The rapid development of Internet technology has made social networks central platforms for information dissemination and acquisition. As key participants, users exhibit increasingly complex connection patterns, reflecting the dynamic nature of online interactions. Therefore, in order to better understand and manage social networks, analyzing these connection patterns, particularly identifying the potential connections between users with similar tendencies, has become a critical research focus in social network studies. Nevertheless, the existing methods exhibit limitations in comprehensively harnessing the heterogeneous nature of social networks and usually over-rely on local network structures while neglecting global patterns. To address these problems, we propose an innovative method based on weighted random walks within heterogeneous information networks (HINs). We first employ HINs to structurally represent and systematically organize complex social network data, leveraging meta-paths to model user connection patterns at semantic levels. Then, based on the meta-paths, we develop an adaptive weighted random walk strategy to integrate global structural features with local semantic information and connect users with similar tendencies. Experimental results on both Twitter and public HIN datasets demonstrate that our method outperforms other classical methods in accurately connecting users with similar tendencies.

Adversarial SQL injection (SQLi) refers to the process in which attackers dynamically modify their attack strategies based on feedback from the target Web Application Firewall (WAF) in an attempt to bypass it. The emergence of automated adversarial SQLi tools in recent years, such as AdvSQLi, RAT, and GPTFuzzer, demonstrates that adversarial SQLi has become a critical method for vulnerability detection and SQLi execution. These tools' intelligent nature poses a significant threat to existing SQLi defense mechanisms. Payloads subjected to adversarial mutation can effectively deceive machine learning-based WAFs, while rule-based WAFs are more susceptible to having vulnerabilities discovered. To address this issue, we propose a hybrid model based on enhanced Character-Level CNN (CLCNN) and Reinforcement Learning (RL), which detects malicious patterns through multi-scale feature extraction by CLCNN from a pattern-matching perspective. Additionally, the reinforcement learning module is employed for adversarial training, executing de-obfuscation operations on payloads for which the CLCNN outputs a low confidence level, further processing ambiguous payloads. The experimental results indicate that even without a priori knowledge, CLCNN demonstrates strong resistance to such tools. And the RL module can further enhance Recall through adversarial training, with minimal reduction in the hybrid model's performance on standard SQLi datasets.

Internet Autonomous System (AS) level topology includes AS topology structure and AS business relationships, describes the essence of Internet inter-domain routing, and is the basis for Internet operation and management research. Although the latest topology inference methods have made significant progress, those relying solely on local information struggle to eliminate inference errors caused by observation bias and data noise due to their lack of a global perspective. In contrast, we not only leverage local AS link features but also re-examine the hierarchical structure of Internet AS-level topology, proposing a novel inference method called topoKG. TopoKG introduces a knowledge graph to represent the relationships between different elements on a global scale and the business routing strategies of ASes at various tiers, which effectively reduces inference errors resulting from observation bias and data noise by incorporating a global perspective. First, we construct an Internet AS-level topology knowledge graph to represent relevant data, enabling us to better leverage the global perspective and uncover the complex relationships among multiple elements. Next, we employ knowledge graph meta paths to measure the similarity of AS business routing strategies and introduce this global perspective constraint to infer the AS business relationships and hierarchical structure iteratively. Additionally, we embed the entire knowledge graph upon completing the iteration and conduct knowledge inference to derive AS business relationships. This approach captures global features and more intricate relational patterns within the knowledge graph, further enhancing the accuracy of AS-level topology inference. Compared to the state-of-the-art methods, our approach achieves more accurate AS-level topology inference, reducing the average inference error across various AS link types by up to 1.2 to 4.4 times.

