Abstract Modern systems generate massive amounts of logs during operation, which are the key foundation for anomaly log analysis. However, existing research typically breaks down log analysis into multiple isolated tasks, which lacks flexibility in complex application scenarios and requires significant manpower. Furthermore, the increasing diversity and complexity of log formats place higher demands on the accuracy of log analysis. To achieve a more robust, accurate, and comprehensive log analysis method, we propose an integrated framework, called LogLAA. We construct a log parser based on length and word frequency that runs stably in most log systems with minimal parameter tuning, supporting both offline and online parsing in various scenarios. By introducing variable substitution and combining it with a similarity prefix tree, we achieve high accuracy and efficiency. We introduce counting embeddings, sequence embeddings, and semantic embeddings, and combining them with a CNN-LSTM model based on a dual-attention mechanism, we significantly improve the precision of anomaly detection. To ensure the interpretability of anomaly logs, we combine them with a large language model (LLM) for analysis. Experimental results show that our log parsing method achieves a 0.8% improvement over the SOTA model and anomaly detection achieves 6% improvement over the average precision of other advanced methods. We use the weighted matching score to evaluate anomaly analysis. LogLAA scores 0.7, placing it at an upper-middle level.

Modern networks have spurred growth in both legitimate and malicious activities concealed within encrypted traffic. Traditional machine learning approaches to traffic classification struggle with scalability to new protocols, diverse tasks, and adaptability to emerging threats. To address these issues, we propose MET-LLM , a novel framework for Malicious Encrypted Traffic detection that integrates domain-specific tokenization, a pretrained large language model, and a dynamic adaptive tuning adaptor. MET-LLM addresses the modal gap between natural language and heterogeneous network traffic data by partitioning each traffic sample into distinct headers and payloads and leveraging a specialized tokenizer trained on a large-scale traffic corpus to extend the base vocabulary of the underlying language model. Building on a domain-adapted pretrained model fine-tuned on extensive security-related corpora, MET-LLM captures critical contextual nuances distinguishing benign from malicious flows. Its dynamic adaptive tuning adaptor facilitates efficient parameter updates via adaptation prompt injection, adversarial training, and dynamic masking, enabling rapid adaptation to evolving network conditions and attack strategies. Extensive evaluations on benchmark datasets, including ISCX Tor 2016, ISCX VPN 2016, APP-53 2023, and CSTNET 2023, demonstrate that MET-LLM’s superior precision, recall, and F1 scores over state-of-the-art methods, affirming its efficacy and robustness in real-world cybersecurity applications. Our code is publicly available at the website, https://github.com/Superagentsys/MET-LLM .

Path-aware networks have garnered significant attention as an emerging research area. It allows network senders to actively select or influence transmission paths to meet specific requirements, which necessitates the support of path validation mechanisms. Supported by the path-aware networking research group under the Internet Engineering Task Force (IETF), path validation plays a crucial role in enhancing end hosts' control over packet forwarding. However, existing methods face trade-offs among security, protocol header overhead, and computational cost, forming a ''trilemma.'' Drawing inspiration from persistent validation in zero-trust architecture, we propose the 1BIT protocol. This protocol reduces protocol header overhead by more than 57% while providing robust data flow security. The packet demand for path fault detection is reduced by more than 72%, and fault locations can be precisely identified. By employing hash algorithms and few binary operations, the 1BIT protocol achieves high throughput and supports routers capable of adapting to high-speed, multi-interface environments. On a 16-core CPU, the 1BIT protocol can handle throughput exceeding 100 Gbps. This lightweight and efficient solution introduces anomaly signal detection techniques into the field of path validation. Benefiting from in-depth research on anomaly signal detection, this technology offers a richer set of solutions for path validation and lays the foundation for future research and implementation in areas such as multi-path validation and path privacy protection.

With the extensive deployment and application of Internet of Things (IoT) devices, vulnerable edge nodes have emerged as primary targets for Advanced Persistent Threat (APT) attacks. Attackers compromise IoT terminal devices to establish an initial foothold and subsequently exploit lateral movement techniques to progressively infiltrate core business networks. Prior investigation methods struggle with fragmented threat intelligence and sparse attack samples in heterogeneous audit logs, resulting in incomplete attack chain reconstruction and high false positives. We propose a novel approach to APT attack investigation, FALCON, which captures complex causal relationships between entities from discrete audit logs and constructs cross-domain provenance graphs, enabling rapid and accurate identification of potential APT activities. FALCON trains an adaptive edge-side local model with cross-domain behavior sequences containing extensive and remote contextual information, and employs a bidirectional transformer pre-trained model to learn latent representations from unlabeled sequences. To the best of our knowledge, FALCON is the first APT investigation method to conduct causal provenance based on cross-domain audit logs while ensuring privacy protection. The experimental results demonstrate that FALCON effectively detects APT attacks with accuracy 99.71% and reconstructs attack scenarios with accuracy 87.4%.

Abstract In cloud-edge collaboration scenarios, attackers pose significant security risks by compromising computational nodes and using them to infiltrate other nodes and networks. Ensuring the security of cloud-edge collaboration is crucial for protecting sensitive data, preventing disruptions to critical services, and safeguarding infrastructure in increasingly interconnected and digitized societies. Traditional passive defense mechanisms are often inadequate in dealing with the complex and dynamic nature of modern network threats. In recent years, Moving Target Defense (MTD) has become an important research direction, disrupting adversaries’ reconnaissance and exploitation phases by dynamically shuffling the attack surface. However, existing MTD strategies have some shortcomings, such as single-dimensional movement strategies, poor flexibility and a lack of historical information analysis. To overcome these challenges, we propose a reinforcement learning-based approach for host address and port hopping (RLAPH). First, the approach strengthens system security through coordinated decision-making across IP address and port, leveraging both historical data and current information to make accurate and adaptive decisions. Second, a reward function is carefully designed to balance the trade-off between system overhead and security. Finally, validation experiments conducted in a simulated environment show that the proposed method effectively enhances defense performance while minimizing system overhead, highlighting its robustness and applicability.

