Abstract Software defect prediction (SDP) is crucial for enhancing software quality and reducing development costs. Prevailing SDP methods often depend on traditional code metrics, which inadequately capture vital semantic information from source code, thereby limiting defect identification accuracy. This paper introduces DP-S3, a novel SDP model that integrates features from abstract syntax trees (ASTs), program slices, and standard metrics. DP-S3 extracts ASTs and program slices, transforming them into vector representations. A hierarchical long short-term memory network then learns semantic features from these vectors, which are combined with standard metrics from the PROMISE repository. A key innovation is our feature fusion strategy employing a channel self-attention mechanism to dynamically weight the three feature sets. We evaluated DP-S3 on seven open-source Java projects from the Apache repository against several state-of-the-art methods. The results demonstrate DP-S3’s superior performance, achieving average improvements of up to 3.8% in area under the receiver operating characteristic curve, 4.5% in F1, and 7.5% in Matthews correlation coefficient over baselines, showcasing its effectiveness. Key limitations include its current focus on Java projects and within-project defect prediction. Nevertheless, this work concludes that a synergistic fusion of syntactic, semantic (slice-based), and traditional metric features, guided by attention mechanisms, significantly enhances SDP capabilities and offers a promising direction for future research.

Abstract In the discovery of modern software vulnerability, mutation-based fuzzing techniques are widely applied, with their performance highly dependent on the effectiveness of mutation scheduling strategies. Most current research primarily focuses on optimizing seed scheduling. However, mutation scheduling plays an equally critical role in fuzzing, as it determines how mutation operators are selected and applied to generate new test cases. Existing mutation scheduling schemes are faced with several issues, such as the need to input manual parameters from users and improper overhead management. To address these challenges, this paper proposes an innovative mutation scheduling model, HavocEDA, utilizing Estimation of Distribution Algorithm to optimize the selection of mutation operators in fuzzing, thereby enhancing the efficiency of vulnerability detection. The HavocEDA model can dynamically adjust the probability distribution of mutation operators based on fuzzing feedback, enabling a more efficient exploration of potential vulnerabilities within the software. We implemented a prototype based on the popular general-purpose fuzzer AFL. We evaluated HavocEDA on 9 open-source Linux programs in FuzzBench. Experimental results indicate that HavocEDA shows a performance improvement in edge coverage and crash discovery compared with the state-of-the-art fuzzers AFL, DARWIN, MOpt, and HavocMAB.

With the rapid growth of network traffic, data has become increasingly complex and voluminous, posing significant challenges for accurate anomaly detection. Traditional deep learning approaches often fail to capture the rich interdependencies and heterogeneous nature of traffic features, limiting their effectiveness in identifying subtle or evolving abnormal patterns. To address these challenges, this paper proposes GS-HF (GraphSAGE with heterogeneous features), an anomaly detection framework. The method integrates both statistical and image-like features extracted from raw traffic data to capture multi-dimensional characteristics, and then constructs a graph based on the fused heterogeneous features to better represent relationships among traffic flows. An improved GraphSAGE model is applied for detection, incorporating Focal Loss to handle class imbalance in real-world anomaly datasets. Extensive experiments on multiple network traffic datasets demonstrate that GS-HF achieves superior detection performance compared to existing methods, highlighting its robustness and effectiveness in handling diverse and complex traffic patterns.

Network traffic classification is essential for application identification and malicious behavior detection. However, the widespread use of encryption protocols hides payloads and reduces the availability of high-quality labeled data, both of which constrain the effectiveness of current models. To address these challenges, we propose CL-ViME, a self-supervised encrypted traffic classification framework that integrates Contrastive Learning and Vision Mixture of Experts. First, we design a packet-temporal matrix that preserves fine-grained packet headers and flow-level temporal structure. Second, we introduce a Vertical Vision Transformer-Mixture of Experts model to extract dual-view features through vertical patching and dynamic expert routing. Third, we develop a dual-granularity contrastive learning framework that aligns packet-level and flow-level representations via an MoE projector, followed by lightweight classifier-head fine-tuning. Experiments on three public datasets show that CL-ViME significantly outperforms state-of-the-art self-supervised and supervised baselines across accuracy, macro-precision, macro-recall, and macro-F1. It also demonstrates strong generalization and stability.

