neural networks or by analyzing chronological behavior sequences from user logs with time series models to detect insider threats. However, existing methods frequently ignore the multi-scale periodicity inherent in user behaviors and do not adequately leverage absolute timestamp data from logs. Furthermore, they typically categorize behaviors coarsely as normal or anomalous, which fails to achieve precise identification of distinct insider threat types. To address these limitations, we propose BTITD, a dual-stream network for insider threat detection. BTITD first processes user behavior logs into two parallel sequences: a behavior sequence and a timestamp sequence. The behavior sequence is transformed via Fourier transform, folded into two-dimensional tensors based on key periods, and processed with two-dimensional convolutions to extract multi-scale periodic patterns. Meanwhile, the timestamp sequence is modeled by a BiLSTM network to capture long-range temporal dependencies. Finally, an attention mechanism fuses the representations from both streams to achieve accurate detection. A series of experiments on the CERT 4.2 dataset demonstrate that BTITD outperforms baseline methods in both binary and multi-class detection tasks. BTITD achieves an F1 score of 97.56% for binary detection and a macro-F1 score of 94.66% for multi-class detection.

The rise in network attacks has made robust malicious traffic detection crucial. However, the dynamic nature of network traffic causes concept drift, undermining the efficacy of traditional detection methods, which often rely on a static i.i.d data environment and struggle to adapt to new patterns. To overcome these limitations, we propose Argus, a novel framework for malicious traffic detection that operates in a comprehensive, automated, and adaptive manner. Argus tackles three core challenges: accurately classifying known traffic while detecting drift, automatically identifying malicious drifting traffic, and maintaining performance through continuous updates. To address these challenges, Argus integrates a contrastive learningbased module to produce compact representations of traffic and implements a fine-grained drift detection method using category-specific reconstruction loss distributions. For drifting traffic, Argus uses clustering-based automated identification to detect attacks without human intervention. Furthermore, a distance-constrained update mechanism ensures smooth model adaptation, preserving stability and accuracy. Extensive experiments demonstrate that Argus achieves superior performance, with an average F1 score exceeding 95% under various conditions and retaining robust performance even under extreme drift scenarios.

The burgeoning prevalence of Ethereum phishing behavior has iCSUR-2025-0155mposed substantial constraints on the advancement of blockchain finance, resulting in losses of more than $7.7 billion to date, so it is urgent to detect it in time. Currently, available detection methods usually focus on the spatial features within transaction graphs. These methods often employ shallow mining techniques on small samples. As a result, they may overlook certain aspects of interaction patterns, such as temporal behavior. Additionally, their data mining capability is limited due to the small sample sizes. In this study, we propose a graph contrastive learning framework to enrich features of accounts behavior patterns with restricted samples to overcome these limitations. Firstly, we construct an Ethereum interaction graph with the multi-graph involving more temporal information centered with labeled nodes and lighten it with our strategy. Secondly, to comprehensively characterize the accounts pattern, we design the encoder part with the GAT-LSTM model based on attention mechanism fusing statistical features , fine-grained temporal behavioral features and graph structural semantic features . Thirdly, to moderate the sparsity of phishing nodes, we employ data augmentation and contrastive learning to fully mine sparse node information. Moreover, we carried out an in-depth experimental evaluation. The CMD-EPD approach, boasting an F 1 -score of 0.87, outperformed all comparison methods. We also executed a thorough case study to analyze phishing accounts phenomenological indicators which back up the superiority of our framework.

The widespread implementation of the HTTPS protocol has greatly bolstered user privacy and data security. However, the widespread use of the HTTPS protocol has also provided criminals with a cloak to disseminate harmful content through websites, thereby undermining the integrity of the online environment. Web page fingerprinting has emerged as a highly popular method for web application identification. Yet, due to the frequent updates of web applications, existing methods struggle with accuracy issues. To tackle these challenges, this paper introduces a novel approach called CrossWP, which leverages cross-web page fingerprinting to enhance the security of the network environment. CrossWP aims at classifying web applications, which novelly constructs the cross web pages behavior sequences on handshake, request and response sequence. CrossWP uses the transformer model based on multi-sequence fusion to thoroughly learn and integrate these unique spatio-temporal sequence characteristics. This model can also capture the internal similarity of behavior sequence, and achieving high accuracy. The effectiveness of CrossWP is validated through closed-world and open-world evaluations, which involve identifying and classifying news websites, social websites, online video websites and e-commerce websites. The results indicate that CrossWP outperforms existing algorithms in terms of both robustness and accuracy.

