Accurately identifying network attacks is crucial for maintaining network security. However, these attacks are often hide within massive volumes of network traffic, posing significant challenges for traditional detection methods. Supervised learning approaches require substantial labeled data and struggle to adapt to unknown attack types, while unsupervised methods face difficulties in accurately pinpointing specific attack categories. To address these limitations, we propose a novel fewshot learning model for network flow attack classification based on graph contrastive learning. Our model leverages contrastive learning to enhance feature representation and generalization capabilities, enabling high-accuracy attack detection even with limited training data. Specifically, we first construct a multi- graph representation of network traffic and segment the data into snapshots. Then, we perform graph data augmentation within each snapshot to generate augmented sample pairs, which are used to pre-train the model via contrastive learning. Finally, we fine-tune the model parameters to achieve multi-class attack classification, leveraging the learned feature representations to identify various attack types, even those unseen during training. Experimental results demonstrate that our model exhibits excellent generalization ability and achieves high attack detection performance, even with limited training data.

MicroRNAs (miRNAs) are critical in diagnosing and treating various diseases. Automatically demystifying the interdependent relationships between miRNAs and diseases has recently made remarkable progress, but their fine-grained interactive relationships still need to be explored. We propose a multi-relational graph encoder network for fine-grained prediction of miRNA-disease associations (MRFGMDA), which uses practical and current datasets to construct a multi-relational graph encoder network to predict disease-related miRNAs and their specific relationship types (upregulation, downregulation, or dysregulation). We evaluated MRFGMDA and found that it accurately predicted miRNA-disease associations, which could have far-reaching implications for clinical medical analysis, early diagnosis, prevention, and treatment. Case analyses, Kaplan-Meier survival analysis, expression difference analysis, and immune infiltration analysis further demonstrated the effectiveness and feasibility of MRFGMDA in uncovering potential disease-related miRNAs. Overall, our work represents a significant step toward improving the prediction of miRNA-disease associations using a fine-grained approach could lead to more accurate diagnosis and treatment of diseases.

Foretelling ongoing malware attacks in real time is challenging due to the stealthy and polymorphic nature of their executive behavior patterns. In this paper, we present MalAF, a novelMalwareAttackForetelling framework that utilizes run-time behavior (i.e., sequences of API events) of malware to foretell the attack that has not yet executed. MalAF first samples suspicious API events by assessing the sensitivity of the parameters of each API event and dividing them into multiple attack time slots by calculating the strong correlation. Following that, MalAF employs dynamic heterogeneous graph sequences to incrementally model contextual semantics for each attack time slot, generating malware state sequences in real time. Moreover, MalAF proposes a greedy adaptive dictionary (GAD)-optimized IRL preference learning method to automate the capture of families' intrinsic attack preferences, which achieves higher performance than the existing inverse reinforcement learning (IRL). Additionally, with the guidance of families' attack preferences, MalAF trains an LSTM to foretell the future path of the target malware. Finally, MalAF matches the identified APIs' paths with a malicious capability base and reports the comprehensible attacks to an analyst. The experiments on real-world datasets demonstrate that our proposed MalAF outperforms the state-of-the-art methods, which improves the baseline by 3.01%$\sim$4.73% of accuracy in terms of path foretell.

Malware attacks, especially “few-shot” malware, have profoundly harmed the cyber ecosystem. Recently, malware detection models based on graph neural networks have achieved remarkable success. However, these efforts over-rely on sufficient labeled data for model training and thus may be brittle in few-shot malware detection because of the label scarcity. To this end, we propose a self-supervised malware detection framework based on graph contrastive learning and adversarial augmentation, termed A2-CLM, to address the challenge of few-shot malware detection. Particularly, A2-CLM first depicts the malware execution context with a sensitivity heterogeneous graph by assessing the security semantic of each behavior. Afterwards, A2-CLM designs multiple adversarial attacks to generate more practical contrastive pairs, including the PGD attack, attribute masking attack, meta-graph-guide sampling attack, direct system calls attack, and obfuscation attack, which is beneficial to strengthening the model’s effectiveness and robustness. To alleviate the training workload of contrastive learning, we introduce a momentum strategy to train the multiple graph encoders in A2-CLM. Especially on 1-shot detection tasks, A2-CLM achieves performance gains of up to 24.63% and 4.58% against supervised and self-supervised detection methods, respectively.

Predicting microbe-disease associations is crucial for demystifying the causes of diseases and preventing them proactively. However, most of existing approaches are feeble to comprehensively investigate the interactive relationships between diseases and microbes by self-supervised manner, resulting in the microbe-disease associations are hard to ploughed. In this paper, we propose DNCL-MDA, a novelMicrobe-DiseaseAssociations prediction model based onDualNetworkContrastiveLearning, to demystify potential microbe-disease associations (MDAs). Particularly, DNCL-MDA first constructs a pair of microbe-disease dual networks, and designs an effective information flow projection method to obtain the individual disease and microbe networks while reserving their interdependent information. Then, DNCL-MDA proposes an optimized graph contrastive learning approach to learn the discriminative feature representations of diseases and microbes. Finally, the feature representations are contacted and fed into a fully connected neural network to predict the potential microbe-disease associations automatically. Experimental results on real-world datasets demonstrate that our proposed DNCL-MDA largely outperforms the state-of-the-art methods with more promising AUC performances.

Detecting the newly emerging malware variants in real time is crucial for mitigating cyber risks and proactively blocking intrusions. In this paper, we propose MG-DVD, a novel detection framework based on dynamic heterogeneous graph learning, to detect malware variants in real time. Particularly, MG-DVD first models the fine-grained execution event streams of malware variants into dynamic heterogeneous graphs and investigates real-world meta-graphs between malware objects, which can effectively characterize more discriminative malicious evolutionary patterns between malware and their variants. Then, MG-DVD presents two dynamic walk-based heterogeneous graph learning methods to learn more comprehensive representations of malware variants, which significantly reduces the cost of the entire graph retraining. As a result, MG-DVD is equipped with the ability to detect malware variants in real time, and it presents better interpretability by introducing meaningful meta-graphs. Comprehensive experiments on large-scale samples prove that our proposed MG-DVD outperforms state-of-the-art methods in detecting malware variants in terms of effectiveness and efficiency.