Despite great progress in fuzzing browser APIs, systematic approaches for testing web storage techniques remain absent. IndexedDB, the most popular NoSql database in modern browsers, brings unique challenges for fuzzing its API due to its asynchronous event-driven feature and strict phase separation. Current browser fuzzing techniques frequently struggle to generate nested event flows and invocations, which significantly impacts semantic correctness. Moreover, they often rely heavily on the try-catch block to suppress exceptions, which introduces substantial performance overhead. We propose IDBFuzz, the first fuzzing approach tailored for the IndexedDB API, which effectively tackles the challenge of capturing the execution context and event semantics inherent to IndexedDB, as well as handling large persistent objects. We design a seed generator based on intermediate representation (IR) that decouples layered IR skeletons from input object generation. With the aid of a global database snapshot, IDBFuzz can generate semantically controllable seeds, enabling the efficient production of high-quality test cases that significantly improve coverage.

Neural machine translation (NMT) systems have been widely deployed in real-world applications. However, despite the great translation performance, these systems inevitably face robustness issues and sometimes produce erroneous outputs, particularly in complex and ambiguous scenarios. In this work, we propose a Fuzzing framework with Differential Testing for NMT systems, namely, DiFuzzNMT. DiFuzzNMT employs a heuristic strategy to continuously search inputs that produce greater output differences across various NMT systems for error detection. Specifically, DiFuzzNMT establishes token mappings between outputs of different NMT systems for the same input through word alignment. To guide the test input generation process of fuzzing, we design specific testing guidance that takes into account the differences between outputs, including word alignment differences and token semantic differences. All the test inputs are generated based on “seed” inputs (inputs to generate new inputs) by applying a mutation operator. Test inputs exhibiting higher testing guidance values are selected as new seeds, while the others are discarded. A potential translation error is reported when the same test input exhibits significant differences across different NMT systems. By iteratively retaining seeds and generating test inputs, DiFuzzNMT can effectively detect translation errors. To evaluate the effectiveness of DiFuzzNMT, we conduct experiments on two widely used NMT APIs (Baidu Translate and Tencent Translate), using a publicly available dataset of 800 original sentences across 8 thematic categories. The experimental results show that DiFuzzNMT detects more translation errors than baselines and exhibits greater diversity. Furthermore, the results show that the proposed testing guidance improves the method's ability to detect translation errors.

ABSTRACT With the increasingly frequent attacks on software systems, software security is an issue that must be addressed. Within software security, automated detection of software vulnerabilities is an important subject. Most existing vulnerability detectors rely on the features of a single code type (e.g., source code or intermediate representation [IR]), which may lead to both the global features of the code slices and the memory operation information not being captured or considered. In particular, vulnerability detection based on source‐code features cannot usually include some macro or type definition content. In this paper, we propose a vulnerability‐detection method that combines the semantic features of source code and the low level virtual machine (LLVM) IR. Our proposed approach starts by slicing (C/C++) source files using improved slicing techniques to cover more comprehensive code information. It then extracts semantic information from the LLVM IR based on the executable source code. This can enrich the features fed to the artificial neural network (ANN) model for learning. We conducted an experimental evaluation using a publicly‐available dataset of 11,381 C/C++ programs. The experimental results show the vulnerability‐detection accuracy of our proposed method to reach over 96% for code slices generated according to four different slicing criteria. This outperforms most other compared detection methods.

ABSTRACT Deep neural networks (DNNs) possess potent feature learning capability, enabling them to comprehend natural language, which strongly support developing dialogue systems. However, dialogue systems usually perform incorrect behaviours in some corner cases, which may cause misunderstanding or economic loss. To test and debug dialogue systems, a popular fuzzing framework by metamorphic testing with Gini impurity guidance is proposed, namely, DialTest. However, DialTest treats all seeds (the initial test inputs to generate the mutated test inputs) equally during the fuzzing process and does not differentiate seeds, resulting in a certain limitation to its incorrect behaviour detection capability. In this paper, we propose to enhance the DialTest by applying a lightweight energy adjustment strategy called DialTest with Energy Adjustment (DialTest‐EA). DialTest‐EA employs the ant colony optimization algorithm (ACO) to adjust the mutation energy of each seed adaptively, ensuring that potential seeds have more opportunities to generate subsequent test inputs. To evaluate the effectiveness of the proposed DialTest‐EA, we conduct a series of comparisons with the original DialTest and random mutation strategy. The experimental results show that the proposed DialTest‐EA outperforms the compared methods both in the intent detection and slot filling tasks. Compared with the original DialTest, the intent detection accuracy of generated test cases by the proposed method is reduced by more than 14%, and the slot filling accuracy is reduced by more than 8%.