Webshell, as a common type of malicious script, is frequently utilized by cyber attackers who execute unauthorized commands on the victim's server to carry out attacks. Strengthening research on Webshell detection techniques is crucial for building a robust cybersecurity defense. Despite significant progress in the field of Webshell detection, these techniques still face numerous challenges. Firstly, the continuous evolution of attacker techniques has enhanced the adversarial capabilities of Webshell, including rapid updates to version variants, as well as the use of advanced obfuscation techniques. Secondly, the use of HTTPS has grown dramatically from 40% in 2014 to 98% in 2023, rendering techniques based on plaintext rules ineffective for detecting Webshell. These technological updates make it difficult for traditional detection methods to effectively identify and defend against Webshell variants based on the HTTPS protocol. To address this problems, we propose a novel dynamic behavior-based detection techniques called DBBDdetect, aiming at detecting encrypted variant Webshell in order to protect critical infrastructure. DBBDdetect delves into the interaction process between the Webshell and the server, extracting three types of feature information. It utilizes CNNs to obtain vector features of the traffic payload and concat statistical features and similar sequential byte behavior features. Then, it uses DBSCAN clustering model to analyze behavioral similarities to detect variant Webshell attacks. This method captures the intrinsic similarities in behavior, and experiments have shown that it achieves a high level of accuracy.

Insider threats have been a focal point in cyberse-curity, leading to severe data leakage and organization system crashes. Due to the low proportion of malicious samples, most methods establish the baseline of normal user behaviors and identify users deviating from this baseline as malicious insiders. However, these methods fail to capture the heterogeneity and temporal evolution of user behavior patterns effectively. This paper proposes an evolving heterogeneous graph transformer based on Siamese architecture (SiamEHGT) to detect malicious insiders. Firstly, SiamEHGT constructs behavior heterogeneous graph sequences for users based on a fixed-size time window. Secondly, SiamEHGT employs the proposed EHGT to explore the heterogeneity of user behaviors on these graphs, while continuously evolving model parameters to mine the dynamism of user behaviors over time. Finally, Siamese architecture is applied at the graph level to learn the similarity of user behavior patterns across any two time windows, effectively using the limited labeled malicious samples. We evaluate our method on CERT and LANL datasets, and the results demonstrate that our approach outperforms many state-of-the-art methods.

As cloud computing and mobile work blur traditional network boundaries, security measures like static firewalls and signature-based systems are becoming inadequate. Audit logs contain fine-grained OS-level information, but due to their vast volume and the complex relationships between entities, processing and analyzing them remains a significant challenge. In this paper, we introduce MPKAN, a new method for detecting APT attacks, which enhances the information input of nodes and edges, integrates node-level and edge-level information, and improves graph-level semantics. It uses meta-path random walks to enhance semantic connections between nodes, merges multiple edges in the provenance graph into a single edge while retaining the original edge information and operation sequence relationships, and by associating heterogeneous graph neighbors, utilizing the message passing mechanism to iteratively update states based on neighbor node information, and using a knowledge association network to integrate node-level and edge-level information, we can effectively capture local and global structural information in the graph. MPKAN's evaluations on the ATLAS and Darpa datasets demonstrate its excellent performance in complex attack scenarios, achieving an average accuracy of 0.9899 and an F1 score of 0.9853, confirming its effectiveness and efficiency.

Advanced Persistent Threats (APTs) are exceptionally challenging to detect due to their high stealthiness. Audit logs, which provide detailed process-level information and record all activities before and after an APT attack, are crucial for detecting such threats. However, the sheer volume of data in audit logs also poses a significant challenge. Current methods suffer from the following issues: 1) difficulty in extracting information from the complex contextual relationships within audit logs, 2) reliance on prior knowledge for detecting APT attacks, and 3) coarse-grained detection signals. In this paper, we introduce Autumn, an APT detection method focused on processes as the primary research object. Autumn is an unsupervised learning model that does not rely on prior knowledge, making it more suitable for real-world APT detection scenarios. Autumn can swiftly identify critical information from vast audit logs and provides fine-grained detection signals by focusing on processes. We begin by constructing a graph from audit logs, segmenting it into subgraphs based on time, and applying strategies to reduce data volume. We then learn the characteristics of processes. By converting process information into input vectors using word2vec and calculating the reconstruction error for each subgraph through the encoding and decoding process of a transformer autoencoder, we train the model by associating the processes' IDF scores. Finally, we train the model on benign data and test it on a separate set of subgraphs containing attack events. Compared to other unsupervised learning methods, Autumn shows significant improvement in detection performance.

