Federated Graph Neural Network (FedGNN) integrate federated learning (FL) with graph neural networks (GNNs) to enable privacy-preserving training on distributed graph data. Vertical Federated Graph Neural Network (VFGNN), a key branch of FedGNN, handles scenarios where data features and labels are distributed among participants. Despite the robust privacy-preserving design of VFGNN, we have found that it still faces the risk of backdoor attacks, even in situations where labels are inaccessible. This paper proposes BVG, a novel backdoor attack method that leverages multi-hop triggers and backdoor retention, requiring only four target-class nodes to execute effective attacks. Experimental results demonstrate that BVG achieves nearly 100% attack success rates across three commonly used datasets and three GNN models, with minimal impact on the main task accuracy. We also evaluated various defense methods, and the BVG method maintained high attack effectiveness even under existing defenses. This finding highlights the need for advanced defense mechanisms to counter sophisticated backdoor attacks in practical VFGNN applications.

With the rapid advancement of social media, the barriers to sharing information have significantly decreased, leading to the rampant spread of rumors across various platforms. Current natural language processing (NLP) techniques use models trained on datasets to detect rumors. However, these datasets often contain inherent biases, which, as has been demonstrated in other NLP tasks, can negatively impact the accuracy of the results. This study confirms the presence of significant bias in rumor detection datasets. Given the intertwined and complex nature of bias and rumors, both of which play a crucial role in assessing the trustworthiness of online content, the article argues that improving detection models should not only focus on performance but also prioritize detecting biased rumors. Addressing this dual challenge is essential to prevent rumor creators from exploiting biases to enhance the spread of false information. To tackle this issue at the data level, this study proposes integrating bias attributes into the training datasets, thereby improving the ability of models to identify biased rumors. Through experiments conducted across multiple rumor detection models, the approach has been shown to enhance the detection of biased rumors in both Chinese and English datasets without compromising overall detection accuracy. This method might be helpful in reducing the spread of biased rumors online, contributing to a healthier information ecosystem.

Creating passwords involves a blend of natural language and password-specific knowledge. Merging these feature to obtain better representations and thus enhancing password cracking efficiency, have consistently remained one of the core challenges in the field of password guessing. In this paper, we put forward the Feedback-information Enhanced Password Guesser (FEPGuesser). We demonstrate, for the first time, how Parameter Efficient Fine Tuning can integrate password knowledge, natural language understanding and bidirectional attention mechanisms to well capture semantic in password sets. Additionally, we propose the novel structure of PassExBertVAE which integrates pre-trained model with Variational AutoEncoder (VAE) architecture for password guessing. We devise the algorithm which can make full use of the inherent properties of the password latent space generated by PassExBertVAE. This algorithm simulates real-world attack scenarios by leveraging attack feedback information to enhance cracking effectiveness. Experiments show that FEPGuesser overall achieves better results than PCFG, FLA, OMEN, PassGAN, PassFlow, DPG and VAEPass. Especially, on the most complex 000webhost dataset, FEPGuesser surpasses the latest PCFG model by 8.75 percentage points and exceeds the DPG model based on representation learning by 34.11 percentage points. Furthermore, cross-site attack experiments show that FEPGuesser is more target-adaptive than PCFG and other deep learning models.

The predominant authentication method still relies on usernames and passwords. To enhance memorability, domain terms may have been opted to include as part of passwords. However, there is little analysis of the extent to which such practice affects password security, so there is a lack of guidance on how users use domain terms on websites with different domain characteristics. To address the problem, we propose a novel approach to analyze the security effect of using domain terms in passwords. The methodology primarily consists of three stages. First, we utilize Web crawlers to harvest domain vocabularies, subsequently leveraging the TextRank algorithm to rank their importance. Second, we propose an algorithm for constructing a simulated domain-specific password dataset by replacing password elements with domain terms. Third, password guessing experiments are done on the dataset using PCFG (Probabilistic Context-Free Grammar) and the Markov model to evaluate the impact of domain terms on password security. The experimental results indicate that, for systems without clear domain, 20% domain terms replacement in the test set can reduce the cracking rate by up to 5.45%. In contrast, for domain-specific systems, 20% domain terms replacement in the training set can increase the cracking rate by 6.45%. These findings provide practical guidance on the application of domain knowledge in password creation for different types of systems. In summary, this study offers a novel perspective for exploring the security implications of passwords influenced by specific domains.

