Identifying hidden cybercrimes is a challenging task, as these behaviors are often carefully planned by criminals with counter-surveillance awareness. Existing solutions for cybercrime detection struggle to uncover enough clues to identify hidden criminal behaviors. Malicious behaviors are concealed beneath benign behaviors, and the boundaries between malicious and benign behaviors in the representation space are blurred to evade mainstream deep learning-based security authentication models. We introduce abehaviortomographer (BT) to reconstruct the behavior structure from three slices: agent, event, and attribute slices, enabling more granular detection of hidden cybercrimes. The core idea of BT is to reconstruct interior information about behavior structure from multiple slices, much like computed tomography in modern medicine enables the reconstruction of internal body. It enables the extraction of discriminative information from intricate interior associations between behavioral attributes rather than surface information meticulously crafted by criminals. Our experiments are conducted on two representative cybercrime datasets. Promising experimental results demonstrate that BT outperforms state-of-the-art models on key metrics, achieving around 0.99 AUC-ROC and approximately 0.9 AUC-PR. Moreover, BT notably excels at low false positive rates, showcasing its high effectiveness for real-world applications.

Automatic sleep staging offers a quick and objective assessment for quantitatively interpreting sleep stages in neonates. However, most of the existing studies either do not encompass any temporal information, or simply apply neural networks to exploit temporal information at the expense of high computational overhead and modeling ambiguity. This limits the application of these methods to multiple scenarios. In this paper, a sequential end-to-end sleep staging model, SeqEESleepNet, which is competent for parallelly processing sequential epochs and has a fast training rate to adapt to different scenarios, is proposed. SeqEESleepNet consists of a sequence epoch generation (SEG) module, a sequential multi-scale convolution neural network (SMSCNN) and squeeze and excitation (SE) blocks. The SEG module expands independent epochs into sequential signals, enabling the model to learn the temporal information between sleep stages. SMSCNN is a multi-scale convolution neural network that can extract both multi-scale features and temporal information from the signal. Subsequently, the followed SE block can reassign the weights of features through mapping and pooling. Experimental results exhibit that in a clinical dataset, the proposed method outperforms the state-of-the-art approaches, achieving an overall accuracy, F1-score, and Kappa coefficient of 71.8%, 71.8%, and 0.684 on a three-class classification task with a single channel EEG signal. Based on our overall results, we believe the proposed method could pave the way for convenient multi-scenario neonatal sleep staging methods.

Vertical Federated Learning (VFL) enables multiple clients to collaboratively train a global model over vertically partitioned data without leaking private local information. Tree-based models, like XGBoost and LightGBM, have been widely used in VFL to enhance the interpretation and efficiency of training. However, there is a fundamental lack of research on how to conduct VFL securely over distributed labels. This work is the first to fill this gap by designing a novel protocol, called FEVERLESS, based on XGBoost. FEVERLESS leverages secure aggregation via information masking technique and global differential privacy provided by a fairly and randomly selected noise leader to prevent private information from being leaked in the training process. Furthermore, it provides label and data privacy against honest-but-curious adversaries even in the case of collusion of$n - 2$out of n clients. We present a comprehensive security and efficiency analysis for our design, and the empirical results from our experiments demonstrate that FEVERLESS is fast and secure. In particular, it outperforms the solution based on additive homomorphic encryption in runtime cost and provides better accuracy than the local differential privacy approach.

Anti-fraud engineering for online credit loan (OCL) platforms is getting more challenging due to the developing specialization of gang fraud. Associations are critical features referring to assessing the credibility of loan applications for OCL fraud prediction. State-of-the-art solutions employ graph-based methods to mine hidden associations among loan applications effectively. They perform well based on the information asymmetry which is guaranteed by the huge advantage of platforms over fraudsters in terms of data quantity and quality at their disposal. The inherent difficulty that can be foreseen is thedata isolationcaused by mistrust between multiple platforms and data control legislations for privacy preservation. To maintain the advantage owned by the platforms, we design a privacy-preserving distributed graph learning framework that ensures critical association repairs by merging parameter sharing and data sharing. Specially, we propose theassociation reconstruction mechanism(ARM) that consists of the devised exploration, processing, transmission and utilization schemes to realize data sharing. For parameter sharing, we design a hybrid encryption technique to protect privacy during collaboratively learning graph neural network (GNN) models among different financial client platforms. We conduct the experiments over real-life data from large financial platforms. The results demonstrate the effectiveness and efficiency of our proposed methods.

