Cyberbullying is a pervasive issue on online platforms, yet early intervention via predictive modeling remains an open challenge. This challenge is compounded by the temporal dynamics of user interactions and the sparsity of such interactions in real-world social networks, making reliable modeling difficult. Current methods predominantly focus on detecting cyberbullying after it occurs through user content and profiles, while overlooking the temporal patterns and struggling when social interaction data is limited. We propose TemSoGraph, a unified temporal social graph learning model for cyberbullying detection and prediction. The model leverages a temporal self-attention mechanism to capture time-evolving user interactions and employs joint global and local node updates to represent users with limited interactions. It further incorporates a domain adaptor that learns domain-invariant features, enhancing generalization across datasets even when labeled target data is scarce. Experiments on two real-world datasets, Instagram and Vine, show that TemSoGraph outperforms eight cyberbullying detection models in detection task and six dynamic graph neural networks in prediction task. On the prediction task, TemSoGraph achieves a recall of 97.18% on Instagram with 2.53% improvement and 93.38% on Vine with 6.25% improvement. The model supports both detection and future prediction and provides a strong benchmark for cyberbullying modeling. • We propose TemSoGraph model for cyberbullying detection and prediction. • TemSoGraph works effectively under real-world data sparsity problem. • TemSoGraph integrates domain adaptor for cross-dataset generalization.

Given the increasing number and severity of cyber attacks, there has been a surge in cybersecurity information across various mediums such as posts, news articles, reports, and other resources. Cyber Threat Intelligence (CTI) involves processing data from these cybersecurity sources, enabling professionals and organizations to gain valuable insights. However, with the rapid dissemination of cybersecurity information, the inclusion of fake CTI can lead to severe consequences, including data poisoning attacks. To address this challenge, we have implemented a three-step strategy: generating synthetic CTI, evaluating the quality of the generated CTI, and detecting fake CTI. Unlike other subdomains, such as fake COVID news detection, there is currently no publicly available dataset specifically tailored for fake CTI detection research. To address this gap, we first establish a reliable groundtruth dataset by utilizing domain-specific cybersecurity data to fine-tune a Large Language Model (LLM) for synthetic CTI generation. We then employ crowdsourcing techniques and advanced synthetic data verification methods to evaluate the quality of the generated dataset, introducing a novel evaluation methodology that combines quantitative and qualitative approaches. Our comprehensive evaluation reveals that the generated CTI cannot be distinguished from genuine CTI by human annotators, regardless of their computer science background, demonstrating the effectiveness of our generation approach. We benchmark various misinformation detection techniques against our groundtruth dataset to establish baseline performance metrics for identifying fake CTI. By leveraging existing techniques and adapting them to the context of fake CTI detection, we provide a foundation for future research in this critical field. To facilitate further research, we make our code, dataset, and experimental results publicly available on GitHub .

The Social Internet of Things (SIoT) enables cross-organisational collaboration for various industrial applications. However, evaluating trust models within such environments remains challenging due to context-dependent dynamics in SIoT environments. Existing evaluation platforms often rely on overly domain-specific or generic datasets, overlooking the inherent uncertainty and dynamicity of real-world SIoT settings. Additionally, there is a lack of practical platforms to assess the feasibility and effectiveness of trust models across diverse scenarios. In this study, we present the Realistic Trust Model Evaluation Platform for the Social Internet of Things (REACT-SIoT) to rigorously assess trust models in SIoT environments, thereby facilitating trustworthy collaboration for sustainable IoT transformations. REACT-SIoT addresses 21 identified requirements essential for simulating a realistic SIoT environment, including categories of heterogeneity, dynamicity, incompleteness, uncertainty, interdependency, and authentic real-world dynamics. We developed a configurable evaluation procedure that mitigates dataset bias and supports the assessment of both existing and newly developed trust models under various scenario-dependent settings. A real-world example demonstrates the platform’s capability to satisfy these requirements effectively. Our analysis reveals that REACT-SIoT meets all defined requirements and outperforms existing evaluation environments based on accuracy, trust convergence, and robustness criteria. The platform has been successfully applied to existing trust models, showcasing its applicability and enabling comparative assessments that were previously constrained by disparate evaluation settings and datasets. In conclusion, REACT-SIoT offers a highly- adaptable evaluation framework that ensures unbiased and comprehensive trust model assessments in SIoT environments. This platform bridges a critical gap in trust evaluation research, enabling the comparison and validation of trust models across diverse, realistic scenarios, thereby supporting the development of more resilient and trustworthy collaborative SIoT systems. • Definition of a realistic Social Internet of Things (SIoT) environment for trust evaluation. • Proposed a trust model evaluation platform that implements a realistic SIoT environment. • Proposed a Canberra Transportation Case Study as a concrete instance to evaluation trust models. • Comprehensive evaluation of trust models in the context of the Canberra Transportation Case Study.