Malicious attack has shown a rapid growth in recent years, it is very important to accurately detect malicious traffic to defend against malicious attacks. Compared with machine learning and deep learning technologies,graphconvolutional neuralnetwork (GCN) achieves better detection results of malicious traffic due to additional consideration of the correlation between network traffic features. However, existing GCN-based detection models suffer from fixed weight assignment, only focusing on local features, lack the ability to model graph structure and relationships as well as having gradient disappearance. To solve these problems, this paper proposes the GSA-DT model based ongraphself-attention network anddecisiontree. GSA-DT first preprocesses the original network traffic to obtain better traffic features and labels, and then uses GCN to extract the topological structure of network traffic as well as capture the correlation relationships among traffic features, where the ReLU activation function is replaced by LeakyReLU to overcome the problems of neuron “death” and gradient disappearance during the training process; It also introduces the self-attention mechanism into GCN to assign larger weights to the key features to reduce the interference of redundant features. Finally, GSA-DT uses decision tree to perform the detection of malicious traffic. Experimental results on four network traffic datasets show that GSA-DT model improves the detection accuracy over 1% on average than seven advanced malicious traffic detection models, and it also performs better in F1-measure, TPR, FPR as well as stability.

Mutation-based greybox fuzzing is an efficient and widely used software testing technique, and its performance heavily depends on the mutation strategy. Existing solutions guide the seed mutation by using program-adaptive mutation strategies or constraint solving techniques. However, they disregard the characteristic that the execution information of seeds with similar behavior contains general strategies for solving specific constraints. In this paper, we propose the FMUZZ, a lightweight fuzzing approach based on mutation strategy optimization. FMUZZ first clusters the seeds based on their execution information into different seed groups and then learns the byte mutation scheduling strategies applicable to different program paths to improve efficiency in generating seeds that satisfy specific branch constraints. Meanwhile, FMUZZ removes the redundant seeds during the learning process by using the customized multi-objective optimization algorithm, thereby improving the efficiency of learning byte mutation scheduling strategies for different program paths. We test the effectiveness of FMUZZ on 9 real-world programs with the comparison of 3 state-of-the-art mutation-based fuzzers. Extensive experimental results show that compared to the benchmark fuzzers, FMUZZ achieves 8.9% higher branch coverage and outperforms 35.3% in discovering unique crashes on average.

Source code vulnerability detection is of great significance in securing software as well as addressing novel threats, and neural network-based methods have made significant progress in the field of vulnerability detection. However, the widely used neural network-based vulnerability detection methods suffer from the loss of complex structural and semantic information in the source code. To solve this problem, this paper proposes a dual-attention composite pooling-based vulnerability detection method called DA-CPVD for source code, it enhances the feature representation through fully considering the overall contextual information and complex dependencies of source code. The key of DA-CPVD is the use of a dual-attention composite pooling approach to emphasizes the key features more flexibly, thereby forming a comprehensive pooled feature representation. In specific, DA-CPVD utilizes a self-attention mechanism to adaptively assign the weights to features, as well as uses a composite pooling based on attention mechanism aggregation to dynamically adjust the weights of pooling results. The DA-CPVD method is evaluated on three publicly available and widely used datasets, and the experimental result shows that DA-CPVD improves Accuracy, Precision and F1-measure by an average of 11.52%, 28.7%, and 10.45%, and reduces False Positive Rate by an average of 19.15% compared to other existing methods.

