Existing community search methods heavily rely on labeled data or predefined structures, thus fail to capture obscure and dynamic community boundaries in open-world heterogeneous networks, leading to poor adaptability. They also ignore modeling behavioral patterns, resulting in poor search performance. To solve the above issues, this work formally defines the unsupervised behavior-driven community search problem for heterogeneous graphs and designs dual-view Contrastive Learning-based Unsupervised framework for Heterogeneous graph Community Search (CLUHCS). CLUHCS designs a relation view to encode local community cohesion and a meta-path view to capture global behavior semantics. By using PathSim averaging strategy to generate positive samples and self-supervised signals, we can completely eliminate label dependency. Then, contrastive training is leveraged to automatically learn community representations and solve the open community boundary ambiguity challenge. Furthermore, by capturing behavior patterns, the meta-path behavior modeling flexibly characterizes the formation mechanism of heterogeneous communities. Experiments on three datasets verify the effectiveness and efficiency of CLUHCS. CLUHCS significantly improves F1-score by 52.7% over the supervised baseline FCS-HGNN and by 41.5% over the unsupervised method TransZero.

Federated learning (FL) is widely used in Internet-of-Things (IoT) systems, but its distributed training process also exposes it to backdoor attacks. Existing studies mainly consider single-target or centralized multi-target settings, while coordinated distributed multi-target attacks remain underexplored. In practical IoT scenarios, one adversarial entity may control multiple distributed malicious clients and assign each client distinct triggers and target labels. Under this setting, existing distributed backdoor methods often fail to preserve the effectiveness of all backdoors because malicious updates conflict during aggregation. To address this issue, we propose a Distributed Multi-Target Backdoor Attack (DMBA) for FL. DMBA introduces a Backdoor Replay (BR) mechanism to reduce discrepancies among malicious gradients and a Channel-Frequency Composite Trigger (CFCT) strategy to improve trigger distinguishability and alleviate local interference. Experiments on multiple datasets show that DMBA ensures attack success rates above 80% for all implanted back-doors, whereas some baseline backdoors fall below 50% and may even approach 0.

Deep neural networks are vulnerable to adversarial examples which fool model predictions by adding imperceptible perturbations to natural examples. Adversarial training is effective in defending against adversarial attacks but faces a challenge with long-tailed data, where the over-compression of tail feature space undermines the reliability of defect classification models. To address this problem, we propose APRCB-AT, a novel adversarial training framework that integrates an adaptive perturbation radius and class-balanced loss. We find a positive correlation between the aggressiveness of adversarial examples and the perturbation radius within a certain range. Based on this, APRCB-AT assigns a larger perturbation radius in a certain range to the tail classes, while incorporating class-balanced loss with regularization to penalize the head classes. The experimental results show that APRCB-AT achieves 70.28% robust accuracy against adversarial attacks, surpassing existing methods, such as LSRG-DRW(67.22%) and REAT(68.06%).

Offline reinforcement learning (RL) heavily relies on the coverage of pre-collected data over the target policy’s distribution. Existing studies aim to improve data-policy coverage to mitigate distributional shifts, but overlook security risks from insufficient coverage, and the single-step analysis is not consistent with the multi-step decision-making nature of offline RL. To address this, we introduce the sequence-level concentrability coefficient to quantify coverage, and reveal its exponential amplification on the upper bound of estimation errors through theoretical analysis. Building on this, we propose the Collapsing Sequence-Level Data-Policy Coverage (CSDPC) poisoning attack. Considering the continuous nature of offline RL data, we convert state-action pairs into decision units, and extract representative decision patterns that capture multi-step behavior. We identify rare patterns likely to cause insufficient coverage, and poison them to reduce coverage and exacerbate distributional shifts. Experiments show that poisoning just 1% of the dataset can degrade agent performance by 90%. This finding provides new perspectives for analyzing and safeguarding the security of offline RL.

To analyze the massive social networks for providing personalized services, community search is widely studied to find the densely connected subgraph that can reflect the network properties for a given query. The existing community search methods adopt single community model to make structural constraints on communities, which can only describe single interaction mode. Since they fail to capture the semantics of the network with multiple interaction modes, they struggle to find the representative communities. To solve this issue, we design a novel community model called ( τ, ρ )-camp to flexibly capture complex network semantics in any level of granularity. We propose the unified support maximized community search problem to find the communities with the densest network semantics, which is proven a NP-hard problem. By constructing a hierarchical index structure, we propose an approximate community search algorithm with approximation ratio of 2 and linear time complexity of the query size. Extensive experiments are conducted on two public datasets and two crawled datasets. The experimental results prove the effectiveness and efficiency of our method.

With the deployment of the QUIC protocol, website fingerprinting attacks targeting QUIC traffic are becoming a growing concern. Since the deployment is incremental, attackers must continuously crawl the QUIC traffic of new QUIC-enabled websites to update their attack models. For the latency caused by data crawling and classifier training, existing few-shot website fingerprinting (FSWF) attacks rely on representation learning to mitigate data dependency. To further achieve zero-latency identification, TCP traffic can be applied to construct the attack model before QUIC deployment. However, the different protocol semantics of TCP and QUIC lead to differences in the latent features. As representation learning models cannot eliminate the website feature differences, classifiers trained on TCP-based features are difficult to adapt to QUIC traffic. To address the issue, we propose a novel cross-protocol FSWF attack method to fuse cross-protocol website features. The proposed method forces TCP features and QUIC features to be in the same feature space by sharing model parameters, and reduces cross-protocol website feature differences through inter-protocol adversarial representation learning. Meanwhile, it utilizes a non-linear classifier to fit the fused features. The proposed method enables zero-latency identification for QUIC traffic based on a few TCP traffic. We conducted comprehensive evaluation experiments on public datasets from both closed-world and open-world settings. The proposed method outperforms state-of-the-art methods in zero-latency identification.

Backdoors on federated learning will be diluted by subsequent benign updates. This is reflected in the significant reduction of attack success rate as iterations increase, ultimately failing. We use a new metric to quantify the degree of this weakened backdoor effect, called attack persistence. Given that research to improve this performance has not been widely noted, we propose a Full Combination Backdoor Attack (FCBA) method. It aggregates more combined trigger information for a more complete backdoor pattern in the global model. Trained backdoored global model is more resilient to benign updates, leading to a higher attack success rate on the test set. We test on three datasets and evaluate with two models across various settings. FCBA's persistence outperforms SOTA federated learning backdoor attacks. On GTSRB, post-attack 120 rounds, our attack success rate rose over 50% from baseline. The core code of our method is available at https://github.com/PhD-TaoLiu/FCBA.

In this study, we present synchronous bilingual Connectionist Temporal Classification (CTC), an innovative framework that leverages dual CTC to bridge the gaps of both modality and language in the speech translation (ST) task. Utilizing transcript and translation as concurrent objectives for CTC, our model bridges the gap between audio and text as well as between source and target languages. Building upon the recent advances in CTC application, we develop an enhanced variant, BiL-CTC+, that establishes new state-of-the-art performances on the MuST-C ST benchmarks under resource-constrained scenarios. Intriguingly, our method also yields significant improvements in speech recognition performance, revealing the effect of cross-lingual learning on transcription and demonstrating its broad applicability. The source code is available at https://github.com/xuchennlp/S2T.

