The proliferation of Internet of Things (IoT) devices with weak passwords poses significant challenges to network security. Hackers can easily compromise these IoT devices by brute-forcing their passwords and then utilize them to launch severe attacks such as Distributed Denial of Service (DDoS). To defeat such threats, an effective solution is to ensure that each device has a strong, high-strength password. However, in practice, this poses a significant challenge, as configuring and managing passwords for such a vast number of devices is highly complex. In this work, we propose a novel Multi-Device Collaborative Authentication (MDCA) system that enables IoT devices to be protected by strong passwords without altering their original weak ones. Our approach is inspired by group defense strategies prevalent in nature: animals cooperate and form groups to enhance their chances of survival. Intuitively, IoT devices can also collaborate to improve their security. Specifically, in our design, devices with strong passwords provide authentication for devices having weak credentials, and the latter can generate clues to detect brute-force attacks. Once these attacks are detected, requests to IoT devices are first authenticated by several other strong password protected devices, and if all authentications succeed, the requests are then permitted. We have implemented the proposed system and theoretically analyzed its security. The experimental results match the theoretical analysis well.

Community detection has long been a fundamental problem in network analysis. A great deal of previous research has regarded community detection as an optimization process, where a variety of internal quality metrics are typically treated as objective functions, such as modularity (${Q}$) and weighted community clustering (WCC). However, purely optimizing a predefined quality metric probably results in an extreme unbalance in the scale of the detected communities, e.g., few giant communities with many very small communities. To reveal the true mesoscopic structure inside a big network under the suitable number of communities, we propose a novel community detection framework called LL-GMR, which is a local learning framework based on generalized metric with neighboring regularization. LL-GMR is qualified for both nonoverlapping and overlapping detection tasks. In LL-GMR, we propose a generalized representation and illustrate that it can be instantiated into 12 well-known internal quality metrics. When the generalized metric is used as an objective function, we encode node-level and community-level neighborhood information into two regularization terms to alleviate the dilemma of unbalanced communities. The experimental results show that our LL-GMR consistently outperforms other state-of-the-art community detection approaches in terms of discovering ground-truth communities in six real-life networks.

Summary Sketch is a compact data structure used to summarize data streams. It is widely used in the measurement of network traffic, and its accuracy is higher than traditional methods. Currently, there are some typical sketches: Count‐Min Sketch, CU Sketch, and Count Sketch. According to the characteristics of network traffic, we propose a new sketch framework called Self‐Adaption Sketch, which is combined Sketch with Bloom Filter. In the framework, the sketch is created dynamically and the memory space is adjusted timely according to the network traffic by using the concept carrying. Our experiment results showed that the space utilization and accuracy are significantly improved while the throughput of self‐adaption sketch is maintained at a relatively good level.

Malware has become a significant problem on the Android platform. To defend against Android malware, researchers have proposed several on-device detection methods. Typically, these on-device detection methods are composed of two steps: (i) extracting the apps’ behavior features from the mobile devices and (ii) sending the extracted features to remote servers (such as a cloud platform) for analysis. By monitoring the behaviors of the apps that are running on mobile devices, available methods can detect suspicious applications (simply, apps) accurately. However, mobile devices are typically resource limited. The feature extraction and massive data transmission might consume substantial power and CPU resources; thus, the performance of mobile devices will be degraded. To address this issue, we propose a novel method for detecting Android malware by clustering apps’ traffic at the edge computing nodes. First, a new integrated architecture of the cloud, edge, and mobile devices for Android malware detection is presented. Then, for repackaged Android malware, the network traffic content and statistics are extracted at the edge as detection features. Finally, in the cloud, similarities between apps are calculated, and the similarity values are automatically clustered to separate the original apps and the malware. The experimental results demonstrate that the proposed method can detect repackaged Android malware with high precision and with a minimal impact on the performance of mobile devices.

