With the rapid development of cloud computing, network architectures are moving towards distributed computing, which performs data processing at edge nodes to reduce latency, enabling more efficient and scalable network services. Nevertheless, this shift introduces significant security challenges due to the heterogeneity of communications protocols and the vulnerabilities of edge devices. To effectively secure these distributed networks, it is essential to perform multiple traffic analysis tasks, e.g. Network Intrusion Detection, Encrypted Traffic Classification, and Application Traffic Classification. However, existing methods have limited generic feature extraction and require the deployment of multiple models to solve multiple tasks, which exceeds the resource capacity of edge nodes. To address these challenges, we introduce a Lightweight Multitask Traffic Analysis Framework LiMTa, which novelly proposes a traffic pre-training method, FreqRec, and a lightweight multi-task model fine-tune method, MT-Adapter. FreqRec enables high-level semantic feature extraction by reconstructing the frequency features of traffic samples, and MT-Adapter efficiently performs multiple tasks by computing the pre-trained model only once. Experimental results demonstrate that our approach achieves state-of-the-art (SOTA) performance on six traffic analysis tasks. Moreover, the MT-Adapter module only fine-tunes a small number of parameters, accounting for only 6.37% of the pre-trained model’s parameters, and achieves the same result as the full fine-tuning. Compared to full fine-tuning, LiMTa reduces the time cost by 50.9% and the space cost by 57.4% in six edge traffic analysis tasks.

The growing flexibility of 5G network architectures increases the risk of network faults. Such network fault types are diverse and variability, as 5G networks have been integrated in various vertical industries, e.g., power grids, resulting in these faults being widespread and challenging to diagnose. To reduce the costs associated with fault identification and remediation, we introduce Rsm-RCA as a novel framework for automated root cause analysis (RCA) in 5G networks. By training on massive amounts of data, Rsm-RCA is capable of identifying fault types from the fault signalling messages collected. Specifically, this framework efficiently collects and processes radio resource control (RRC) fault signalling messages from commercial networks to extract multidimensional attributes and KPI parameters. The processed signalling messages are then fed into a decision tree model, which enables accurate fault classification with minimal time expenditure after training. For power utilities private 5G networks, fast and accurate RCA is highly beneficial. Experimental results demonstrate that Rsm-RCacan classify faults in an extremely short time, achieving an average accuracy of 99 %.

The growing complexity and diversity of 5G network architecture (e.g., power grid 5G network) have made security risk assessment and root cause analysis increasingly challenging. Recent advances in large language models (LLMs) have the potential to transform this landscape. However, existing LLMs-based solutions primarily focus on understanding the language of 5G telecommunications, while overlooking potential security vulnerabilities in the data flows. To facilitate LLMs' in-depth application, this paper presents RCA-LLM, a novel fault root cause analysis framework for 5G networks developed from tailored LLMs-based solutions. In explicit terms, RCA-LLM is trained by inputting processed and organized fault information for fine-tuning, and combined with retrieval-augmented generation (RAG) technology to significantly improve the accuracy of 5G fault analysis. Our experimental results indicate that RCA-LLM performs well in fault analysis, effectively supporting users in diagnosing and resolving fault issues. Model evaluation results further demonstrate that the model significantly improves fault analysis accuracy and has high practical value. In addition, RCA-LLM provides important reference value for efficient operation and maintenance management of 5G and future power grid networks, while also offering new ideas for advancing intelligent fault analysis.

Satellite-based cloud computing cybersecurity threats have long posed significant challenges, particularly for cloud infrastructure operators.While prior research has partially addressed these issues by mitigating threats and enhancing human response efficiency, this paper proposes a novel AI-Driven Threat Analysis and Response (TAR) framework.The study progresses in three main phases: (1) redefining urgent threats through a novel formula; (2) implementing a triage and analysis framework using augmented Large Language Models (LLMs); and (3) automating incident response via a Security Orchestration, Automation, and Response (SOAR) platform.Our prototype, tested in a simulated public cloud environments using real production threats, demonstrated a 17% improvement in handling low-and medium-urgency threats.Experimental results show our approach achieves 97.8% coverage in automatic threat classification, significantly outperforming traditional manual methods, which achieve 77.8% coverage.With high recall and precision in managing low-and medium-urgency threats, our method enhances manual efficiency through SOAR-enabled automation.Furthermore, * Corresponding Author.our augmented method surpasses the state-of-the-art GPT-4 Turbo model in addressing security threats containing Chinese characters.

