Heterogeneous graph neural networks (HGNNs) have proven effective at capturing complex relationships in graphs with diverse node and edge types. However, centralized training in HGNNs raises privacy concerns, as sensitive data can be exposed during model training. This risk is further exacerbated when the data is distributed across multiple clients. Federated learning (FL) offers a potential solution by enabling collaborative training without sharing local data. However, existing FL methods for heterogeneous graphs fail to effectively address challenges such as data imbalance and the handling of private edge types. Moreover, existing methods designed for homogeneous graphs are ineffective at addressing the data sparsity issue in heterogeneous graphs. In this article, we propose FedHeGA, a FL framework for heterogeneous graphs that enhances node classification performance while preserving privacy. We tackle data imbalance by integrating heterogeneous graph reconstruction with differential autoencoders to generate semantically coherent node features, improving feature propagation in sparse or imbalanced data. To preserve privacy, we propose a parameter decomposition mechanism that uploads only edge-type-independent global parameters, protecting sensitive local data. Additionally, we address dataset skewness by employing a contrastive learning strategy to align local and global model parameters, which enhances convergence. Experimental results demonstrate that FedHeGA significantly outperforms existing methods on node classification benchmarks, offering an effective solution for federated heterogeneous graph learning.

Blockchain technology has driven the development of Decentralized Applications (DApps) in areas such as decentralized finance. However, as application scenarios become more complex, the limitations of computational resources and costs gradually lead to insufficient performance. Large Language Models (LLMs), as a promising technology, have the potential to enhance blockchain’s capabilities in complex task governance. However, due to factors such as consensus mechanisms, it is challenging to directly integrate them with blockchain. To address this issue, this article proposes and implements a general framework for integrating LLMs with blockchain data, C-LLM, which successfully overcomes interoperability barriers between the two. By combining semantic relevance evaluation and truth discovery techniques, this article presents an innovative data aggregation method, SenteTruth, which effectively improves the correctness and credibility of data generated by LLMs. To validate the framework’s effectiveness, we construct a dataset containing three types of questions, covering Q&A records between 10 oracle nodes and 5 LLM models. Experimental results show that, in the presence of 40% malicious nodes, the proposed method improves data correctness by an average of 17.74% compared with the optimal baseline. This research not only provides an innovative solution for the intelligent application of smart contracts but also demonstrates the potential for deep integration of LLMs and blockchain, driving the development of smarter and more complex application scenarios for smart contracts.

Blockchain is distinguished by its decentralization and security, but it faces significant scalability challenges. Sharding is widely regarded as a key solution for improving blockchain scalability. However, existing sharding schemes, such as Monoxide, often suffer from load imbalance and excessive cross-shard transactions (TXs), which degrades system performance. To address these issues, we propose Sharding-aware NSGA-II (SNSGA-II), a variant of the Non-dominated Sorting Genetic Algorithm II, designed to optimize account allocation in blockchain sharding. We formulate the allocation problem as a multi-objective optimization task and develop a SNSGA-II-based sharding algorithm that dynamically adjusts account allocation to improve load balancing while minimizing cross-shard TXs. The proposed approach achieves a well-balanced trade-off in terms of Pareto efficiency, ensuring that improvements in load balancing do not come at the cost of excessive cross-shard TXs. We evaluate our method through simulation experiments on a real Ethereum dataset. The results demonstrate that our method significantly outperforms existing solutions, including Metis, Monoxide, and HyperChain, in key metrics such as throughput and TX confirmation delay.

Encrypted traffic classification (ETC) is essential for ensuring network security and efficient management. Despite advances in deep learning, ETC remains challenging as existing models struggle to learn robust, discriminative representations from content-encrypted, highly imbalanced traffic.To address these challenges, we propose BTRFormer, a novel ETC approach that capitalizes on the inherent properties of encryption algorithms to enhance classification accuracy. At the core of BTRFormer lies a block-based, multi-layer traffic representation that adopts a 4×4 block as the fundamental unit, inspired by the encryption algorithm’s use of 16-byte blocks for encryption operations. This representation preserves the intrinsic structure of encrypted payloads, facilitating the model’s ability to learn deep semantic features. Subsequently, a transformer-based model is employed to learn from the multi-layer representation, capturing intra-block, inter-block, and inter-packet dependencies through block-wise attention mechanisms. Finally, BTRFormer leverages a pre-training phase on large-scale unlabeled data, followed by fine-tuning with a minimal amount of labeled samples to improve generalization and adaptability. Experimental results show that BTRFormer significantly outperforms SOTA methods on six real-world datasets, highlighting its effectiveness in encrypted traffic classification and secure network management.