The stealth and persistence of APT attacks make investigation particularly challenging, further complicated by the diversity and volume of host logs. Existing methods, though effective, have limitations: 1) They rely heavily on manual processing and complex models that often fail to capture temporal relationships in logs; 2) These models struggle to differentiate highly similar attack behaviors from normal activities; 3) Interpretability and security challenges in deep learning models remain unresolved. This paper introduces DCASI, a sequence-based investigation method that integrates DTW similarity with contrastive learning. By constructing provenance graphs and extracting sequences through node pairs, DCASI performs semantic analysis, computes DTW similarity matrices, and employs contrastive learning to generate robust sequence representations. A lightweight random forest model is then used to identify attack behaviors. Evaluation on public datasets shows that DCASI outperforms existing methods.

With the growth of the Internet of Things (IoT) market, IoT devices have become major targets for attacks. For network administrators, effectively addressing these attacks requires accurately identifying IoT devices. Due to the rich communication protocols and complex network environments of IoT, current fingerprinting methods lack robustness. This paper proposes a fingerprinting method based on Context-Packet, which effectively reduces the impact of traffic noise and fingerprint redundancy by focusing only on session packets that carry payload data. Additionally, a lightweight Efficient VMamba model is trained to extract fingerprints from the packets. We design a method that utilizes the Context-Packet length sequences to classify traffic samples from the same device category, while retaining rare traffic samples during the random sampling process. Experiments show that our method outperforms existing approaches in classification performance, improving the F1 score to 97.08% ( 0.60% ↑ ), 98.07% ( 2.7% ↑ ), 95.55% ( 1.27% ↓ ), and 92.22% ( 3.71% ↑ ) in the AA, II, AI, and IA experiments, respectively. Moreover, it offers faster inference speed and lower resource overhead.

Alert underreporting presents a significant challenge to the reconstruction of attack chains, as it often leads to the absence of critical information necessary for fully presenting the entire attack. To address this issue, this paper proposes an approach for attack chain context inference and completion based on Large Language Models. By integrating an attack knowledge base, this approach leverages LLM-driven inference to identify missing attack stages and uncover potential attack behaviors. Experimental results demonstrate that this approach can effectively detect omitted alerts and complete the attack chain, thereby enhancing the integrity of attack detection.

Advanced Persistent Threats (APTs) are continuously evolving, leveraging their stealthiness and persistence to put increasing pressure on current provenance-based Intrusion Detection Systems (IDS). This evolution exposes several critical issues: (1) The dense interaction between malicious and benign nodes within provenance graphs introduces neighbor noise, hindering effective detection; (2) The complex prediction mechanisms of existing APTs detection models lead to the insufficient utilization of prior knowledge embedded in the data; (3) The high computational cost makes detection impractical.

Advanced Persistent Threats (APTs) comprise complex and stealthy attack techniques. Due to the characteristics of system audit logs in capturing system-level process calls and providing granular log data, using audit logs for causal analysis of advanced threat behaviors has become a popular solution. However, existing solutions still suffer from several deficiencies: (1) semantic gaps between raw data in low-level views and high-level system behaviors, (2) fatigue alert, and (3) poor interpretability and inferability. In this paper, we propose PathWatcher, a path-based behavior detection method, which enables attack investigation based on detection results. PathWatcher enhances low-level semantics by combining operation sequences, extracting paths as behavioral entities from the provenance graph, and learning path features. This approach reduces the semantic gap between low-level data and high-level system behaviors. PathWatcher first performs graph construction and path extraction in the graph construction module, followed by feature learning of nodes and paths in the behavioral sequence extraction module, the data generated during the process exists in the path record with a certain rule, and finally the data from the path record is used for feature extraction and path tracing in the behavior identification and attack clues module, the data from the path record is used for feature extraction and path tracing. This model exhibits strong inferability and interpretability by matching paths to operational behaviors in logs. This allows security researchers to combine path records and investigate attacks directly using high-level semantics, thereby alleviating alert fatigue. Our experimental results demonstrate that PathWatcher effectively improves the detection accuracy of malicious behaviors while enhancing semantic interpretability. The detection results are inferable, achieving accuracies of 99.76% and 99.07% on two datasets, and we provide an analysis of attack investigations.