Bayesian optimization is a powerful surrogate-assisted algorithm for solving expensive black-box optimization problems. While Bayesian optimization was developed for centralized optimization, the availability of massive distributed data has attracted increased interests in exploring federated Bayesian optimization that can use data on multiple clients without leaking the raw data. However, existing federated Bayesian optimization (FBO) approaches assume that either all clients jointly solve the same optimization task, or only one client solves one target optimization task by transferring knowledge from others in a federated way, making them unsuited for many real-world applications. In this paper, we consider FBO for the scenario where multiple related local black-box tasks associated with different clients are jointly optimized by sharing knowledge between tasks without leaking the data privacy. An efficient federated many-task Bayesian optimization framework is proposed to address not independent and identically distributed (non-IID) data while protecting the data privacy in the federated setting. A novel federated knowledge transfer paradigm is developed for dynamic many-task model aggregation according to a dissimilarity matrix. The dissimilarity is measured based on the rank of the predictions and only the hyperparameters in the local Gaussian process models are shared. In addition, a federated ensemble acquisition function is constructed by integrating the predictions of two surrogates using the global and local hyperparameters, respectively, to effectively search for the optimal solution. Experimental results show that our proposed method has reliable performance on both benchmark problems and a real machine learning problem also in the presence of non-IID data.

Despite the recent advances in automatic sleep staging, few studies have focused on real-time sleep staging to promote the regulation of sleep or the intervention of sleep disorders. In this paper, a novel network named SwSleepNet, that can handle both precisely offline sleep staging, and online sleep stages prediction and calibration is proposed. For offline analysis, the proposed network coordinates sequence broadening module (SBM), sequential CNN (SCNN), squeeze and excitation (SE) block, and sequence consolidation module (SCM) to balance the operational efficiency of the network and the comprehensive feature extraction. For online analysis, only SCNN and SE are involved in predicting the sleep stage within a short-time segment of the recordings. Once more than two successive segments have disparate predictions, the calibration mechanism will be triggered, and contextual information will be involved. In addition, to investigate the appropriate time of the segment that is suitable to predict a sleep stage, segments with five-second, three-second, and two-second data are analyzed. The performance of SwSleepNet is validated on two publicly available datasets Sleep-EDF Expanded and Montreal Archive of Sleep Studies (MASS), and one clinical dataset Huashan Hospital Fudan University (HSFU), with the offline accuracy of 84.5%, 86.7%, and 81.8%, respectively, which outperforms the state-of-the-art methods. Additionally, for the online sleep staging, the dedicated calibration mechanism allows SwSleepNet to achieve high accuracy over 80% on three datasets with the short-time segments, demonstrating the robustness and stability of SwSleepNet. This study presents a real-time sleep staging architecture, which is expected to pave the way for accurate sleep regulation and intervention.

Traffic prediction acts as a fundamental function in the management and optimization of networks and services. There are emerging requirements for extraordinary traffic prediction, including variable-term traffic series and comprehensive traffic behavior. Compared to ordinary traffic prediction, these demands call for solutions to mine rich information and predict business load under broader conditions. In this work, we propose X-Trafformer, a graph spatiotemporal transformer model, for extraordinary traffic prediction. Unlike conventional techniques that model traffic sequences, we transform traffic sequences into traffic behaviors under generalized objects, where behaviors are initiated by generalized objects and possess specific behavioral attributes. It allows for the prediction of multiple variables in traffic data across different networks and services, leveraging the matching of behavioral attributes among behavior objects and events. X-Trafformer incorporates multiple interrelated graph structures to capture fine-grained attribute spatiotemporal associations and coarse-grained object spatiotemporal distributions, forming the foundation for accurate prediction. Evaluation on real and representative traffic scenarios (communication traffic from Italian Telecom and business traffic from Tmall) demonstrates X-Trafformer's exceptional prediction performance at low computational costs.