Despite being widely used in network intrusion detection systems (NIDSs), machine learning (ML) has proven to be vulnerable to adversarial attacks. White-box and black-box adversarial ML attacks of NIDS have been explored in several studies. However, white-box attacks unrealistically assume that the attackers have full knowledge of the target NIDSs. Meanwhile, existing black-box attacks can not achieve high attack success rate due to the weak adversarial transferability between models (e.g., neural networks and tree models). Additionally, neither of them explains why adversarial examples exist and why they can transfer across models. To address these challenges, this paper introduces ETA, anExplainableTransfer-based Black-Box AdversarialAttack framework. ETA aims to achieve two primary objectives: 1) create transferable adversarial examples applicable to various ML detectors and 2) provide insights into the existence of adversarial examples and their transferability within NIDSs. Specifically, we first provide a general transfer-based adversarial attack method applicable across the entire ML space. Following that, we exploit a unique insight based on cooperative game theory and perturbation interpretations to explain adversarial examples and adversarial transferability. On this basis, we propose an Important-Sensitive Feature Selection (ISFS) method to guide the search for adversarial examples, achieving stronger transferability and ensuring traffic-space constraints. Finally, the experimental results on three NIDSs datasets show that our method performs significantly effectively against several classical and state-of-the-art ML classifiers, outperforming the latest baselines. We conduct three interpretation experiments and two cases to verify our interpretation method's correctness. Meanwhile, we uncover two major misconceptions about applying machine learning to NIDSs systems.

The ever-increasing complexity and scale of 5G communication networks pose huge challenges to network operations. Root cause analysis is considered as a promising method for fault detection. However, it still suffers challenges of severely uneven distribution of fault data, low accuracy in root cause detection, and long time consumption due to a large search space in 5G cellular networks. To address the above challenges, we introduce SimRCA to effectively analyze the faults’ root causes in 5G networks using signalling messages. By designing a novel confidence threshold value and pruning technique, SimRCA can significantly reduce the search space of signalling messages while maintaining the accuracy of root cause analysis. Moreover, SimRCA is proven to be able to handle unbalanced data distribution in 5G networks. We collected over 10GB of signalling data from Huawei 5G commercial network and conducted extensive experiments on this dataset. Experimental results demonstrate that SimRCA can complete root cause localization and fault classification within 11 seconds with an average F1-score over 0.93 which outperforms the current state-of-the-art solutions.

The increasing complexity and openness of 5G networks naturally enlarge the attack surface and introduce new vulnerabilities, thereby posing challenges to the performance of existing intrusion detection systems (IDSs). Current IDSs solely rely on statistical features, which may suffer from low accuracy due to the complex traffic patterns in 5G networks. Additionally, recent IDSs apply contrastive learning to improve detection capabilities, but the reliance on costly manual labeling hinders the adaptability to complex attacks in 5G networks.In this paper, we present Manticore, an unsupervised intrusion detection system based on contrastive learning for 5G networks. Specifically, Manticore leverages both statistical features and original features of packets to capture the holistic information of traffic in 5G networks. Moreover, it automatically establishes positive and negative pairs without manual labeling. We further explore the combination patterns between reconstruction loss and contrastive loss to attain a more precise model. Our experimental evaluation of two datasets demonstrates the proposed Manticore outperforms the relevant state-of-the-art methods.

Recently, Self-Supervised Learning (SSL) has achieved great success in various famous applications e.g., BERT and ChatGPT. However, when applying SSL to safety-critical downstream tasks, such as self-driving cars, potential adversarial attacks can completely change the final decisions and thus lead to serious security issues. To overcome this issue, existing methods combine adversarial training with pre-training to improve the adversarial robustness of SSL. However, combining these two computationally complex processes may largely amplify the computation cost. Moreover, whether performing adversarial training in pre-training or fine-tuning, current methods may degrade the accuracy due to the famous catastrophic forgetting problem. The computation cost of current adversarial training methods based on full parameter updating is still high even in the fine-tuning stage.To address the above challenges, we propose an effective robust fine-tuning framework for SSL based on Low-Rank Adaptation (LoRA), named LoFT. First, LoFT performs adversarial training in the fine-tuning stage rather than in the pre-training stage. Second, LoFT innovatively and elaborately integrates LoRA into adversarial training to avoid the catastrophic forgetting problem. Third, LoFT exploits a low-rank matrix in LoRA which enables efficient fine-tuning by updating only a small set of parameters, which contains only 1%-5% of the parameters of the pre-trained model. The whole pre-training and fine-tuning stages take only 9.44 hours, which reduces training time by 3× over the current SOTA method. Furthermore, compared with existing SOTA robust pre-training methods for SSL, LoFT improves accuracy by 5.97% (77.41%⇒83.38%) and robustness by 13% (45.04%⇒58.44%) on the CIFAR-10 dataset.