In recent years, blockchain oracle, as the key link between blockchain and real-world data interaction, has greatly expanded the application scope of blockchain. In particular, the emergence of the Multi-Data Source (MDS) oracle has greatly improved the reliability of the oracle in the case of untrustworthy data sources. However, the current MDS oracle scheme requires nodes to obtain data redundantly from multiple data sources to guarantee data reliability, which greatly increases the resource overhead and response time of the system. Therefore, in this paper, we propose a Secure and Efficient Multi-data Source Oracle framework (SEMSO), where nodes only need to access one data source to ensure the reliability of final data. First, we design a new off-chain data aggregation protocol TBLS, to guarantee data source diversity and reliability at low cost. Second, according to the rational man assumption, the data source selection task of nodes is modeled and solved based on the Bayesian game under incomplete information to maximize the node's revenue while improving the success rate of TBLS aggregation and system response speed. Security analysis verifies the reliability of the proposed scheme, and experiments show that under the same environmental assumptions, SEMSO takes into account data diversity while reducing the response time by 23.5%.

In the industrial Internet of Things (IIoT) scenarios, data sharing can promote mutual collaboration among production parties to improve productivity and optimise resource allocation, but data sharing in industrial scenarios faces the risk of privacy leakage due to open networks. Attribute-based encryption (ABE) can be used to solve the problem of data sharing privacy leakage. However, there is still no effective privacy protection solution for data sharing and access control policies in blockchain, which may expose sensitive information of data owners. Moreover, existing schemes only focus on protecting data privacy and ignore the protection of users’ query privacy. In addition, most of these schemes are based on cloud servers, which may lead to data tampering and a single point of failure. To address these issues, we propose a blockchain-based data security sharing scheme (BAPIR) that combines attribute-based encryption and private information retrieval (PIR). In this paper, we implement fine-grained access control using ABE based on the inner product and protecting the access policy. Additionally, PIR technology is introduced to protect users’ query privacy. To achieve efficient blockchain data storage, IPFS is used for on-chain and off-chain collaboration, and complex computational tasks are outsourced to edge servers, ensuring secure and efficient data sharing. Finally, we demonstrate the security and efficiency of BAPIR through security analysis and performance evaluation.

Malware classification involves categorizing mal-ware samples based on their characteristics. While deep learning techniques applied to malware execution traces, mainly API calls, have shown potential in this field, they still perform poorly. This is primarily because they treat all APIs equally and train classifiers directly on native APIs, which inadequately capture the under-lying family-related semantics. In this paper, we first investigate the behaviors of multiple malware families and observe that different families exhibit divergent behaviors, with each family consistently favoring certain behaviors over time. Motivated by this, we propose APIBeh, a new embedding method designed to enhance malware classification. APIBeh first utilizes Benignity Degree Algorithm to identify and exclude insignificant, likely benign APIs from sequences. Then, it introduces the concept of Behavior Inclination, which quantifies the association between an API and malicious behaviors, facilitating high-level behavior encoding for each API. This Behavior Inclination embedding is then concatenated with raw embedding to represent an API, and fed into a DL model for classifier training. Experimental results show that APIBeh outperforms existing embedding methods in classification performance, e.g., 3.18% boost in weighted f1-score over a recent study using word2vec. In addition, it offers robustness to concept drift and adversarial attacks.

Federated Learning (FL) is a distributed privacy-protecting machine learning paradigm that enables collaborative training among multiple parties without the need to share raw data. This mode of training renders FL particularly susceptible to attacks. A pivotal challenge within FL is the defense against Byzantine attacks, which can alter the model aggregation process and ultimately lead to the failure of Federated Learning convergence. Existing Byzantine defense mechanisms often result in diminished model accuracy in scenarios characterized by non-independent and identically distributed (non-IID) data. To alleviate this issue, we propose a novel defense approach named Fed-BRMC. This method combines a self-developed federated Dual-Model Contrastive Detection technique with Similarity Detection methods, leveraging historical update information from users to deeply mine the characteristics of model parameters, effectively distinguishing between Byzantine and honest users. Extensive experimentation has shown that Fed-BRMC significantly improves user identification accuracy in non-IID data scenarios compared to existing methods and notably enhances the global model accuracy of Byzantine-robust Federated Learning.