In the field of fake news detection, deep learning techniques have emerged as superior performers in recent years. Nevertheless, the majority of these studies primarily concentrate on either unimodal feature-based methodologies or image-text multimodal fusion techniques, with a minimal focus on the fusion of unstructured text features and structured tabular features. In this study, we present SGAMF, a Sparse Gated Attention-based Multimodal Fusion strategy, designed to amalgamate text features and auxiliary features for the purpose of fake news identification. Compared with traditional multimodal fusion methods, SGAMF can effectively balance accuracy and inference time while selecting the most important features. A novel sparse-gated-attention mechanism has been proposed which instigates a shift in text representation conditioned on auxiliary features, thereby selectively filtering out non-essential features. We have further put forward an enhanced ALBERT for the encoding of text features, capable of balancing efficiency and accuracy. To corroborate our methodology, we have developed a multimodal COVID-19 fake news detection dataset. Comprehensive experimental outcomes on this dataset substantiate that our proposed SGAMF delivers competitive performance in comparison to the existing state-of-the-art techniques in terms of accuracy and$F_{1}$score.

The vulnerabilities of transient execution have been exploited in many side-channel attacks (SCA). We report Whisper, a novel transient execution timing (TET) side channel, which is based on the execution time difference of transient execution under different conditions. We develop TET version of SCAs including Meltdown, Zombieload, and Spectre-RSB that use Whisper as covert channel to leak information. We further propose TET-KASLR to break the kernel address space layout randomization (KASLR) mechanism under the protection of KPTI and FLARE. These attacks are simple to implement and can bypass the existing mitigation methods because the TET side channel relies on execution time that can be conveniently obtained by architectural level timing analysis. We demonstrate the correctness and effectiveness of these attacks on various x86-64 CPUs. The root cause of Whisper is analyzed with our toolset built on performance monitor unit (PMU) and potential defense against Whisper is also discussed.

In the Internet of Things (IoT) scenario, the device diversity and data sparsity present a significant challenge for malicious traffic detection, notably the “small sample problem” where insufficient data hampers the performance of the deep learning methods that depend on large volumes of labeled data for training. Transfer learning (TL) has the capability to transfer knowledge from a label-rich but heterogeneous domain to a label-sparse domain, making it a powerful tool for addressing challenges in IoT malicious traffic detection. To address these challenges, we introduce the EMTD-SSC model, a novel enhanced malicious traffic detection model that leverages TL under small sample conditions in IoT environments. Initially, our approach includes a comprehensive labeled data set that merges a small-scale IoT intrusion detection domain with the traditional intrusion detection domain to enrich semantic information transfer from the source to target domains. The EMTD-SSC model employs dual residual convolutional autoencoders for robust feature extraction and transfer, incorporating skip connections to expedite the model convergence and minimize information loss. Furthermore, to optimize transfer efficiency, we minimize the multilayer multi kernel maximum mean discrepancy (MLMK-MMD) across corresponding network layers, facilitating effective domain adaptation. Through unsupervised training and subsequent fine tuning on the target domain data, the model significantly enhances anomaly detection capabilities. Extensive experiments on the two well-known public data sets demonstrate that the EMTD-SSC model’s effectiveness, achieving an impressive 94.8% accuracy in the binary classification tasks.

The vigorous development of the Internet of Things (IoT) has generated a massive amount of personal data. How to better protect and use the privacy data of IoT has become the primary problem to be solved today. In this paper, we design a semantic-aware post-quantum searchable encryption scheme to make the use of IoT data more intelligent and secure. Firstly, the topic model and homomorphic encryption technology were used to make the retrieval query expression of ciphertext stronger and the retrieval ability more complete. Secondly, the proxy re-encryption technology was used to make the scheme achieve effective retrieval in the multi-user environment of IoT, so that each user had independent retrieval rights to ensure that there was no possibility of privacy leakage between users. At the same time, to maintain data privacy in all aspects of IoT communication, a simple homomorphic encryption OT protocol was proposed, which provides a secure channel for the user to interact with the topic management server. Finally, the complete scheme construction is based on lattice cryptography, which has proven to be resistant to quantum attacks and has stronger security.

Insider threats represent a significant challenge in both corporate and governmental sectors. Most existing supervised learning based detection methods that rely on transforming user behavior into sequential data do not fully utilize structural information and require extensive labeled data. This reliance poses a challenge due to the scarcity of labeled data in real-world scenarios, leading to a few-shot learning situation. To address these limitations, we propose a novel Graph modularized-based Meta-learning Framework for Insider Threat Detection, named GMFITD. Specifically, GMFITD utilizes a structural reconstruction mechanism that combines a graph-based autoencoder with an attention mechanism to explore structural information and infer potential relationships between users. Additionally, we employ a graph prototype construction method coupling episodic meta-learning principle (MAML) to compute representative embeddings for few-shot learning scenarios. By leveraging MAML, the proposed method can capture prior knowledge of insider threat classification by training on similar few-shot learning tasks with few labeled samples. We further enhance the resilience of GMFITD to adversarial attacks through an edge importance estimation mechanism, which assigns higher weights to relevant edges. Extensive experiments demonstrate that our proposed GMFITD outperforms state-of-the-art methods in insider threat detection, achieving higher accuracy with fewer labeled samples and resisting adversarial attacks.

Performance Monitoring Unit (PMU) is a common hardware module in modern processors that monitors the processor's architectural and microarchitectural events (PMU events) for CPU performance analysis and optimization. Vendors publish PMU events in documents such as Intel's Software Development Manual (SDM) and ARM processor technical reference manuals. In this paper, we report our findings that these documented PMU events are only a very small portion of the PMU event space. We define hidden PMU events as those that can be triggered in the instruction's execution but are not documented by the vendors. The hidden PMU events may not be as useful as the documented ones for CPU performance analysis. However, they might introduce security vulnerabilities. We develop an automated tool to traverse all the possible PMU events during the execution of each valid instruction to locate the hidden PMU events. On six Intel processors with different micro-architectures, where there are about 307 documented PMU core events on average, our tool finds an average of 17,361 hidden PMU events. We further demonstrate the security implications in both defense and attack of these hidden PMU events. Our experimental results show that up to 6,613 hidden PMU events on the i7-6700 can be used to detect transient execution attacks and 1,192 hidden PMU events can be exploited for side-channel attacks.

