Provenance-based threat hunting identifies Advanced Persistent Threats (APTs) on endpoints by correlating attack patterns described in Cyber Threat Intelligence (CTI) with provenance graphs derived from system audit logs. A fundamental challenge in this paradigm lies in the modality gap —the structural and semantic disconnect between provenance graphs and CTI reports. Prior work addresses this by framing threat hunting as a graph matching task: 1) extracting attack graphs from CTI reports, and 2) aligning them with provenance graphs. However, this pipeline incurs severe information loss during graph extraction and demands intensive manual curation, undermining scalability and effectiveness.

Advanced Persistent Threats (APTs) commonly manifest through a sequence of attack steps, known as Tactics, Techniques, and Procedures (TTPs). Recent studies identify TTPs by converting audit logs into causal provenance graphs and applying expert-driven mappings that correlate low-level system events with high-level TTP patterns. However, these methods face persistent challenges: determining the impact boundaries of TTP activities, adapting to evolving TTP stacks, and recognizing fine-grained TTP semantics for deeper forensic insights. To address these challenges, we presentZoomer, a novel TTP recognition framework that segments provenance graphs into multiple TTP subgraphs with multi-granular annotations (i.e., tactics, techniques, and sub-techniques). First, we devise a heuristic subgraph sampling algorithm guided by anomalous node detection to precisely delineate the scope of TTP activities. Second, we introduce a dual-tower Deep & Wide architecture that integrates contextual behavior semantics from provenance graphs and domain-informed features to learn expressive TTP representations. Finally, we adopt a prototypical network that reformulates TTP recognition as a few-shot pattern matching task, thereby enhancing adaptability and accuracy under limited supervision. To advance future research, we built and released the first TTP-annotated provenance dataset, encompassing the most comprehensive collection of TTP instances to date. Extensive experiments show thatZoomerachieves TTP recognition with 88% accuracy at the sub-technique level and 94% at the tactic level, significantly outperforming state-of-the-art baselines.

DevOps enhances software production through IT automation, continuous integration, and deployment, with Docker as a key tool that packages applications and their environments into standardized images for consistent and efficient deployment. Dockerfiles, which are text-based configuration files, define the composition and runtime actions of these images. Mismanagement of dependencies between Dockerfile instructions can cause build failures, highlighting the need for accurate dependency parsing. Current methods often miss implicit dependencies due to the complex syntax and logic of Dockerfile instructions. To address this, we propose DockInsight, a novel tool that uses a rule-based approach and semantic analysis to determine Dockerfile dependencies accurately. DockInsight features a unified feature structure representation, DVector, and a dependency type table to facilitate precise dependency determination. Evaluations demonstrate that DockInsight achieves 99.44% accuracy, significantly outperforming keyword matching and large language model methods by 64.84% and 55.74%, respectively. Additionally, DockInsight maintains stable processing times across various Dockerfile lengths, proving its efficiency and scalability. Our ablation study further highlights the importance of semantic information supplementation, particularly for RUN instructions, in enhancing accuracy. DockInsight’s robust performance makes it a valuable tool for developers and DevOps engineers, contributing to more reliable and maintainable Dockerfiles.

Open source software has evolved into a fundamental element of the contemporary information sector; however, security threats within its supply chain are persistently rising. Within the collaborative development framework of open source, the introduction of malicious code can lead to significant security vulnerabilities. Conventional methods for detecting these vulnerabilities, which rely on machine learning, face challenges such as a lack of sufficient datasets, inadequate deep semantic understanding, and limitations to single-vulnerability detection. To address these challenges, we introduce a novel approach named VulnTrace, which analyzes historical records of submissions in open source projects to construct a high-quality dataset of vulnerabilities with accurate labels. VulnTrace employs Word2Vec alongside Abstract Syntax Tree (AST) technologies to capture both the semantic and structural details of code segments and utilizes a Transformer model for precise vulnerability identification, thereby enhancing accuracy and interpretability in detection. Experimental results indicate that VulnTrace achieves approximately 93% accuracy, 95% precision, 83% recall and an F1 score of 88% in vulnerability detection tasks, significantly reducing false positives and demonstrating remarkable robustness.

The collaborative model of open-source software (OSS) development significantly enhances efficiency and fosters innovation by enabling diverse global contributors to collaborate seamlessly.Core contributors, who provide the majority of code commits, are crucial for maintaining project direction, quality, and momentum.Despite their importance, there is limited research on the dynamics and prediction of changes in core contributors over time, which is essential for sustaining project growth and stability.To bridge this gap, we introduce CoreCast, an innovative predictive model designed to forecast future core contributor numbers using comprehensive project data.By analyzing multidimensional metrics from high-quality OSS projects, CoreCast trains models that outperform traditional methods, achieving a mean absolute error (MAE) of 0.7866.Our findings reveal seven significant growth trends that are crucial for understanding and sustaining OSS project development.All data and scripts are open-sourced, providing valuable resources for future research and further advancements in the field.

Mobile authentication is a fundamental factor in the protection of user’s private resources. In recent years, motion sensor-based biometric authentication has been widely used for privacy-preserving. However, it faces with the problems including low data collection efficiency, insufficient authentication scenario coverage rate, weak de-noising ability, and poor robustness of models, rendering existing methods difficult to meet the security, privacy, and usability requirements jointly in the real-world scenario. To overcome these difficulties, we propose a system calledEspialCog, which is able to 1) collect the sensor data embedded in mobile devices self-adaptively, unobtrusively and efficiently through the evolutionary stable participation game mechanism (ESPGM) with a high scenario coverage rate; 2) minimize noise from collected data by analyzing three types of abnormalities; and 3) authenticate the ownership of mobile devices in real-time by adopting optimized LSTM model with an enhanced stochastic gradient descent (SGD) algorithm. The simulation experiment on 6000 users shows that the efficiency and coverage rates increase dramatically by deploying our ESPGM. Moreover, we conduct experiments on a large-scale real-world noisy dataset with 1513 users and two other small pure real-world datasets. The experimental results show the high accuracy and favorable robustness ofEspialCogin the noisy environment.