Malware traffic classification is a critical task in network security and intrusion detection. Existing multimodal traffic classification approaches often combine packet content and flow-level behavioral statistics through direct late fusion, while overlooking the representational gap between discrete byte sequences and continuous temporal features. In this extended abstract, we present an Alignment-then-Fusion (AF) dual-tower framework for malware traffic classification. AF first aligns heterogeneous traffic modalities in a shared semantic space using an InfoNCE-style contrastive objective, and then performs deep feature interaction through bi-directional cross-attention. Preliminary evaluations on the USTC-TFC2016 dataset show that AF slightly outperforms payload-only, behavior-only, and late-fusion baselines under the same experimental setting, demonstrating the potential benefit of alignment-before-fusion for fine-grained benign and malware traffic family classification.

Due to the complexity of integrated circuit design and manufacturing process, an increasing number of third parties are outsourcing their untrusted Intellectual Property (IP) cores to pursue greater economic benefits, which may embed numerous security issues. The covert nature of hardware Trojans (HTs) poses a significant threat to cyberspace, and they may lead to catastrophic consequences for the national economy and personal privacy. To deal with HTs well, it is not enough to just detect whether they are included, like the existing studies. Same as malware, identifying the attack intentions of HTs, that is, analyzing the functions they implement, is of great scientific significance for the prevention and control of HTs. Based on the fined detection, for the first time, this paper proposes a two-stage Graph Neural Network model for HTs’ multifunctional classification, GNN4HT. In the first stage, GNN4HT localizes HTs, achieving a notable True Positive Rate (TPR) of 94.28 the Trust-Hub dataset and maintaining high performance on the TRTC-IC dataset. GNN4HT further transforms the localization results into HT Information Graphs (HTIGs), representing the functional interaction graphs of HTs. In the second stage, the dataset is augmented through logical equivalence for training and HT functionalities are classified based on the extracted HTIG from the first stage. For the multifunctional classification of HTs, the correct classification rate reached as high as 80.95% at gate-level and 62.96% at RTL. This paper marks a breakthrough in HT detection, and it is the first to address the multifunctional classification issue, holding significant practical importance and application prospects.

The centralized control plane characteristic of Software Defined Networking (SDN) makes it a prime target for Distributed Denial of Service (DDoS) attacks. A significant issue in network traffic data is the severe imbalance between background traffic and various types of DDoS attack traffic. To address this challenge, we propose a novel DDoS detection model based on single-class cluster oversampling and weighted ensemble method. Initially, we design a multi-strategy feature selection using variance inflation factor and recursive feature elimination. Next, we construct a single-class cluster model based on the spatial distribution of samples, and create minority class samples independently within each cluster. Finally, detection results are determined using the weight vector of each base classifier in ensemble learning. The proposed DDoS detection model's performance is validated through simulations of various DDoS attack scenarios in an SDN environment. Experimental results indicate that the proposed strategy exhibits superior performance, showing improvements in precision, recall, and F1 score compared to state-of-the-art techniques.