Federated learning aims to complete model training without private data sharing, but many privacy risks remain. Recent studies have shown that federated learning is vulnerable to membership inference attacks. The weight as an important parameter in neural networks has been proven effective for membership inference attacks, but it leads to significant overhead. Facing this issue, in this paper, we propose a bias-based method for efficient membership inference attacks against federated learning. Different from the weight that determines the direction of the decision surface, the bias also plays an important role in determining the distance to move along the direction. Moreover, the number of bias is way less than the weight. We consider two types of attacks: local attack and global attack, corresponding to two possible types of insiders: participant and central aggregator. For the local attack, we design a neural network-based inference, which fully learns the vertical bias changes of the member data and non-member data. For the global attack, we design a difference comparison-based inference to determine the data source. Extensive experimental results on four public datasets show that the proposed method achieves state-of-the-art inference accuracy. Moreover, experiments prove the effectiveness of the proposed method to resist some commonly used defenses.

Insider threats present a formidable challenge to cybersecurity, as insiders possess the privileges and information necessary to execute diverse attacks. A comprehensive analysis of user behavior, including behavioral features, sequences, and inter-user relationships, is required for effective insider threat detection. However, few existing methods consider these features in an integrated manner, which could result in high false positives. To further improve the accuracy of insider threat detection, we propose a novel framework for insider threat detection based on a temporal graph convolutional network with data augmentation (referred to as TGCN-DA), which integrates the exploration of structural information among users and simultaneously captures the behavior temporal dependencies. In particular, we introduce an edge predictor to encode user structural information and strengthen intra-class edges among users based on the representation of users’ behavior. Additionally, the GCN with temporal feature mechanism is leveraged to learn dynamic changes in users’ behavior to capture behavior temporal dependence. Extensive experiments demonstrate that our proposed TGCN-DA outperforms other state-of-the-art methods and achieves higher accuracy in the task of insider threat detection.

The rapid development of the Internet and the increasingly complex structure of network space make the network security situation more and more serious. Abnormal traffic detection is an important part of network intrusion detection and plays an important role in the field of network security. Traditional machine learning methods rely too much on feature selection and extraction and have high false positive rate and delay caused by abnormal behavior recognition. Deep learning models such as CNN and RNN have many parameters and long training time, which seriously affect the early warning function of network intrusion detection. Aiming at the problem that the parameter redundancy of deep learning models limits the corresponding model deployment in some scenarios and devices, this paper proposes a lightweight bit-operation abnormal traffic detection method based on XNOR-net convolutional neural network (XNOR-CNN). The model uses convolutional neural network(CNN) and long-short term memory(LSTM) to comprehensively analyze the temporal and spatial characteristics of network traffic, and predicts and classifies the attack behaviors in the future network traffic. In particular, the model transforms the complex convolution process into bit operation between vectors by XNOR operation, which reduces the storage of weight vectors and complex redundant calculation, greatly improves the speed of network training and reduces the consumption of network memory. In this paper, the accuracy and efficiency of XNORCNN model are proved through a large number of comparative experiments on real traffic datasets.

Abstract Federated Learning (FL) suffers from the Non-IID problem in practice, which poses a challenge for efficient and accurate model training. To address this challenge, prior research has introduced clustered FL (CFL), which involves clustering clients and training them separately. Despite its potential benefits, CFL can be computationally and communicationally expensive when the data distribution is unknown beforehand. This is because CFL involves the entire neural networks of involved clients in computing the clusters during training, which can become increasingly time-consuming with large-sized models. To tackle this issue, this paper proposes an efficient CFL approach called LayerCFL that employs a Layer-wised clustering technique. In LayerCFL, clients are clustered based on a limited number of layers of neural networks that are pre-selected using statistical and experimental methods. Our experimental results demonstrate the effectiveness of LayerCFL in mitigating the impact of Non-IID data, improving the accuracy of clustering, and enhancing computational efficiency.

Performance Monitor Unit (PMU) is an important hardware module in mainstream processors, which counts various architectural and microarchitectural events during the run-time of the processor. Theoretically, if an instruction is executed but doesn’t successfully retire (this is called transient execution), the events it triggers needn’t be recorded by PMU. However, in this study, we discover that current PMU implementations are capable of recording some events that are triggered in transient executions, which is a hardware vulnerability. Based on this vulnerability, we propose the PMU-Spill attack, a new kind of side channel attack that enables attackers to maliciously leak secret data in transient executions. We perform a thorough study of PMU counters on five Intel processors and find that they all have vulnerable PMU counters that will measure transient execution events (there are 162 vulnerable PMU counters among all the 383 PMU counters). We demonstrate on real hardware that 112 vulnerable PMU counters can be utilized in PMU-Spill attack to leak the secret data protected by Intel Software Guard Extensions (SGX). Besides, our experiments suggest that the throughput of PMU-Spill attack is up to 291.2 bytes per second (Bps) with an error rate of 2.45% on average. This discovery and the corresponding mitigation methods can be helpful for microarchitecture designers to reevaluate the security risks induced by the PMU module.

Insider threat is destructive and concealable, making addressing it a challenging task in cybersecurity. Most existing methods transform user behavior into sequential information and analyze user behavior while neglecting structural information among users, resulting in high false positives. To solve this problem, in this paper, we propose Dual-Domain Graph Convolutional Network (referred to as DD-GCN), a graph-based modularized method for high accuracy and adaptive insider threat detection. The central idea is to convert user features and structural information into heterogeneous graphs in the light of various relationships and take user behavior and relationship into account together. To this end, a weighted feature similarity mechanism is applied to balance the feature similarity of users and original linkages among them so as to generate the fused structure. Next, specific graph embeddings are extracted from the original topology structure and fused structure simultaneously, which convert behavior information into high-level representations. Furthermore, an attention mechanism is applied to learn the adaptive importance weights of the user’s features in the corresponding embedding. The combination and difference constraints are proposed to enhance the learned embeddings’ commonality and the ability to capture different information. Extensive experiments on two real-world datasets clearly show that our proposed DD-GCN extracts the most correlated information from structural topology and feature information substantially, and achieves improved accuracy with a clear margin.

