With the increasing sophistication of cyber attacks, traditional defense mechanisms have become inadequate due to information asymmetry between attackers and defenders. While threat intelligence sharing helps bridge this gap, existing entity recognition methods face two critical challenges: (1) difficulty in handling domain-specific features and entity ambiguity in cybersecurity texts; and (2) ineffective alignment of heterogeneous entities across multi-source threat intelligence. To address these issues, we propose the Semantic Entity Recognition and Alignment (SERA) framework, which employs SecureBERT to construct security-domain semantic representations and learn specialized threat intelligence features. The framework combines bidirectional long short-Term memory (BiLSTM) to capture contextual dependencies, incorporates an attention mechanism to enhance key semantic modeling, and finally utilizes a Conditional Random Field (CRF) layer to improve label sequence consistency. To resolve entity naming inconsistencies and representation redundancy, we integrate three types of information—semantic similarity, structural embedding similarity, and contextual similarity—and perform multi-source entity alignment through weighted scoring, effectively improving cross-source entity unification. Experimental results on the DNRTI dataset demonstrate that the SERA model achieves superior performance compared to baseline models, with an F1-score of 0.7821, precision of 0.7625, recall of 0.8152, and entity recognition accuracy of 0.9387.

As a widely adopted protocol for anomaly detection in attributed networks, reconstruction error prioritizes comprehensive feature extraction to detect anomalies over interrogating the differential representation between normal and abnormal nodes. Intuitively, in attributed networks, normal nodes and their neighbors often exhibit similarities, whereas abnormal nodes demonstrate behaviors distinct from their neighbors. Hence, normal nodes can be accurately represented through their neighbors and effectively reconstructed. As opposed to normal nodes, abnormal nodes represented by their neighbors may be erroneously reconstructed as normal, resulting in increased reconstruction error. Leveraging from this observation, we propose a novel anomaly detection protocol called Neighbor-aware Mask-Filling Anomaly Detection (NMFAD) for attributed networks, aiming to maximize the variability between original and reconstructed features of abnormal nodes filled with information from their neighbors. Specifically, we utilize random-mask on nodes and integrate them into the backbone Graph Neural Networks (GNNs) to map nodes into a latent space. Subsequently, we fill the masked nodes with embeddings from their neighbors and smooth the abnormal nodes closer to the distribution of normal nodes. This optimization improves the likelihood of the decoder to reconstructing abnormal nodes as normal, thereby maximizing the reconstruction error of abnormal nodes. Experimental results demonstrate that, compared to the existing models, NMFAD exhibits superior performance.in attributed networks.

Federatedlearning has garnered significant attention in the Internet of Things and healthcare applications due to its ability to train a shared global model across distributed clients. However, imbalanced data distribution leads to model discrepancies among clients. Most existing methods adopt implicit alignment strategies while overlooking explicit modeling of geometric and directional discrepancies in feature representations, which undermines local model optimization. To address this issue, we propose a method of representation deviation alignment in federated learning, which projects features onto the principal feature space to measure deviations between local and global feature representations explicitly. Specifically, Federated learning with Representation Deviation Alignment (FedRDA) employs a feature encoder to extract compact features and construct unbiased principal feature spaces for global and local models. Then, the residual projection in the feature space serves as a quantitative measure of the representation deviation, effectively capturing the latent direction differences between models. Besides, we introduce a representation consistency alignment strategy, which ensures that the distribution of local client features becomes more uniform within the global feature space. Extensive experiments on SVHN, CIFAR-10, CIFAR-100, Tiny-ImageNet, and GC10 demonstrate that FedRDA effectively reduces the classifier bias caused by representational differences.

In unsupervised graph anomaly detection, existing methods usually focus on detecting outliers by learning local context information of nodes, while often ignoring the importance of global context. However, global context information can provide more comprehensive relationship information between nodes in the network. By considering the structure of the entire network, detection methods are able to identify potential dependencies and interaction patterns between nodes, which is crucial for anomaly detection. Therefore, we propose an innovative graph anomaly detection framework, termed CoCo (Context Correlation Discrepancy Analysis), which detects anomalies by meticulously evaluating variances in correlations. Specifically, CoCo leverages the strengths of Transformers in sequence processing to effectively capture both global and local contextual features of nodes by aggregating neighbor features at various hops. Subsequently, a correlation analysis module is employed to maximize the correlation between local and global contexts of each normal node. Unseen anomalies are ultimately detected by measuring the discrepancy in the correlation of nodes’ contextual features. Extensive experiments conducted on six datasets with synthetic outliers and five datasets with organic outliers have demonstrated the significant effectiveness of CoCo compared to existing methods.