Due to the cache’s capacity of forwarding information, Named Data Networking (NDN) has become a promising networking architecture. Since distributed caching is susceptible to cache pollution attacks (CPAs), researchers pay more attention to CPAs detection and defense. The current detection schemes seriously rely on an assumption that the content popularity remains stable over time. However, the change in interests of legitimate users in the network is unavoidable, which makes content popularity change dynamically. Thus, it is difficult to detect CPAs based on a static content popularity distribution. To address this issue, we propose a novel scheme to detect CPAs by analysing latency instead of popularity. The proposed scheme constructs the probability transfer matrix based on the Markov process of contents transfer and detects CPAs by the convergence states of the matrix. Once a CPA is detected, the affected router recognizes the attack type and adopts a specific defense method according to the attack type. This defense method can improve the network Quality of Service (QoS) by leveraging particular methods for different routers rather than the broadcasted global method. Extensive simulations in ndnSIM show that our scheme can effectively detect CPAs with higher detection ratio and defense CPAs with acceptable impacts on the overall network in network scenarios with dynamically changing content popularity.

The vulnerability of Named Data Network (NDN) causes a series of privacy problems. Path inference provides network privacy protection and network security improvement in NDN via obtaining the content transmission paths. The traditional path inference methods ignore the influence of in-network cache, leading to a lacking consideration of the confusion issue between content sources and cached copies. To facilitate the effectiveness and robustness of the path inference, we have proposed a novel method that reduces the influence of incomplete and misleading information. The proposed method consists of two parts. First, the hybrid attack method based on hop count variation is used for collecting complete request feedback information and merging all information to infer paths. Second, the benefit-driven evolutionary game is adopted to promote the cooperation of the timing attack and the cache pollution attack. The combination of the two types of attacks alleviates the restriction of in-network cache. The simulations in ndnSIM indicate that our proposed method infers paths with higher precision, recall, and F1-Score compared to other advanced methods.

In recent years, social media has become one of the most popular ways of news dissemination. There is a phenomenon that numerous fake news are spreading rampantly on public social media platforms, posing a serious threat to the credibility of social media. Moreover, more and more social media news posts carry multimodal contexts, i.e., utilize not only text but also abundant images to describe the news. However, existing methods only involve the first image along with text in multimodal fake news detection. It severely hampers the extraction of global image semantic information and consequently damages the effectiveness of multimodal fake news detection. To address this issue, we propose a Cross-Image Semantic Fusion based multi-modal fake news detection method (CISF for short). The method uses an adaptive attention diffusion module to model semantic correlations among different images, fully leveraging the contextual dependencies between different images to achieve semantic interaction and fusion among images. On the basis, a global image semantic representation is generated to represent the entire image modality. Finally, the fake news detection is performed based on the multimodal fusion of the text and the global image semantic representation. We conduct experiments on two real-world datasets and demonstrate the effectiveness of the proposed method.

Communities are prevalent in large graphs such as social networks, protein networks, etc. Community search aims to find a cohesive subgraph that contains the query nodes. Existing community search algorithms often adopt community models to find target communities, and k-truss model is a popularly used one that provides structural constraints. However, the structural constraints presented by k-truss is so tight that the searching algorithm often can not find the target communities. There always exist some subgraphs that may not conform to k-truss structure but do have cohesive characteristics to meet users' personalized requirements. Moreover, the k-truss based community search algorithms can not meet users' real-time demands on large graphs. To address the above problems, this paper proposes the relaxed k-truss community search problem for the first time. Then we construct a relaxed k-truss index, which can help to find cohesive communities in linear time and provide flexible searching for nested communities. We also design an index maintenance algorithm to dynamically update the index. Furthermore, a community search algorithm based on the relaxed k-truss index is presented. Extensive experimental results on real datasets prove the effectiveness and efficiency of our model and algorithms.

Summary This research introduces a comprehensive suite of neural network models designed to tackle the challenging task of rumor stance detection within the framework of simulating complex rumor propagation systems. Our objective centers on accurately modeling the intricate structures of rumor dialogues and propagation patterns to identify user stances—whether they are in support, denial, questioning, or commenting on rumors. Unlike conventional methods that rely on simplistic keyword targeting and fail in the nuanced context of social networks, our models delve into the complexities of dialogue and propagation structures, offering a more precise and insightful analysis of rumor dynamics. In addressing the simulation and modeling of complex systems, our approach specifically focuses on the elaborate interaction networks that underpin rumor spread and reception. While our methodology does not directly engage with brain‐like computing paradigms, it reflects a similar level of sophistication in handling layered and complex information flows, analogous to cognitive processes in understanding and interpreting human communications. Employing a hierarchical attention mechanism, our models adeptly parse through multitiered dialogue sequences, effectively distinguishing between various indicators of user stances. This allows for a nuanced and detailed representation of the rumor ecosystem, significantly enhancing the accuracy of stance detection. Through rigorous testing on diverse datasets, our approach has demonstrated superior performance over existing models, thereby establishing a new benchmark in the field.

Few-shot website fingerprinting (FSWF) attacks attempt to identify whether the users have access to specific websites based on a few training data. Existing FSWF attack methods focus on adapting to variable network conditions in real scenarios. They use various techniques to transfer the model to adapt to test data which has a different distribution from training data. However, recent methods ignore the impact of pre-training data diversity on adaptability. The poor data diversity caused by the user-specific data crawl limits representation ability, and further hinders rapid adaptation to new network conditions. Due to the extreme Non-IId between multiple attackers’ datasets, it is not feasible to mix multiple datasets or perform traditional federated learning methods to improve representation ability. To address the issue, we propose a novel method based on a joint learning framework to achieve the collusion FSWF attacks. The proposed method fuses the feature spaces of multiple user-side attackers to enhance the representation ability of the local model, and constructs a virtual fusion center to mitigate the impact of Non-IID. It improves the adaptability under variable network conditions for the local attacker. This paper conducts comprehensive experiments to evaluate the performance of the proposed method in both closed-world and open-world settings. Compared with the state-of-the-art method, the proposed method improves the accuracy by up to 13.02% in the closed-world setting and the AUC by up to 0.085 in the open-world setting, respectively.

Anchor link prediction enhances the effectiveness of digital forensics through the identification of multiple social network users. The current methods based on deep learning are characterized by both the exaggerated similarity between adjacent nodes in the same latent space and the variation in the feature spaces caused by semantics. A novel approach is developed to fuse the semantic features of different networks in this paper. The proposed method is divided into two stages. Firstly, representation learning pays more attention to the influence of uncertainty on the equivalence of node network structure, and introduces the difference between adjacent nodes from the latent space. Secondly, a joint representation learning framework trains and exchanges the parameters depending on known anchor links. The joint representation learning framework injects fused features into the representation learning processes of different networks. The combination of enhanced discrimination and cross-network feature fusion reduces the feature space differences caused by the semantics of different social networks. This paper conducts comprehensive experiments on social networks in the real world. The outcome shows that the proposed approach is more efficient and robust compared to the existing state-of-theart methods.