With the development of social media, multimodal hate speech that relies on images and text has become an emerging way of spreading hate. The detection of multimodal hate speech is gradually becoming an increasingly challenging task. While many works based on neural networks and multimodal machine learning were proposed to detect multimodal hate speech, only few attempts have been made in terms of the interpretability of the task. This leads to difficulties in analyzing prediction results and model improvement. Therefore, this paper investigates the interpretable multimodal hate speech detection task and develops an intrinsically interpretable deep learning method by leveraging the multimodal architecture. Specifically, we leverage a multimodal pretrained model as the backbone of the final detection results and parallel an interpretability module via a joint training approach, which calculates the input tokens and fine-grained tags through a filter-gate attention mechanism. The interpretability module provides an interpretable basis for the final result judgment. We conduct experiments on the hate speech detection dataset and demonstrate that our proposed method not only significantly outperforms other methods but also provides interpretable insights into the decisions of our model.

In the era of Internet of Things (IoT), millions of heterogeneous IoT devices generate an explosion of data and services waiting to be discovered. The convergence of IoT with social networks (SIoT) interconnects multiple IoT applications and alleviates the common data sparsity and cold start problems in traditional recommendation systems. However, the social trust relationships may also be very sparse, which affects the accuracy of trust-based recommendation systems. Meanwhile, mobile devices have limited resources and are more vulnerable to malicious attacks in the IoT environment. In order to complete the trust relationship and further improve the trust-based recommendation performance, we propose a reliable and lightweight trust inference model for service recommendation in SIoT, calledTIRec. First, we obtain a comprehensive weighted centrality metric (LGWC) considering both local and global contexts. Based on this, we propose a corresponding lightweight trust path selection algorithm. Then, we present a reliable trust inference calculation algorithm consist of trust propagation and aggregation strategy, which can efficiently resist two common malicious attacks. Finally, we incorporate the rating, direct trust, and indirect trust together into the matrix factorization model, and integrate the influence of truster and trustee to obtain the synthetic model for rating predication. To the best of our knowledge, this article is the first to integrate trust inference algorithm into the trust-based recommendation systems. The extensive experiments are conducted on three real-world data sets, and the results show that ourTIRecmodel performs better than other advanced recommendation models in both “all users” view and “cold start users” view.

Facing multidemand tasks and massive heterogeneous resources in an IoT edge computing environment, it is a challenge to obtain reliable and quick response service and allocate application tasks to resource nodes that meet task requirements and user preference. Since IoT edge computing is facing different types of severe attacks, such as message attacks, swing attacks, collusion attack, node attacks, etc., providing a reliable service environment, trust evaluation between edge nodes is necessary. Existing trust computing schemes, however, suffer from a long response period and low malicious detection rate in a dynamic environment. To alleviate these issues, we propose a reliable and efficient task offloading strategy based on the multifeedback trust mechanism (TOSMFTM). First, a reliable and efficient architecture of TOSMFTM is established, which can effectively improve the ability of trust computing and task offloading. Second, according to the broker’s dynamic monitoring of data, a multifeedback trust aggregation model based on time attenuation and interaction frequency is proposed to provide a trusted running environment. Third, a trust weight$k$-means (TWK-means) clustering algorithm is designed based on resource attributes to enhance the reliability of service, and quickly and accurately cluster out resource nodes required by the task. Finally, we construct a task offloading model based on trust clustering to ensure user experience quality and promote system efficiency. Different from existing task processing models, which only focus on task offloading, our method also carries out resource preprocessing, trust evaluation, and resource clustering before task processing. The experiment verifies the effectiveness and feasibility of our TOSMFTM scheme.

As a complementary technology to traditional network security, trust computing scheme has been playing an increasingly important role in providing cloud service. However, many organizations constantly face trust computing challenges; moreover, establishing a highly trustworthy cloud ecosystem can be costly and time-consuming. In this article, we originally propose the conceptual model and formal definitions for a trustworthy collaboration service ecosystem, and construct a Bi-trustworthy cloud collaboration service (Bi-TCCS), which is a scheme based on an innovative bilateral social feedback (referred to as “bi-feedback”) scheme. First, a trust-aware collaboration service model is proposed based on cloud service brokerages (CSBs), which can provide intermediation and aggregation capabilities to enable organizations to deploy their services across a collaborative cloud environment. Then, we propose a bi-feedback scheme based on the inherent social relationship among three network communities, which are composed of three types of network entities: cloud users, CSBs, and cloud service providers. The proposed scheme is effective and reliable against garnished and bad-mouthing attacks resulting from the traditional social feedback scheme. Moreover, we innovatively adopt an aggregating method for overall trust based on deviation analysis. This method can minimize errors and overcome the limitations of traditional schemes, where trust attributes are weighted manually. Theoretical analysis and experiments verify the effectiveness ofBi-TCCS. Compared with existing approaches, the service successful ratio ofBi-TCCSincreased by 12 percent under highly dishonest cloud environment. These results also indicate thatBi-TCCSis more adaptable both in the random walk and cheating profiles, which represents a substantial improvement in tracking the dynamic behavior of cloud services.

Many pioneering approaches have verified the effectiveness of utilizing the global temporal and local object information for video understanding tasks and have achieved significant progress. However, existing methods utilize object detectors to extract all objects overall video frames. This may bring performance degradation due to the information redundancy both spatially and temporally. To address this problem, we propose an adaptive spatial location module for the video captioning task which dynamically predicts an important position of each video frame in the procedure of generating the description sentence. The proposed adaptive spatial location method not only makes our model focus on local object information, but also reduces time and memory consumption brought by the temporal redundancy in extensive video frames and improves the accuracy of generated description. Besides, we propose a balanced loss function to address the class imbalance problem existing in training data. The proposed balanced loss assigns different weight to each word of ground-truth sentence in the training process which can generate more diversified description sentences. Extensive experimental results on the MSVD and MSR-VTT dataset show that the proposed method achieves competitive performance compared to state-of-the-art methods.

