Sewing patterns, the essential blueprints for fabric cutting and tailoring, act as a crucial bridge between design concepts and producible garments. However, existing uni-modal sewing pattern generation models struggle to effectively encode complex design concepts with a multimodal nature and correlate them with vectorized sewing patterns that possess precise geometric structures and intricate sewing relations. In this work, we propose a novel sewing pattern generation approach Design2GarmentCode based on Large Multimodal Models (LMMs), to generate parametric pattern-making programs from multi-modal design concepts. LMM offers an intuitive interface for interpreting diverse design inputs, while pattern-making programs could serve as well-structured and semantically meaningful representations of sewing patterns, and act as a robust bridge connecting the cross-domain pattern-making knowledge embedded in LMMs with vectorized sewing patterns. Experimental results demonstrate that our method can flexibly handle various complex design expressions such as images, textual descriptions, designer sketches, or their combinations, and convert them into size-precise sewing patterns with correct stitches. Compared to previous methods, our approach significantly enhances training efficiency, generation quality, and authoring flexibility. Project page: https://style3d.github.io/design2garmentcode.

The proliferation of Internet of Things (IoT) devices with weak passwords poses significant challenges to network security. Hackers can easily compromise these IoT devices by brute-forcing their passwords and then utilize them to launch severe attacks such as Distributed Denial of Service (DDoS). To defeat such threats, an effective solution is to ensure that each device has a strong, high-strength password. However, in practice, this poses a significant challenge, as configuring and managing passwords for such a vast number of devices is highly complex. In this work, we propose a novel Multi-Device Collaborative Authentication (MDCA) system that enables IoT devices to be protected by strong passwords without altering their original weak ones. Our approach is inspired by group defense strategies prevalent in nature: animals cooperate and form groups to enhance their chances of survival. Intuitively, IoT devices can also collaborate to improve their security. Specifically, in our design, devices with strong passwords provide authentication for devices having weak credentials, and the latter can generate clues to detect brute-force attacks. Once these attacks are detected, requests to IoT devices are first authenticated by several other strong password protected devices, and if all authentications succeed, the requests are then permitted. We have implemented the proposed system and theoretically analyzed its security. The experimental results match the theoretical analysis well.

Realistic digital garment modeling remains a labor-intensive task due to the intricate process of translating 2D sewing patterns into high-fidelity, simulation-ready 3D garments. We introduce GarmageNet , a unified generative framework that automates the creation of 2D sewing patterns, the construction of sewing relationships, and the synthesis of 3D garment initializations compatible with physics-based simulation. Central to our approach is Garmage , a novel garment representation that encodes each panel as a structured geometry image, effectively bridging the semantic and geometric gap between 2D structural patterns and 3D garment geometries. Followed by GarmageNet , a latent diffusion transformer to synthesize panel-wise geometry images and GarmageJigsaw , a neural module for predicting point-to-point sewing connections along panel contours. To support training and evaluation, we build GarmageSet , a large-scale dataset comprising 14,801 professionally designed garments with detailed structural and style annotations. Our method demonstrates versatility and efficacy across multiple application scenarios, including scalable garment generation from multi-modal design concepts (text prompts, sketches, photographs), automatic modeling from raw flat sewing patterns, pattern recovery from unstructured point clouds, and progressive garment editing using conventional instructions, laying the foundation for fully automated, production-ready pipelines in digital fashion. Refer to our project page for open-sourced code and dataset.

Diffusion models have significantly advanced image manipulation techniques, and their ability to generate photorealistic images is beginning to transform retail workflows, particularly in presale visualization. Beyond artistic style transfer, the capability to perform fine-grained visual feature transfer is becoming increasingly important. Embroidery is a textile art form characterized by intricate interplay of diverse stitch patterns and material properties, which poses unique challenges for existing style transfer methods. To explore the customization for such fine-grained features, we propose a novel contrastive learning framework that disentangles fine-grained style and content features with a single reference image, building on the classic concept of image analogy. We first construct an image pair to define the target style, and then adopt a similarity metric based on the decoupled representations of pretrained diffusion models for style-content separation. Subsequently, we propose a two-stage contrastive LoRA modulation technique to capture fine-grained style features. In the first stage, we iteratively update the whole LoRA and the selected style blocks to initially separate style from content. In the second stage, we design a contrastive learning strategy to further decouple style and content through self-knowledge distillation. Finally, we build an inference pipeline to handle image or text inputs with only the style blocks. To evaluate our method on fine-grained style transfer, we build a benchmark for embroidery customization. Our approach surpasses prior methods on this task and further demonstrates strong generalization to three additional domains: artistic style transfer, sketch colorization, and appearance transfer. Our project is available at: https://style3d.github.io/embroidery_customization.

