Diffusion models have shown strong performance in image inpainting, yet their stochastic nature often leads to semantic inconsistencies between inpainted regions and known parts of the image, especially under large-mask settings. While Transformers excel at capturing long-range semantic dependencies, their high computational complexity restricts their applicability in handling large missing areas, potentially compromising structural consistency. To address these challenges, we propose MATdiff, a unified framework that effectively integrates Transformer-based semantic modeling with the generative capabilities of diffusion models. Specifically, we leverage a mask-aware transformer (MAT) as a conditional encoder to capture semantically coherent features from visible regions, thereby constraining stochastic generation and preserving global structural consistency during the reverse diffusion process. Moreover, we introduce a distribution-guided diffusion training (DGDT) strategy that utilizes a pre-trained unconditional latent diffusion model alongside a frozen conditional encoder, enabling end-to-end optimization of the MATdiff framework. DGDT leverages the underlying data distribution learned by the diffusion model to facilitate the generation of plausible overall structures for large-mask inpainting. Extensive experiments on the CelebA-HQ and Places datasets demonstrate that MATdiff achieves strong image inpainting performance, producing semantically coherent and structurally consistent results with high visual fidelity in large-mask scenarios, while also showing consistent improvements over the baseline MAT.

Abstract With Internet access shifting from desktop-driven to mobile-driven, application-level mobile traffic identification has become a research hotspot. Although considerable progress has been made in this research field, two obstacles are hindering its further development. Firstly, there is a lack of sharable labeled mobile traffic datasets. Although it is easy to capture mobile traffic, labeling traffic at the application level is non-trivial. Besides, researchers usually hold a conservative attitude toward publishing their datasets for privacy concerns. Secondly, most of the datasets used by existing studies are inadequate to evaluate the proposed methods, since they usually have the problems of inaccurate labels, small scale and simple collection configurations. To tackle these two obstacles, a mobile traffic collection is carried out in this paper. The collected traffic has the advantages of large-scale data size, accurate application-level labels and diverse collection configurations. Then, the collected traffic is anonymized carefully to make it public. Several mobile traffic identification methods are compared based on our anonymized dataset, which proves the applicability of our dataset.

The botnet relies on the Command and Control (C&C) channels to conduct its malicious activities remotely. The Domain Generation Algorithm (DGA) is often used by botnets to hide their Command and Control (C&C) server and evade take-down attempts, which allows the bot to generate a large number of domain names until it finds its C&C server. The lengths of domain names generated by DGAs are different. Our research finds that the length of the domain name has an impact on the performance of the DGA domain name detection model. In other words, the model is sensitive to the length of the domain name. In this case, attackers can evade detection simply by designing domain names of specific lengths. Moreover, the detection accuracy of DGA domain names still needs to be further improved. To solve these problems, three feature extraction methods adapted to the length of the domain name are proposed in this paper. For extra-short domain names, we use the attention-based method to extract features, which can make use of the character-level semantic feature. For moderate-length domain names, a two-dimensional structure, namely Right Shifted Tensor (RST), is constructed to make the domain name present apparent features similar to images. For the extra-long domain name, the effective classification of domain names can be achieved by manually crafted easy-to-calculate features. Then, different detection structures are designed based on these tree feature extraction methods to form a heterogeneous DGA detection model, namely HAGDetector. In addition, the public suffix is an important part of the domain name. We further analyze the public suffix to evaluate its impact on the detection of DGA domain names. Finally, the experiments are conducted to assess the validity of HAGDetector, as well as compare our approach with the current state-of-the-art and highlight the impact of the domain name length. The experimental results show that our method greatly improves the detection performance.