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system calledHinCTIis developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. WithHinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

In social networking platforms, the text published by users is usually the most direct way to express users' interests. This paper studies the method of text classification to mine user's interests for friends recommendation. And by fine-tuning the BERT (Bidirectional Encoder Representation from Transformers) pre-training language model to complete text classification tasks. Aiming at the problem of local information missing in the output of BERT pre-training language model. This paper proposes the KBERT-CNN (K_layers Bidirectional Encoder Representation from Transformers and Text Convolutional Neural Networks) text classification model. The model uses the output of the last four layers Transformers of the BERT pre-training language model as text vector, and combines with TextCNN(Text Convolution Neural Network) to build a text classification model. Then this paper uses the probability distribution of user's texts categories to calculate the interest similarity between users to achieve Top-N friends recommendation. Experimental results show that the F1 of the KBERT-CNN text classification model reaches 92.26%, which is better than other text classification models. The Precision of friends recommendation based on text classification is ahead of other content-based friends recommendation methods.

The integration of trust system and recommendation system is a new hot spot in current research. Trust relationship has be exploited in social recommendation, which can effectively solve the problems of low recommendation quality, sparse data and cold start in the traditional recommendation system. Meanwhile, trust inference in social relations is necessary in completing trust information and expanding social recommendation knowledge base. In this work, we propose a new trust inference algorithm LWCTrust to improve the efficiency and accuracy of social recommendation. Firstly, we construct a local weighted centrality (LWC) metric based on the user's degree centrality and trust information, and propose a new adaptive breadth-first search algorithm. Then, based on the property of path decay, we compare two different trust decay strategies. In addition, considering inconsistencies and conflicts in trust opinion, we apply LWC metric to multi-path aggregation step and present a OWA dynamic aggregation strategy. A number of experiments are conducted on the real social network dataset Advogato, and the results validate the great performance of LWCTrust. Our work is the first to construct an efficient LWC metric using social graph trust information, and we explore the effect of attenuation functions on accuracy in path propagation.

Today, the scale of global Internet users continues to grow; the Internet has become the main driver of global economic growth; IoT technology is also constantly pushing the process of the Internet of Everything. However, the ever-changing cybersecurity situation is not optimistic and the people's demand for secure network is also increasing. In this paper, for the biggest challenge of building anomaly-based Network Intrusion Detection System: building a high-performance intrusion detection classifier model, we first propose an effective intrusion detection method based on pruning deep neural network: P-DNN. Firstly, we train a deep neural network with complex structure and good intrusion detection performance. Secondly, through the pruning operation, only the connections with more important information in the weight are reserved, reducing the complexity of the model. Finally, retrain the deep neural network to find the best model. We use the KDD Cup 99 dataset to evaluate the effectiveness of the method and achieve exciting results. The model constructed by P-DNN achieves a detection rate of 0.9904 for known attacks and a detection rate of 0.1050 for unknown attacks. By comparing with related work, the model achieves the best intrusion detection performance: COST is reduced to 0.1875 and ACC is increased to 0.9317.

Recent work has shown that convolutional neural network models, especially end-to-end models, perform significant better over traditional methods on stereo matching. However, these models neglect that the information at coarse and fine scales is processed interactively when dealing with matching problems in human visual mechanisms, which can help improve the performance of the model. To solve this problem, we propose CSCNet based on mixed spatial pyramid module and cross-scale correlation volume. In the mixed spatial pyramid module, we propose a way to extract multi-scale context information by mixing pooling and dilated convolution. The cross-scale correlation volume perform cross-computation to obtain full correlation of different scales and the best scale of matching, which reduce the matching ambiguity by imitating the human visual mechanism, and it also provide more similarity information for the subsequent regularization process. Experiments on the KITTI and Scene Flow datasets show that our model outperforms the previous methods.

In this paper, we propose a novel hybrid layout called Information Eye for relational information space, which supports interactive exploration of information. It is a new visual metaphor, which uses the circular layout to represent the relationship information and the radial tree in the center to represent the attribute information. It combines the two traditional layout methods and presents the shape of the eye. This method draws on the idea of force-directed algorithm and introduces the concept of force into a circular layout. The distance from the node to the center of the circle is used instead of the node-link diagram to express the relationship, making the relationship more intuitive. In the center of the circular layout, the radial tree is used to characterize the attribute information of the nodes, which is more layered. Information Eye also introduces a round lens method, similar to the focusing function of human eyes, to realize the context change when the center of the circle is selected or not, and realizes a smooth transition of the information view. It combines multiple interactive technologies to realize the interactive exploration of two types of information. Finally, we apply this technique to movie data to illustrate its usefulness.

Data aggregation is a critical operation in wireless sensor networks (WSNs). Many applications have strict requirements for the latency of data aggregation. This paper focuses on the latency problem of data aggregation. Two factors determine the latency of data aggregation. First, because of the existence of interference, efficient collision-free scheduling is crucial for reducing data aggregation latency. Second, the tree structure has an important impact on data aggregation latency. In this paper, we propose a novel approach called distributed and efficient data aggregation scheduling over multichannel links (DEDAS-MC). DEDAS-MC minimizes the latency in routing the aggregated data to the sink over multichannel links. In DEDAS-MC, we first present a scheduling algorithm to schedule sensors to avoid interference and minimize the latency of data aggregation on a given tree. Then, a distributed algorithm for constructing minimum-latency data aggregation trees is proposed by employing the Markov approximation method. In DEDAS-MC, the value of β is adaptive. The Markov approximation method-based adaptive-β is more flexible and efficient than the single β approximation. The experiments show that DEDAS-MC outperforms the existing competing schemes.

The interaction between mobile Internet of Things (IoT) devices is based on a hybrid communication architecture. To improve packet delivery ratio, reduce end-to-end delay, and protect data privacy, designing an efficient data forwarding scheme is crucial in guaranteeing the quality of data transmission. Fog computing, a novel distributed computing framework, can decrease the amount of data transmission on the Internet and improve quality of services. In this paper, we propose a fog computing-assisted trustworthy forwarding (FCTF) scheme. To the best of our knowledge, this paper is the first study that investigates the role of fog infrastructure nodes (FINs) in forwarding scheme design. FCTF first selects the contact probability and the service degree as the basic trustworthy metrics between node pairs, and combines high-performance optimization algorithms to design a dynamic detection model of overlapping trustworthy communities (DOTCs). Then, we construct logical joint edge community structures on the basis of the results of DOTC and the distribution of FINs at each timestamp. Finally, based on the logical joint edge community, we define the forwarding utilities for FINs and mobile devices, respectively, and design self-adaptive forwarding rules. The experimental results prove that our FCTF scheme can enhance the delivery ratio, and decrease the latency and average hop-count more effectively, and has better routing quality compared with some popular forwarding models in mobile IoT applications.