MapReduce is a widely-used programming model in cloud environment for parallel processing large-scale data sets. The combination of the high-level language with a SQL-to-MapReduce translator allows programmers to code using SQL-like declarative language, so that each program can afterwards be complied into a MapReduce jobflow automatically. This way is helpful to narrow the gap between non-professional users and cloud platforms, and thus significantly improve the usability of the cloud. Although a number of translators have been developed, the auto-generated MapReduce programs still suffered from extremely inefficiency. In this paper, we present an efficient Cost-Aware SQL-to-MapReduce Translator (CAT). CAT has two notable features. First, it defines two intra-SQL correlations: Generalized Job Flow Correlation (GJFC) and Input Correlation (IC), based on which a set of looser merging rules are introduced. Thus, both Top-Down (TD) and Bottom-Up (BU) merging strategies are proposed and integrated into CAT simultaneously. Second, it adopts a cost estimation model for MapReduce jobflows to guide the selection of a more efficient MapReduce jobflows auto-generated by TD and BU merging strategies. Finally, comparative experiments on TPC-H benchmark demonstrate the effectiveness and scalability of CAT.

Spammers, who manipulate online reviews to promote or suppress products, are flooding in online commerce. To combat this trend, there has been a great deal of research focused on detecting review spammers, most of which design diversified features and thus develop various classifiers. The widespread growth of crowdsourcing platforms has created large-scale deceptive review writers who behave more like normal users, that the way they can more easily evade detection by the classifiers that are purely based on fixed characteristics. In this paper, we propose a hybrid semisupervised learning model titled hybrid PU-learning-based spammer detection (hPSD) for spammer detection to leverage both the users' characteristics and the user-product relations. Specifically, the hPSD model can iteratively detect multitype spammers by injecting different positive samples, and allows the construction of classifiers in a semisupervised hybrid learning framework. Comprehensive experiments on movie dataset with shilling injection confirm the superior performance of hPSD over existing baseline methods. The hPSD is then utilized to detect the hidden spammers from real-life Amazon data. A set of spammers and their underlying employers (e.g., book publishers) are successfully discovered and validated. These demonstrate that hPSD meets the real-world application scenarios and can thus effectively detect the potentially deceptive review writers.

Summary Nowadays, online product reviews strongly influence the purchase decision of consumers in e‐commerce platforms. Driven by the immense financial profits, review spammers deliberately post fake reviews to promote or demote their target products. Some spammers are even organized as groups to work together and try to take total control of the sentiment on their target products. To detect such spammer groups, most previous works exploit frequent itemset mining (FIM) to find spammer group candidates and then use unsupervised spamicity ranking methods to identify real spammer groups. However, these methods usually suffer from the problem of threshold setting, ie, high support value finding fewer groups while low support value leading to more coincidentally generated groups and computational inefficiency. Moreover, the unsupervised methods are not able to make good use of labeled instances which are actually obtainable in practice. In this paper, we propose CONSGD, a cosine pattern and heterogeneous information network–based spammer group detecting method. Specifically, the CONSGD uses cosine pattern mining (CPM) to discover tight spammer group candidates with a respective low support value, where the cosine threshold is utilized to avoid coincidentally generated groups. Moreover, CONSGD employs heterogeneous information network classification to identify the real spammer groups, which could utilize the labeled instances and do not rely to the assumption of independent instances. Experiments on real‐life dataset show that our proposed CONSGD is effective and outperforms the state‐of‐the‐art spammer group detection methods.

Driven by profits, spam reviews for product promotion or suppression become increasingly rampant in online shopping platforms. This paper focuses on detecting hidden spam users based on product reviews. In the literature, there have been tremendous studies suggesting diversified methods for spammer detection, but whether these methods can be combined effectively for higher performance remains unclear. Along this line, a hybrid PU-learning-based Spammer Detection (hPSD) model is proposed in this paper. On one hand, hPSD can detect multi-type spammers by injecting or recognizing only a small portion of positive samples, which meets particularly real-world application scenarios. More importantly, hPSD can leverage both user features and user relations to build a spammer classifier via a semi-supervised hybrid learning framework. Experimental results on movie data sets with shilling injection show that hPSD outperforms several state-of-the-art baseline methods. In particular, hPSD shows great potential in detecting hidden spammers as well as their underlying employers from a real-life Amazon data set. These demonstrate the effectiveness and practical value of hPSD for real-life applications.