The security of web services increasingly relies on accurate detection of advanced, previously unseen attacks hidden within complex host activities. Provenance-based intrusion detection systems (PIDSes) offer a promising foundation for this task by capturing rich causal and structural relationships across processes, files, and network interactions. However, recent studies show that these graph-driven methods remain vulnerable to graph manipulation attacks, where adversaries subtly alter provenance graphs to evade detection, which limits their practical deployment.

While the web interfaces of remotely managed devices offer convenience, their unstructured content can inadvertently leak geographic locations, posing a significant security risk. We aim to assess the feasibility of automatically exploiting this leakage, serving as a clear warning to cybersecurity regulators. To this end, we propose WebGeoInfer, a framework that does not rely on page structure. It extracts clues through page clustering and differential analysis to overcome the challenge of information heterogeneity. It also leverages search engines and large language models to augment sparse clues and infer precise coordinates, addressing the challenge of information sparsity. In large-scale experiments, WebGeoInfer successfully located 5,435 devices across 94 countries and 2,056 cities, achieving accuracy rates as high as 96.96% at the country level, 88.05% at the city level, and 79.70% at the street level. These findings provide the first conclusive evidence of the reality and scale of this threat. Furthermore, our analysis offers new insights and mitigation strategies for affected devices, establishing a key benchmark for future security research.

Publicly verifiable privacy-preserving aggregation is widely regarded as an effective approach to protect user privacy and ensure the integrity of the aggregated model published by the aggregator in Federated Learning (FL). State-of-the-art solutions either fail to guarantee unforgeability when the aggregator colludes with malicious users or require costly cryptographic operations during the online aggregation phase and lack fault tolerance. In this work, we propose eVTPA, the first online-efficient, publicly verifiable, and fault-tolerant privacy-preserving aggregation protocol considering malicious users and aggregators for FL. We introduce a novel collusion-resistant symmetric masking technique to conceal users' local gradients while ensuring the correctness of the aggregated model through a publicly verifiable aggregation signature algorithm. To improve the efficiency of online signature generation, we design a specialized precomputation-based acceleration method and leverage the randomness of masking to enable batch processing. Furthermore, eVTPA adopts a dynamic mask update mechanism that tolerates user dropouts without affecting the validation of the aggregated model. Security analysis shows that eVTPA meets FL's confidentiality, integrity, and authenticity requirements. Experimental results demonstrate that our scheme maintains model classification accuracy while achieving at least a 7.85× faster online aggregation than related solutions at the same security level.

As the complexity and frequency of cyberattacks, such as Advanced Persistent Threats (APTs) and ransomware, continue to escalate, traditional anomaly detection methods have proven inadequate in addressing these sophisticated, multi-faceted threats. Recently, Host Provenance Graphs (HPGs) have played a crucial role in analyzing system-level interactions, detecting anomalous behaviors, and tracing attack chains. However, existing provenance-based detection methods primarily rely on single-dimensional feature analysis, which fails to capture the dynamic and multi-dimensional patterns of modern APT attacks, resulting in insufficient detection performance. To overcome this limitation, we introduce STGAN, a model that integrates spatial-temporal graphs into host provenance graph modeling. STGAN applies temporal and spatial encoding to dynamic provenance graphs to extract temporal, spatial, and semantic features, constructing a comprehensive feature representation. This representation is further fused and enhanced using a multi-head self-attention mechanism, followed by anomaly detection. Through extensive evaluations on three widely-used provenance graph datasets, we demonstrate that our approach consistently outperforms current state-of-the-art techniques in terms of detection performance. Additionally, we contribute to the research community by releasing our datasets and code, facilitating further exploration and validation.