In data-intensive cloud collaboration services with tens of thousands of users and million-level resources, means of providing personalized and trust-aware services quickly and simultaneously is a challenging issue. In this paper, we propose Per-trust, a trust-aware and fast resource matchmaking scheme for personalized QoS guaranteeing in collaboration cloud service. First, an integrated and trust-aware service broking architecture is proposed across the collaborative cloud computing environment; this architecture can provide trust computing and personalized resource matchmaking capacities. Then, a resource clustering method is proposed based on the multidimensional properties of cloud resources; this method can accurately, quickly meet the personalized requirements of users. Finally, an innovative algorithm is proposed for the trust computing of service resources based on real-time and dynamic monitoring of data, thereby quickly and effectively providing trust-aware resource matchmaking. Different from existing methods, which focus only on QoS and trust issues, our approach adds a resource clustering step before QoS and trust evaluation. Three key components are organically combined, namely, service broking architecture, resource clustering, and security and QoS-related trust computing. To the best of our knowledge, this paper is the first to construct an integrated solving scheme for cloud resource matchmaking that can simultaneously satisfy the trustworthiness and personalization required by users. Theoretical and experimental results verify the effectiveness of the proposed scheme.

More and more organizations and individuals start to pay attention to real-time threat intelligence to protect themselves from the complicated, organized, persistent and weaponized cyber attacks. However, most users worry about the trustworthiness of threat intelligence provided by TISPs (Threat Intelligence Sharing Platforms). The trust evaluation mechanism has become a hot topic in applications of TISPs. However, most current TISPs do not present any practical solution for trust evaluation of threat intelligence itself. In this paper, we propose a graph mining-based trust evaluation mechanism with multidimensional features for large-scale heterogeneous threat intelligence. This mechanism provides a feasible scheme and achieves the task of trust evaluation for TISP, through the integration of a trust-aware intelligence architecture model, a graph mining-based intelligence feature extraction method, and an automatic and interpretable trust evaluation algorithm. We implement this trust evaluation mechanism in a practical TISP (called GTTI), and evaluate the performance of our system on a real-world dataset from three popular cyber threat intelligence sharing platforms. Experimental results show that our mechanism can achieve 92.83% precision and 93.84% recall in trust evaluation. To the best of our knowledge, this work is the first to evaluate the trust level of heterogeneous threat intelligence automatically from the perspective of graph mining with multidimensional features including source, content, time, and feedback. Our work is beneficial to provide assistance on intelligence quality for the decision-making of human analysts, build a trust-aware threat intelligence sharing platform, and enhance the availability of heterogeneous threat intelligence to protect organizations against cyberspace attacks effectively.

In Device-to-Device (D2D)communications, the communication environments are multifarious and it is difficult for devices to distinguish undependable services and get successful cooperation. In this paper, we originally propose a broker-guided trust calculation model based on feedback from brokers of BSs which provide mobile network services. And we adopt lightweight trust evaluating mechanism which facilitates low-overhead trust computing algorithms to reduce networking risk and improve system efficiency. Compared with existing models, the experimental results show that our model have great advantage in both reliability and efficiency.

Data aggregation is widely used in wireless sensor networks (WSNs) due to the resource constraints of computational capability, energy and bandwidth. Because WSNs are often deployed in an unattended hostile environment, WSNs are prone to various attacks. The traditional security technologies such as privacy protection and encryption technology can not address the attacks from the internal nodes of network. Therefore, the trust management mechanism for data aggregation has become a hot research topic, and an efficient trust management mechanism plays an important role in data aggregation.

Providing high trustworthy service is the most fundamental task for any cloud computing platform. Users are willing to deliver their computing tasks and the most sensitive data to cloud data centers, which is based on the trust relationship established between users and cloud service providers. However, with the development of collaboration cloud computing, how to provider fast response for a large number of users' service requests becomes a challenging problem. In order to quickly provide highly trustworthy services, the service platform must efficiently and quickly reply tens of millions of service requests, and automatically match-make tens of thousands of service resources. In this context, lightweight and fast (high-speed, low-overhead) trust computing schemes become the fundamental demand for implementing a trustworthy and collaborative cloud service. In this paper, we propose an innovative and parallel trust computing scheme based on big data analysis for the trustworthy cloud service environment. First, a distributed and modular perceiving architecture for large-scale virtual machines' service behavior is proposed relying on distributed monitoring agents. Then, an adaptive, lightweight, and parallel trust computing scheme is proposed for big monitored data. To the best of our knowledge, this paper is the first to use a blocked and parallel computing mechanism, the speed of trust calculation is greatly accelerated, which makes this trust computing scheme very suitable for a large-scale cloud computing environment. Performance analysis and experimental results verify feasibility and effectiveness of the proposed scheme.

Multi-cloud collaborative environment consists of multiple data centers, which is a typical processing platform for big data. This paper focuses on the trust computing requirement of multi-cloud collaborative services and develops a Data-driven and Feedback-Enhanced Trust (DFET) computing pattern across multiple data centers with several innovative mechanisms. First, a trust-aware service monitoring architecture is proposed based on distributed soft agents to serve as middleware for multi-cloud trust computing and task scheduling. A data-driven trust computation scheme based on multi-indicator monitoring data is then proposed. The integration of several key service indicators into trust computing makes this scheme suitable for service-oriented cloud applications. More importantly, according to the intrinsic relationship among users, monitors, and service providers, we propose an enhanced and hierarchical feedback mechanism that can effectively reduce networking risk while improving system dependability. Theoretical analysis shows that DFET pattern is highly dependable against garnished and bad-mouthing attacks. We also build a prototype system to verify the feasibility of DFET pattern and the experiments yield meaningful observations that can facilitate the effective utilization of DFET in the large-scale multi-cloud collaborative environment.