Graph anomaly detection aims to identify the nodes that display significantly different behavior from the majority. However, existing methods neglect the combined interaction between the network structure and node attributes, resulting in suboptimal latent representations of nodes due to network noise. In this paper, we introduce a novel approach called adversarial regularized attributed network embedding (ARANE) for graph anomaly detection. ARANE addresses this issue by forcing normal nodes to inhabit a compact manifold in the latent space, taking into account both the network structure and node attributes.It ensures that data points from the normal class, originating from different distributions, are distributed within a single compact latent space, while excluding anomalies from this region.ARANE employs a dual-encoder architecture consisting of an attribute encoder and a structure encoder.The attribute encoder learns node attribute embeddings, while the structure encoder focuses on learning structure embeddings.To obtain high-quality node embeddings for effective anomaly detection, we apply adversarial learning to regularize the learned embeddings separately in both the structure and attribute spaces.Furthermore, we introduce a fusion module that combines the final node embeddings derived from the structure and attribute spaces.These joint embeddings serve as inputs to a dual-decoder for graph reconstruction, where the resulting reconstruction errors are utilized as anomaly scores for anomaly detection.Extensive experiments conducted on real-world attributed networks demonstrate the superior effectiveness of our proposed method compared to state-of-the-art approaches.

Cyber-Physical System needs high security to ensure the safe operation. Anomaly detection is one of the mainstream security technologies, the core of which is data analysis and learning. Unsupervised Deep-Learning-based Anomaly Detection Methods can be used in the scenarios that collects large amounts of unlabeled data and are more in line with the actual needs of CPS. However, the correlation among data did not attract enough attention to exploring their implicit relationship, and the adaptive training was deficient. Therefore, we propose an Adaptive-Correlation-aware Unsupervised Deep Learning (ACUDL) for anomaly detection in CPS. It constructs a directed graph structure to represent the implicit correlation among data and adaptively updates with dynamic graph; then, designs a dual-autoencoder to extract the original non-correlation, correlation, and reconstruction features, and builds an estimation network using the Gaussian mixture model (GMM) to estimate the anomaly energy. Experimental results on several CPS data scenarios show that ACUDL can be well adapted to many application scenarios with different data characteristics and achieves better overall results than some up-to-date DL-ADMs.

Capturing the complex interaction between the node attribute and the network structure is important for attributed network embedding and anomaly detection. However, there are few methods to explicitly model the correlation between these two views of the node attribute and the network structure. In this article, we propose an attributed network anomaly detection (CaCo) method based on the canonical correlation analysis, which assumes that there should be a strong correlation between the attribute and structure features of normal nodes, and a weak correlation one between those abnormal nodes, in the attributed networks. Consequently, a joint learning mechanism is designed in CaCo to explicitly measure the correlation between two views in the latent space. Specifically, the backbone of a weight-sharing graph convolutional network is employed to encode the node feature from two views of attribute and structure in the latent space, respectively. Then, a Kullback–Leibler divergence regularization is used to align the distributions of the two views. Finally, the parameters of CaCo are optimized by maximizing the correlation between attribute and structure features of normal nodes in the training phase, and anomalies can be detected by measuring the correlation between two views in the testing phase. Extensive experiments on six real-world datasets demonstrate the effectiveness of the proposed method compared to the state-of-the-art techniques.

Networks are ubiquitous in the real world such as social networks and communication networks, and anomaly detection on networks aims at finding nodes whose structural or attributed patterns deviate significantly from the majority of reference nodes. However, most of the traditional anomaly detection methods neglect the relation structure information among data points and therefore cannot effectively generalize to the graph structure data. In this paper, we propose an end-to-end model of Deep Dual Support Vector Data description based Autoencoder (Dual-SVDAE) for anomaly detection on attributed networks, which considers both the structure and attribute for attributed networks. Specifically, Dual-SVDAE consists of a structure autoencoder and an attribute autoencoder to learn the latent representation of the node in the structure space and attribute space, respectively. Then, a dual-hypersphere learning mechanism is imposed on them to learn two hyperspheres of normal nodes from the structure and attribute perspectives, respectively. Moreover, to achieve joint learning between the structure and attribute of the network, we fuse the structure embedding and attribute embedding as the final input of the feature decoder to generate the node attribute. Finally, abnormal nodes can be detected by measuring the distance of nodes to the learned center of each hypersphere in the latent structure space and attribute space, respectively. Extensive experiments on the real-world attributed networks show that Dual-SVDAE consistently outperforms the state-of-the-arts, which demonstrates the effectiveness of the proposed method.