As a promising technology, intelligent reflecting surface (IRS) enables future communications and networks to realize programmable data transmissions. Due to the untrustworthiness of the communication environment and the selfishness of wireless devices, secure and intelligent IRS resource management is still an open issue. In this paper, we aim to implement IRS resource scheduling with properties of security, intelligence, efficiency, and fairness. To realize the above goals, we propose the blockchain and multi-agent learning empowered incentive scheduling system for tamper-proof and undeniable IRS resource management. To overcome the low throughout and intensive computation issues of blockchain, we devise a hybrid framework combining traditional Satoshi-style and directed acyclic graph blockchain for IRS resource scheduling. Due to the storage limitation of wireless devices, an intelligent blockchain storage reduction mechanism is proposed, where a multi-dimensional multi-hierarchy feature-based scheme is designed to determine block storage priority. Based on this storage priority and device states, the selection of storage-reduction devices is formulated as a cooperative multi-agent decision problem. Then, a multi-agent deep reinforcement learning-driven scheme is proposed to determine reduction strategies. To facilitate IRS providers/subscribers participating in the proposed system and maintain the efficiency of resource scheduling, an auction-based incentive mechanism is devised. In this mechanism, we propose the IRS resource allocation scheme and the payment scheme to achieve economic robustness and high efficiency. Finally, security analysis and experiment analysis indicate the feasibility and effectiveness of the proposed IRS resource scheduling in intelligent reconfigurable networks.

Anchor link prediction exacerbates the risk of privacy leakage via the de-anonymization in edge computing. The predictive effect of traditional unsupervised learning methods is too dependent on user attributes and supervised learning methods are sensitive to network structure noise. Anchor link prediction methods based on graph embedding are restricted by the sparsity of the observable anchor links which can be used for training. To facilitate the effectiveness and robustness of the anchor link prediction, we have proposed a novel method which reduces the restrictions on the observable anchor links used for training. The proposed method consists of two phases. First, graph embedding based on network structural roles is used to generate the latent feature space, reconciling the distinction and similarity between nodes. Second, the supervised learning for optimizing the Wasserstein distance which estimates the minimum amount of work to change one distribution into the other. The combination of the reconciled latent feature space and the estimate for the amount of change alleviates the restriction on observable overlapping parts. Extensive experiments on real-life social networks have demonstrated that the proposed method significantly outperforms the state-of-the-art methods in terms of both precision and robustness.

Prompting collaboration is a promising choice to enhance the performance of Vehicle Trajectory Prediction (VTP) in the Internet-of-Vehicles (IoV). This paper designs an edge-assisted collaborative VTP framework that employs Roadside Units (RSU) to associate vehicles and encourages RSUs to collaborate to realize VTP. A novel decentralized machine learning method, called Hierarchical Swarm Learning (HierSL), is proposed to improve efficiency and security in the collaborative learning process. HierSL is particularly suited for large-scale edge-assisted IoV systems with its two-layer hierarchical learning framework. HierSL allows nearby RSUs to form local organizations and performs lower-layer learning (local level) for knowledge integration within each organization. Over local organizations, an upper layer is constructed to integrate the knowledge of local organizations, thereby generating well-performed global models. Compared to vanilla Swarm Learning (SL), HierSL not only reduces the reliance on global communications but also cuts the cost of blockchain for collaborative VTP. Experiments are conducted on a real-world NGSIM US-101 data set, and the results show that the proposed method outperforms vanilla SL and is comparable to centralized learning.

In-network content caching is a fundamental functionality in Information Centric Network (ICN), which facilitates content distribution with reduced bandwidth consumption, lower network congestion, and faster content retrieval. However, traditional heuristic caching strategies often fail to handle dynamic ICN environments, and most leaning-based strategies cannot realize secured content caching for distributed ICN. In observation of these challenges, this paper investigates collaborative content caching in ICN, and proposes a novel algorithm, called Swarm Reinforcement Learning (SRL), for designing a secured caching mechanism in distributed ICN caching platform. SRL inherits salients features from both Swarm Learning (SL) and Deep Reinforcement Learning (DRL): it enables a fully decentralized learning process and strictly guarantees the privacy and security of data and models during collaborative caching by leveraging the blockchain technique; SRL also lets local ICN router interact with the local environment and integrate the learned knowledge with other ICN routers for constructing a collaborative caching strategy that maximizes the long-term reward of the entire ICN caching platform. We carry out systematic experiments to evaluate the performance of the proposed method. The results show that SRL-based collaborative caching outperforms state-of-the-art caching strategies in terms of cache hit rate and content retrieval delay, and also improves the stability of the ICN caching platform.

Federated learning is designed to train models in a distributed scheme while keeping the clients' data stored locally. The aggregation server only receives local models from clients and does not require clients to upload their local data, in which way it protects the clients' privacy. However, federated learning is vulnerable. The federated learning models are sensitive to poisoning attacks. Existing data poisoning attack methods assume that the attacker and the client have the same data distribution and data volume, which is unpractical. In this paper, we first propose a privacy inference-based poisoning data generation method, FLPDG. FLPDG changes the relationship between data and labels, and uses the data of benign clients to launch poisoning attacks. This method relies on the global model of an iterative update to obtain the data and labels of benign clients. Second, a privacy inference-based data poisoning attack model Poi_PDG is proposed. This model uses the FLPDG method to launch a data poisoning attack under conditions of insufficient original data volume of the attacker. Meanwhile, a defense method PDG_DF is proposed for Poi_PDG. It splits the image data into variance regions and utilizes GANs to hide the visual features of each image region. It controls the degree of feature hiding by setting different thresholds to keep the classification features of the image while ensuring the accuracy of the training model. Finally, several experiments are conducted to evaluate the proposed attack and defense methods, and the experimental results indicate the effectiveness of the methods.

Today, with more and more devices in the industrial control system (ICS), the risk becomes higher and brings more attack surfaces. The need for reliable anomaly detection systems is increasing. Traditional SCADA-based detection systems deployed are difficult to assess large-scale control systems accurately, and novel AI-based technologies struggle to ensure timely response. In this paper, we propose an edge computing assisted delay-aware anomaly detection (ECADA) scheme for ICS, which considers both the accuracy and timeliness, and ensures that abnormal conditions can be accurately detected and handled in a short time. First, we model the components in ICS as three layers, taking network resources, delay, and reliability into consideration. Second, we convert the anomaly detection procedure into a decision making problem. By dividing the warning capabilities into various levels, the flexibility of the anomaly detection system is enhanced. Third, we cast a mixed-integer linear programming (MILP) problem to find the efficient anomaly detection mechanism, so that it can be dynamically scheduled to achieve the tradeoff between reliability and timeliness. We use an real-world industrial system dataset for experimental evaluation. By comparing with various traditional anomaly detection methods, it is proved that ECADA can always ensure reliable response of anomaly detection system in various network environments.