Mobile crowd sensing (MCS) arises as an appealing paradigm, which utilizes participants to contribute sensing data generated from sensors embedded in smart devices in the internet of things (IoT) for the people-centric service delivery and crowd intelligence extraction. Due to the inherent selfishness of human and network's openness, the quality of the data submitted by the participants is not always satisfying. To cope with this problem, a dynamic-trust-based recruitment framework (DTRF) for MCS system is proposed to recruit suitable participants who are trustworthy and always submit high-quality sensing data on time. In this model, we first give the definition of trust, and evaluate the overall trust degree of the participant from multi-dimensional trust evaluation factors: direct trust, feedback trust and incentive function. Then we develop an adaptive weight allocation approach based on information entropy theory, and the algorithm realization is given. Extensive simulations verifies that DTRF can achieve good performance in terms of trustworthy participants selection and task completion rate, compared with trust without feedback model.

Mobile Crowd Sensing (MCS) is a promising paradigm in which mobile users collect and share sensor data from their local environment using wireless mobile devices. The inherent openness of this platform and the selfishness of individuals make it easy to contribute low-quality sensor data, so the recruitment of suitable participants who are trustable and contribute high-quality sensor data, becomes a fundamental requirement for MCS system. In this paper, we propose a dynamic-trust-based recruitment framework (DTRF) for MCS system. Real-time direct trust and lightweight feedback aggregation trust are combined to select the well-suited participants. In addition, we adopt an adaptive weight allocation approach to calculate the overall trust degree of the participants. Theoretical analysis and extensive simulation confirm that DTRF can efficiently select the trustworthy participants and effectively stimulate the participants to contribute high-quality sensor data and thus get high task completion rate and data quality.

With the rapid development of big data analytics, mobile computing, Internet of Things, cloud computing, and social networking, cyberspace has expanded to a cross-fused and ubiquitous space made up of human beings, things, and information. Internet applications have evolved from Web 1.0 to Web 2.0 and Web 3.0, and web information has seen an explosive growth, which is strongly promoting the advent of a global era of big data. In this ubiquitous cyberspace, traditional search engines can no longer fully satisfy the evolving needs of various types of users. Therefore, search engines must make completely innovative, revolutionary changes for the next generation of search, which is referred to as “big search”. This paper first studies the development needs of big search. Then, big search is defined, and the 5S properties (Sourcing, Sensing, Synthesizing, Solution, and Security) of big search, which are different from those of traditional search engines, are elaborated. Also, the paper provides a system architecture for big search, explores the key technologies that support the 5S properties, and describes potential application fields of big search technology. Finally, the research opportunities of big search are discussed.

With the development of mobile devices, mobile cloud computing is becoming increasingly important. One of the basic questions in mobile cloud computing is how to match user demand with cloud server resources. Based on Improved FCM (IGAFCM) Algorithm, this paper proposes a scheduling scheme which is provided for mobile resources to cluster continuously, so as to reduce the size of the matching requirements during the search. Moreover, Experiments have proved that matching strategy is dynamically adjusted according to the matching score and feedback training.

Improved FCM algorithm based on genetic algorithm is used to extract user needs in mobile cloud computing. By using its characteristics of fast clustering, users can be divided into the same category with similar attributes and behavior patterns, and then use the similarity recommendation algorithm, which makes the similar user requests can be quickly responded. This algorithm (GAFCM-CF) is proposed in this paper to solve the problem of mobile cloud user attribute collection and user request processing in small and medium network. At the same time, this paper compares the simulation experiment with the traditional MIN-MIN scheduling algorithm, and verifies the effectiveness and efficiency of the algorithm.

In recent years, more and more internet companies trend to fuse their products with personal recommendation functions. Although the idea of this business model satisfies characteristic of Internet industry felicitously, scientists and engineers gradually find out that the effect is worse than they expected. The quality of recommendation is limited by cold start, data sparse, lack of learning contextual aware, and so on. One of the most important drawbacks of existing recommendation systems is that they usually use only rating matrix as useful information and not fully consider item attributes. In this paper, we proposed an optimized recommendation system, which based on modeling of items in a multidimensional space of item's attribute. The presented approach takes item attributes, user preferences and user context into consideration, and is mainly composed of two modules: (1) attribute-latent factor model, which is used to show user latent preference for each attribute, (2) multi-attribute model, which is used to show user preference between all attributes. The research is conducted in a practical application environment, and the preliminary experimental results show the validity of the recommendation.

Oriented by requirement of trust management in multiple cloud environment, this paper presents T-broker, a trust-aware service brokering scheme for efficient matching cloud services (or resources) to satisfy various user requests. First, a trusted third party-based service brokering architecture is proposed for multiple cloud environment, in which the T-broker acts as a middleware for cloud trust management and service matching. Then, T-broker uses a hybrid and adaptive trust model to compute the overall trust degree of service resources, in which trust is defined as a fusion evaluation result from adaptively combining the direct monitored evidence with the social feedback of the service resources. More importantly, T-broker uses the maximizing deviation method to compute the direct experience based on multiple key trusted attributes of service resources, which can overcome the limitations of traditional trust schemes, in which the trusted attributes are weighted manually or subjectively. Finally, T-broker uses a lightweight feedback mechanism, which can effectively reduce networking risk and improve system efficiency. The experimental results show that, compared with the existing approaches, our T-broker yields very good results in many typical cases, and the proposed system is robust to deal with various numbers of dynamic service behavior from multiple cloud sites.

This paper proposes a service operator-aware trust scheme (SOTS) for resource matchmaking across multiple clouds. Through analyzing the built-in relationship between the users, the broker, and the service resources, this paper proposes a middleware framework of trust management that can effectively reduces user burden and improve system dependability. Based on multidimensional resource service operators, we model the problem of trust evaluation as a process of multi-attribute decision-making, and develop an adaptive trust evaluation approach based on information entropy theory. This adaptive approach can overcome the limitations of traditional trust schemes, whereby the trusted operators are weighted manually or subjectively. As a result, using SOTS, the broker can efficiently and accurately prepare the most trusted resources in advance, and thus provide more dependable resources to users. Our experiments yield interesting and meaningful observations that can facilitate the effective utilization of SOTS in a large-scale multi-cloud environment.