Password composition policies are helpful in strengthening password’s resistance against guessing attacks. Sadly, existing off-the-shelf composition policies often remain static, which creates potential security vulnerability. In this paper, we propose a new adaptive password policy generation framework called HTPG. Based on the Zipf distribution of passwords, HTPG classifies all passwords in data set into two categories, that is, head passwords and tail passwords. We find that head passwords are vulnerable and high-value for attackers because they are most frequently used, while tail passwords have higher strength than head passwords. According to this fact, HTPG dynamically generates policies to enhance head passwords by modifying them so as to be closer to tail passwords on feature space. By introducing the idea of machine learning, we propose a policy sort method based on information gain ratio to help user choose more effective policies in enhancing head passwords. HTPG can effectively improve the security of entire password data set and make the password distribution more uniform. Experiments show that the number of cracked head passwords decreases 69% on average, compared with the original head passwords, by adopting policies generated by HTPG. Surveys on usability show that 80.23% enhanced passwords can be recalled by those who remember the corresponding original passwords.

Moving target defence mainly focus on the single parameter hopping and rarely refer to the hopping of multiple parameters in multiple layers. With the background of database security, this paper constructs a layer-crossing, multi-parameter and dynamic security model over moving target defence. Seven parameters which belong to different layers in the database application are defined, and two mathematical functions of successful attack probability and the reconnection time of the legitimate users are proposed. Then through mathematical analysis, this paper comes to the conclusion that it is impossible to let the successful attack probability and the average reconnection time take the minimum values at the same time. Finally, under specific scenarios, the specific expressions of the two functions and the optimal hopping interval of each parameter are present. The model proposed is not only applicable to the security of database system, but also to other information systems.

Text-based passwords have long acted as the dominating authentication method. Leet, as one of the significant components in password, has not been paid enough attention yet. In this paper, we systematically study the presence of Leet in passwords. We define single and pattern forms of Leet and propose a matching approach to check whether a user password contains Leet. We extract the most prevalent counterpart pairs of Leet manifestations. Afterward, we examine the effect of Leet in passwords by incorporating Leet transformation into the probabilistic context-free grammar(PCFG) method to crack passwords. We construct the first comprehensively analyzed dictionary of Leets for passwords, which is confirmed suitable for most datasets by user survey. Experiments on four leaked password sets demonstrate that distinguished Leet usage accumulates to account for around 1% of the total dataset. Only 5% of high-frequency Leets replacement could increase the cracking rate by 0.55%. For crackers, incorporating popular Leets aids to improve password cracking performance. For users, adopting low-frequency Leets could strengthen their passwords. This research provides a new perspective to investigate Leet transformations in passwords.

Attack graph can simulate the possible paths used by attackers to invade the network. By using the attack graph, the administrator can evaluate the security of the network and analyze and predict the behavior of the attacker. Although there are many research studies on attack graph, there is no systematic survey for the related analysis methods. This paper firstly introduces the basic concepts, generation methods, and computing tasks of the attack graph, and then, several kinds of analysis methods of attack graph, namely, graph-based method, Bayesian network-based method, Markov model-based method, cost optimization method, and uncertainty analysis method, are described in detail. Finally, comparative study of the methods and future work are provided. We believe that this work would help the research community to understand the attack graph analysis method systematically.

Objectionable text content on the Web is harmful to young children. Although keyword-based methods are superior in achieving faster detection, they fail to detect text content that is semantically objectionable. A novel framework based on adaptive topic modeling is proposed to detect objectionable text content. Firstly, a weighted graph is constructed based on several seed words and a set of training texts. Feature words are then selected from the graph according to the measure which shows how likely a word to be sensitive. Adaptive LDA (Latent Dirichlet Allocation) topic model in which topic number can be automatically estimated is proposed to find the latent objectionable topic structure for the text set. An objectionable topic criterion is devised for the adaptive selection method which takes the objectionable topic characteristic into consideration. Finally, detection for a given text is evaluated based on its probability value with respect to the model. Extensive comparison experiments on real world text sets show that the proposed method can effectively detect objectionable text. The performance is superior to that of keyword-based methods with several different approaches to generate keyword list. Experiments also show that the performance is better than that of detection methods based on traditional topic modeling.

Facing the enormous text on the Internet, automatic topic discovery out of large text corpus becomes an important task for advanced intelligence information analysis, such as opinion recognition, Web user interest analysis, etc. Although many topic mining methods have shown great success in dealing with topic-based analysis tasks, it is desired to discover meaningful topic descriptions for informatics analysis. To avoid words with different granularity to explain a topic, a mechanism for separating text corpus into two subsets with equal semantic topics is proposed. EM algorithm is employed to infer topics models for the subsets. Then a merging process is devised to generate topic descriptions based on the output of EM. Experiments on standard AP text corpus shows that the proposed topic discovery method can achieve better perplexity, which means better ability in predicting topics. Furthermore, a test of topics extraction on a collection of news documents about recent Expo 2010 Shanghai China shows that the description key words in topics are more meaningful and reasonable than that of tradition topic mining method.