Facing the explosive growth of data, the introduction of cloud computing in the Space-Air-Ground Integrated Internet of Things (SAGIIoT) can solve the problem of limited computing power of the terminals. At the same time, data security on the cloud is also a focus that cannot be ignored. Secure outsourcing computing is helpful in improving privacy preserving. Due to the wide applicability of$K $-means clustering, outsourcing computing for$K $-means has become a major research hotspot in industry and academia. Most of the existing work on outsourcing$K $-means clustering is based on homomorphic encryption, which has a high computational overhead due to the mathematical puzzles’ nature of homomorphic encryption. In addition, the high computational overhead of designing a verification algorithm based on homomorphic encryption is unacceptable. To address the above issues, we design a${K}$-means clustering outsourcing algorithm by sparse matrix transformation, which can verify the deceptive behavior of cloud while achieving high efficiency. In this article, we theoretically prove the accuracy, security, efficiency, and verifiability of the proposed algorithm. Extensive experiments indicate that our algorithm is efficient.

Cloud and edge computing are gradually used to achieve complex energy operation control and massive information processing in conventional power grid. Meanwhile, with the tremendous number of distributed energy resources and power equipment integrated into the smart grid enabled by cloud and edge computing, the centralized distribution network cannot realize the flexible and realtime energy supply due to the unpredictable and wide distribution of distributed energy resources, which will further deteriorate the stability of smart grid. To solve those problems, this article proposes energy centric smart grid to achieve power dispatching with the help of cloud-edge computing. Our solution uses energy caching and energy multiple addressing of the edge router to eliminate the intermittency of renewables and speed up energy response. For the stability of energy market and to encourage users to participate in power dispatching, a cloud-edge computing-driven energy cache orchestration mechanism is designed. The empirical results show that the response time is greatly reduced to meet the stringent quality of service requirement in smart grid integrated with distributed energy resources.

Anchor link prediction exacerbates the risk of privacy leakage via the de-anonymization of social network data. Embedding-based methods for anchor link prediction are limited by the excessive similarity of the associated nodes in a latent feature space and the variation between latent feature spaces caused by the semantics of different networks. In this article, we propose a novel method which reduces the impact of semantic discrepancies between different networks in the latent feature space. The proposed method consists of two phases. First, graph embedding focuses on the network structural roles of nodes and increases the distinction between the associated nodes in the embedding space. Second, a federated adversarial learning framework which performs graph embedding on each social network and an adversarial learning model on the server according to the observable anchor links is used to associate independent graph embedding approaches on different social networks. The combination of distinction enhancement and the association of graph embedding approaches alleviates variance between the latent feature spaces caused by the semantics of different social networks. Extensive experiments on real social networks demonstrate that the proposed method significantly outperforms the state-of-the-art methods in terms of both precision and robustness.

Software-defined industrial Internet of things (SD-IIoT) exploits federated learning to process the sensitive data at edges, while adaptive poisoning attacks threat the security of SD-IIoT. To address this problem, this article proposes a multi-tentacle federated learning (MTFL) framework, which is essential to guarantee the trustness of training data in SD-IIoT. In MTFL, participants with similar learning tasks are assigned to the same tentacle group. To identify adaptive poisoning attacks, a tentacle distribution-based efficient poisoning attack detection (TD-EPAD) algorithm is presented. And also, to minimize the impact of adaptive poisoning data, a stochastic tentacle data exchanging (STDE) protocol is also proposed. Simultaneously, to protect the tentacle’s privacy in STDE, all exchanged data will be processed by differential privacy technology. A MTFL prototype system is implemented, which provides extensive ablation experiments and comparison experiments, demonstrating that the accuracy of the global model under attack scenario can be improved with 40%.

Anchor link prediction across social networks plays an important role in multiple social network analysis. Traditional methods rely heavily on user privacy information or high-quality network topology information. These methods are not suitable for multiple social networks analysis in real-life. Deep learning methods based on graph embedding are restricted by the impact of the active privacy protection policy of users on the graph structure. In this paper, we propose a novel method which neutralizes the impact of users’ evasion strategies. First, graph embedding with conditional estimation analysis is used to obtain a robust embedding vector space. Secondly, cross-network features space for supervised learning is constructed via the constraints of cross-network feature collisions. The combination of robustness enhancement and cross-network feature collisions constraints eliminate the impact of evasion strategies. Extensive experiments on large-scale real-life social networks demonstrate that the proposed method significantly outperforms the state-of-the-art methods in terms of precision, adaptability, and robustness for the scenarios with evasion strategies.

Traffic forecasting is essential in improving and maintaining safety and orderliness in intelligent transportation systems (ITS). As a deep learning approach, graph neural networks (GNN) based spatial-temporal association mining methods are promising in traffic forecasting. However, current GNN-based methods usually require a high number of training data, and when the sample volume is small, the performance of the model drops dramatically. The existing transfer methods can solve this problem by leveraging knowledge from other data-rich areas, but the domain adaption method with access to source data still faces the non-neglectable problem of private information leakage in the source area. A solution that can solve cross-area transfer without access to source data is still missing. In this paper, to fill the gap, we propose a Transferable Federated Inductive Spatial-Temporal Graph Neural Network (T-ISTGNN) framework to transfer spatial-temporal dependency information in cross-area data to accomplish traffic state forecasting. First, we introduce a multi-source model aggregation scheme based on federated learning to retain the traffic information of the source areas. Second, we propose a transfer method between source and target areas based on hypothesis transfer learning to achieve domain adaption under source domain data protection. Third, we propose a GNN-based method called Inductive Spatial-Temporal Graph Neural Network (ISTGNN) for traffic forecasting. Experiments on real-world datasets demonstrate that T-ISTGNN is capable of cross-area traffic state forecasting under the restriction of preserving the privacy of source areas.

The emergence of Digital Twin Edge Networks (DTENs) achieves the mapping of real physical entities to digital models of cyberspace. By offloading real-time mobile data to Mobile Edge Computing (MEC) servers for processing and modeling, communication-efficient Digital Twin (DT) services could be achieved. However, the spatio-temporal dynamic DT service demand stochastically generated by mobile users easily causes service congestion, which challenges the long-term DT service stability. Meanwhile, current DT services still lack long-term effective incentive designs for participants. To solve these issues, we design an incentive-based congestion control scheme for stochastic demand response in DTENs. First, we adopt the Lyapunov optimization theory to decompose the long-term congestion control decision into a sequence of online edge association decisions, with no need for future system information. We then present a contract-based incentive design to optimize the long-term profit of the DT service provider, comprehensively considering the delay sensitivity, incentive compatibility, and individual rationality. Finally, experimental simulations are carried out to verify the superiority of the proposed scheme with the base station dataset of Shanghai Telecom. Theoretical and simulation analysis demonstrates that compared with benchmarks, our scheme could effectively avoid long-term service congestion with an arbitrarily near-optimal profit.

