Insider threat detection (ITD) poses a persistent and high-impact challenge in cybersecurity due to the subtle, long-term, and context-dependent nature of malicious insider behaviors. Traditional models often struggle to capture semantic intent and complex behavior dynamics, while existing LLMbased solutions face limitations in prompt adaptability and modality coverage. To bridge this gap, we propose DMFI, a dual-modality framework that integrates semantic inference with behavior-aware fine-tuning. DMFI converts raw logs into two structured views: (1) a semantic view that processes content-rich artifacts (e.g., emails, https) using instruction-formatted prompts; and (2) a behavioral abstraction, constructed via a 4 W -guided (When-Where-What-Which) transformation to encode contextual action sequences. Two LoRA-enhanced LLMs are fine-tuned independently, and their outputs are fused via a lightweight MLP-based decision module. We further introduce DMFI-B, a discriminative adaptation strategy that separates normal and abnormal behavior representations, improving robustness under severe class imbalance. Experiments on CERT r4.2 and r5.2 datasets demonstrate that DMFI outperforms state-of-the-art methods in detection accuracy. Our approach combines the semantic reasoning power of LLMs with structured behavior modeling, offering a scalable and effective solution for real-world insider threat detection.

In many real-world applications, sequential rule mining (SRM) can offer prediction and recommendation functions for a variety of services. It is an important technique of pattern mining to discover all valuable rules that can reveal the temporal relationship between objects. Although several algorithms of SRM are proposed to solve various practical problems, there are no studies on the problem of targeted mining. Targeted sequential rule mining aims to obtain those interesting sequential rules that users focus on, thus avoiding the generation of other invalid and unnecessary rules. It can further improve the efficiency of users in analyzing rules and reduce the consumption of computing resources. In this paper, we first present the relevant definitions of target sequential rules and formulate the problem of targeted sequential rule mining. Then, we propose an efficient algorithm called TaSRM. Several pruning strategies and an optimization are introduced to improve the efficiency of TaSRM. Finally, a large number of experiments are conducted on different benchmarks, and we analyze the results in terms of running time, memory consumption, and scalability, as well as query cases with different query rules. It is shown that the novel algorithm TaSRM and its variants can achieve better experimental performance compared to the baseline algorithm.

Knowledge tracing (KT) involves utilizing historical data from students’ learning interactions to model their mastery of knowledge over time, with the aim of predicting their future performance in interactions. Recently, significant advancements have been achieved through the application of various deep learning methodologies to address the KT challenge. However, a considerable proportion of deep learning-based knowledge tracing (DLKT) approaches exhibit striking similarities in their methodologies, and model designs, and even the outcomes demonstrate minimal divergence. In addition, the evaluation procedures employed in current DLKT studies are not standardized, resulting in substantial inconsistencies in the reported area under the curve (AUC) outcomes, despite analyzing the same model on identical datasets. To address the two aforementioned problems, this paper proposes a generalized DLKT framework and represents the existing DLKT models with five components, i.e., multimodal data encoder, student knowledge memory, auxiliary knowledge base, learning outcome objective, and computational efficiency and scalability. Furthermore, we develop and open source a standardized DLKT benchmark platform namedpyKT,1that consists of a standardized set of integrated data preprocessing procedures on 9 popular datasets across different domains, and 21 frequently compared DLKT model implementations. WithpyKT, we conduct empirical and reproducible research to assess the performance of prevalent DLKT algorithms in an unbiased and clear setting over multiple data sources. Finally, we discuss the applications of KT techniques in the educational sector and their future development directions.

There is substantial attention to federated learning with its ability to train a powerful global model collaboratively while protecting data privacy. Despite its many advantages, federated learning is vulnerable to backdoor attacks, where an adversary injects malicious weights into the global model, making the global model's targeted predictions incorrect. Existing defenses based on identifying and eliminating malicious weights ignore the similarity variation of the local weights during iterations in the malicious model detection and the presence of benign weights in the malicious model during the malicious local weight elimination, resulting in a poor defense and a degradation of global model accuracy. In this paper, we defend against backdoor attacks from the perspective of local models. First, a malicious model detection method based on interpretability techniques is proposed. The method appends a sampling check after clustering to identify malicious models accurately. We further design a malicious local weight elimination method based on local weight contributions. This method preserves the benign weights in the malicious model to maintain their contributions to the global model. Finally, we analyze the security of the proposed method in terms of model closeness and then verify the effectiveness of the proposed method through experiments. In comparison with existing defenses, the results show that BADFL improves the global model accuracy by 23.14% while reducing the attack success rate to 0.04% in the best case.

Knowledge tracing (KT) is the problem of predicting students' future performance based on their historical interaction sequences. With the advanced capability of capturing contextual long-term dependency, attention mechanism becomes one of the essential components in many deep learning based KT (DLKT) models. In spite of the impressive performance achieved by these attentional DLKT models, many of them are often vulnerable to run the risk of overfitting, especially on small-scale educational datasets. Therefore, in this paper, we propose sparseKT, a simple yet effective framework to improve the robustness and generalization of the attention based DLKT approaches. Specifically, we incorporate a k-selection module to only pick items with the highest attention scores. We propose two sparsification heuristics: (1) soft-thresholding sparse attention and (2) top-K sparse attention. We show that our sparseKT is able to help attentional KT models get rid of irrelevant student interactions and improve the predictive performance when compared to 11 state-of-the-art KT models on three publicly available real-world educational datasets. To encourage reproducible research, we make our data and code publicly available at https://github.com/pykt-team/pykt-toolkit1..