Modeling and producing lifelike clothed human images has attracted researchers' attention from different areas for decades, with the complexity from highly articulated and structured content. Rendering algorithms decompose and simulate the imaging process of a camera, while are limited by the accuracy of modeled variables and the efficiency of computation. Generative models can produce impressively vivid human images, however still lacking in controllability and editability. This paper studies photorealism enhancement of rendered images, leveraging generative power from diffusion models on the controlled basis of rendering. We introduce a novel framework to translate rendered images into their realistic counterparts, which consists of two stages: Domain Knowledge Injection (DKI) and Realistic Image Generation (RIG). In DKI, we adopt positive (real) domain finetuning and negative (rendered) domain embedding to inject knowledge into a pretrained Text-to-image (T2I) diffusion model. In RIG, we generate the realistic image corresponding to the input rendered image, with a Texture-preserving Attention Control (TAC) to preserve fine-grained clothing textures, exploiting the decoupled features encoded in the UNet structure. Additionally, we introduce SynFashion dataset, featuring high-quality digital clothing images with diverse textures. Extensive experimental results demonstrate the superiority and effectiveness of our method in rendered-to-real image translation.

Abstract Cyber‐physical systems (CPSs) usually have a huge number of nodes, and it is very expensive to deploy security defenses at all nodes. Therefore, selecting the most appropriate nodes for protection to ensure system security is an essential issue in CPS. However, how to achieve this in the system design phase remains to be an open challenge. In this paper, we propose a security strategy determination method for CPS design models. In particular, we utilize SysML to model a CPS. To choose the best nodes for security protection, we realize an automatic construction of an attack‐defense tree (ADTree) model from the SysML model by considering the known attacks and defenses. Further, we transform the ADTree model into an atom attack‐defense tree (A2DTree) model and infer the optimal security strategy under a given cost constraint. We implement our method as an open‐source tool and test it with a pump station attack. The experimental results show that the proposed method is reasonable and feasible and can provide theoretical guidance for the formulation of CPS security policies.

Network security protocols (such as Transport Layer Security, TLS) are increasingly used by hackers to evade detection. The detection of encrypted malicious traffic is becoming a critical task for cyber security. To accomplish this task, researchers have proposed several machine learning or deep learning based methods. However, existing methods require a huge amount of malicious flows as annotated samples, which is difficult or even impossible to obtain for emerging attacks. In this paper, we propose a novel method to detect malicious TLS traffic with only one sample, i.e., one annotated malicious flow. Our observation is that there are a large number of benign HTTPS (HTTP+TLS) flows in the network, and these flows are similar but with subtle differences in behavior. If a model can efficiently distinguish different HTTPS flows by traffic behavior, it should know how to extract inherent characteristics of TLS traffic. Based on the observation, we visit Alexa top websites and train ResNet models in conjunction with statistical traffic data. The obtained conjunction models are used as the feature extractor for malicious TLS flows. To achieve one-shot classification, we further train a feed-forward neural network to transfer the extracted features to a classification decision boundary of the support vector machine (SVM). We test our approach with a thorough set of experiments, and the experimental results show that our approach significantly outperforms the baseline methods.

Recent research has shown that hackers can ef-ficiently infer sensitive user activities only by observing the network traffic of smart home devices. To protect users' privacy, researchers have designed several traffic obfuscation methods. However, existing methods usually consume high bandwidth or provide weak privacy protection. In this paper, we conduct thorough research on smart home traffic obfuscation. We first propose a fixed-value obfuscation scheme and prove that it is perfectly secure by showing the indistinguishability of user activities. Yet, fixed-value obfuscation has high bandwidth con-sumption. To further reduce the bandwidth consumption, we propose combining fixed-value obfuscation with Multipath TCP transmission. The security and performance of the proposed mul-tipath fixed-value obfuscation method are theoretically analyzed. We have implemented the proposed methods and tested them on public packet traces and simulated smart home networks. The experimental results match well with the theoretical analysis.