The traffic anomaly analysis in IoT-based intelligent transportation system (ITS) is crucial to improving public transportation safety and efficiency. The issue is also challenging due to the unbalanced distribution of anomaly data in IoT-based ITS, which may cause overfitting or underfitting in the training phase. However, some research on traffic anomaly analysis injected limited data to address the shortage of anomaly samples or even neglects this issue, which overlooks the potential representation of nodes in graph neural networks. In this paper, we propose an improved contrastive GNN-based learning framework for traffic anomaly analysis that alleviates the problem of imbalanced datasets in the training phase. In this framework, we provide a graph augmentation approach with coupled features to learn different views of graph data. Besides, we design an effective training method based on the contrastive loss for our framework, which can learn the better performance of latent representations utilized in the downstream tasks. Finally, we conduct extensive experiments to evaluate the performance of our proposed frame-works based on real-world datasets. We demonstrate that our framework achieves as high as 6.45% precision improvement compared to the state-of-the-art.

Blockchain-based federated learning, also being named as swarm learning, is perceived to have great potential to support decentralized and privacy-enhancing big data processing. However, numerous serious vulnerabilities found on blockchain and federated learning enforce us to concern about the security of swarm learning. Some seemingly-unrelated combinations of known vulnerabilities may derive highly-converted and unknown threats to swarm learning. In this paper, we first investigate the security threats of the swarm learning framework. And then, leveraging backdoor attacks and eclipse attacks, a novel hybrid vulnerability that can furtively propagate backdoors among swarm learning nodes is identified. To speed up the backdoor propagation and reduce attack costs, a sample-specific eclipse (SSE) strategy that can select the swarm network node with a high data contribution rate as the attack object is also proposed. Finally, by adjusting the trigger size, the data distribution rate, and the poisoning ratio, we conduct various comparison experiments to validate the feasibility of the proposed methods. To the best of our knowledge, this is the first article to study the epidemicity of backdoors in swarm learning.

The existing Underwater Internet of Things (UIoT) is based on the IP architecture, which is not conducive to the efficient storage and distribution of huge amounts of content generated in underwater. Actively pushing all content to users causes much unnecessary resource consumption in the UIoT. The information-centric networking (ICN) architecture opens new horizons up for these challenges. However, the slowness of underwater propagation speed makes traditional ICN not suitable for UIoT, especially considering about delay time. In this article, we propose an information-centric wireless sensor networking scheme with water-depth-aware content caching (ICWSN-WDA) to solve the above challenges. First, we design a naming scheme and a hybrid communication mode suitable for ICWSN-WDA. The communication mode in underwater we design is divided into push and pull traffic, which balances energy consumption and delay time. Second, we define a push level to decide which water depth the content actively pushes to, finding a suitable junction point of two modes. Third, as the water depth is deeper, it becomes more difficult to replace the sensor battery. To save energy consumption of deep-water sensors, the water-depth-aware caching mechanism is proposed based on water depth, popularity, and senor energy. Our extensive evaluation confirms the effectiveness of our proposed scheme, and it balances energy consumption constraints and latency.

Recently, edge artificial intelligence techniques (e.g., federated edge learning) are emerged to unleash the potential of big data from Internet of Things (IoT). By learning knowledge on local devices, data privacy preserving and Quality of Service (QoS) are guaranteed. Nevertheless, the dilemma between the limited on-device battery capacities and the high energy demands in learning is not resolved. When the on-device battery is exhausted, the edge learning process will have to be interrupted. In this article, we propose a novel wirelessly powered edge intelligence (WPEG) framework, which aims to achieve a stable, robust, and sustainable edge intelligence by energy harvesting (EH) methods. First, we build a permissioned edge blockchain to secure the peer-to-peer (P2P) energy and knowledge sharing in our framework. To maximize edge intelligence efficiency, we then investigate the wirelessly powered multiagent edge learning model and design the optimal edge learning strategy. Moreover, by constructing a two-stage Stackelberg game, the underlying energy-knowledge trading incentive mechanisms are also proposed with the optimal economic incentives and power transmission strategies. Finally, simulation results show that our incentive strategies could optimize the utilities of both parties compared with classic schemes, and our optimal learning design could realize the optimal learning efficiency.

In the era of the sixth generation (6G), the deployment of massive Internet of Things (IoT) generates and processes large amounts of data, resulting in high energy demand and huge challenges to the energy-limited IoT devices. To achieve green and sustainable communication, energy harvesting is a feasible technology to prolong the lifetime of IoT. However, the existing energy harvesting architecture cannot guarantee the privacy of energy users while improving the intelligence and effectiveness of energy transmission. To solve these issues, we propose a differential privacy and intelligent reflecting surface empowered privacy-preserving energy harvesting framework for 6G-enabled IoT. First, a secure and intelligent energy harvesting framework is designed, which includes an intelligent reflecting surface-aided radio frequency power transmission mechanism and a differential privacy-based energy harvesting mechanism. Second, an exponential mechanism-based privacy-preserving energy harvesting scheme is established, where we analyze the adversary mode, propose the differential privacy-enabled location-preserving algorithm, and provide security analysis and proof. Third, we quantify the user satisfaction for energy harvesting and propose a deep reinforcement learning empowered resource allocation scheme to maximize the weighted satisfaction of all system users. Finally, simulation results show the effectiveness of the proposed secure and intelligent energy harvesting architecture for 6G IoT.

Recently, the Internet of Medical Things (IoMT) could offload healthcare services to 5G edge computing for low latency. However, some existing works assumed altruistic patients will sacrifice quality of service for the global optimum. For priority-aware and deadline-sensitive healthcare, this sufficient and simplified assumption will undermine the engagement enthusiasm, i.e., unfairness. To address this issue, we propose a long-term proportional fairness-driven 5G edge healthcare, i.e., FairHealth. First, we establish a long-term Nash bargaining game to model the service offloading, considering the stochastic demand and dynamic environment. We then design a Lyapunov-based proportional-fairness resource scheduling algorithm, which decouples the long-term fairness problem into single-slot subproblems, realizing a tradeoff between service stability and fairness. Moreover, we propose a block-coordinate descent method to iteratively solve nonconvex fair subproblems. Simulation results show that our scheme can improve 74.44% of the fairness index (i.e., Nash product), compared with the classic global time-optimal scheme.

Energy harvesting (EH) is a promising and critical technology to mitigate the dilemma between the limited battery capacity and the increasing energy consumption in the Internet of everything. However, the current EH system suffers from energy-information cross threats, facing the overlapping vulnerability of energy deprivation and private information leakage. Although some existing works touch on the security of energy and information in EH, they treat these two issues independently, without collaborative and intelligent protection cross the energy side and information side. To address the aforementioned challenge, this article proposes a joint protection framework of energy security and information privacy for EH with an incentive federated learning approach. First, we design a federated-learning-based malicious energy user detection method according to energy status and behaviors to provide energy security protection. Second, a differential-privacy-empowered information preservation scheme is devised, where sensitive information is perturbed and protected by the customized demand-based noise. Third, a noncooperative-game-enabled incentive mechanism is established to encourage EH nodes to participate in the joint energy-information protection system. The proposed incentive mechanism derives the optimal energy-information security strategy for EH nodes and achieve a tradeoff between the protection of energy security and information privacy. Evaluation results have verified the effectiveness of our proposed joint protection mechanism.