As a trusted middleware connecting the blockchain and the real world, the blockchain oracle can obtain trusted real-time price information for financial applications such as payment and settlement, and asset valuation on the blockchain. However, the current oracle schemes face the dilemma of security and service quality in the process of node selection, and the implicit interest relationship in financial applications leads to a significant conflict of interest between the task publisher and the executor, which reduces the participation enthusiasm of both parties and system security. Therefore, this paper proposes an anonymous node selection scheme that anonymously selects nodes with high reputations to participate in tasks to ensure the security and service quality of nodes. Then, this paper also details the interest requirements and behavioral motives of all parties in the payment settlement and asset valuation scenarios. Under the hypothesis of rational man, an incentive mechanism based on the Stackelberg game is proposed. It can achieve equilibrium under the pursuit of the revenue of task publishers and executors, thereby ensuring the revenue of all types of users and improving the enthusiasm for participation. Finally, we verify the security of the proposed scheme through security analysis. The experimental results show that the proposed scheme can reduce the variance of obtaining price data by about 55 % while ensuring security, and meeting the revenue of all parties.

Blockchain technology ensures secure and trust-worthy data flow between multiple participants on the chain, but interoperability of on-chain and off-chain data has always been a difficult problem that needs to be solved. To solve the problem that blockchain systems cannot access off-chain data, oracle is introduced. However, existing research mainly focuses on the consistency and integrity of data, but ignores the problem that oracle nodes may be externally attacked or provide false data for selfish motives, resulting in the unresolved problem of data accuracy. In this paper, we introduce a new Decentralized Testing architecture (DecTest) that aims to improve data accuracy. A blockchain oracle random secret testing mechanism is first proposed to enhance the monitoring and verification of nodes by introducing a dynamic anonymized question-verification committee. Based on this, a comprehensive evaluation incentive mechanism is designed to incentivize honest work performance by evaluating nodes based on their reputation scores. The simulation results show that we successfully reduced the discrete entropy value of the acquired data and the real value of the data by 61.4 %.

A blockchain provides decentralization and trustlessness features for the Industrial Internet of Things (IIoT), which expands the application scenarios of IIoT. To address the problem that blockchains cannot actively obtain off-chain data, the blockchain oracle is proposed as a bridge between the blockchain and external data. However, the existing oracle schemes make it difficult to solve the problem of low quality of service caused by frequent data changes and heterogeneous devices in IIoT, and the current oracle node selection schemes are difficult to balance security and quality of service. To tackle these problems, this paper proposes a secure and reliable oracle scheme that can obtain high-quality off-chain data. Specifically, we first design an oracle node selection algorithm based on a Verifiable Random Function (VRF) and reputation mechanism to securely select high-quality nodes. Second, we propose a data filtering algorithm based on a sliding window to further improve the consistency of the collected data. We verify the security of the proposed scheme through security analysis. The experimental results show that the proposed scheme can effectively select high-quality nodes, reduce data differences, and improve the quality of service of the oracle. In the oracle network with malicious nodes accounting for 10%, the data accuracy rate is increased by about 4%, and the data variance is reduced by about 45% on average.

Analyzing malware based on API call sequences is an effective approach, as these sequences reflect the dynamic execution behavior of malware. Recent advancements in deep learning have facilitated the application of these techniques to mine valuable information from API call sequences. However, these methods typically operate on raw sequences and may not effectively capture crucial information, especially in the case of multi-process malware, due to theAPI call interleaving problem. Furthermore, they often fail to capture contextual behaviors within or across processes, which is particularly important for identifying and classifying malicious activities. Motivated by this, we present API2Vec++, a graph-based API embedding method for malware detection and classification. First, we construct a graph model to represent the raw sequence. Specifically, we design the Temporal Process Graph (TPG) to model inter-process behaviors and the Temporal API Property Graph (TAPG) to model intra-process behaviors. Compared to our previous graph model, the TAPG model exposes operations with associated behaviors within the process through node properties and thus enhances detection and classification abilities. Using these graphs, we develop a heuristic random walk algorithm to generate numerous paths that can capture fine-grained malicious familial behavior. By pre-training these paths using the BERT model, we generate embeddings of paths and APIs, which can then be used for malware detection and classification. Experiments on a real-world malware dataset demonstrate that API2Vec++ outperforms state-of-the-art embedding methods and detection/classification methods in both accuracy and robustness, particularly for multi-process malware.

Due to the explosion of online educational resources, the protection and management of educational multimedia data have become more challenging. Blockchain has emerged as a promising technology for copyright management due to its decentralized and traceable nature. However, it still faces problems such as difficulties in copyright maintenance and delays in the consensus process, especially for educational multimedia data with large amounts of data, high demand for privacy, and many participants. This paper proposes a secure and trustworthy copyright protection method based on a redactable blockchain to address these issues. We use a decentralized chameleon hash function for copyright maintenance to enable trusted blockchain editing. This can promptly modify infringing copyrights to complete efficient copyright maintenance. For the delay during consensus, we design a consensus mechanism called Proof of Behavior (PoB) based on the Bayesian network (BN), which can achieve fast and reliable consensus by predicting user behavior and selecting highly trusted nodes to participate in consensus. Finally, We conduct simulation experiments to validate the performance of our proposed approach. Specifically, our approach effectively reduces storage space by 5%-10% comparable to other blockchain solutions and enhances system scalability and security.