Abstract Regression testing is an essential and expensive process in software testing. However, there may be insufficient resources for the execution of all test cases during regression testing. Test case prioritization (TCP) techniques improve the efficiency of regression testing by adjusting the test case execution sequence. Traditional TCP techniques usually rely on the historical execution information of the software under test for more efficient results. String distance‐based TCP (SD‐TCP) avoids these limitations; it uses only the textual difference information of the test cases themselves for prioritization. However, the time overhead on the sorting process of this method is not ideal, and the extreme test case inputs have an impact on the stability of the method. To address these problems, we propose a novel test case prioritization strategy, it first classifies the test cases more finely using the K‐medoids algorithm and then transforms the set into subsequences and improves the early diversity by greedy sorting within clusters. Finally, the test cases are selected through a polling strategy to compose the execution sequence. Extensive experimental results demonstrate that the proposed approach outperforms SD‐TCP in better time efficiency on test case prioritization; it also has a higher average percentage of fault detected (APFD) value than random prioritization (RP) and SD‐TCP.

Summary Although cross‐project defect prediction (CPDP) techniques that use traditional manual features to build defect prediction model have been well‐developed, they usually ignore the semantic and structural information inside the program and fail to capture the hidden features that are critical for program category prediction, resulting in poor defect prediction results. Researchers have proposed using deep learning to automatically extract the semantic features of programs and fuse them with traditional features as training data. However, in practice, it is important to explore the effective representation of the semantic features in the programs and how the fusion of a reasonable ratio between the two types of features can maximize the effectiveness of the model. In this paper, we propose a semantic feature enhancement‐based defect prediction framework (SFE‐DP), which augments the semantic feature set extracted from the program code with data. We also introduce a layer of self‐attentive mechanism and a matching layer to filter low‐efficiency and non‐critical semantic features in the model structure. Finally, we combine the idea of hybrid loss function to iteratively optimize the model parameters. Extensive experiments validate that SFE‐DP can outperform the baseline approaches on 90 pairs of CPDP tasks formed by 10 open‐source projects.

There is a severe class imbalance problem in defect datasets, with nondefective data dominating the distribution, making it easy to generate inaccurate software defect prediction models. Ensemble learning has been proven to be one of the best methods to solve class imbalance problem. Traditional ensemble prediction models usually ensemble the results of several base classifiers simply, and most of them only ensemble once, rarely consider the diversity of ensemble or the combination of ensemble learning and neural network. In order to explore whether the secondary ensemble of classifiers based on a diversity ensemble combined with neural network can improve the performance of defect prediction model, in this article, we propose a novel dual ensemble software defect prediction (DE-SDP) approach based on a diversity ensemble combined with neural network. In the first ensemble, we use cross-validation to build different subclassifiers, then, these subclassifiers are used to establish base ensemble classifiers with weighted average method. Through seven classification algorithms, seven base ensemble classifiers can be established. In the second ensemble, a neural network model and stacking are used to ensemble the base ensemble classifiers again. We have evaluated DE-SDP against other ensemble defect prediction methods on eight datasets of NASA MDP. The results show that our approach is superior to other ensemble approaches and effectively improves the performance of defect prediction model.

Malicious attack is a major factor to endanger the cyberspace security. The accurate detection of abnormal network traffic generated by malicious attacks can effectively detect potential malicious attacks and thus protecting the network security. However, the scale of abnormal network traffic is relatively small (i.e., there is a data imbalance phenomenon), which causes a significant decrease of detection accuracy. The introduction of CycleGAN model can effectively deal with the data imbalance phenomenon, but it suffers from semantic inconsistency, image distortion and lack of diversity. This paper proposes an abnormal network traffic detection model called CGSA-RNN that incorporates CycleGAN, self-attention mechanism and RNN to overcome the disadvantages of CycleGAN model, thereby accurately detecting abnormal network traffic. CGSA-RNN model first takes the advantage of style migration of CycleGAN to perform data augmentation for the small-scale abnormal network traffic, and then replaces the ReLU activation function with LeakyReLU in the CycleGAN generator to reduce the effects of artifacts and distortion in the generated images. In addition, a self-attention mechanism is introduced into the CycleGAN to help it to better capture important features, thereby further improving the data augmentation capability. Finally, CGSA-RNN uses the RNN model to detect abnormal network traffic. Extensive experimental results on two publicly available network traffic datasets show that compared with four advanced detection models based on data augmentation, the average precision, recall and F1-measure of CGSA-RNN model are improved by more than 2%.