Digital Twin (DT) has become the key technology in the Intelligent Transportation Systems (ITS) in smart cities to keep the health and reliability of various DT requesters, such as private vehicles, public transportation, energy systems, etc. The combination of DT and ITS can further release the potential of participants in smart cities and guarantee their efficiency and reliability. Despite the advantages of DT-enabled ITS, not all requesters need the same level of DT service due to the highly dynamic nature of ITS. Safe and reliable matching between DT and ITS still needs to be resolved. To address these issues, we propose the blockchain-enabled Digital Twin as a Service (DTaaS) for ITS. First, we propose an on-demand DTaaS architecture to fully utilize the sensing capabilities of ITS and the macro perspective of DT. Second, a double-auction model and a price adjustment algorithm are proposed to realize the optimal DT matching for ITS requesters and ensure the benefits of participants. Third, a permissioned blockchain and a novel DT-DPoS consensus mechanism are established to enhance the security and efficiency of DTaaS. Simulation shows that the proposed DTaaS and double-auction can efficiently stimulate and facilitate DT transactions. The proposed DT-DPoS also has obvious advantages.

There is a new cache pollution attack in the information-centric network (ICN), which fills the router cache by sending a large number of requests for nonpopular content. This attack will severely reduce the router cache hit rate. Therefore, the detection of cache pollution attacks is also an urgent problem in the current information center network. In the existing research on the problem of cache pollution detection, most of the methods of manually setting the threshold are used for cache pollution detection. The accuracy of the detection result depends on the threshold setting, and the adaptability to different network environments is weak. In order to improve the accuracy of cache pollution detection and adaptability to different network environments, this paper proposes a detection algorithm based on gradient boost decision tree (GBDT), which can obtain cache pollution detection through model learning. Method. In feature selection, the algorithm uses two features based on node status and path information as model input, which improves the accuracy of the method. This paper proves the improvement of the detection accuracy of this method through comparative experiments.

As an innovative strategy, edge computing has been considered a viable option to address the limitations of cloud computing in supporting the Internet-of-Things applications. However, due to the instability of the network and the increase of the attack surfaces, the security in edge-assisted IoT needs to be better guaranteed. In this paper, we propose an intelligent intrusion detection mechanism, FedACNN, which completes the intrusion detection task by assisting the deep learning model CNN through the federated learning mechanism. In order to alleviate the communication delay limit of federal learning, we innovatively integrate the attention mechanism, and the FedACNN can achieve ideal accuracy with a 50% reduction of communication rounds.

Online social networks provide convenient conditions for the spread of rumors, and false rumors bring great harm to social life. Rumor dissemination is a process, and effective identification of rumors in the early stage of their appearance will reduce the negative impact of false rumors. This paper proposes a novel early rumor detection (ERD) model based on reinforcement learning. In the rumor detection part, a dual-engine rumor detection model based on deep learning is proposed to realize the differential feature extraction of original tweets and their replies. A double self-attention (DSA) mechanism is proposed, which can eliminate data redundancy in sentences and words at the same time. In the reinforcement learning part, an ERD model based on Deep Recurrent Q-Learning Network (DRQN) is proposed, which uses LSTM to learn the state sequence features, and the optimization strategy of the reward function is to take into account the timeliness and accuracy of rumor detection. Experiments show that, compared with existing methods, the ERD model proposed in this paper has a greater improvement in the timeliness and detection rate of rumor detection.

The rapid development in network technology has resulted in the proliferation of Internet of Things (IoT). This trend has led to a widespread utilization of decentralized data and distributed computing power. While machine learning can benefit from the massive amount of IoT data, privacy concerns and communication costs have caused data silos. Although the adoption of blockchain and federated learning technologies addresses the security issues related to collusion attacks and privacy leakage in data sharing, the “free-rider attacks” and “model poisoning attacks” in the federated learning process require auditing of the training models one by one. However, that increases the communication cost of the entire training process. Hence, to address the problem of increased communication cost due to node security verification in the blockchain-based federated learning process, we propose a communication cost optimization method based on security evaluation. By studying the verification mechanism for useless or malicious nodes, we also introduce a double-layer aggregation model into the federated learning process by combining the competing voting verification methods and aggregation algorithms. The experimental comparisons verify that the proposed model effectively reduces the communication cost of the node security verification in the blockchain-based federated learning process.

A prominent security threat to unmanned aerial vehicle (UAV) is to capture it by GPS spoofing, in which the attacker manipulates the GPS signal of the UAV to capture it. This paper introduces an anti‐spoofing model to mitigate the impact of GPS spoofing attack on UAV mission security. In this model, linear regression (LR) is used to predict and model the optimal route of UAV to its destination. On this basis, a countermeasure mechanism is proposed to reduce the impact of GPS spoofing attack. Confrontation is based on the progressive detection mechanism of the model. In order to better ensure the flight security of UAV, the model provides more than one detection scheme for spoofing signal to improve the sensitivity of UAV to deception signal detection. For better proving the proposed LR anti‐spoofing model, a dynamic Stackelberg game is formulated to simulate the interaction between GPS spoofer and UAV. In particular, for GPS spoofer, it is worth mentioning that for the scenario that the UAV is cheated by GPS spoofing signal in the mission environment of the designated route is simulated in the experiment. In particular, UAV with the LR anti‐spoofing model, as the leader in this game, dynamically adjusts its response strategy according to the deception’s attack strategy when upon detection of GPS spoofer’s attack. The simulation results show that the method can effectively enhance the ability of UAV to resist GPS spoofing without increasing the hardware cost of the UAV and is easy to implement. Furthermore, we also try to use long short‐term memory (LSTM) network in the trajectory prediction module of the model. The experimental results show that the LR anti‐spoofing model proposed is far better than that of LSTM in terms of prediction accuracy.

Fatigue driving is one of main causes of traffic accidents. To avoid such traffic accidents, divers' fatigue detection has been used in Intelligent Internet of Vehicles (IIoV). IIoV usually dynamically allocate computing resources according to drivers' fatigue degree to improve the real-time of fatigue detection model. However, the traditional fatigue detection model may have bias on certain groups, which would further cause unfair resource allocation. To solve the problem, this paper proposes an improved IIoV framework, named Fair-Intelligent Internet of Vehicles (FIIoV). Compared with IIoV, we improve two layers in FIIoV, i.e., the detection layer and the normalization layer. The detection layer uses Convolutional Neural Network (CNN) to detect drivers' fatigue degree, and then uses adversarial network to achieve fairness of detection models. The normalization layer achieves the distribution of different sensitive feature values from historical detection results generated in the detection layer, and then uses the distribution to normalize the output of the detection layer to improve the fairness and accuracy of fatigue detection models. Simulation results show that both accuracy and fairness of FIIoV is improved compared with the original IIoV.