Abstract Insider threats pose significant challenges to network security due to their destructive and covert nature, often resulting in substantial losses for enterprises. Traditional methods mainly analyze user behavior patterns or convert behaviors into time sequences for further analysis. However, existing detection methods primarily focus on identifying abnormal users or behaviors, lacking the capability to pinpoint specific threats. Additionally, these methods struggle to accurately identify long-distance dependencies in behavior sequences, frequently increasing false positives. To address these issues, we introduce a scenario-oriented insider threat detection model. This model targets three specific threat scenarios-privilege abuse, identity theft, and data leakage-by analyzing user behavior patterns, extracting detailed behavioral characteristics, and constructing behavior sequences. Firstly, this paper serializes user behavior daily and vectorizes it using one-hot encoding. Then, it introduces contextual characteristic information and reconstructs the background of abnormal behavior through behavior vectorization, providing a comprehensive description of user behavior characteristics. This approach addresses the issue of behavior isolation, thereby improving the accuracy and robustness of anomaly detection. Subsequently, a time series analysis model based on a multi-head attention mechanism is employed to analyze long-distance dependencies in behavior sequences. The multi-head attention mechanism simultaneously attends to multiple positions in the behavior sequence, capturing potential correlations between behaviors and user behavior patterns. This mechanism can analyze local information and obtain long-distance dependencies, providing depth feature representation for anomaly detection. Ultimately, we achieve the goal of classifying abnormal behavior sequences. We conduct comprehensive tests on the CERT dataset, demonstrating that our method outperforms traditional deep learning approaches (LSTM, GNN, and GCN) in detecting abnormal sequences. Compared to the best results among the baseline methods, it shows an improvement in accuracy of approximately 2% for privilege abuse, 5% for identity theft, and 2% for data leakage.

Encrypted traffic classification plays a critical role in network security and management. Currently, mining deep patterns from side-channel contents and plaintext fields through neural networks is a major solution. However, existing methods have two major limitations: (1) They fail to recognize the critical link between transport layer mechanisms and applications, missing the opportunity to learn internal structure features for accurate traffic classification. (2) They assume network traffic in an unrealistically stable and singular environment, making it difficult to effectively classify real-world traffic under environment shifts. In this paper, we propose FG-SAT, the first end-to-end method for encrypted traffic analysis under environment shifts. We propose a key abstraction, theFlow Graph, to represent flow internal relationship structures and rich node attributes, which enables robust and generalized representation. Additionally, to address the problem of inconsistent data distribution under environment shifts, we introduce a novel feature selection algorithm based on Jensen-Shannon divergence (JSD) to select robust node attributes. Finally, we design a classifier, GraphSAT, which integrates Graph-SAGE and GAT to deeply learn Flow Graph features, enabling accurate encrypted traffic identification. FG-SAT exhibits both efficient and robust classification performance under environment shifts and outperforms state-of-the-art methods in encrypted attack detection and application classification.

The command and control (C&C) mechanism is the key to realizing many network attack activities. Most available C&C traffic detection methods rely on machine learning. However, the methods often detect specific attacks and struggle to adapt to the complex needs of real-world network traffic environments due to high training costs and limited transferability. To address the problems, we propose a C&C communication traffic detection model called HBGraph, a host behavior graph model based on directed packet payload length sequences. The model can preprocess the original traffic datasets, extract directed payload length sequences, and then integrate them into weighted directed graphs that represent different host communication behaviors. We also propose a method of merging graphs with the same label. In HBGraph, we measure the similarity between the unknown instance and the signature with both node and edge similarity scores. Finally, the model can predict whether the unknown test instance belongs to the C&C communication traffic. After experimental evaluation, we prove that our model has good performance, strong generalizability, and detection ability for C&C communication behaviors.

With the digital transformation of enterprises, the increasing complexity of their internal information systems poses a growing challenge in terms of insider threats. Most existing research focuses on user-level and session-level insider threat detection, neglecting activity-level detection, leading to a lack of fine-grained insider threat detection. To tackle the aforementioned issue, we propose MADE, a novel method for detecting malicious activities within enterprise environments. MADE first encodes user multi-source activity logs into activity sequences and learns the semantic representations of activities within the sequences through embedding. Following this, we design an activity detection network based on Bidirectional Long Short-Term Memory (BiLSTM), Convolutional Neural Network (CNN), and Conditional Random Field (CRF). Combining adversarial training, our activity detection network learns the embedded activity sequences and identifies malicious activities. Extensive experimental results on the CERT R4.2 and R5.2 datasets demonstrate the effectiveness of our proposed MADE method.