Abstract Existing association-based outlier detection approaches were proposed to seek for potential outliers from huge full set of uncertain data streams ($UDS$), but could not effectively process the small scale of $UDS$ that satisfies preset constraints; thus, they were time consuming. To solve this problem, this paper proposes a novel minimal rare pattern-based outlier detection approach, namely Constrained Minimal Rare Pattern-based Outlier Detection (CMRP-OD), to discover outliers from small sets of $UDS$ that satisfy the user-preset succinct or convertible monotonic constraints. First, two concepts of ‘maximal probability’ and ‘support cap’ are proposed to compress the scale of extensible patterns, and then the matrix is designed to store the information of each valid pattern to reduce the scanning times of $UDS$, thus decreasing the time consumption. Second, more factors that can influence the determination of outlier are considered in the design of deviation indices, thus increasing the detection accuracy. Extensive experiments show that compared with the state-of-the-art approaches, CMRP-OD approach has at least 10% improvement on detection accuracy, and its time cost is also almost reduced half.

Summary Combinatorial testing (CT) is considered as a practical approach to detect software faults, which has arisen from the interaction between factors affecting the software behavior. However, most of the traditional algorithms on CT generation did not take advantage of the execution results of the earlier test cases, as well as neglect the impact of the nonequilibrium input parameter model (NE‐IPM) effect on redundant test cases, which bring a deleterious effect to the detection accuracy of the software faults. To solve these problems, we propose a novel CT approach with fuzzing strategy called CTAF. Based on the idea that fuzzing is performed during execution, CTAF exploits the execution results of earlier tests to provide guidance for subsequent test generation thereby reducing the redundant test cases without compromising the diversity of test cases. And then, we designed three experiments on real subjects of six open source software systems, and the experimental results show that the proposed CTAF approach can effectively improve the NE‐IPM effect and enhance the detection accuracy of software faults.

In recent years, the use of TLS (Transport Layer Security) protocol to protect communication information has become increasingly popular as users are more aware of network security. However, hackers have also exploited the salient features of the TLS protocol to carry out covert malicious attacks, which threaten the security of network space. Currently, the commonly used traffic detection methods are not always reliable when applied to the problem of encrypted malicious traffic detection due to their limitations. The most significant problem is that these methods do not focus on the key features of encrypted traffic. To address this problem, this study proposes an efficient detection model for encrypted malicious traffic based on transport layer security protocol and a multi-head self-attention mechanism called TLS-MHSA. Firstly, we extract the features of TLS traffic during pre-processing and perform traffic statistics to filter redundant features. Then, we use a multi-head self-attention mechanism to focus on learning key features as well as generate the most important combined features to construct the detection model, thereby detecting the encrypted malicious traffic. Finally, we use a public dataset to verify the effectiveness and efficiency of the TLS-MHSA model, and the experimental results show that the proposed TLS-MHSA model has high precision, recall, F1-measure, AUC-ROC as well as higher stability than seven state-of-the-art detection models.

The growing use of Android software has made mobile devices the main platform for information services such as mobile social media and financial services. Mobile software provides great convenience but also brings challenges to the software community. For example, mobile malware, a malicious software specifically designed to target mobile devices, creates security concerns for the business network and the data stored on it. Therefore, it is becoming more and more important to effectively identify and classify malware. Most of the current malware-classification methods rely on the specific (static/dynamic) behaviour information from Android software for improved malware-detection capability. Nevertheless, these methods cannot detect new types of fraud software due to the limited generalisability. To address these issues, this paper proposes the AMC-FN, i.e. an Android-based malware classification method using feature fusion and natural language processing technologies. The proposed AMC-FN aims to improve the dimension and performance of classification and also some specific functions of natural language processing, i.e. mutual information method, n-gram word segmentation and feature mapping. The AMC-FN framework improves the classification dimensions by leveraging the information from Android APK permission, API calls and realistic network traffic. Moreover, the framework also contains a novel multi-level feature fusion algorithm (MFFA) designed to improve the weighted feature fusion. To obtain better fine granularity and generalisability, the fusion features are used by the optimized SVM (Support Vector Machine) classifier for training. Our experimental measurements and comparisons show the improved performance based on the proposed AMC-FN framework.