In social networks, some private information, such as the personal name, age gender, the number of friends, can be obtained by others. This paper defines a combination degree-neighborhood label matching attack model based on group maps obtained from multi-social networks. Based on the heuristic combination degree attack model, the target combination degree and neighborhood labels are used as the background knowledge of the attacker to obtain the candidate vertices set. The singularity of the sensitive label matching results will expose the sensitive information of the vertex being attacked. In order to solve this privacy attack, this paper proposes a group graph sensitive label generalization L diversity algorithm. This algorithm reduces the probability of sensitive labels being identified by designing a group map sensitive label generalization tree. According to the background knowledge, the number of sensitive labels in the candidate set and the number of sensitive labels obtained by matching are not less than L, so as to protect the sensitive information of the attacked target. The algorithm was evaluated by using three sets of data with different ratios. The experiment results show that the privacy protection algorithm effectively prevents sensitive label privacy attacks consisting of combination degree-domain label matching and better maintains the availability of graph data.

Standardization facilitates the management of Internet of Things (IoT) and expedites the generation of IoT big data. However, there is not yet a big data management architecture matching such IoT. Current methodologies, which mainly adopts Simple Network Management Protocol (SNMP), is defective in the following two aspects. First, facing ubiquitous sensor and actuator nodes, timeliness and scalability can hardly be assured by the centralized paradigm. Second, existing management infrastructure cannot perform data analysis and is thus not smart enough, which wastes the value of big data. To address these issues, we propose a big data management architecture for standardized IoT. First, we design a scalable and smart SNMP, which has a hierarchical and decentralized paradigm, and is embedded with edge MapReduce to perform distributed big data analysis. Second, we put forward an Edge MapReduce-based Random Matrix Model (RMM) algorithm for anomaly detection in IoT, which is parallelized and particularly suitable for high-dimensional big data. Third, we conduct a case study of smart grids, where the architecture is implemented using virtual machines and deployed to detect malfunctions in electrical grids. Experiment results demonstrate that the architecture has good performance in terms of timeliness and scalability.

Intelligent embedded-enable smart manufacturing is an important infrastructure for future industries. Increasing security threats are disturbing the normal operations of smart manufacturing. As a novel type of threat, an advanced persistent threat (APT) has the novel features of strong concealment, latency, and long-term entanglement, which can penetrate the core systems of smart manufacturing, especially for intelligent embedded systems, and cause great destruction from the cyber side to physical side. However, the existing security schemes cannot provide sustainable resource management, which causes the core system in smart manufacturing not to perform sustainable secure detection and defense against APTs. To address this challenge, this paper proposes a sustainable secure management mechanism for smart manufacturing against APTs. The proposed mechanism includes two parts: sustainable threat intelligence analysis and sustainable secure resource management. Sustainable threat intelligence analysis provides sustainable discovery of the indications of potential APTs, which has features of a weak signal, low correlation, and slow time variation. The sustainable secure resource management provides deep and continuous protection for intelligent embedded systems in smart manufacturing. The evaluations show the defense capabilities and the feasibility of the proposed mechanism.

Due to the shortage and unbalance of medical resources, it is difficult for patients in the countryside to get high-quality and timely medical services from the central medical facility. Existing researches of fog e-health has the potential of providing real-time medical services for the countryside with body sensor networks (BSN), but there are two limitations. On one hand, because of the medical services requiring not only low-latency but also high-quality, constructing an AI e-health service on resource-constrained fog with edge AI is necessary but unsolved. On the other hand, because of the regional differences in disease risk, there is a lack of an effective mechanism to provide a customized fog AI e-health service for patients in different regions. To address these issues, a smart customized e-health (SCEH) framework is proposed in this paper to provide edge-intelligent and customized medical services for the countryside. Firstly, semantics-based lightweight and meticulous load management mechanism is designed to reduce data load and involve medical semantic. Secondly, model-ensemble based fog AI collaborative analysis mechanism is proposed for load balance and knowledge integration. Thirdly, an attention-weight based customized fog AI e-health generation mechanism is devised for regional medical model reconstruction. The simulation results demonstrate the effectiveness of SCEH which ensures both the accuracy and low latency of fog e-health with limited resource.

Software-defined networking (SDN) allows the smart grid to be centrally controlled and managed by decoupling the control plane from the data plane, but it also expands attack surface for attackers. Existing studies about the security of SDN-enabled smart grid (SDSG) mainly focused on static methods such as access control and identity authentication, which is vulnerable to attackers that carefully probe the system. As the attacks become more variable and complex, there is an urgent need for dynamic defense methods. In this paper, we propose a security function virtualization (SFV) based moving target defense of SDSG which makes the attack surface constantly changing. First, we design a dynamic defense mechanism by migrating virtual security function (VSF) instances as the traffic state changes. The centralized SDN controller is re-designed for global status monitoring and migration management. Moreover, we formalize the VSF instances migration problem as an integer nonlinear programming problem with multiple constraints and design a pre-migration algorithm to prevent VSF instances' resources from being exhausted. Simulation results indicate the feasibility of the proposed scheme.

In this issue, we consider the location-aware targeted influence blocking maximization (LTIBM) problem, which plays a very important role in viral marketing and rumor control. LTIBM aims to find a set of positive seeds in a given social network to block the influence propagation of negative seeds over the targeted nodes located in a given region and having a preference on a given topic set as much as possible. We devise a simulation-based greedy algorithm based on monotone and submodular characteristics of influence function under the homogeneous independent cascade model. To improve the efficiency of the greedy algorithm, we propose LTIBM-H, a heuristic algorithm based on QT-tree and maximum influence arborescence (MIA). Experimental results show that the proposed LTIBM-H algorithm can achieve matching the blocking effect to the greedy algorithm and often performs better in terms of effectiveness than other baseline algorithms, while LTIBM-H is four orders of magnitude faster than the greedy algorithm.

Mobile Edge Computing (MEC) is a novel platform to bring computation resources close to local users in vicinity constrained, obtaining the nickname of Cloudlet on the edge of the network. However, due to users' behaviors, computation resources demands show spatial and temporal dynamics among different Cloudlets, which is hardly to achieve on-demand computation workload balance management. While vehicles, unique for their mobility and powerful on- board equipments, could act as computation resources transporters breaking geographically restriction, which have potential to balance computation demands in the city. To address the issue above, in this paper, we design a novel computation demand response management (DRM) mechanism called Vehicle-to-Cloudlet (V2C), considering the mobility of vehicles, computation states of vehicles, and computation demands of Cloudlets. There exists two phases in V2C mechanism: cognitive phase and game phase, respectively. In cognitive phase, which Cloudlets are computation-scarce and which vehicles are potential computation resources can be cognized. Then, in game phase, to simulate computation resources trading process among Cloudlet service provider and individual vehicles, we formulate a price-based two-stage Stackelberg game, jointly maximizing the utility of the Cloudlet and the individual utility of each vehicles. We prove that unique Nash Equilibrium (NE) and Stackelberg Equilibrium (SE) exist in this game and propose a gradient iterative algorithm to obtain the optimal solution. Finally, numerical simulations show that our solution has good scalability and also encourages vehicles to trade their own computation resources to the Cloudlet.

