With the rapid development of cloud-network convergence, alert data processing has become a critical task in intelligent cloud-network operations and maintenance. Enterprise threat detection systems serve as a vital defense against cyberattacks. However, due to well-known challenges such as massive unlabeled data, false alerts, and lack of interpretability, threat detection remains a formidable challenge. To address these issues, we propose the Enterprise Threat Detection Explainer (ETDE), an interpretable graph neural network (GNN)-based framework designed to automatically identify attackers from intrusion prevention system (IPS) alerts. ETDE extracts relevant subgraph structures and features from security attribute graphs to model attack patterns, while providing comprehensive explanations to help security teams rapidly pinpoint threats and accelerate incident response. Evaluations on real-world operational data demonstrate that ETDE significantly reduces the manual workload for security analysts, enhancing both efficiency and reliability in threat detection.

DNS tunnels, due to their versatility and concealment, have become a preferred method for attackers to execute Command and Control (C&C) attacks, posing a significant security threat to terminal devices. Therefore, the efficient and accurate detection of DNS tunnels is important in reducing the economic losses and privacy risks faced by both enterprises and individuals. Despite notable advancements in the research of intelligent detection of DNS tunnels, existing model-based approaches predominantly concentrate on the surface-level features of domain names or packet payloads. This narrow focus leads to low detection accuracy when dealing with unknown DNS tunnel attacks and traffic from wildcard DNS. Furthermore, these methods struggle with accurately identifying DNS tunneling tools, complicating the task of swiftly locating and mitigating malware for analysts. This paper proposes GraphTunnel, a framework based on graph neural networks for detecting DNS tunnels and identifying tunneling tools. It delves into the correlations among DNS resolutions to construct paths that represent the recursive resolution process of DNS. By using central nodes that denote the gateways, these paths are connected and transformed into graph structures. Concurrently, it employs GraphSage to aggregate the features of nodes and their edges in the graph, enabling effective detection of DNS tunnels. Additionally, GraphTunnel utilizes the G2M algorithm to capture the statistical features of nodes in the graph and maps them into grayscale images, which are then processed by a CNN for multi-class identification of DNS tunneling tools. Experimental results demonstrate that in non-wildcard DNS scenarios, GraphTunnel achieves a 100% accuracy in DNS tunnel detection, encompassing unknown DNS tunnels. Even in high false-positive environments caused by wildcard DNS, GraphTunnel maintains an F1-Score of 99.78%. Moreover, GraphTunnel can identify DNS tunneling tools with an accuracy rate exceeding 98.57%, enhancing the rapid mitigation capabilities of emergency responders in dealing with malicious DNS tunnels.

As training a high-performance deep neural network (DNN) model requires a large amount of data, powerful computing resources and expert knowledge, protecting well-trained DNN models from intellectual property (IP) infringement has raised serious concerns in recent years. Most existing methods using DNN watermarks to verify the ownership of the models after IP infringement occurs, which is reactive in the sense that they cannot prevent unauthorized users from using the model in the first place. Different from these methods, in this article, we propose an active authorization control and user’s fingerprint tracking method for the IP protection of DNN models by utilizing sample-specific backdoor attack. The proposed method inversely and multiplely exploits sample-specific trigger as the key to implement authorization control for DNN model, in which the generated triggers are imperceptible and sample-specific for clean images. Specifically, a U-Net model is used to generate backdoor instances. Then, the target model is trained on the clean images and backdoor instances, which are inversely labeled as wrong classes and correct classes, respectively. Only authorized users can use the target model normally by pre-processing the clean images through the U-Net model. Moreover, the images processed by the U-Net model will contain unique fingerprint that can be extracted to verify and track the corresponding user’s identity. This article is the first work that utilizes the sample-specific backdoor attack to implement active authorization control and user’s fingerprint management for DNN model under black-box scenarios. Extensive experimental results on ImageNet dataset and YouTube Aligned Face dataset demonstrate that the proposed method is effective in protecting the DNN model from unauthorized usage. Specifically, the protected model has a low inference accuracy (1.00%) for unauthorized users, while maintaining a normal inference accuracy (97.67%) for authorized users. Besides, the proposed method can achieve 100% fingerprint tracking success rates on both the ImageNet and YouTube Aligned Face datasets. Moreover, it is demonstrated that the proposed method is robust against fine-tuning attack, pruning attack, pruning attack with retraining, reverse-engineering attack, adaptive attack, and JPEG compression attack. The code is available at https://github.com/nuaaaisec/SSAT .

Legacy applications are the huge existing IPv4-based network applications. It is a critical subject to maintain them availability during IPv6 transition period. However they could run properly neither in IPv6-only networks nor between IPv6/IPv4 heterogeneous networks. That has resulted in the limitation of the widespread adoption of IPv6. To deal with this problem, we propose a novel framework called 4644 with two new mechanisms (i.e. API Adapter and Address Control Protocol). In 4644, end users are able to run seamlessly their legacy applications over IPv6-only network as usual and the legacy applications can interoperate transparently with each other between heterogeneous networks without Application Level Gateway (ALG). We have implemented this prototype system with some legacy applications such as HTTP, Email, Telnet, FTP, QQ messenger and Skype. The implementation results have proved that 4644 enabled these applications to run well. 4644 has great potential as an IPv6 transition solution to speed up IPv6 and Internet development.