Deep learning-based vulnerability detection frees human experts from the tedious task of defining features and allows for better detection capabilities. The common practice is to convert program code into vector representation for neural network model training. Since the length of the vector representation varies across program code, finding the optimal vector length is critical to ensuring detection accuracy. This paper proposes an adaptive search optimization algorithm for finding the optimal vector length. It sorts all the vector lengths obtained by word2vec and takes the vector length corresponding to the point where the trend changes from slow to fast as the output. We evaluate our algorithm on three publicly available datasets against state-of-the-art algorithms. The results show that, without significantly increasing the time overhead, our algorithm can more accurately choose an appropriate vector length instead of setting a value empirically or arbitrarily. Furthermore, it shows that while a larger vector length can usually produces a higher detection accuracy, the extra time overhead incurred often does not suffice to compensate for the corresponding accuracy improvement.

Coverage-guided Greybox fuzzing is regarded as a practical approach to detect software vulnerabilities, which targets to expand code coverage as much as possible. A common implementation is to assign more energy to such seeds which find new edges with less execution time. However, solely considering new edges may be less effective because some hard-to-find branches often exist in the complex code of program. Code complexity is one of the key indicators to measure the code security. Compared to the code with simple structure, the program with higher code complexity is more likely to find more branches and cause security problems. In this paper, we propose a novel fuzzing method which further uses code complexity to optimize power schedule process in AFL (American Fuzzy Lop) and AFLFAST (American Fuzzy Lop Fast). The goal of our method is to generate inputs which are more biased toward the code with higher complexity of the program under test. In addition, we conduct a preliminary empirical study under three widely used real-world programs, and the experimental results show that the proposed approach can trigger more crashes as well as improve the coverage discovery.

With the rapid development of computer technology, the cross-subject network components (CSNC) is widely used in software. However, the existing of vulnerabilities in CSNC may seriously affect the security of software, which attracts the attention of software tester. This paper proposes a formal-based vulnerability detection method called FVDM for CSNC to detect the security vulnerabilities and defects in the logic of components. The proposed FVDM firstly selects the singleton as the medium of abstract computation as well as uses the formal description language to construct a vulnerability propagation model; And then, the FVDM classifies the vulnerabilities into explicit and implicit vulnerabilities through analyzing the types of vulnerabilities, thereby designing the vulnerability detection algorithm for explicit vulnerabilities and implicit vulnerabilities respectively. The experimental results on several COM (Component Object Model) components show that the proposed FVDM can detect the buffer overflow as well as illegal access vulnerabilities in the components.

Abstract The recognition of malware in network traffic is an important research problem. However, existing solutions addressing this problem rely heavily on the source code and misrecognise vulnerabilities (i.e. incur a high false positive rate (FPR)) in some cases. In this paper, we initially use the K‐means clustering algorithm to extract malware patterns under user to root attacks in network traffic. Since the traditional K‐means algorithm needs to determine the number of clusters in advance and it is easily affected by the initial cluster centres, we propose an improved K‐means clustering algorithm (NIKClustering algorithm) for cluster analysis. Furthermore, we propose the use of self‐similarity and our improved clustering algorithm to recognise buffer overflow vulnerabilities for malware in network traffic. This motivates us to design and implement a recognition approach for buffer overflow vulnerabilities based on self‐similarity and our improved clustering algorithm, called Reliable Self‐Similarity with Improved K‐means Clustering (RSS‐IKClustering). Extensive experiments conducted on two different datasets demonstrate that the RSS‐IKClustering can achieve much fewer false positives than other notable approaches while increasing accuracy. We further apply our RSS‐IKClustering approach on a public dataset (Center for Applied Internet Data Analysis), which also exhibited a high accuracy and low FPR of 96% and 1.5%, respectively.

Cross-project software defect prediction solves the problem of insufficient training data for traditional defect prediction, and overcomes the challenge of applying models learned from multiple different source projects to target project. At the same time, two new problems emerge: (1) too many irrelevant and redundant features in the model training process will affect the training efficiency and thus decrease the prediction accuracy of the model; (2) the distribution of metric values will vary greatly from project to project due to the development environment and other factors, resulting in lower prediction accuracy when the model achieves cross-project prediction. In the proposed method, the Pearson feature selection method is introduced to address data redundancy, and the metric compensation based transfer learning technique is used to address the problem of large differences in data distribution between the source project and target project. In this paper, we propose a software defect prediction method with metric compensation based on feature selection and transfer learning. The experimental results show that the model constructed with this method achieves better results on area under the receiver operating characteristic curve (AUC) value and F1-measure metric.