The convenience offered by the Internet accelerates the evolution of fraudulent behavior during facilitating the rapid development of online payment services. Fraudsters can change their behavior patterns frequently and at a low cost in the online space, allowing them to evade regulatory oversight. This poses a significant challenge for meticulously trained learning-based security applications for fraud detection and can lead to serious social security risks. Most of them depend on the static learning paradigm, which trains a model over a static training dataset and deploys the trained model for inference with the frozen model parameters under the i.i.d. assumption. To stay ahead of the rapidly evolving fraud, researchers have been exploring models with low latency and fast response capabilities to effectively combat fraudulent behavior. Unfortunately, the evolving fraud is not only reflected in the drift of their superimposed risk features but also in the openness of their category. The interweaving of open-category and concept-drift accelerates the process of existing security methods becoming powerless. In this paper, we propose EvoFD, an online evolving fraud detection framework to enable continual learning to cope with undercurrent surges of evolving fraud. The core idea of EvoFD is to weaken the bias caused by theanchoring effecton the learned information. It learns in an online streaming fashion by using instructive representations as anchors. Specially, we maintain the progressively updatable class anchors and optimize the representation network to embed features and class anchors into a unified normalized space, where the training and predicting can be conducted simultaneously or independently. In the framework, we preserve the balanced replay memory for each class to accumulate knowledge and avoid forgetting. The advantages of our method are validated by extensive experiments over the real-world dataset from a prestigious bank.

The rapid growth of electronic commerce brings convenience to modern life but comes with security risks by various cybercrimes in online payment services. Most existing security methods for fraud detection depend on the static learning paradigm, which trains a model over a static training dataset and deploys the trained model for inference with the frozen model parameters under the i.i.d. assumption. Unfortunately, this paradigm becomes incommensurate with the increasingly complicated and varying fraud patterns due to the untimely and delayed responses in the offline environment. Without sensing the evolution of fraud timely, it is challenging to train and deploy targeted countermeasures. The emerging means of fraud are not only reflected in the openness of their category, but also in the drift of their superimposed risk features. The interweaving of open-category and concept drift accelerates the process of existing methods becoming powerless. In this paper, we propose EvoFD, an online evolving fraud detection framework to enable continual learning to cope with undercurrent surges of evolving fraud. The core idea of EvoFD is to weaken the bias caused by the anchoring effect on the learned information. It learns in an online streaming fashion by using instructive representations as anchors. Specially, we maintain the progressively updatable class anchors and optimize the representation network to embed features and class anchors into a unified normalized space, where the training and predicting can be conducted simultaneously or independently. In the framework, we preserve the balanced replay memory for each class to accumulate knowledge and avoid forgetting. The advantages of our method are validated by extensive experiments over the real-world dataset from a prestigious bank.

Gang fraud, the major and primary security issue in online lending services, can be efficiently solved by the data-driven paradigm that is recognized as a promising solution for online lending gang fraud prediction. However, it is challenging that such predictions need to detect evolving and increasingly impalpable fraud patterns based on low-quality data, i.e., very preliminary and coarse applicant information. The technical difficulty mainly stems from two factors: the extremedeficiency of information associationsandweakness of data labels. In this work, we mainly address the challenges by enhancing the utility of associations (i.e.,recovering missing associationsandmining underlying associations) on a knowledge graph. Specifically, we first propose an efficient method of Chinese address disambiguation to recover some critical associations that are broken by the ambiguity of applicant information, e.g., address related information. Then, to mine the implicit associations, we design a novel association representation method, calledAdaptive Connected Component Embedding Simplification Scheme(ACCESS), which can adaptively implement embedding for different connected components depending on their sizes. Finally, we adopt the graph clustering algorithms and devised predicting schemes based on the above enhanced associations to predict gang fraud in the case of weakness of data labels. Moreover, we propose a framework called RMCP by integrating the above techniques, which is consists of four steps:Recovering,Mining,Clustering, andPredicting, for efficiently predicting gang fraud. The good performance is validated by the experiments on a real-world dataset from a commercial lending company. Meanwhile, we provide a visual decision support system namedLongArmsover the RMCP framework.

In data-driven anti-fraud engineering for online payment services, the integration of proper function modules is an effective way to further improve detection performance by overcoming the inability of single-function methods to cope with complex and varied frauds. However, a qualified integration is really inaccessible under multiple demanding requirements, i.e., improving detection performance, ensuring decision explainability, and limiting processing latency and computing consumption. In this work, we propose a qualified integration system, named CAeSaR, that can simultaneously meet all of the above requirements. This satisfactory result is achieved by the cooperation of two innovative techniques. The first is a novel three-way taxonomy of function division, called TRTPT, according to the temporal positions of transactions relative to a reference fraudulent transaction. Based on TRTPT, CAeSaR can introduce three kinds of anti-fraud function modules which collaboratively cover all types of frauds theoretically. The second is an effective integration scheme, called TELSI. It generates the candidate decision strategies by combining the judgments of three function modules by only two simple logical connectives, which essentially ensures the decision explainability. Particularly, TELSI can assign the most effective decision strategy to the corresponding transaction adaptively by a devised stacking-based multi-classification. The advantages of CAeSaR are validated in practice over real-life data from a prestigious bank.