AQM algorithm is one of the effective methods to alleviate network congestion. The traditional AQM algorithms (RED, CoDel, PIE, BLUE) are usually based on limited information (such as queue length, the delay time, etc.). In this paper, we propose an AQM algorithm named Sketch-AQM which is inspired by the RED algorithm but introduces an additional size-controlled structure to achieve fine-grained flow control. Similar to the RED algorithm, Sketch-AQM algorithm judges the network congestion state mainly based on the average queue length, but the drop policy is adjusted to make full use of the new measurement structure to balance fairness and efficiency. We tested the performance of the algorithm in NS-3. Compared with RED, PIE, and CoDel algorithms, on the basis of maintaining throughput performance, the average queue length of Sketch-AQM algorithm is reduced by an average of 88%, the number of passive packet drop is reduced by about 65% on average. The simulation results show that our algorithm implements a fine-grained packet drop strategy to quickly identify and relieve congestion.

Summary Sketch is a compact data structure used to summarize data streams. It is widely used in the measurement of network traffic, and its accuracy is higher than traditional methods. Currently, there are some typical sketches: Count‐Min Sketch, CU Sketch, and Count Sketch. According to the characteristics of network traffic, we propose a new sketch framework called Self‐Adaption Sketch, which is combined Sketch with Bloom Filter. In the framework, the sketch is created dynamically and the memory space is adjusted timely according to the network traffic by using the concept carrying. Our experiment results showed that the space utilization and accuracy are significantly improved while the throughput of self‐adaption sketch is maintained at a relatively good level.

Malware has become a significant problem on the Android platform. To defend against Android malware, researchers have proposed several on-device detection methods. Typically, these on-device detection methods are composed of two steps: (i) extracting the apps’ behavior features from the mobile devices and (ii) sending the extracted features to remote servers (such as a cloud platform) for analysis. By monitoring the behaviors of the apps that are running on mobile devices, available methods can detect suspicious applications (simply, apps) accurately. However, mobile devices are typically resource limited. The feature extraction and massive data transmission might consume substantial power and CPU resources; thus, the performance of mobile devices will be degraded. To address this issue, we propose a novel method for detecting Android malware by clustering apps’ traffic at the edge computing nodes. First, a new integrated architecture of the cloud, edge, and mobile devices for Android malware detection is presented. Then, for repackaged Android malware, the network traffic content and statistics are extracted at the edge as detection features. Finally, in the cloud, similarities between apps are calculated, and the similarity values are automatically clustered to separate the original apps and the malware. The experimental results demonstrate that the proposed method can detect repackaged Android malware with high precision and with a minimal impact on the performance of mobile devices.

The cyberphysical system (CPS) is becoming the infrastructure of society. Unfortunately, the CPS is vulnerable to cyberattacks, which may cause environmental pollution, property losses, and even casualties. Furthermore, in contrast to the conventional Internet, the devices in CPSs are more specific, and the device systems may not be upgraded or installed with new programs during their life spans. The selection of the best defense nodes for defeating cyberattacks is quite challenging in CPSs. To overcome this issue, several attack-defense modeled methods have been proposed. However, few existing studies have considered the defense cost, which is usually a determinant in practice. In this paper, we propose a method for choosing optimal defense nodes that (1) can defeat specific attacks and (2) are inexpensive. First, the atom attack defense tree (A2DTree) is proposed by adding constraints to the conventional attack defense tree (ADTree). Second, the algebraic method is used to efficiently calculate the minimum defense cost. On this basis, a minimum defense cost calculation tool is designed and implemented. Finally, the effectiveness of the proposed method is verified with two typical case studies, and a comparative experiment of related work is carried out. The results show that the method can correctly and efficiently identify the optimal defense nodes and calculate the minimum defense cost of a CPS.