Malicious traffic detection has been a focal point in the field of network security, and deep learning-based approaches are emerging as a new paradigm. However, most of them are supervised methods, which highly depend on well-labeled data, and fail to handle unknown or continuously evolving attacks. Unsupervised methods alleviate the need for labeled data, but existing methods are often limited to detecting anomalies either in vertical perspective through historical comparisons or in horizontal perspective by comparing with concurrent entities. Relying on data from a single perspective is unreliable, and it limits the model's accuracy and generalizability. In this paper, we propose a novel method ContraMTD based on contrastive learning, which comprehensively considers both vertical and horizontal perspectives. ContraMTD extracts local behavior features and global interaction features from normal network traffic by proposed SEC and DE-GAT respectively, then employs contrastive learning to learn the relationship, especially consistency between them, and finally detects malicious traffic through a multi-round scoring approach. We conduct extensive experiments on three datasets, including a self-collected dataset, and the results demonstrate that our method outperforms many state-of-the-art methods in the domain of unsupervised malicious traffic detection.

Abstract Advanced Persistent Threats (APTs) achieves internal networks penetration through multiple methods, making it difficult to detect attack clues solely through boundary defense measures. To address this challenge, some research has proposed threat detection methods based on provenance graphs, which leverage entity relationships such as processes, files, and sockets found in host audit logs. However, these methods are generally inefficient, especially when faced with massive audit logs and the computational resource-intensive nature of graph algorithms. Effectively and economically extracting APT attack clues from massive system audit logs remains a significant challenge. To tackle this problem, this paper introduces the ProcSAGE method, which detects threats based on abnormal behavior patterns, offering high accuracy, low cost, and independence from expert knowledge. ProcSAGE focuses on processes or threads in host audit logs during the graph construction phase to effectively control the scale of provenance graphs and reduce performance overhead. Additionally, in the feature extraction phase, ProcSAGE considers information about the processes or threads themselves and their neighboring nodes to accurately characterize them and enhance model accuracy. In order to verify the effectiveness of the ProcSAGE method, this study conducted a comprehensive evaluation on the StreamSpot dataset. The experimental results show that the ProcSAGE method can significantly reduce the time and memory consumption in the threat detection process while improving the accuracy, and the optimization effect becomes more significant as the data size expands.

Abstract Internal network attacks pose a serious security threat to enterprises and organizations, potentially leading to critical information leaks and network system damage. Hosts, as the core data and service bearers, are often primary targets of cyber attacks. Therefore, accurately identifying hosts with malicious behavior in the network is crucial. However, detecting malicious hosts on this intranet presents several challenges. Firstly, the network state is unstructured data that dynamically changes in real-time. Secondly, the large amount of normal traffic in the network drowns out the traces generated by malicious behaviors, leading to the problem of category imbalance. Lastly, the traditional graph neural network model has limitations in processing edge information and is unable to directly learn the information in netflow. To overcome these challenges, this paper proposes a malicious host detection system. The system extracts the Host Communication Graph by time slicing and uses a random undersampling method to balance samples. For malicious host detection, this paper proposes the Relational-Edge Graph Convolutional Network (RE-GCN) model, which can directly aggregate and learn features on edges and use them to accurately classify nodes, compared to other GNN models. Comparative experiments were conducted on various netflow datasets, demonstrating the effectiveness of our approach. Our approach outperformed other common GNN models in detecting malicious hosts.

Abstract Despite the growing attention on blockchain, phishing activities have surged, particularly on newly established chains. Acknowledging the challenge of limited intelligence in the early stages of new chains, we propose ADA-Spear-an automatic phishing detection model utilizing a dversarial d omain a daptive learning which symbolizes the method’s ability to penetrate various heterogeneous blockchains for phishing detection. The model effectively identifies phishing behavior in new chains with limited reliable labels, addressing challenges such as significant distribution drift, low attribute overlap, and limited inter-chain connections. Our approach includes a subgraph construction strategy to align heterogeneous chains, a layered deep learning encoder capturing both temporal and spatial information, and integrated adversarial domain adaptive learning in end-to-end model training. Validation in Ethereum, Bitcoin, and EOSIO environments demonstrates ADA-Spear’s effectiveness, achieving an average F1 score of 77.41 on new chains after knowledge transfer, surpassing existing detection methods.