In cloud computing, trust management is more important than ever before in the use of information and communication technologies. Owing to the dynamic nature of the cloud, continuous monitoring on trust attributes is necessary to enforce service‐level agreements. This study presents Cloud‐Trust, an adaptive trust management model for efficiently evaluating the competence of a cloud service based on its multiple trust attributes. In Cloud‐Trust, two kinds of adaptive modelling tools (rough set and induced ordered weighted averaging (IOWA) operator) are organically integrated and successfully applied to trust data mining and knowledge discovery. Using rough set to discover knowledge from trust attributes makes the model surpass the limitations of traditional models, in which weights are assigned subjectively. Moreover, Cloud‐Trust uses the IOWA operator to aggregate the global trust degree based on time series, thereby enabling better real‐time performance. Experimental results show that Cloud‐Trust converges more rapidly and accurately than do existing approaches, thereby verifying that it can effectively take on trust measurement tasks in cloud computing.

The resource efficiency and dependability of a trust system are the most fundamental requirements for any wireless sensor network (WSN). However, existing trust systems developed for WSNs are incapable of satisfying these requirements because of their high overhead and low dependability. In this work, we proposed a lightweight and dependable trust system (LDTS) for WSNs, which employ clustering algorithms. First, a lightweight trust decision-making scheme is proposed based on the nodes' identities (roles) in the clustered WSNs, which is suitable for such WSNs because it facilitates energy-saving. Due to canceling feedback between cluster members (CMs) or between cluster heads (CHs), this approach can significantly improve system efficiency while reducing the effect of malicious nodes. More importantly, considering that CHs take on large amounts of data forwarding and communication tasks, a dependability-enhanced trust evaluating approach is defined for cooperations between CHs. This approach can effectively reduce networking consumption while malicious, selfish, and faulty CHs. Moreover, a self-adaptive weighted method is defined for trust aggregation at CH level. This approach surpasses the limitations of traditional weighting methods for trust factors, in which weights are assigned subjectively. Theory as well as simulation results shows that LDTS demands less memory and communication overhead compared with the current typical trust systems for WSNs.

In Peer-to-Peer (P2P) trust management, feedback provides an efficient and effective way to build a reputation-based trust relationship among peers. There is no doubt that the scalability of a feedback aggregating overlay is the most fundamental requirement for large-scale P2P computing. However, most previous works either paid little attention to the scalability of feedback aggregating overlay or relied on the flooding-based strategy to collect feedback, which greatly affects the system scalability. In this paper, we proposed a scalable feedback aggregating (SFA) overlay for large-scale P2P trust evaluation. First, the local trust rating method is defined based on the time attenuation function, which can satisfy the two dynamic properties of trust. The SFA overlay is then proposed from a scalable perspective. Not only can the SFA overlay strengthen the scalability of the feedback aggregation mechanism for large-scale P2P applications, but it can also reduce networking risk and improve system efficiency. More importantly, based on the SFA overlay, an adaptive trustworthiness computing method can be defined. This method surpasses the limitations of traditional weighting methods for trust factors, in which weights are assigned subjectively. Finally, the authors design the key techniques and security mechanism to be simple in implementation for the easy incorporation of the mechanism into the existing P2P overlay network. Through theoretical and experimental analysis, the SFA-based trust model shows remarkable enhancement in scalability for large-scale P2P computing, as well as has greater adaptability and accuracy in handling various dynamic behaviors of peers.

Peer-to-peer Grid (PG) is a new, promising approach for distributed computation that takes advantage of the huge amount of resources in grid computing. The purpose of PG is to support cooperative work between large-scale grid domains. In order to protect each domain's privilege and security, an efficient trust management mechanism is essential. Focusing on the requirement of large-scale PG computing, PG-Trust, a novel trust model is proposed based on trust relationships across domains. Firstly, a self-adaptive overall trust quantified framework is proposed based on the historical interaction records between participants, which not only can improve system efficiency, but also can solve trust computing problem when the direct evidence is sparse. Furthermore, the direct trust computing method based on attenuation function and the feedback trust mechanism based on direct trust tree (DTT) are introduced, which makes our model have a higher self-adaptability and a better scalability than previous studies. Through performance analyzing, the proposed model exhibits a strong self-adaptability in handling various dynamic behaviors of peers, and has a remarkable enhancement in the accuracy of trust evaluation.

With the widespread application of web services, trust-based service selection has become a significant requirement from a requester's point of view, and trust prediction mechanism has become a determining factor for any given service's success. But the dynamic nature of trust creates the biggest challenge in measuring a trust value and make trust predictions. In this paper, a new trust prediction model is proposed based on multiple decision factors. Firstly, the proposed model integrates multiple complementary decision factors to reflect complexity and uncertainty of trust relationship. In addition to including traditional experience-based trust factor and feedback-based trust factor, this model innovatively integrates QoS-based trust factor into global trust evaluation, which makes the model have a better rationality and a higher practicability than the existing approaches. Meanwhile, the proposed model applies the theory of OWA (Ordered Weighted Averaging) operator to assign the classification weights to these decision factors, which makes the model exhibit a strong adaptability in handling various dynamic behaviors of service providers. Simulation results show that, compared to the existing approaches, the proposed model has remarkable enhancements in the accuracy of trust prediction.

Multicast and MPLS are two complementary technologies. Merging MPLS and multicast technologies can acquire two advantages: multicast saving bandwidth and MPLS supporting high-speed, QoS and traffic engineering, VPN. Implementation of MPLS multicast has two key expectations: how to construct multicast tree over MPLS domain and how to enhance multicast scalability. In this paper, we design a scalable MPLS multicast algorithm. The algorithm uses tunneling technology and branching nodes technology, which can merge source and shared trees multicast in MPLS networks. Using tunneling technology to implement multipoint-to-multipoint (MP2MP) shared-tree multicast can solve one of the difficulties of MPLS multicast: MP2MP label distribution. Using branching nodes technology can reduce multicast forwarding state in routers and enhance multicast scalability. We also evaluate our proposal in terms of scalability and efficiency and present some simulation results based on NS-2