Knowledge tracing (KT) is the problem of predicting students’ future performance based on their historical interactions with intelligent tutoring systems. Recent studies have applied multiple types of deep neural networks to solve the KT problem. However, there are two important factors in real-world educational data that are not well represented. First, most existing works augment input representations with the co-occurrence matrix of questions and knowledge components1 (KCs) but fail to explicitly integrate such intrinsic relations into the final response prediction task. Second, the individualized historical performance of students has not been well captured. In this paper, we proposed AT-DKT to improve the prediction performance of the original deep knowledge tracing model with two auxiliary learning tasks, i.e., question tagging (QT) prediction task and individualized prior knowledge (IK) prediction task. Specifically, the QT task helps learn better question representations by predicting whether questions contain specific KCs. The IK task captures students’ global historical performance by progressively predicting student-level prior knowledge that is hidden in students’ historical learning interactions. We conduct comprehensive experiments on three real-world educational datasets and compare the proposed approach to both deep sequential KT models and non-sequential models. Experimental results show that AT-DKT outperforms all sequential models with more than 0.9% improvements of AUC for all datasets, and is almost the second best compared to non-sequential models. Furthermore, we conduct both ablation studies and quantitative analysis to show the effectiveness of auxiliary tasks and the superior prediction outcomes of AT-DKT. To encourage reproducible research, we make our data and code publicly available at https://github.com/pykt-team/pykt-toolkit 2.

Distributed k-winners-takes-all (k-WTA) neural network (k-WTANN) models have better scalability than centralized ones. In this work, a distributed k-WTANN model with a simple structure is designed for the efficient selection of k winners among a group of more than k agents via competition based on their inputs. Unlike an existing distributed k-WTANN model, the proposed model does not rely on consensus filters, and only has one state variable. We prove that under mild conditions, the proposed distributed k-WTANN model has global asymptotic convergence. The theoretical conclusions are validated via numerical examples, which also show that our model is of better convergence speed than the existing distributed k-WTANN model.

Utility-driven mining is an important task in data science and has many applications in real life. High-utility sequential pattern mining (HUSPM) is one kind of utility-driven mining. It aims at discovering all sequential patterns with high utility. However, the existing algorithms of HUSPM can not provide a relatively accurate probability to deal with some scenarios for prediction or recommendation. High-utility sequential rule mining (HUSRM) is proposed to discover all sequential rules with high utility and high confidence. There is only one algorithm proposed for HUSRM, which is not efficient enough. In this article, we propose a faster algorithm called US-Rule, to efficiently mine high-utility sequential rules. It utilizes the rule estimated utility co-occurrence pruning strategy (REUCP) to avoid meaningless computations. Moreover, to improve its efficiency on dense and long sequence datasets, four tighter upper bounds (LEEU, REEU, LERSU, and RERSU) and corresponding pruning strategies (LEEUP, REEUP, LERSUP, and RERSUP) are designed. US-Rule also proposes the rule estimated utility recomputing pruning strategy (REURP) to deal with sparse datasets. Finally, a large number of experiments on different datasets compared to the state-of-the-art algorithm demonstrate that US-Rule can achieve better performance in terms of execution time, memory consumption, and scalability.

With increasingly popular GPS-equipped mobile devices (e.g., smartphones, tablets, laptops), massive spatio-textual data has been outsourced to cloud servers for storage and analysis such as spatial keyword search. However, existing privacy-preserving spatial keyword query schemes only support coarse-grained non-temporal access control in single-user sharing scenarios, which does not scale well in time-related scenes such as message valid period. To solve the above issues, we propose Privacy-preserving Boolean Range Query with Temporal access control in mobile computing (PBRQ-T). Specifically, we first achieve PBRQ with linear search complexity using the adapted Gray code, Bloom filter, and Katz-Sahai-Waters encryption. Then, we provide fine-grained and temporal access control in PBRQ based on the forward/backward derivation function and attribute-based encryption, where PBRQ is executed only when the spatio-textual data is accessible. Finally, an enhanced PBRQ-T (i.e., PBRQ-T+) with faster-than-linear search complexity is proposed by constructing a Quadtree index structure. Our formal security analysis shows that data privacy and index privacy can be guaranteed during the query process. Our extensive experiments using a real-world dataset demonstrate the efficiency and feasibility of our schemes.

To ensure the security of outsourced data without affecting data availability, one can use Symmetric Searchable Encryption (SSE) to achieve search over encrypted data. Considering that query users may search with misspelled words, the fuzzy search should be supported. However, conventional privacy-preserving fuzzy multi-keyword search schemes are incapable of achieving the result verification and adaptive security. To solve the above challenging issues, in this paper we propose a Verifiable Fuzzy multi-keyword Search scheme with Adaptive security (VFSA). VFSA first employs the locality sensitive hashing to hash the misspelled and correct keywords to the same positions, then designs a twin Bloom filter for each document to store and mask all keywords contained in the document, next constructs an index tree based on the graph-based keyword partition algorithm to achieve adaptive sublinear retrieval, finally combines the Merkle hash tree structure with the adapted multiset accumulator to check the correctness and completeness of search results. Our formal security analysis shows that VFSA is secure under the IND-CKA2 model and achieves query authentication. Our empirical experiments using the real-world dataset demonstrate the practicality of VFSA.