Summary Nowadays, online product reviews strongly influence the purchase decision of consumers in e‐commerce platforms. Driven by the immense financial profits, review spammers deliberately post fake reviews to promote or demote their target products. Some spammers are even organized as groups to work together and try to take total control of the sentiment on their target products. To detect such spammer groups, most previous works exploit frequent itemset mining (FIM) to find spammer group candidates and then use unsupervised spamicity ranking methods to identify real spammer groups. However, these methods usually suffer from the problem of threshold setting, ie, high support value finding fewer groups while low support value leading to more coincidentally generated groups and computational inefficiency. Moreover, the unsupervised methods are not able to make good use of labeled instances which are actually obtainable in practice. In this paper, we propose CONSGD, a cosine pattern and heterogeneous information network–based spammer group detecting method. Specifically, the CONSGD uses cosine pattern mining (CPM) to discover tight spammer group candidates with a respective low support value, where the cosine threshold is utilized to avoid coincidentally generated groups. Moreover, CONSGD employs heterogeneous information network classification to identify the real spammer groups, which could utilize the labeled instances and do not rely to the assumption of independent instances. Experiments on real‐life dataset show that our proposed CONSGD is effective and outperforms the state‐of‐the‐art spammer group detection methods.

We propose AppFA, an Application Flow Analysis approach, to detect malicious Android applications (simply apps) on the network. Unlike most of the existing work, AppFA does not need to install programs on mobile devices or modify mobile operating systems to extract detection features. Besides, it is able to handle encrypted network traffic. Specifically, we propose a constrained clustering algorithm to classify apps network traffic, and use Kernel Principal Component Analysis to build their network behavior profiles. After that, peer group analysis is explored to detect malicious apps by comparing apps’ network behavior profiles with the historical data and the profiles of their selected peer groups. These steps can be repeated every several minutes to meet the requirement of online detection. We have implemented AppFA and tested it with a public dataset. The experimental results show that AppFA can cluster apps network traffic efficiently and detect malicious Android apps with high accuracy and low false positive rate. We have also tested the performance of AppFA from the computational time standpoint.

Summary Tor is a famous anonymous communication system for preserving users' online privacy. It supports TCP applications and packs upper‐layer application data into encrypted equal‐sized cells with onion routing to hide private information of users. However, we note that the current Tor design cannot conceal certain application behaviors. For example, P2P applications usually upload and download files simultaneously, and this behavioral feature is also kept in Tor traffic. Motivated by this observation, we investigate a new attack against Tor, application classification attack, which can recognize application types from Tor traffic. An attacker first carefully selects some flow features such asburst volumesanddirectionsto represent the application behaviors and takes advantage of some efficient machine‐learning algorithm (e.g., Profile Hidden Markov Model) to model different types of applications. Then he or she can use these established models to classify target's Tor traffic and infer its application type. We have implemented the application classification attack on Tor using parallel computing, and our experiments validate the feasibility and effectiveness of the attack. We argue that the disclosure of application type information is a serious threat to Tor users' anonymity because it can be used to reduce the anonymity set and facilitate other attacks. We also present guidelines to defend against application classification attack. Copyright © 2015 John Wiley & Sons, Ltd.

Tor is a popular anonymizing network and the existing work shows that it can preserve users' privacy from website fingerprinting attacks well. However, based on our extensive analysis, we find it is the overlap of web objects in returned web pages that make the traffic features obfuscated, thus degrading the attack detection rate. In this paper, we propose a novel active website fingerprinting attack under Tor's local adversary model. The main idea resides in the fact that the attacker can delay HTTP requests originated from users for a certain period to isolate responding traffic segments containing different web objects. We deployed our attack in PlanetLab and the experiment lasted for one month. The SVM multi-classification algorithm was then applied on the collected datasets with the introduced features to identify the visited website among 100 top ranked websites in Alexa. Compared to the stat-of-the-art work, the classification result is improved from 48.5% to 65% by delaying at most 10 requests. We also analyzed the timing characteristics of Tor traffic to prove the stealth of our attack. The research results show that anonymity in Tor is not as strong as expected and should be enhanced in the future.