In online lending services, fraud prediction is an especially critical step to control loss risk and improve processing efficiency. Unfortunately, it is definitely challenging since the ex-ante prediction actually needs to be made only based on the most basic information of applicants. This work figures out that the essential difficulty here is the low information density of data associations which contain the useful information for fraud prediction. Accordingly, we propose a novel multi-stage data representation scheme, called AI2Vec (Applicant Information Vectoring), as an information density booster. It can gradually boost information density of associations by simultaneously decreasing the scale of information carriers and increasing the amount of useful information. The qualified performance of our AI2Vec is validated by the experiments over real-life data from a prestigious online lending platform. It can help commonly-used machine learning classifiers outperform the state-of-the-art methods, including the method of pilot platform with manual feature engineering by the subject matter experts.

Deep learning methods have become an important tool for automatic sleep staging in recent years. However, most of the existing deep learning-based approaches are sharply constrained by the input modalities, where any insertion, substitution, and deletion of input modalities would directly lead to the unusable of the model or a deterioration in the performance. To solve the modality heterogeneity problems, a novel network architecture named MaskSleepNet is proposed. It consists of a masking module, a multi-scale convolutional neural network (MSCNN), a squeezing and excitation (SE) block, and a multi-headed attention (MHA) module. The masking module consists of a modality adaptation paradigm that can cooperate with modality discrepancy. The MSCNN extracts features from multiple scales and specially designs the size of the feature concatenation layer to prevent invalid or redundant features from zero-setting channels. The SE block further optimizes the weights of the features to optimize the network learning efficiency. The MHA module outputs the prediction results by learning the temporal information between the sleeping features. The performance of the proposed model was validated on two publicly available datasets, Sleep-EDF Expanded (Sleep-EDFX) and Montreal Archive of Sleep Studies (MASS), and a clinical dataset, Huashan Hospital Fudan University (HSFU). The proposed MaskSleepNet can achieve favorable performance with input modality discrepancy, e.g. for single-channel EEG signal, it can reach 83.8%, 83.4%, 80.5%, for two-channel EEG+EOG signals it can reach 85.0%, 84.9%, 81.9% and for three-channel EEG+EOG+EMG signals, it can reach 85.7%, 87.5%, 81.1% on Sleep-EDFX, MASS, and HSFU, respectively. In contrast the accuracy of the state-of-the-art approach which fluctuated widely between 69.0% and 89.4%. The experimental results exhibit that the proposed model can maintain superior performance and robustness in handling input modality discrepancy issues.

In this work, we aim at building a bridge from coarse behavioral data to an effective, quick-response, and robust behavioral model for online identity theft detection. We concentrate on this issue in online social networks (OSNs) where users usually have composite behavioral records, consisting of multidimensional low-quality data, e.g., offline check-ins and online user-generated content (UGC). As an insightful result, we validate that there is a complementary effect among different dimensions of records for modeling users’ behavioral patterns. To deeply exploit such a complementary effect, we propose ajoint(instead offused) model to capture both online and offline features of a user’s composite behavior. We evaluate the proposed joint model by comparing it with typical models and their fused model on two real-world datasets: Foursquare and Yelp. The experimental results show that our model outperforms the existing ones, with the area under the receiver operating characteristic curve (AUC) values 0.956 in Foursquare and 0.947 in Yelp, respectively. Particularly, therecall(true positive rate) can reach up to 65.3% in Foursquare and 72.2% in Yelp with the correspondingdisturbance rate(false-positive rate) below 1%. It is worth mentioning that these performances can be achieved by examining only one composite behavior, which guarantees the low response latency of our method. This study would give the cybersecurity community new insights into whether and how real-time online identity authentication can be improved via modeling users’ composite behavioral patterns.

The vigorous development of e-commerce breeds cybercrime. Online payment fraud detection, a challenge faced by online service, plays an important role in rapidly evolving e-commerce. Behavior-based methods are recognized as a promising method for online payment fraud detection. However, it is a big challenge to build high-resolution behavioral models by using low-quality behavioral data. In this work, we mainly address this problem from data enhancement for behavioral modeling. We extract fine-grained co-occurrence relationships of transactional attributes by using a knowledge graph. Furthermore, we adopt the heterogeneous network embedding to learn and improve representing comprehensive relationships. Particularly, we explore customized network embedding schemes for different types of behavioral models, such as the population-level models, individual-level models, and generalized-agent-based models. The performance gain of our method is validated by the experiments over the real dataset from a commercial bank. It can help representative behavioral models improve significantly the performance of online banking payment fraud detection. To the best of our knowledge, this is the first work to realize data enhancement for diversified behavior models by implementing network embedding algorithms on attribute-level co-occurrence relationships.

