Natural language generation is an important task in natural language processing and has been applied in various scenarios. Most state-of-the-art generation models, however, are usually slow at inference time mainly due to the sequential dependencies of autoregressive generation and the use of more and more large-scale decoder models. To this end, we propose a Dual-Decoder (Dude) model to speed up the decoder without sacrificing the overall model performance. Dude model is composed of a semantic decoder and an output decoder, which are able to capture the long-term semantic dependencies and predict the target sequence fast as well. We evaluate Dude model on three natural language generation tasks including Neural Machine Translation, Text Summarization and Question Generation. The experimental results demonstrate that our model achieves 1.43× faster inference speed than the standard baseline while maintaining comparable performance, and even 1.62× faster on longer sequence generation tasks.

The big data platform supports powerful data re-trieval and mining analysis, providing users with seamless access to extensive data for valuable insights. However, the increasing access to sensitive data raises privacy concerns. Existing studies utilize access control mechanisms to ensure secure data authorization. Nevertheless, previous approaches are deficient in facilitating risk control during real-time query processing and fail to elucidate the details of attack access. To address these limitations, we propose a novel Interpretable Risk-aware Access Control (IRAAC) for Spark - the advanced distributed engine for large-scale data computing in big data ecosystems. IRAAC utilizes the sequence representation techniques and contrastive learning idea from Natural Language Processing to learn patterns of attack queries for extracting critical attack subqueries. In terms of attack investigation, IRAAC designs specific templates to encourage large language models (LLMs) to provide a comprehensive delineation of potential query access risks.

The real-time collection and query analysis of dynamic data streams have become increasingly common and important, yet the protection of sensitive private information remains a pressing challenge. Differential privacy, as the gold standard for protecting personal data privacy, has been widely studied and applied. However, existing mechanisms mostly focus on static datasets and specific simple stream queries. This paper presents StreamDP, a novel framework designed to achieve differential privacy for complex real-world stream queries. We introduce the observation-prediction mechanism that predicts statistics such as join attribute frequency using observations and truncates the data stream based on the predicted threshold. Then we design operation-oriented recursive sensitivity calculation rules and employ a hierarchy algorithm for noise perturbation. Extensive experimental evaluations on multiple real-world datasets and distributed stream processing benchmarks show that StreamDP can support various complex real-world data stream queries/applications with high utility and low-performance overhead.

To address the ever-evolving network threats, system audit logs have become a crucial data source for threat analysis. While current log-based threat detection methods have significant potential in identifying malicious activities, they face limitations in capturing dynamic attack behaviors and revealing complete attack activities.To address these issues, we introduces DyCom, a dynamic graph partitioning technique based on audit logs. Our method incrementally partitions the system log streaming into multiple communities with security semantics, allowing the use of graph community summarization techniques to provide a summary of key activities within each community, thereby aiding security experts in understanding system activities. This method retains all attack activities, reduces analysts’ workload, and keeps them continuously informed about system activities. By focusing on process entities and constructing intimate process events, DyCom effectively reduces the storage cost of log data while ensuring the security semantics of the log communities. Additionally, DyCom employs temporal graph networks to dynamically represent system entities, ensuring real-time monitoring of system activities. Evaluations using the open-source DARPA TC dataset and our simulated datasets demonstrate that DyCom can accurately partition large-scale dynamic system entities into distinct communities, with improvements in precision, recall, and F1 score by 0.71, 0.31, and 0.65 respectively, compared to baseline methods, highlighting its practical potential in threat analysis.

Hardware performance counter based malware detection (HMD) model that learns HPC-level behavior by using machine learning or deep learning algorithms has been widely researched in various application scenarios. However, the program's HPC-level behavior is easily affected due to system resource competition, which leaves counter based malware detection out-of-date. Unfortunately, current research could not adaptively update HMD model. In this paper, we propose DAMUS, a distribution-aware model updating strategy to adaptively update counter based malware detection model. Specifically, we first design an autoencoder with contrastive learning to map existing samples into a low-dimensional space for better calculating distributions. Second, in the low-dimensional space, the distribution characteristics are calculated for further judging the drift of testing samples. Finally, based on the total determined drifts of testing samples and a threshold, a decision could be given on whether the counter based malware detection model needs to be updated. We evaluate DAMUS by testing HMD model on datasets collected under benchmark application environment and actual server environment with different resource types or pressure levels. The experimental results show the advantages of DAMUS over existing updating strategies in promoting model updating. We also demonstrate its overhead spent on the task of malware detection.

Hardware performance counter (HPC) has been widely used in malware detection because of its low access overhead and the ability of revealing dynamic behavior during program's execution. However, HPC based malware detection (HMD) suffers from performance decline due to HPC's non- determinism caused by resource competition. Current work enables malware detection under resource competition but still leaves misclassifications. In this paper, we propose HUND, a framework for improving the detection ability of HMD models under resource competition. To this end, we first introduce an explanation module to make the program's prediction interpretable and accurate on the whole. We then design a rectification module for troubleshooting HMDMs' errors by generating modified samples and lowering the effects of false classified instances on model decision. We evaluate HUND by performing HMD models two datasets of HPC-level behaviors. The experimental results show HUND explains HMDMs with high fidelity and HUND's effectiveness in troubleshooting the errors of HMDMs.

Differential privacy has emerged as a gold standard privacy definition due to its persuasive mathematical guarantee. While various data protection mechanisms provide differential privacy for SQL queries of RDBMSs, enforcing differential privacy for big data platforms needs to be further researched. This work presents Prispark, which enforces differential privacy for Spark - the advanced distributed engine for large-scale data computing in big data ecosystems where sensitive data is often processed. Prispark targets to support various data processing (i.e., relational and unstructured queries) on Spark. In particular, to calculate a tighter sensitivity bound and improve the utility of results, we design the overall statistics estimation algorithm for estimating the upper bound of statistics with the filter condition, and propose a novel fine-grained operation-oriented rules set for calculating sensitivity of various relational and unstructured queries. Moreover, we propose a general differential privacy mechanism, Prispark, a suite including Prisparksql and Prisparkdag. We enforce Prisparksql at the Catalyst optimization layer for relational queries in Spark SQL and Prisparkdag at the RDD execution layer for unstructured queries in Spark core. Finally, we experimentally evaluate Prispark on TPC-H, TPC-DS, PigMix benchmarks, and real-world dataset LANL. The experimental results suggest that Prispark supports various applications/queries while improving the utility of all query results by orders of magnitude with negligible performance overhead.

Federated learning is a secure machine learning technology proposed to protect data privacy and security in machine learning model training. However, recent studies show that federated learning is vulnerable to backdoor attacks, such as model replacement attacks and distributed backdoor attacks. Most backdoor defense techniques are not appropriate for federated learning since they are based on entire data samples that cannot be hold in federated learning scenarios. The newly proposed methods for federated learning sacrifice the accuracy of models and still fail once attacks persist in many training rounds. In this paper, we propose a novel and effective detection and defense technique called FederatedReverse for federated learning. We conduct extensive experimental evaluation of our solution. The experimental results show that, compared with the existing techniques, our solution can effectively detect and defend against various backdoor attacks in federated learning, where the success rate and duration of backdoor attacks can be greatly reduced and the accuracies of trained models are almost not reduced.