Detecting encrypted malware traffic promptly to halt the further propagation of an attack is critical. Currently, machine learning becomes a key technique for extracting encrypted malware traffic patterns. However, due to the dynamic nature of network environments and the frequent updates of malware, current methods face the challenges of detecting unknown malware traffic in open-world environment. To address the issue, we introduce MVDet, a novel method that employs machine learning to mine the behavioral features of malware traffic based on multi-view analysis. Unlike traditional methods, MVDet innovatively characterizes the behavioral features of malware traffic at 4-tuple flows from four views: statistical view, DNS view, TLS view, and business view, which is a more stable feature representation capable of handling complex network environments and malware updates. Additionally, we achieve a short-time behavioral features construction, significantly reducing the time cost for feature extraction and malware detection. As a result, we can detect malware behavior at an early stage promptly. Our evaluation demonstrates that MVDet can detect a wide variety of known malware traffic and exhibits efficient and robust detection in both open-world and unknown malware scenarios. MVDet outperforms state-of-the-art methods in closed-world known malware detection, open-world known malware detection, and open-world unknown malware detection.

Malicious traffic detection in the real world faces the challenge of dealing with a diverse mix of known, unknown, and variant malicious traffic, requiring methods that are accurate, generalizable, and reliable for identifying both known and emerging threats. However, existing methods are unable to fully meet these requirements. Supervised methods can accurately detect known malicious traffic, but their performance declines significantly when encountering unknown attacks. Additionally, the misclassification is usually silent, leading to doubts about the reliability and practicality. Unsupervised methods can deal with unknown attacks, but their high false positive rate and inability to utilize the knowledge of existing attack data constitute obvious shortcomings. To overcome these limitations, we propose ECNet, an end-to-end robust malicious network traffic detection method. Particularly, ECNet incorporates multi-view features, including content and pattern features, and employs a gated-based feature fusion approach, providing an efficient and robust representation. Moreover, ECNet introduces a confidence mechanism and combines category probability and confidence values during training and detection; therefore, it can accurately detect both known and unknown malicious traffic while ensuring the credibility of results. To validate the performance of ECNet, we conduct comprehensive experiments on six reorganized datasets and compare ECNet with seven state-of-the-art methods. The results demonstrate that ECNet outperforms others, particularly showing significant improvements in detecting unknown attacks, with up to a 14.15% increase in F1 compared to the best-performing method.

Network traffic anomaly detection is a critical means to detect network attacks, and plays a very important role in ensuring network security. However, existing network traffic anomaly detection methods rely on large-scale, well-labeled, class-balanced datasets, which are difficult to apply in practical application. Thus, this paper proposes a few shot network traffic anomaly detection method, called “SN-IDS”. “SN-IDS” includes a raw traffic encoding module and a convolution based siamese net(CSNet). The raw traffic encoding module converts the traffic into 3D images. The CSNet uses 3D convolution operations to extract the feature vectors of different traffic sessions from the 3D images and compares them in a metric way to detect anomalies. Experiments on the CICIDS2017 dataset show that the detection accuracy of our proposed method in the 5-shot scenario exceeds the current state-of-the-art methods.

As one of the most challenging threats in cyberspace, insider threats frequently lead to substantial losses for enterprises. Recently, there are many studies focus on user behavior analysis for insider threats detection. However, they ignore the underlying causes of insider threats and the implicit relationships between users, which is more critical for discover the insider threats. To address this gap, we propose the novel ITDE model in this paper, which applies a graph neural network approach based on two-layer attention. The core idea is to abstracting user features and potential relationships as heterogeneous graphs based on an analysis of user behavior and the causes of insider threats. Futhermore, we employ node-level attention and semantic-level attention to capture the complex graph structure information and generate node embedding by aggregating features from meta-path based neighbors. Finally, we use a cross-entropy loss function to implement insider threat detection. We verify the effectiveness of our model on the CERT r4.2 dataset and it outperforms state-of-the-art methods in insider threat detection.