The rapid growth of Internet of Things (IoT) devices has expanded the cyber attack surface, posing a challenge to IoT security. Some deep learning-based detection methods have been designed to detect malicious attacks in the IoT by analyzing network traffic. However, the algorithm computational complexity of existing methods is usually high due to having a large number of parameters and iterative training inference, making them difficult to implement on IoT gateways which have limited computational and storage resources. To this end, this paper proposes a lightweight malicious traffic detection model for IoT based on lightweight residual block (LRB) modules, named LightGuard. Specifically, LRB module designs a unique residual structure based on the construction idea of ShuffleNetV2, which enables LightGuard to achieve high detection performance while reducing the parameters, computations and inference time of the model. In addition, LRB module replaces the traditional convolution with a lightweight convolutional module called ghost module to generate feature maps at low cost while without compromising detection performance. We evaluate the effectiveness of LightGuard by comparing it with seven advanced baseline models on four generic datasets. The experimental results show that LightGuard achieves more than 99.6% accuracy on all four datasets, while exhibits significant advantages with low computational complexity.

Posting programs to code hosting platforms such as GitHub is common for developers, but it will lead to privacy leakage issues in hosted programs. Though there are some detection methods for privacy leakage, they are difficult to be applied in practice. First, existing works mainly focus on detection algorithms, while ignoring the complete detection system from a holistic perspective. Second, the system will be blocked when acquiring programs because code hosting platforms usually have protection mechanism. Third, high-performance privacy detection algorithms need hardware devices in practice, and their effectiveness in real scenarios has not been verified since there is no public real hosted program privacy dataset.To address the above problems, we implement and commercialize a user-friendly privacy information leakage detection system for actual hosted programs. Firstly, we provide a system frame-work that can automatically complete "program acquisition-privacy detection-alert", allowing subscribers receive alerts if there is a privacy information leakage. Secondly, we propose a novel multi-random crawler scheme that can flexibly cope with the limitations of GitHub when acquiring hosted programs. Thirdly, we skillfully apply a cost-effective detection approach based on fuzzy matching, which can detect the subscriber customized privacy information with high performance. Based on this, we further provide a high-quality dataset obtained in real scenarios. Finally, we conduct comprehensive experiments to evaluate our system. Experimental results demonstrate the effectiveness of our crawler scheme and detection approach in providing a user-friendly system.

With the rapid development of the cutting edge cloud computing technology, millions of vulnerabilities have been identified, there is a growing concern that organizations should devote plenty of time and lots of resources to secure. The overarching objective of remediation is to prioritize the vulnerabilities. Hence, define the severity and the urgency of the vulnerabilities and remediate them automatically is very important. Although the recognized Common Vulnerability Scoring System (CVSS) 4.0 method addresses this issues partly, they are difficult to be implemented in practices on the cloud because of the complication and lack of risk based factors.To this end, we propose a Cost-effective Massive Automation Method of Vulnerability Analysis and Remediation Based on Cloud Native Framework. Specifically, considering that the current CVSS is more like a severity of vulnerabilities, we design a novel formula to define the urgency of vulnerabilities. The formula takes the advantaged of the capabilities of modern cloud-based infrastructure and simplifies the CVSS. Besides, we propose an algorithm of risk reduction by leveraging the cloud native security capabilities, which cut down unnecessary patching time and workload. Particularly, in order to remediation the risk on the cloud, we implement an automatic scheme to harden the vulnerabilities by invoking the cloud native APIs based on the Security Orchestration, Automation and Response (SOAR) platform. Finally, we conduct comprehensive experiments to evaluate our system. Experimental results demonstrate the effectiveness of ours approach has a high ratio of urgency risk recognition of 99.24%. Meanwhile, ours approach shows a maximum risk reduction by downgrade the fixable vulnerability with a average of 79% risk reduction rate in application level and 99% of risk reduction rate in operating system level respectively. As a result, our approach lightens the workload of patching greatly in the real cloud computing environment.

Effective adversarial attacks simulation is essential for the deployment of ensemble Intrusion Detection Systems (en- semble IDSs) in Satellite-Terrestrial Integrated Network (STIN). This is because it can automatically generate a large amount of adversarial samples to evaluate the robustness of different classifiers. Based on the result, it can further guide the STIN engineers to select proper classifiers in ensemble IDSs. Moreover, it can help the IDSs improve detect performance by their self- learning property in the adversarial attack process. However, the existing adversarial attack approaches suffer from the problems of low success rate and high overhead of communication and calculation due to the limited computing resources and long communication links of STIN. This results in their inefficiency in STIN. To address the above problems, we provide StinAttack as a robustness evaluation scheme for STIN. First, StinAttack provides a comprehensive and automatic robustness evaluation framework for IDSs in STIN with only few times interactions between terrestrial and satellite nodes. Second, StinAttack proposes an effective adversarial attack simulation based on lightweight gradient evaluation for ensemble IDSs. Third, we conduct experiments on 11 typical IDSs, 4 baseline popular adversarial attacks and our StinAttack. Experimental results show that our approach can effectively attack ensemble IDSs and the evaluation results based on real STIN dataset are instructive for designing secure networks.