With the rapidly increasing volume of cyber-attacks over the past years due to the new working-from-home paradigm, protecting hosts, networks, and individuals from cyber threats is in higher demand than ever. One promising solution are Provenance-based Intrusion Detection Systems (PIDS), which correlate host-based security logs to generate provenance graphs that describe the causal relationship between system entities. PIDS have shown significant potential in enhancing detection performance and reducing false alarms compared to traditional Intrusion Detection Systems (IDS). Rule-based approaches used in PIDS utilize expert-defined rule sets to identify known malicious patterns in provenance graphs. Although these rule-based techniques have been widely applied, they can only detect known attack patterns, are heavily dependent on the quality of the rules, and creating rules manually is time-consuming. To address these shortcomings, this study proposed two novel techniques: the Multi-level Attack Description Model (MADM) for describing attack patterns at multiple granularity levels and the Provenance-enabled Automated Rule Generation and Matching Framework (PARGMF) to generate rules deterministically and promptly. We evaluated the proposed approaches using the DARPA OpTC dataset, complemented by a practical case study. This case study involved a prototype extension for the CAPEv2 sandbox environment, demonstrating the real-world applicability of our approaches. Our results demonstrate, firstly, that PARGMF generates rules deterministically with an average processing time of only 13.11 s compared to multiple hours or even days for manual rule creation by security experts. Secondly, through generalization of attack descriptions, MADM enhanced the robustness of rules by 21.9% for Behavioural Attack Description (BAD) and 25% for Structural Attack Description (SAD) compared to approaches without generalization. Another added benefit compared to existing approaches is that PARGMF also generates differential graphs to support security experts’ timely validation of security alarms.

As the volume of scientific papers grows rapidly in size, knowledge management for scientific publications is greatly needed. Information extraction and knowledge fusion techniques have been proposed to obtain information from scholarly publications and build knowledge repositories. However, retrieving the knowledge of problem/solution from academic papers to support users on solving specific research problems is rarely seen in the state of the art. Therefore, to remedy this gap, a knowledge-driven solution support system (K3S) is proposed in this paper to extract the information of research problems and proposed solutions from academic papers, and integrate them into knowledge maps. With the bibliometric information of the papers, K3S is capable of providing recommended solutions for any extracted problems. The subject of intrusion detection is chosen for demonstration in which required information is extracted with high accuracy, a knowledge map is constructed properly, and solutions to address intrusion problems are recommended.

Building ontology for wireless network intrusion detection is an emerging method for the purpose of achieving high accuracy, comprehensive coverage, self-organization and flexibility for network security. In this paper, we leverage the power of Natural Language Processing (NLP) and Crowdsourcing for this purpose by constructing lightweight semi-automatic ontology learning framework which aims at developing a semantic-based solution-oriented intrusion detection knowledge map using documents from Scopus. Our proposed framework uses NLP as its automatic component and Crowdsourcing is applied for the semi part. The main intention of applying both NLP and Crowdsourcing is to develop a semi-automatic ontology learning method in which NLP is used to extract and connect useful concepts while in uncertain cases human power is leveraged for verification. This heuristic method shows a theoretical contribution in terms of lightweight and timesaving ontology learning model as well as practical value by providing solutions for detecting different types of intrusions.