Abstract Ethereum’s high attention, rich business, certain anonymity, and untraceability have attracted a group of attackers. Cybercrime on it has become increasingly rampant, among which scam behavior is convenient, cryptic, antagonistic and resulting in large economic losses. So we consider the scam behavior on Ethereum and investigate it at the node interaction level. Based on the life cycle and risk identification points we found, we propose an automatic detection model named Aparecium. First, a graph generation method which focus on the scam life cycle is adopted to mitigate the sparsity of the scam behaviors. Second, the life cycle patterns are delicate modeled because of the crypticity and antagonism of Ethereum scam behaviors. Conducting experiments in the wild Ethereum datasets, we prove Aparecium is effective which the precision, recall and F1-score achieve at 0.977, 0.957 and 0.967 respectively.

Machine learning and neural networks have become increasingly popular solutions for encrypted malware traffic detection. They mine and learn complex traffic patterns, enabling detection by fitting boundaries between malware traffic and benign traffic. Compared with signature-based methods, they have higher scalability and flexibility. However, affected by the frequent variants and updates of malware, current methods suffer from a high false positive rate and do not work well for unknown malware traffic detection. It remains a critical task to achieve effective malware traffic detection. In this paper, we introduce CBSeq to address the above problems. CBSeq is a method that constructs a stable traffic representation, behavior sequence, to characterize attacking intent and achieve malware traffic detection. We novelly propose the channels with similar behavior as the detection object and extract side-channel content to construct behavior sequence. Unlike benign activities, the behavior sequences of malware and its variant’s traffic exhibit solid internal correlations. Moreover, we design the MSFormer, a powerful Transformer-based multi-sequence fusion classifier. It captures the internal similarity of behavior sequence, thereby distinguishing malware traffic from benign traffic. Our evaluations demonstrate that CBSeq performs effectively in various known malware traffic detection and exhibits superior performance in unknown malware traffic detection, outperforming state-of-the-art methods.

Predicting the cost of forwarding contract is a severe challenge to road transport management system.The transportation cost of a forwarding contract often depends on many factors.It is hard for humans to evaluate the various factors in transportation and calculate the cost of forwarding contract.In this paper, we propose an approach to address such a problem by following the sequence of machine learning steps which consist of data analysis, feature engineering and model construction.First, we conduct a detailed analysis of the given data.Then, we generate effective features to characterize the cost of forwarding contract and eliminate redundant features.Finally, in the model construction phase, we propose a gradient boosting decision tree based method to train and predict the cost of forwarding contract.The proposed approach achieves RMSE scores of 0.1391 on the test set, which is the 2 nd final score in the competition.

Intrusion detection is critical in the area of cyberspace security. Deep learning methods, especially CNN, have been widely used in intrusion detection in recent years. Network traffic is usually converted into images for processing. However, images converted from network traffic do not have multi-channel features like real-world pictures and have explicit long-distance dependencies between pixels. These characteristics will cause weak performance and poor explanation, making images converted from network traffic unsuitable to be processed by CNN. Besides, most works only consider the first few packets (named head packets) in a flow, which contains the information about connection establishment and interaction between two parts. However, the last few packets (named tail packets) are omitted, resulting in the loss of information about disconnection. To handle the above problems, we propose a reliable intrusion detection model called IV-IDM. Instead of convolution, IV-IDM uses a new structure, involution. Involution has the properties of spatial-specific and channel-agnostic and is more suitable for intrusion detection tasks than convolution. We also propose I-Res, which is constructed based on involution and is used as the base classifier of IV-IDM. We use head and tail packets of a flow as the inputs to two I-Res respectively to learn richer information and employ a voting algorithm to integrate the results of these two parts to promote the robustness of the model. Finally, IV-IDM is evaluated by the ISCX-IDS-2012 and the CIC-IDS-2017 datasets. The experimental results demonstrate that IV-IDM outperforms the state-of-the-art models and is qualified for intrusion detection.

Abstract With the wide application and development of blockchain technology in various fields such as finance, government affairs and medical care, security incidents occur frequently on it, which brings great threats to users’ assets and information. Many researchers have worked on blockchain abnormal behavior awareness in respond to these threats. We summarize respectively the existing public blockchain and consortium blockchain abnormal behavior awareness methods and ideas in detail as the difference between the two types of blockchain. At the same time, we summarize and analyze the existing data sets related to mainstream blockchain security, and finally discuss possible future research directions. Therefore, this work can provide a reference for blockchain security awareness research.