The existence of outliers will reduce the reliability of original data streams, thus adversely affecting data-based operations. Through the interpretation and analysis of outliers, users can clarify the difference between the normal data and outliers, thus clearing outliers to improve the reliability of original data streams. However, there are few explanations and analyses on the reasons of outliers. The contribution of this paper is that we have designed a visual analysis system for outlier detection of data streams based on association, VooddS, which can reasonably explain and analyze outliers from two aspects of algorithm operation process and data distribution, and better show users why data instances are judged as outliers. VooddS system starts from the running process of the algorithm and designs a visual forms according to the running process of outlier detection algorithm, so as to reasonably explain the reason for determining outliers to users; From the point of view of data distribution, a combination of box graph, broken line and histogram is designed, and the correlation between data and outlier degree is analyzed from two levels of data attribute and data tuple, which helps users to explore the influence of context data on outlier judgment. In addition, the effectiveness of the system is verified by real data sets, and the results show that VooddS can reasonably explain abnormal values, and the interactive mode of the system can bring better experience to users.

Network intrusion detection identifies malicious activity in the network by analyzing the behavior of network traffic. As an important part of network intrusion detection, feature extraction plays a crucial role in improving the performance of intrusion detection. This research proposes a novel secondary feature extraction method called L-KPCA based on the Liner Discriminant Analysis (LDA) and Kernel Principal Component Analysis (KPCA), to provide efficient features for network intrusion detection. While maintaining the effectiveness of processing nonlinear data in network traffic, the use of LDA effectively compensates for the problem that KPCA only focuses on the analysis of features in terms of variance and ignores the performance of features in terms of mean. Extensive experimental results verify that the use of the proposed, L-KPCA can make the intrusion detection classification model perform better in terms of recognition accuracy and recall.

Network intrusion detection plays an important role in the network security, but the increasingly complex network environment brings a serious challenge to intrusion detection. Although the existing efficient Convolutional Neural Network (CNN)-based network traffic intrusion detection models do not require manual design of the traffic features, but they do not make full use of the structured information of network traffic. In this paper, we propose a novel network intrusion detection model based on Temporal Convolutional Networks (TCN), it extracts the key features in the dataset through exploiting the characteristics of byte sequence in the network traffic packets. Compared with traditional recurrent neural networks (RNN), TCN shows a better performance in sequence modeling tasks and it can process the sequences in parallel for faster training. To solve the problem of poor detection accuracy caused by the “death” of some neurons on ReLU during the training stage, we use the ELU activation function in the TCN instead of ReLU. Finally, we compare our proposed TCN-based intrusion detection model with the state-of-the-art methods on the CTU public dataset, and the experimental results show that the use of TCN can obtain higher performance within less time consumption, in terms of higher average accuracy, higher average recall and higher average F1-measure.

To find software vulnerabilities using software vulnerability detection technology is an important way to ensure the system security. Existing software vulnerability detection methods have some limitations as they can only play a certain role in some specific situations. To accurately analyze and evaluate the existing vulnerability detection methods, an integrated testing and evaluation system (iTES) is designed and implemented in this paper. The main functions of the iTES are:(1) Vulnerability cases with source codes covering common vulnerability types are collected automatically to form a vulnerability cases library; (2) Fourteen methods including static and dynamic vulnerability detection are evaluated in iTES, involving the Windows and Linux platforms; (3) Furthermore, a set of evaluation metrics is designed, including accuracy, false positive rate, utilization efficiency, time cost and resource cost. The final evaluation and test results of iTES have a good guiding significance for the selection of appropriate software vulnerability detection methods or tools according to the actual situation in practice.

The process of component security testing can produce massive amounts of monitor logs. Current approaches to detect implicit security exceptions (those which cannot be identified by visual inspection alone) compare correct execution sequences with fixed patterns mined from the execution of sequential patterns in the monitor logs. However, this is not efficient and is not suitable for mining large monitor logs. To enable effective mining of implicit security exceptions from large monitor logs, this paper proposes a method based on improved variable-length sequential pattern mining. The proposed method first mines the variable-length sequential patterns from correct execution sequences and from actual execution sequences, thus reducing the number of patterns. The sequential patterns are then detected using the Sunday string-searching algorithm. We conducted an experimental study based on this method, the results of which show that the proposed method can efficiently detect the implicit security exceptions of components.