Abstract In current research on network intrusion detection systems (IDS), mainstream methods typically rely on large-scale, high-quality labeled datasets to train deep learning models, such as convolutional neural networks (CNNs), recurrent neural networks (RNNs), and their variants. These methods can achieve high detection accuracy and robustness under conditions where sufficient training data is available. However, during actual deployment, especially at the initial emergence of novel attacks or in specific scenarios, it is often difficult to collect sufficient and reliable labeled samples, leading to extremely small-sample conditions. Under extremely small-sample conditions, existing deep learning-based IDS methods experience significant degradation in both detection performance and generalization capability due to scarce training data or insufficient labeling quality. To address this problem, this paper proposes CogAugIDS, a cognitive model data augmentation-based IDS framework. CogAugIDS simulates human learning and decision-making processes to deeply understand and reason about extremely small-sample data, thereby generating more representative and diverse augmented samples. This approach enhances the training and detection performance of deep learning-based IDS methods under extremely small-sample conditions. Experimental results show that, when tested on the UNSW-NB15 dataset with only 10 samples per attack category, CogAugIDS achieves significantly better performance in multi-classification tasks compared to classical deep learning methods (CNN-BiLSTM, 1D-CNN, CNN-LSTM, LSTM). Specifically, CogAugIDS improves the accuracy of multi-classification tasks by approximately 5%–7% compared to classical deep learning-based IDS approaches. Furthermore, CogAugIDS demonstrates stronger robustness and generalization ability in resource-constrained environments. It effectively enhances detection accuracy even when faced with a very small number of training samples, and its adaptability to is superior to that of baseline deep learning-based IDS methods. These results validate the superiority of the CogAugIDS framework under extremely small-sample conditions and demonstrate its practical applicability in resource-limited IDS environments.

Trusted Execution Environments (TEE) serve as a fundamental trust infrastructure of smartphones. By placing critical code and data inside TEE, smartphone apps ensure their confidentiality and integrity, even with a compromised outside system. However, there is a lack of studies on the usage of TEEs on smartphones. To that end, we conduct a comprehensive empirical study, demystifying smartphone-based TEEs, TEE-based apps, and their interactions. Specifically, our study answers threefold questions: (1) how are TEEs designed for smartphones, (2) what do the TEE-based apps look like, and (3) how do these apps use TEE? To answer these questions, our research investigates 17 TEE systems and more than 10,000 real-world Android apps across over 50 regular and malicious app categories. To automate the investigation, a tool that detects if an app uses TEE (i.e., TEE-based apps) has been provided. Our findings can provide practical guidance for app testers to generate valid TEE test cases, for TEE vendors to optimize their TEE solutions, and for security researchers and developers to enhance their protection mechanisms.

In the judicial deposit scenario, the storage device needs to ensure the long-term trustworthy storage of electronic evidence. In order to reduce the energy consumption of the storage device in the storage process, the judicial authority introduces the cold storage device as the storage device for electronic evidence. Cold storage equipment as a core component in the judicial depository scene, the trustworthiness of its cold storage behavior affects the trustworthiness of the entire scene of electronic evidence, judicial institutions and so on. Since the success of storage depends on many complex factors, and there are many cold storage devices in the archiving system, the managers can not quickly locate the abnormal problem information, and in the long run, there are many inconveniences in the abnormal management of the devices. Therefore, this research will study the trustworthiness of cold storage behavior in judicial depository scenarios. This paper mainly focuses on the description of the trustworthiness of cold storage behavior and the collection of data related to behavioral trustworthiness, and the trustworthiness assessment of cold storage behavior will be carried out at a later stage. In this paper, a new trusted attribute classification method is proposed to analyze the trusted attributes for the observer, operation ontology and operation object of deeds. In addition, the cold storage logs are obtained based on the operations of constructing trusted behavior declarations and simulating the operating environment, and the logs are analyzed according to the Drain3 algorithm to extract the real behavioral data of cold storage, which provides theoretical and data support for the next step of cold storage behavioral trustworthiness metrics.

Trusted requirements affect the trusted attributes of software, and have an important impact on whether trusted software can meet the trusted requirements. However, despite the continuous development of society and technology, the work of obtaining and analyzing trusted requirements has not become easy, has become more and more difficult. In the process of obtaining trusted requirements, a series of problems, such as low efficiency and inaccurate acquisition of requirements, serious software quality problems, budget overruns and delivery delays, have become increasingly prominent. In view of the above problems, this paper integrates the concept of meta-requirement into trusted requirement. Based on the respective characteristics of meta-requirement and trusted requirement, this paper puts forward the concept of trusted meta-requirement, and introduces the basic elements and characteristics. Then the trusted meta-requirements and some rules involved in it are formalized by the combination of first-order logic and set theory in order to improve the accuracy of the description and analysis of trusted requirements.