Federated learning is a distributed machine learning approach to privacy preservation and two major technical challenges prevent a wider application of federated learning. One is that federated learning raises high demands on communication resources, since a large number of model parameters must be transmitted between the server and clients. The other challenge is that training large machine learning models such as deep neural networks in federated learning requires a large amount of computational resources, which may be unrealistic for edge devices such as mobile phones. The problem becomes worse when deep neural architecture search (NAS) is to be carried out in federated learning. To address the above challenges, we propose an evolutionary approach to real-time federated NAS that not only optimizes the model performance but also reduces the local payload. During the search, a double-sampling technique is introduced, in which for each individual, only a randomly sampled submodel is transmitted to a number of randomly sampled clients for training. This way, we effectively reduce computational and communication costs required for evolutionary optimization, making the proposed framework well suitable for real-time federated NAS.

The so-calledbehavioral anomaly detection(BAD) is expected to solve effectively a variety of security issues by detecting the deviances from normal behavioral patterns of protected agents. We propose a new graph-based behavioral modeling paradigm for BAD problem, namedbehavioral identification graph(BIG), which has distinct advantages over existing methods by mining deeply theproperty-level(as an enhancement to theevent-level) associations in behavioral data. Under BIG, the behavioral properties and their co-occurrence associations in behavioral data are modeled as the entities and relationships of graph, respectively; furthermore, behavioral properties and events are both vectorized by a devised event-property composite model, and the behavioral patterns of agents are finally represented as a multidimensional spatial distribution of behavioral properties. Consequently, for a behavior, the intensity of its behavioral anomaly can be transformed into the spatial decentrality of its behavioral agent and properties which contain both fine-grained information between behavioral properties and coarse-grained information between behavioral events. To the best of our knowledge, this is the first work to improve behavioral modeling for anomaly detection by integratinginter(event-level) andintra(property-level) associations of behaviors into a unified graph and space. Our method is validated by four representative security issues, i.e.,fraud detectionin online payment services (by transaction behaviors),intrusion detectionin network communication services (by traffic behaviors),insider threat detectionin organizational information systems (by system behaviors), andcompromise detectionin social networking services (by trajectory behaviors).

The rapid development of internet finance has caused increasing concern in online payment fraud due to its great threat. It is typical to employ rule systems or machine learning-based techniques to detect frauds. For the most significant features of such fraudulent transactions are exhibited in a sequential form, the sliding time window is a widely-recognized effective tool for this problem. With a sliding time window, features about the transaction characteristics can be extracted, and the latent patterns hidden in transaction records can be captured. However, the adaptive setting of sliding time window is really a big challenge, since the transaction patterns in real-life application scenarios are often too elusive to be captured. As a matter of fact, the practical setting usually needs to be updated and refined with manual intervention regularly. This is time-consuming indeed. In this article, we pursue an adaptive learning approach to detect fraudulent online payment transactions with automatic sliding time windows. Accordingly, we make efforts on optimizing the setting of windows and improving the adaptability. We design an intelligent window, called learning automatic window (LAW). It utilizes the learning automata to learn the proper parameters of time windows and adjust them dynamically and regularly according to the variation and oscillation of fraudulent transaction patterns. By the experiments over a real-world dataset of the online payment service from a commercial bank, we validate the gain of LAW in terms of detection effectiveness and robustness. To the best of our knowledge, this is the first work to make a sliding time window for fraud detection capable of learning its proper size in changing situations.

Federated learning is an emerging technique used to prevent the leakage of private information. Unlike centralized learning that needs to collect data from users and store them collectively on a cloud server, federated learning makes it possible to learn a global model while the data are distributed on the users' devices. However, compared with the traditional centralized approach, the federated setting consumes considerable communication resources of the clients, which is indispensable for updating global models and prevents this technique from being widely used. In this paper, we aim to optimize the structure of the neural network models in federated learning using a multi-objective evolutionary algorithm to simultaneously minimize the communication costs and the global model test errors. A scalable method for encoding network connectivity is adapted to federated learning to enhance the efficiency in evolving deep neural networks. Experimental results on both multilayer perceptrons and convolutional neural networks indicate that the proposed optimization method is able to find optimized neural network models that can not only significantly reduce communication costs but also improve the learning performance of federated learning compared with the standard fully connected neural networks.