Nowadays, benefit from more powerful edge computing devices and edge artificial intelligence (edge-AI) could be introduced into Internet of Things (IoT) to find the knowledge derived from massive sensory data, such as cyber results or models of classification, and detection and prediction from physical environments. Heterogeneous edge-AI devices in IoT will generate isolated and distributed knowledge slices, thus knowledge collaboration and exchange are required to complete complex tasks in IoT intelligent applications with numerous selfish nodes. Therefore, knowledge trading is needed for paid sharing in edge-AI enabled IoT. Most existing works only focus on knowledge generation rather than trading in IoT. To address this issue, in this paper, we propose a peer-to-peer (P2P) knowledge market to make knowledge tradable in edge-AI enabled IoT. We first propose an implementation architecture of the knowledge market. Moreover, we develop a knowledge consortium blockchain for secure and efficient knowledge management and trading for the market, which includes a new cryptographic currency knowledge coin, smart contracts, and a new consensus mechanism proof of trading. Besides, a noncooperative game based knowledge pricing strategy with incentives for the market is also proposed. The security analysis and performance simulation show the security and efficiency of our knowledge market and incentive effects of knowledge pricing strategy. To the best of our knowledge, it is the first time to propose an efficient and incentive P2P knowledge market in edge-AI enabled IoT.

More data and applications are moving to the cloud, which presents many new security risks. Malware is one of the most significant threats to cloud computing. In this paper, we explore to employ virtual machine introspection(VMI) and memory forensics analysis(MFA) techniques to detect malware running in guest virtual machines. Our scheme differs from existing malware detection methods based on virtualization technology in three aspects. First, this paper combines VMI with MFA to extract multiple type features in the guest virtual machine at the same time. Our scheme can effectively minimize the data acquisition overhead. Second,compared with single dynamic feature or multiple static feature detection methods, our data acquisition method employs dynamic multiple type features, and effectively promotes the ability of sophisticated malware detection. Finally,we use AdaBoost ensemble learning method and combination strategy of voting to improve the accuracy and generalization ability of the overall classifier. The experimental results based on a lot of real-world malware show that our scheme can achieve a detection accuracy of 0.9975. Our approach can improve virtual machines security, and further effectively enhance the security of cloud computing environment.

Nowadays, cyberspace has become a vital part of social infrastructure. With the rapid development of the scale of networks, applications and services have become enriched, and the bearing function of the underlying network devices (such as switches and routers) has also been extended. To promote the dynamics architecture, high-level security, and high quality of service of the network, control network architecture forward separation is a development trend of the networking technology. Currently, software-defined networking (SDN) is one of the most popular and promising technologies. In SDN, high-level strategies are deployed by the proprietary equipment, which is used to guide the data forwarding of the network equipment. This can reduce many complicated functions of the network equipment and improve the flexibility and operability of the implementation and deployment of new network technologies and protocols. However, this novel networking technology faces novel challenges in term of architecture and security. The aim of this study is to offer a comprehensive review of the state-of-the-art research on novel advances of programmable SDN, and to highlight what has been investigated and what remains to be addressed, particularly, in terms of architecture and security.

While mobile networks provide many opportunities for people, they face security problems huge enough that a firewall is essential. The firewall in mobile networks offers a secure intranet through which all traffic is handled and processed. Furthermore, due to the limited resources in mobile networks, the firewall execution can impact the quality of communication between the intranet and the Internet. In this paper, a performance evaluation mathematical model for firewall system of mobile networks is developed using queuing theory for a multihierarchy firewall with multiple concurrent services. In addition, the throughput and the package loss rate are employed as performance evaluation indicators, and discrete‐event simulated experiments are conducted for further verification. Lastly, experimental results are compared to theoretically obtained values to identify a resource allocation scheme that provides optimal firewall performance and can offer a better quality of service (QoS) in mobile networks.

Human behavior data is the basis of behavior analysis, and usually we need to collect large quantities of data before analysis. Most existing data collection methods are labor intensive works in which the volunteers need to be asked to behave naturally under the monitoring of researchers. Identity identification can be used in passive data collection of human behavior analysis systems in big data. Previous researches show the sensing potential of WiFi signals in a device-free passive manner. It is confirmed that human's gait is unique from each other like fingerprint and iris. As a result, researchers start to explore the ability of WiFi in human identification. However, the identification accuracy of existing approaches is not satisfactory in practice. In this paper, we present Wii, a device-free WiFi-based Identity Identification approach utilizing human's gait based on Channel State Information (CSI) of WiFi signals. Principle Component Analysis (PCA) and low pass filter are applied to remove the noises in the signals. We then extract entities' gait features from both time and frequency domain. Based on these features, Wii realizes identity identification through a Support Vector Machine (SVM) with Radial Basis Function (RBF) kernel. It is implemented using commercial WiFi devices and evaluated in a typical indoor scenario. The results indicate that Wii achieves high identification accuracy with low computational cost and has the potential to work in human behavior analysis systems.

Web Security Gateway (WSG) is a new type of network security product that maintains the security of trusted networks. In this paper, a WSG model for evaluating WSG performance is presented. This paper advances discussion of previous studies on series services under multiple service windows. The proposed model consists of a two-stage queuing system. The first stage is a network layer simulation. The second stage is thus similar to a parallel hyper-Erlang distribution model. The results of a simulation test verified the feasibility and performance of the proposed model.

Occupancy information is one of the most important privacy issues of a home. Unfortunately, an attacker is able to detect occupancy from smart meter data. The current battery-based load hiding (BLH) methods cannot solve this problem. To thwart occupancy detection attacks, we propose a framework of battery-based schemes to prevent occupancy detection (BPOD). BPOD monitors the power consumption of a home and detects the occupancy in real time. According to the detection result, BPOD modifies those statistical metrics of power consumption, which highly correlate with the occupancy by charging or discharging a battery, creating a delusion that the home is always occupied. We evaluate BPOD in a simulation using several real-world smart meter datasets. Our experiment results show that BPOD effectively prevents the threshold-based and classifier-based occupancy detection attacks. Furthermore, BPOD is also able to prevent nonintrusive appliance load monitoring attacks (NILM) as a side-effect of thwarting detection attacks.

Intrusion detection plays a critical role in security of people's possessions. Approaches such as video-based, infrared-based, RFID, UWB, etc. can provide satisfying detection accuracy. However, they all require specialized hardware deployment and strict using conditions which hinder their wide deployment. Beyond communication, WLANs can also act as generalized sensor networks and there are several researches working on motion detection via WLAN due to its advantages in deployment flexibility, coverage, and cost efficiency. Nevertheless, they are unsuitable for intrusion detection as none of them can accurately detect human motion when the moving speed is very slow. This paper proposes SIED as an accurate method for Speed Independent device-free Entity Detection which is suitable for intrusion detection even when the entity's moving speed is very slow. The influence becomes much smaller when the entity is moving with a very slow speed. Previous methods have the limitations in that their performance downgrades sharply when the entity's moving speed is very slow. Recently, it has been shown that Channel State Information (CSI) at PHY layer of wireless network has the potential to detect moving entities more accurately. In this paper we leverage CSI of 802.11n wireless network and probability technique to detect entities of different moving speeds. SIED captures the variance of variances of amplitudes of each CSI subcarrier, and combines Hidden Markov Model (HMM) to make entity detection a probability problem. We implement SIED using commercial WiFi devices and evaluate our method using two typical testbeds and show that SIED can achieve an average detection accuracy of greater than 98% under different entity moving speed.