Predicting victories in video games from rich history of gameplay logs is a severe challenge to game developers. It is hard for humans to evaluate the real-time game situation and predict who will win the video game. In this paper, we propose an approach to this problem by following the sequence of machine learning steps which consist of feature engineering, feature selection, and model construction. We conduct a detailed analysis of the game logs and generate effective features from different granularity gameplay logs in the feature engineering phase. Then, we design a group based recursive feature elimination method for feature selection. In model construction, we present an ensemble approach that combines stacking and averaging for prediction to improve the generalization performance of models. The proposed approach achieves AUC scores of 0.8997 on the test set, which is the highest final score in the competition.

Network trace signature matching is one reliable approach to detect active Remote Control Trojan, (RAT). Compared to statistical-based detection of malicious network traces in the face of known RATs, the signature-based method can achieve more stable performance and thus more reliability. However, with the development of encrypted technologies and disguise tricks, current methods suffer inaccurate signature descriptions and inflexible matching mechanisms. In this paper, we propose to tackle above problems by presenting MBTree, an approach to detect encryption RATs Command and Control (C&C) communication based on host-level network trace behavior. MBTree first models the RAT network behaviors as the malicious set by automatically building the multiple level tree, MLTree from distinctive network traces of each sample. Then, MBTree employs a detection algorithm to detect malicious network traces that are similar to any MLTrees in the malicious set. To illustrate the effectiveness of our proposed method, we adopt theoretical analysis of MBTree from the probability perspective. In addition, we have implemented MBTree to evaluate it on five datasets which are reorganized in a sophisticated manner for comprehensive assessment. The experimental results demonstrate the accurate and robust of MBTree, especially in the face of new emerging benign applications.

Network intrusion detection plays a critical role in cyberspace security. Most existing conventional detection methods mostly rely on manually-designed features to detect intrusion behaviours from large-scale flow data. Recent studies show that deep learning-based methods are effective for network intrusion detection due to the ability to learn discriminative features from data automatically. However, these models ignore the problem of the irregular time intervals between packets in a flow, causing the degradation of detection performance. To this end, we propose a Spatial and Temporal Aware Intrusion Detection model (STIDM). The proposed STIDM model first uses a one-dimensional Convolutional Neural Network (1D-CNN) to extract spatial features based on the nature of flow and packet. Then we design a Time and Length sensitive LSTM (TL-LSTM) method to learn richer temporal features from the irregular flows. The two parts are trained simultaneously to achieve global optimum. Through extensive experiments on the ISCX2012 dataset and the CICIDS2017 dataset, we demonstrate that STIDM outperforms state-of-the-art models.

As a cyber security protection technology, Intrusion Detection System (IDS), through real-time monitoring, issues alerts when detecting malicious events. It is one of the most widely used network security products, yet still has high false positive rates. False positive alerts will not only waste a lot of resources and time to process, but also have bad effects on the correlation analysis and attack path detection. Therefore, reducing the false positives rate is one of the important means to improve the performance of IDS. In this paper, we propose an effective model for false positives identification using gradient boosting tree models based on the analysis of security features of the IDS alerts. Firstly, we analyze alarms from aggregation and correlation by constructing a correlated alert graph based on IP addresses. Secondly, we design a novel bidirectional recursive feature elimination method combining with random forest for feature selection. Finally, the ensemble methods are employed from boosting tree models in our approach for better improvement.

The abuse of anonymous communication technology brings serious challenges to network supervision. The valid identification of anonymity network traffic is a prerequisite and fundamentally important for preventing the violence of such techniques. However, due to the distinct characteristics of flow from anonymity networks including Tor, I2P, and JonDonym, existing studies don't take full advantage of these features, damaging the accuracy of identification. In this paper, we propose an effective anonymity network traffic identification model, called isAnon. Firstly, isAnon designs a novel hybrid feature selection algorithm by combining Modified Mutual Information and Random Forest (MMIRF) algorithm to filter out some irrelevant and redundant features quickly. Secondly, our proposed model applies a nested cross-validation scheme with an inner 5-fold cross-validation and an outer Monte Carlo cross-validation to prevent model overfitting. Finally, we use the Extreme Gradient Boosting (XGBoost) algorithm to identify Tor, I2P, and JonDonym networks for four scenarios. Comprehensive experimental results on several real-world anonymity network traffic datasets clearly show the effectiveness of our isAnon model compared with state-of-the-art baseline identification methods.