A cyber–physical system (CPS) is a multidimensional complex system integrating computing, communication, and control technologies. Because of their key functionality within the system, CPS requires large robustness and security to ensure its reliable operation. Due to its importance in supporting overall system security, anomaly detection (AD) is likely to continue to play an important role in the CPS security. Moreover, unsupervised AD models based on deep learning have shown better performances in rule training, adaptive update, detection efficiency, and accuracy. Due to the nature of the CPS systems, CPS data is more likely to exhibit implicit correlative relationship among data, which would be vital to exploit for CPS security provisions in more complex data environments. In view of this observation, we propose the data-correlation-aware unsupervised deep learning model for AD in CPS, which uses an undigraph structure to store samples and implicit correlation among samples. We design a dual-autoencoder to train both original features and implicit correlation features among data, and we construct an estimation network using Gaussian mixture model (GMM) to evaluate the probability distribution of samples to complete the anomaly analysis. Experimental results compared the performance with relevant AD models based on deep learning which did not use data-correlation analysis. The results showed that, under some representative application scenarios of CPS considered, data-correlation-aware unsupervised deep-learning model achieved superior results in parameter sensitivity, ablation, relationship between correlation degree and detection performance, visualization, and detection effects.

Semi-supervised learning (SSL) has proven to be a powerful algorithm in different domains by leveraging unlabeled data to mitigate the reliance on the tremendous annotated data. However, few efforts consider the underlying temporal relation structure of unlabeled time series data in the semi-supervised learning paradigm. In this work, we propose a simple and effective method of Semi-supervised Time series classification architecture (termed as SemiTime) by gaining from the structure of unlabeled data in a self-supervised manner. Specifically, for the labeled time series, SemiTime conducts the supervised classification directly under the supervision of the annotated class label. For the unlabeled time series, the segments of past-future pair are sampled from time series, where two segments of pair from the same time series candidate are in positive temporal relation, while two segments from the different candidates are in negative temporal relation. Then, the temporal relation between those segments is predicted by SemiTime in a self-supervised manner. Finally, by jointly classifying labeled data and predicting the temporal relation of unlabeled data, the useful representation of unlabeled time series can be captured by SemiTime. Extensive experiments on multiple real-world datasets show that SemiTime consistently out-performs the state-of-the-arts, which demonstrates the effectiveness of the proposed method. Code and data are publicly available at https://haoyfan.github.io.

The artificial immune system (AIS) is one of the important branches of artificial intelligence technology, and it is widely used in many fields. The detector set is the core knowledge set, and the AIS application effects are mainly determined by the generation, evolution, and detection of the detectors. Presently, the problem space (shape-space) of AIS mainly applied real-valued representation. But the real-valued detectors have some problems that have not been solved well, such as slow convergence speed of generation, holes in the nonself region, detector overlapping redundancy, dimension curse, etc., which lead to the unsatisfactory detection effects. Moreover, artificial immune anomaly detection is a dynamic adaptive model, needs to be evolved adaptively with the detection environments. Without better adaptive modeling, these problems mentioned before will get worse. In view of this, this article proposes a multisource immune detector adaptive model in neighborhood shape-space and applies it to anomaly detection: based on random, chaotic map and DNA genetic algorithm (DNA-GA), multisource neighborhood negative selection algorithm (MSNNSA), multisource neighborhood immune detector generation algorithm (MS-NIDGA), and neighborhood immune anomaly detection algorithm (NIADA) are proposed, so that the generation and detection of immune detectors can be improved efficiently; introducing immune adaptive and feedback mechanism, multisource neighborhood immune detector adaptive model (MS-NIDAM) is built, so that the detectors can be adaptively evolved in a more targeted search domain, and keep better distribution to the nonself region in real time, so as to solve various problems existing in the real-valued shape-space under dynamic environment mentioned before and improve the overall detection performances. The experimental results show that MS-NIDAM can improve the detector generation/evolution efficiency, keep the up-to-date understanding of the changing environment, so as to obtain better overall detection performances and stability than other comparative methods.