In dynamicWindows malware detection, deep learning models are extensively deployed to analyze API sequences. Methods based on API sequences play a crucial role in malware prevention. However, due to the continuous updates of APIs and the changes in API sequence calls leading to the constant evolution of malware variants, the detection capability of API sequence-based malware detection models significantly diminishes over time. We observe that the API sequences of malware samples before and after evolution usually have similar malicious semantics. Specifically, compared to the original samples, evolved malware samples often use the API sequences of the pre-evolution samples to achieve similar malicious behaviors. For instance, they access similar sensitive system resources and extend new malicious functions based on the original functionalities. In this paper, we propose a framework MME(Mitigating the impact of Malware Evolution), a framework that can enhance existing API sequence-based malware detectors and mitigate the adverse effects of malware evolution. To help detection models capture the similar semantics of these post-evolution API sequences, our framework represents API sequences using API knowledge graphs and system resource encodings and applies contrastive learning to enhance the model’s encoder. Results indicate that, compared to regular Text-CNN, our framework can significantly reduce the false positive rate by 13.10% and improve the F1-Score by 8.47% on five years of data, achieving the best experimental results. Additionally, evaluations show that our framework can save on the human costs required for model maintenance. We only need 1% of the budget per month to reduce the false positive rate by 11.16% and improve the F1-Score by 6.44%.

In recent years, researchers have employed search agents to perform real-time retrieval of biomedical information or leveraged biomedical Retrieval-Augmented Generation (RAG) frameworks to integrate authoritative biomedical knowledge bases into the retrieval and generation process, aiming to mitigate the hallucination issues of large language models (LLMs) in biomedical contexts. However, search agents face limitations in multi-source retrieval, such as the lack of integration with protein databases, which can lead to protein information mismatches and erroneous feedback of 3D structural data. Moreover, existing biomedical RAG frameworks lack real-time retrieval capabilities, making it difficult to access the latest scientific findings in a timely manner. To effectively address the limitations of existing methods, we propose BioMedSearch, a real-time multi-source biomedical information retrieval framework based on LLMs. The framework consists of three core modules: Biomedical Search Planner, Biomedical Retrieval Executor, and Summary Report Generator. These modules decompose complex biomedical queries, such as protein-related queries, to extract keywords and perform real-time multi-source retrieval across literature, web, and protein databases, generating high-quality, contextually accurate answers through iterative filtering. To evaluate the accuracy of question answering, we constructed a multi-level dataset, BioMedMCQs, consisting of 3,000 questions. The dataset covers three levels of reasoning: mechanistic identification, non-adjacent semantic integration, and temporal causal reasoning, and is used to assess the performance of BioMedSearch and other methods on complex QA tasks. Experimental results show that BioMedSearch outperforms all existing comparison methods at level 1–3. Specifically, compared to search agents, BioMedSearch surpasses the best-performing method, PaSa, with an average accuracy improvement of 13.2 % at level 3; in comparison with biomedical RAG frameworks, it outperforms the strongest method, MedRAG, achieving a 15.6% average accuracy gain at level 3. The code and BioMedMCQs are available at: https://github.com/CyL-ucas/BioMed_Search.

The Provenance Graph has been widely applied in host anomaly detection due to its ability to detect unforeseen threats, reveal correlations between host behaviors, and the superior performance offered by Graph Neural Networks. However, a barrier to the practical adoption of Provenance-based intrusion detection systems is the lack of interpretation. Unfortunately, existing interpretation approaches are proposed for either non-security domains or other kinds of anomaly detections like tabular, homogeneous graph or network intrusion detections, which are not suitable for Provenance-based intrusion detection systems and fail to satisfy special requirements in security domains. In this paper, we propose PGAid, a method aiming to interpret Provenance-based intrusion detection in security domains. Firstly, PGAid addresses the different interaction features between nodes in heterogeneous graphs by layering the provenance graph to be explained according to the types of source and destination nodes, segmenting it into different subgraphs for explanation. Then, we search for reference edge groups within each subgraph, adjusting the priority during the search process. Finally, we verified the effectiveness of our method from fidelity and stability, which respectively surpassed other baselines by 10% and 2-5%.

Few-shot named entity recognition can identify new types of named entities based on a few labeled examples. Previous methods employing token-level or span-level metric learning suffer from the computational burden and a large number of negative sample spans. In this paper, we propose the Hybrid Multistage Decoding for Few-shot NER with Entity-aware Contrastive Learning (MsFNER), which splits the general NER into two stages: entity-span detection and entity classification. There are 3 processes for introducing MsFNER: training, finetuning, and inference. In the training process, we train and get the best entity-span detection model and the entity classification model separately on the source domain using meta-learning, where we create a contrastive learning module to enhance entity representations for entity classification. During finetuning, we finetune the both models on the support dataset of target domain. In the inference process, for the unlabeled query data, we first detect the entity-spans, then the entity-spans are jointly determined by the entity classification model and the KNN. We conduct experiments on the open FewNERD dataset and FewAPTER dataset, the results demonstrate the advance of MsFNER.

With the widespread adoption of Android devices, the number of malware instances continues to rise, posing severe threats to users’ security and privacy. Existing malware detection methods primarily rely on static or dynamic analysis, typically performing machine learning classification by extracting features such as permissions or sensitive API calls. However, these methods fail to adequately capture the behavioral patterns of malware and face efficiency bottlenecks when dealing with complex data structures like Function Call Graphs (FCG). To address this, we propose a malware detection method based on the Behavior Relation Graph (BRG). By simplifying the Function Call Graph using community detection algorithms, we partition the complex graph structure into several communities, thereby extracting the functional modules and behavioral patterns of malware and significantly reducing the complexity of analysis. Subsequently, we vectorize the BRG using Graph Neural Networks (GNNs) and combine it with a classification model to achieve high-performance detection and interpretation of malware. Experimental results demonstrate that our method performs excellently on a large-scale dataset containing 12,408 benign software samples and 7,658 malware samples, with an average of 44,704 function nodes. We achieved a classification performance of 100% accuracy and a 100% F1-Score, significantly improving detection accuracy and providing an efficient and reliable solution for malware analysis.

Attacks, including program exploits, malware implantation, and targeted intrusions such as advanced persistent threats (APTs), are increasingly used by modern adversaries. Recently, provenance-based host intrusion detection systems (HIDSs) have gained significant attention due to their superior performance in detecting complex attacks at the system level. Despite their potential, many existing approaches either do not fully utilize the rich information available in raw data or overlook the evolving topological structure of system behavior over time. Furthermore, some approaches lack fine granularity required for intrusion detection. These deficiencies may result in high false positives or false negatives. To address these limitations, we designed an anomaly-based node-level host intrusion detection system, NAHID, which does not require prior knowledge of attack patterns. It begins by extracting important entities (e.g., processes, files) and their interactions (e.g., read and write operations) from raw host data to construct a provenance graph. To effectively model the dynamic behavior of nodes over time, NAHID leverages temporal graph neural networks for graph representation learning, capturing both complex interaction patterns and temporal behavior evolution. The detection task is then formulated as a node-level multi-class classification problem. To address the inherent class imbalance present in host provenance data, we incorporate a class-weighted loss function that enhances the model’s ability to recognize minority-class anomalies. We evaluated our model on three public datasets and demonstrated that it outperforms our baseline host intrusion detection system. In addition, we also evaluated our model’s runtime and conducted ablation experiments.