Abstract Vulnerability reports are essential for improving software security since they record key information on vulnerabilities. In a report, CWE denotes the weakness of the vulnerability and thus helps quickly understand the cause of the vulnerability. Therefore, CWE assignment is useful for categorizing newly discovered vulnerabilities. In this paper, we propose an automatic CWE assignment method with graph neural networks. First, we prepare a dataset that contains 3394 real world vulnerabilities from Linux, OpenSSL, Wireshark and many other software programs. Then, we extract statements with vulnerability syntax features from these vulnerabilities and use program slicing to slice them according to the categories of syntax features. On top of slices, we represent these slices with graphs that characterize the data dependency and control dependency between statements. Finally, we employ the graph neural networks to learn the hidden information from these graphs and leverage the Siamese network to compute the similarity between vulnerability functions, thereby assigning CWE IDs for these vulnerabilities. The experimental results show that the proposed method is effective compared to existing methods.

In the world of cyber security, backdoor attacks are widely used. These attacks work by injecting a hidden backdoor into training samples to mislead models into making incorrect judgments for achieving the effect of the attack. However, since the triggers in backdoor attacks are relatively single, defenders can easily detect backdoor triggers of different corrupted samples based on the same behavior. In addition, most current work considers image classification as the object of backdoor attacks, and there is almost no related research on speaker verification. This paper proposes a novel audio steganography-based personalized trigger backdoor attack that embeds hidden trigger techniques into deep neural networks. Specifically, the backdoor speaker verification uses a pre-trained audio steganography network that employs specific triggers for different samples to implicitly write personalized information to all corrupted samples. This personalized method can significantly improve the concealment of the attack and the success rate of the attack. In addition, only the frequency and pitch were modified and the structure of the attacked model was left unaltered, making the attack behavior stealthy. The proposed method provides a new attack direction for speaker verification. Through extensive experiments, we verified the effectiveness of the proposed method.

Set-valued data and social network provide opportunities to mine useful, yet potentially security-sensitive, information. While there are mechanisms to anonymize data and protect the privacy separately in set-valued data and in social network, the existing approaches in data privacy do not address the privacy issue which emerge when publishing set-valued data and its correlative social network simultaneously. In this paper, we propose a privacy attack model based on linking the set-valued data and the social network topology information and a novel technique to defend against such attack to protect the individual privacy. To improve data utility and the practicality of our scheme, we use local generalization and partial suppression to make set-valued data satisfy the grouped ρ-uncertainty model and to reduce the impact on the community structure of the social network when anonymizing the social network. Experiments on real-life data sets show that our method outperforms the existing mechanisms in data privacy and, more specifically, that it provides greater data utility while having less impact on the community structure of social networks.

Data collection by social networking applications offers many opportunities for mining information, which provides a better understanding of social structures and their dynamic structures. Anonymization of social networks before they are published or shared is particularly important, since social network data usually contain much sensitive information on individuals. In this paper, we address the privacy problems of dynamic releases of social networks. We re-define the label-neighborhood attack model in dynamic social network releases. An adversary can use one-hop neighbor's network structure and label as background knowledge to identity the victim to learn more sensitive information. We propose a dynamic-l-diversity anonymized method to resist attacks. Experiments show that the proposed approach can retain much of the characteristics of the network while providing high utility.

With the popularity of social networks, privacy issues with regard to publishing social network data have gained intensive focus from academia. We analyzed the current privacy-preserving techniques for publishing social network data and defined a privacy-preserving model with privacy guarantee [Formula: see text]. With our definitions, the existing privacy-preserving methods, [Formula: see text]-anonymity and randomization can be combined together to protect data privacy. We also considered the privacy threat with label information and modify the [Formula: see text]-anonymity technique of tabular data to protect the published data from being attacked by the combination of two types of background knowledge, the structural and label knowledge. We devised a partial [Formula: see text]-anonymity algorithm and implemented it in Python and open source packages. We compared the algorithm with related [Formula: see text]-anonymity and random techniques on three real-world datasets. The experimental results show that the partial [Formula: see text]-anonymity algorithm preserves more data utilities than the [Formula: see text]-anonymity and randomization algorithms.