Inferring the home locations of online social network (OSN) users from their corresponding account data is an important process for many applications, such as personal privacy protection and business advertising applications. The existing methods typically use a supervised learning method to infer a user's home location according to a single or partial aspect of their OSN information. However, the home location of a user may be represented in a biased way if only a single or partial aspect of the information is used, and the performances of the supervised learning-based methods are also very sensitive to the quality of the training set utilized. To address these problems, this article presents a novel unsupervised method for inferring the home locations of the OSN users. The method first builds a heterogeneous network model to comprehensively represent the complex location information in the OSN data and then recursively infers users’ home locations by fusing the direct and indirect location information of the users. Experiments that compared our method with five existing typical Twitter user home location inference methods on a Twitter dataset demonstrate that the proposed method can significantly improve the accuracy and reliability of user home location inference.

The privacy of social media users is a major concern when the users share their content to the public. Sensitive information such as the location of the users can be inferred from relevant content without arising the awareness of the users. With blooming services provided by social media platforms, the users have more freedom to share information via diverse data formats. The multi-modality of the shared information may, in return, worsen the private information leakage caused by inference attacks. In this paper, we first examine the problem of location inference on multi-modal data comprised of textual information and visual content. It is observed that the visual content, such as photos shared by social media users, can significantly boost the success rate of location inference. To thwart adversaries who are driven by visual-related data, we propose a defence that mitigates the threat of location privacy breach under an imperceptible utility loss. Our defence, namely LocGuard, perturbs the photos in a one-off manner before sharing them. The perturbations, along with a simple but effective bipartite perturbation strategy, ensure that LocGuard is resistant to adaptive adversaries who can perform adversarial training based on the perturbed photos. Moreover, LocGuard remains effective against open-set adversaries whose data categories in the training dataset are hidden from the defender. In the evaluation, we conduct extensive experiments based on real-world datasets and compare our work with previous methods. The results show that LocGuard significantly outperforms the existing defences. In particular, LocGuard not only achieves better privacy protection and utility preservation for image sharing, but also can effectively defend against adversarial-training-capable attackers.

In this work, we revisit a classical network tomography problem of inferring a tree topology using end-to-end measurements, with two key differences: (i) instead of relying on the correlation of source-to-destination end-to-end probe packets routing behaviors, we leverage round-trip network traffic behavior characteristics, which enables us to therefore utilize passive measurements and require only source node without available to destination nodes; (ii)rather than assuming that the network is stationary and uses only a single network performance parameter, we leverage network traffic behavior in addition to network performance parameters. Our key idea is to uncover multiple features that can reveal the network topology by exploring the traffic behavior and features observed during data transmission in the network. We then infer the network topology by combining these features through iterative optimization. Simulation and real network experiments demonstrate that our method accurately infers the network topology using network traffic behaviors, with only one source detection node.

A complex network is a fundamental tool to describe real-world complex systems, with most real-world systems containing multiple object types and relationships that can be described as heterogeneous information networks. However, with the increasing network complexity, understanding the complex patterns and finding the meta paths or meta-structures of the heterogeneous information networks has become challenging. This paper proposes a sparse representation for heterogeneous information networks and extracts the heterogeneous information atoms that describe the basic connection pattern of the original heterogeneous information network. The heterogeneous information atoms help extract the main meta-paths or meta-structures and understand the complex patterns of the original heterogeneous information network. Furthermore, the heterogeneous information networks can be decomposed, dimension-reduced, and reconstructed through the heterogeneous information atoms. Extensive experimental results demonstrate that heterogeneous information atoms and sparse coding represent the basic connection pattern of real-world heterogeneous information networks. Indeed, the developed method can reconstruct a network with a recovery exceeding 90%.

