As an emerging machine learning method, Federated Learning is widely used in network anomaly detection scenarios. However, many current federated learning-based network anomaly detection works ignore the communication overhead problem during model training. The transmission of model parameters occupies a large amount of bandwidth, affecting the efficiency of network anomaly detection as well as the communication tasks of other programs. In this study, we propose eFedAD, an efficient federated learning framework for network traffic anomaly detection. Specifically, eFedAD uses singular value decomposition to compress the transmitted parameters and introduces a weighting mechanism to control the compression rate and aggregation proportion. In this way, eFedAD can significantly reduce the number of transmitted parameters and assign higher weights to more valuable clients, enhancing the generalization ability of the global model. Additionally, to address the slow convergence issue due to compressed parameters and minimize the total number of transmitted parameters, eFedAD uses a client selection method that is based on clustering clients’ data feature distributions. The experimental results demonstrate that eFedAD outperforms other compression methods and network anomaly detection approaches, achieving excellent performance.

Recently, a series of vulnerabilities occurred to divulge or forge single sign-on tickets, such as the famous SolarWinds incident Once malicious attackers obtain fraudulent tickets, they can pry into user privacy as well as compromise the system by impersonating the victim user. Inspired by certificate transparency, a ticket transparency (TT) framework for detecting fraudulent tickets is proposed. However, it suffers from inefficiency and potential failure. In this paper, we further propose an enhanced ticket transparency (eTT) scheme, which ensures that all fraudulent tickets can be detected efficiently through a novel dual-backup structure to store ticket entries in the public log. Meanwhile, we design specific calculations for pairwise pseudonymous identifiers (PPIDs), to support fraudulent-detection towards tickets in which user identifiers are pseudonyms. We implemented the prototype system, and the experimental evaluation shows that eTT framework introduces acceptable overheads in the sign-on process.

Terminal users can deploy verification tools to verify Windows code-signing signatures and check their details (signing time, certificate chain, etc). Some representative verification tools are also adopted in related studies, which take tools’ outputs as contributing factors to analyse malicious software or certificate ecosystems. However, as code-signing signature verification is related to multiple dimensions, such as certificate status and system policies, getting accurate signature status and details is essential but rather complicated. And performance of different tools in verifications has not been well studied and compared with.We provide a novel methodology to inspect Windows code-signing verification tools, checking that if they print consistent results and details. We choose four representative tools to verify massive samples (more than 26 million) and collect their outputs. During the verification, we deploy a two-step verification method, which efficiently excludes 78.8% of samples (not signed). We write scripts to read each line of outputs, learning tools’ output structures. Then we can precisely locate and extract interested code-signing fields from outputs. After that, we compare these essential fields from different tools, and analyze inconsistent cases. Finally, we present three types of inconsistent cases: verifying neglect, timestamp disturbance, and compatibility/robustness issues. We find some verification tools may assert code-signing signatures as invalid due to external factors, such as unexpected signing or invalid timestamp.

Predicting urban traffic is of great importance to smart city systems and public security; however, it is a very challenging task because of several dynamic and complex factors, such as patterns of urban geographical location, weather, seasons, and holidays. To tackle these challenges, we are stimulated by the deep-learning method proposed to unlock the power of knowledge from urban computing and proposed a deep-learning model based on neural network, entitled Capsules TCN Network, to predict the traffic flow in local areas of the city at once. Capsules TCN Network employs a Capsules Network and Temporal Convolutional Network as the basic unit to learn the spatial dependence, time dependence, and external factors of traffic flow prediction. In specific, we consider some particular scenarios that require accurate traffic flow prediction (e.g., smart transportation, business circle analysis, and traffic flow assessment) and propose a GAN-based superresolution reconstruction model. Extensive experiments were conducted based on real-world datasets to demonstrate the superiority of Capsules TCN Network beyond several state-of-the-art methods. Compared with HA, ARIMA, RNN, and LSTM classic methods, respectively, the method proposed in the paper achieved better results in the experimental verification.

Identifying the physical person behind an SNS account has become a critical issue in investigations of SNS-involved crime cases. It is a challenging task because information provided by users on an SNS platform could be false, conflicting, missing and deceptive. One way to gain an accurate profile of a user is to link up all their multiple accounts created on different social platforms, which is referred to as Account Linkage (AL). However, existing AL techniques suffer from the problem of information unreliability. Recent advances in location acquisition and wireless communication technologies give rise to new opportunities for AL. In this paper, we propose a framework that links up multiple accounts belonging to the same individual by comparing habit patterns extracted from user-generated location data. We built a topic model to capture users habit patterns in both spatial and temporal dimensions. Results of experiments carried out on a real-world dataset demonstrate the feasibility and validity of the proposed framework.