With growing awareness of user privacy and the widespread adoption of encryption tools such as SSL/TLS, VPN, and Tor, traditional traffic classification methods based on port analysis and deep packet inspection (DPI) have become increasingly ineffective. While conventional machine learning approaches can classify traffic using flow statistical features, they remain limited by their dependence on manual feature engineering and poor generalization capability. Deep learning techniques overcome these constraints by automatically extracting features and enabling early traffic classification. However, existing deep learning solutions still exhibit notable shortcomings: most rely exclusively on either flow-level or packet-level features, neglecting the complementary information present in the other dimension; furthermore, packet-level methods often mix header and payload data, risking violation of user privacy. To address these issues, this paper proposes a novel encrypted traffic classification method that effectively integrates both flow-level and packet-level features without relying on payload content. By introducing new techniques for feature extraction and fusion at both levels, our approach captures complex nonlinear relationships among features. Extensive evaluation on four public datasets demonstrates that the proposed method achieves high accuracy and significantly outperforms single-modal models.

Edge computing has been proposed as an extension of cloud computing to provide computation, storage, and network services in network edge. The tasks requested from terminal devices can be processed at the edge to save network bandwidth and reduce response time as long as the edge server is configured with the corresponding virtualization services. However, the limited capacity of various resources of edge servers and the low-delay service demands of tasks limit the application of traditional virtualization technologies in the task scheduling and resource management of edge computing. Meanwhile, the tasks have become more diverse, which are often divided into independent tasks and complex tasks composed of multiple dependent tasks.In this paper, we study the task scheduling problem in the container-based edge computing environment. Based on the Proximal Policy optimization algorithm, we propose two Task Scheduling algorithms for independent (PPOTS) and dependent (PPODTS). Our objective is to minimize the utility which is a trade-off between the completion time and the energy consumption. Experimental results show that our proposed PPOTS and PPODTS algorithms can reduce the average utility by at least 15.83% (and up to 77.9%) and at least 3.5% (and up to 10.3%) compared with baselines respectively.

Resources of cloud workloads can be automatically allocated according to the requirements of the application. In the long-term running process, resource requirements change dynamically. Insufficient allocation may lead to the decline of service quality, and excessive allocation will lead to the waste of resources. Therefore, it is crucial to accurately predict resource demand. This paper aims to improve resource utilization in the data center by predicting the resources required for each application. Resource demand forecasting understands and manages future resource needs by mining current and past resource usage patterns. Because we need to analyze time series data with long-term dependence and noise, it is challenging to predict future resource utilization.We designed and implemented an attention-based GRU model. The attention mechanism was added to the GRU model to quickly filter out valuable information from large amounts of data. We used the Azure and Alibaba cluster trace to train our neural network, and used three evaluation indicators RMSE, MAPE and R2 to evaluate our proposed method. The experimental results show that our prediction method has 4.5% improvements in RMSE evaluation criteria and 9.5% improvements in MAPE evaluation criteria compared with single GRU model (without attention mechanism) used. That is, the prediction model with the attention mechanism can improve the accuracy of resource prediction. At the same time, we also studied the influence of the window size on the experimental results, finding that the prediction results are more accurate as the window size increases.

A knowledge base is an important notion of rough set theory. A tolerance knowledge base is its generalization. Measures of uncertainty as important evaluation tools in the fields of machine learning can measure the dependence and similarity between two targets. This paper investigates uncertainty measurement for a tolerance knowledge base by using its knowledge structure. The knowledge structure of a given tolerance knowledge base is first introduced by means of set vectors. Then, the dependence and independence between knowledge structures of tolerance knowledge bases are depicted. Next, the measurement uncertainty of tolerance knowledge bases is investigated. Finally, to obtain two tolerance knowledge bases with additional data, two information systems from the UCI Repository of machine learning databases are selected to construct two numerical experiments, and an effectiveness analysis is performed from the perspective of statistics to show the feasibility of the proposed measures.

XSS is one of the common vulnerabilities in web applications. Many black-box testing tools may collect a large number of payloads and traverse them to find a payload that can be successfully injected, but they are not very efficient. And previous research has paid less attention to how to improve the efficiency of black-box testing to detect XSS vulnerability. To improve the efficiency of testing, we develop an XSS testing tool. It collects 6128 payloads and uses a headless browser to detect XSS vulnerability. The tool can discover XSS vulnerability quickly with the ART(Adaptive Random Testing) method. We conduct an experiment using 3 extensively adopted open source vulnerable benchmarks and 2 actual websites to evaluate the ART method. The experimental results indicate that the ART method can effectively improve the fuzzing method by more than 27.1% in reducing the number of attempts before accomplishing a successful injection.

IoT devices used in smart home have become a fundamental part of modern society. Such devices enable our living space to be more convenient. This enables human interaction with physical environment, also happens between two applications or others third-party rules in addition, and causes some unexpected automation, even causes safety concerns. What's worse is that attackers can leverage stealthy physical interactions to launch attacks against IoT systems or steal user privacy. In this paper, we propose a tool called IoTIE that discovers any possible physical interactions and extract all potential interactions across applications and rules in the IoT environment. And we present a comprehensive system evaluation on the Samsung SmartThings and IFTTT platform. We study 187 official SmartThings applications and 98 IFTTT rules, and find they can form 231 hidden inter-app interactions through physical environments. In particular, our experiment reveals that 74 interactions are highly risky and could be potentially exploited to impact the security and safety of the IoT environment.

The capability leakage of Android applications is one kind of serious vulnerabilities. It can cause other applications to leverage its functions to achieve their illegal goals. In this paper, we propose a tool which can automatically detect and confirm capability leakages of Android applications with dynamic-feedback testing. The tool utilizes context-sensitive, flow-sensitive inter-procedural data flow analysis to find key variables and instrumentation points, then it tests the application continuously by test cases generated from test log. We have made experiments on 607 most popular applications of Wandoujia in 2017, and found a total of 6,070 in 16 kinds of capability leakages. Compared with the famous IntentFuzzer, our tool is 19.38% better on the average ability to detect permission capability leakage.

Most current literature on Android malware pays particular attention to the features of applications. Much of them focus on permissions or APIs, neglecting the behavioral semantics of applications, and the literature considering behavioral semantics is often expensive and weak in extendibility. In this paper, we introduce RepassDroid - a relatively coarse-grained but faster tool for automatic Android malware detection. We define Generalized-sensitive API and emphasize on considering if the trigger points of generalized-sensitive APIs are UI-related or not. It analyzes the application by abstracting the generalized sensitive API with its trigger point as the semantic feature, with the addition of Really-essential Permission as the syntax feature. Then it utilizes machine learning to automatically determine whether an application is benign or malicious. We evaluate RepassDroid on 24288 samples in total, 20000 for training and 4288 for test. With the comparative experiments, we find that Random Forest is the optimal classification technique for our feature set, achieving 97.7% accuracy and 0.99 AUC, along with a malware classification precision as high as 99.3%. Our evaluation results confirm that our approach and the feature set are logical and effective for Android malware detection.

Although reflection methods in Android can facilitate developing applications, they will block control flow and data flow in static analysis, making its precision decreased. To solve this problem, we trigger applications to execute reflection methods and record its reflection targets at runtime. Reflection targets may be a method invocation, field setting or instantiating of some classes. Considering many static analysis' input is apk file, we further transform reflection methods in apk into explicit method invocation, field setting and class initiating according to the recorded reflection targets. Our experiment result shows that, based on our method, some static analysis can perform better on these transformed apk and produce more precise results.