In the last two years, the outbreak of COVID-19 has significantly affected human life, society, and the economy worldwide. To prevent people from contracting COVID-19 and mitigate its spread, it is crucial to timely distribute complete, accurate, and up-to-date information about the pandemic to the public. In this article, we propose a spatial–temporally bursty-aware method calledSTBAfor real-time detection of COVID-19 events from Twitter.STBAhas three consecutive stages. In the first stage,STBAidentifies a set of keywords that represent COVID-19 events according to the spatiotemporally bursty characteristics of words using Ripley’s$K$function.STBAwill also filter out tweets that do not contain the keywords to reduce the interference of noise tweets on event detection. In the second stage,STBAuses online density-based spatial clustering of applications with noise clustering to aggregate tweets that describe the same event as much as possible, which provides more information for event identification. In the third stage,STBAfurther utilizes the temporal bursty characteristic of event location information in the clusters to identify real-world COVID-19 events. Each stage ofSTBAcan be regarded as a noise filter. It gradually filters out COVID-19-related events from noisy tweet streams. To evaluate the performance ofSTBA, we collected over 116 million Twitter posts from 36 consecutive days (from March 22, 2020 to April 26, 2020) and labeled 501 real events in this dataset. We comparedSTBAwith three state-of-the-art methods, EvenTweet, event detection via microblog cliques (EDMC), and GeoBurst+ in the evaluation. The experimental results suggest thatSTBAoutperforms GeoBurst+ by 13.8%, 12.7%, and 13.3% in terms of precision, recall, and$F_{1}$score.STBAachieved even more improvements compared with EvenTweet and EDMC.

Boolean tomography is based on exploiting performance level correlations of end-to-end measurements to identify the congested links. Most work to date attempts to find the congested links according to the observed pattern of congested paths and the prior link congestion probabilities. In their work, the prior link congestion probabilities are either assumed to be unrealistically equal or estimated by a computationally complex algorithm. Furthermore, all congested paths are mapped down to the same “bad” state regardless of their congestion degrees, then separate causes of congestion may be identified as a common cause. In this paper, we propose a fast Bottom-Up Approach named BUA to estimate the prior probabilities based on a small number of measurement snapshots. BUA is computationally simpler than the existing approaches since it computes the congestion probability of each individual link through an explicit function of the measurements. We then extract the subsets of congested paths that might traverse the same congested links in current measurement snapshot according to their congestion degrees. The links that cause the congestion of each subset of paths are identified with the aid of the learnt probabilities. Simulations in different network scenarios demonstrate that our approach is able to improve the accuracy of the identification procedure.

Understanding the network link loss is particularly important for optimising delay-sensitive applications. This study addresses the issue of estimating temporal dependence characteristic of link loss by using network tomography. Different from existing works of network loss tomography, the authors use a kth order Markov Chain (k-MC for short, k>1) to model the packet loss process, and propose a constrained optimisation-based method to estimate the state transmission probabilities of the k-MC link loss model. The authors also propose a top–down algorithm in order to ensure that our method can be applied to large networks. Compared with existing loss tomography methods, our method is capable of obtaining more accurate packet loss probability estimates. The ns-2 simulation results show the good performance of our method.

Understanding the topology of a network is very important for network control and management. There have been several methods designed for estimating network topology from end-to-end measurements. Among these methods, the maximum-likelihood-based topology inference method is superior to suboptimal and pair-merging approaches, because it is capable of finding the global optimal topology. However, the existing method which searches the maximum likelihood tree directly is time-consuming, and may not be able to obtain the accurate topology of a larger-scale network. To overcome these issues, this study presents a maximum-likelihood-based leaf nodes inserting topology inference method. The method first builds a binary tree with two leaf nodes, and then inserts the remaining nodes into the tree one by one according to the maximum-likelihood criterion. When compared with the previous methods, the proposed method has the advantages of less computational cost and higher estimate precision. The analytical and simulation results show good performances by the proposed method.

Most of methods for network link performance parameters inference are under the assumption that the link states are stationary during measurement period, as a result, the time-varying characteristics of link state can not be obtained. In this paper, we present a novel nonstationary internal loss tomography method to infer time-varying link loss characteristic. The method is based on improved three-packet stripe, which can provide more accurate unicast end-to-end measurements. The ns-2 simulation shows good performance of improved probe, and effectiveness of time-varying internal loss inference method in tracking variation of link loss.