Large language models (LLMs) demonstrate remarkable capabilities in various complex language tasks, yet they face significant reliability challenges, including factual inaccuracies and generated biases. Uncertainty quantification (UQ) plays a pivotal role in assessing model trustworthiness, particularly for high-stakes applications. However, current UQ methods for LLMs encounter computational efficiency bottlenecks due to their reliance on extensive sampling or external model invocations. In this work, we introduce a novel, sampling-free uncertainty quantification framework centered on hidden layer representation analysis. Our method facilitates real-time uncertainty quantification by modeling hierarchical internal semantic dynamics during the generation process. Through comprehensive experiments on multiple QA datasets and diverse model scales, we show that our approach consistently outperforms existing uncertainty quantification techniques in distinguishing correct from incorrect generations. Our results reveal that analyzing the dynamic evolution of hidden states provides a potent and computationally efficient signal for uncertainty quantification, directly from the model's internal workings, surpassing methods that depend solely on output probabilities or approximations via multiple samples.

Edge collaboration is expected to effectively relieve the load of base stations and enhance the driving experience of autonomous vehicles (AVs). However, in existing edge collaboration schemes, the frequent information exchange between AVs will consume a significant amount of resources. In addition, the existing schemes ignore the types of services, where services with different types may be combined into a composite service which affects the utility of AVs. To this end, we consider various types of services in autonomous vehicular networks (AVNs) and propose a digital twin (DT)-enabled edge collaboration scheme for composite services. Specifically, we first divide the DTs of service requesters (DT-SRs) into service request groups (SRGs) based on the same basic service requests and propose an architecture to facilitate the edge collaboration between the DTs of the leaders of SRGs (DT-L-SRGs) and the DTs of the service providers (DT-SPs). In this architecture, different service composition forms will result in different resource purchase strategies for DT-L-SRGs and different resource pricing strategies for DT-SPs. Therefore, we model the process of service composition as a coalition game to determine the optimal service composition form for each basic service. In the process of the coalition game, in order to obtain the optimal resource purchase strategy for each DT-L-SRG and the optimal resource pricing strategy for each DT-SP under different coalition structures, the interaction between the DT-L-SRGs and the DT-SPs is formulated as a Stackelberg game. By obtaining the game equilibrium, the optimal strategies of each DT-L-SRG and each DT-SP can be determined to measure the performance of the given coalition structure until a stable and optimal composite service structure is finally formed through multiple rounds of iterations. Compared with traditional schemes, the simulation results demonstrate that our scheme can bring the highest utilities to both the SRs and the SPs.

Identifying and blocking malicious domains is one of the most direct and effective ways to combat malicious websites. In recent years, tools and technologies such as domain registration services, code repositories, and Domain-Flux have been exploited to generate malicious websites, enabling them to quickly "reincarnate" after being identified and shut down. Detecting methods for such malicious website domains are gradually shifting from the Belief Propagation (BP) algorithm to the Graph Neural Network (GNN) algorithm because the latter excels at aggregating neighboring node information to integrate node representations and graph embeddings. However, cloud services, Content Delivery Network (CDN), and Carrier-Grade Network Address Translation (CGNAT) often lead to benign-malicious co-location for domains, causing miscommunication in messages passing based on domain association relationships, thus reducing detection accuracy. To overcome this limitation, this paper proposes a malicious website domain detection algorithm based on one Multi-Message Passing Heterogeneous Neural Network (HMPN) framework. We apply this method to real-world network traffic scenarios and find that it achieves a Macro-Average F1 score of 91.70%, outperforming the baselines. We further conduct a measurement and analysis of the malicious websites’ industrial characteristics to better explore and detect malicious websites.

The explosive growth of video traffic has brought major challenges for network providers to improve user experience. On account of traffic encryption, network providers need to identify encrypted video traffic first before adopting optimization approaches to them. Traditional encrypted video traffic identification methods try to reveal the pattern of video traffic by using statistical features, which are not robust enough in different network environments. Some sophisticated graph-based methods recently have shown their advantages for encrypted traffic identification. However, these works lack optimization when it comes to the video streaming scenario. Inspired by these works, we propose GraphV, a GNN-based approach for identifying encrypted video traffic. Specifically, we construct an information-rich graph structure enhanced by unique features of video transmission. Then the embedding representation of each graph can be obtained through a Bi-LSTM layer added to all the sequential nodes embedding on this graph. The experiments on a well-known dataset and two open-world datasets from different network environments we collected show that GraphV outperforms the existing methods, especially on the generalization ability of the model.

The rapid development of pornographic and gambling websites, fueled by the widespread abuse of information technology, has become a growing concern. They pose a serious threat to the physical and mental health of children and can also endanger personal property. Therefore, it is necessary to detect them. However, pornographic and gambling websites become more and more tricky, which shows fake-normal to evade censorship and challenges traditional content-based detection methods. Therefore, it is essential to rely on information about relationships between websites.We propose HMAN, one Multi-Attention Heterogeneous Graph Neural Network (HGNN) model to detect pornographic and gambling websites by integrating content features and structural information, even if they present fake-normal. By one multi-attention mechanism consisting of explicit weight, self-attention and attention mechanism, content features can be selectively utilized with the assistance of structural information. The experimental results show that our method achieves the best 95.1% Macro-Avg-F1 and outperforms all baselines. We also illustrate that all extracted metapaths do contribute to the detection, where the hyperlink, title/meta terms and IP address are relatively important.

With the widespread abuse of information technology, pornographic and gambling websites develop rapidly. They affect the physical and mental health of children and endanger personal property. Therefore, it is necessary to detect them. However, the existing detection methods ignored that imperfect datasets are common in the scenario of pornographic and gambling websites which are hence adverse to the detection. Those imperfections specifically include sparse samples, mismatch and imbalanced datasets. In addition, over-reliance on visual features incurred high overhead.To overcome these shortcomings, we innovatively propose a lightweight graph-based method to detect pornographic and gambling websites through semi-supervised learning of textual content. The semi-supervised learning is to solve sparse samples and mismatch datasets, while the graph-based approach can combine the semi-supervised part with community discovery to deal with imbalanced datasets. Specifically, we perform the detection process with the utilization of modified TF-IDF and Louvain during the iteration and updating by the EM algorithm. The experimental results show that our method achieves the best 92.01% Macro-Avg-F1 with the shortest CPU time and outperforms all baselines. We also illustrate that the designed components in our model do contribute to the detection.

Collaborative driving can significantly reduce the computation offloading from autonomous vehicles (AVs) to edge computing devices (ECDs) and the computation cost of each AV. However, the frequent information exchanges between AVs for determining the members in each collaborative group will consume a lot of time and resources. In addition, since AVs have different computing capabilities and costs, the collaboration types of the AVs in each group and the distribution of the AVs in different collaborative groups directly affect the performance of the cooperative driving. Therefore, how to develop an efficient collaborative autonomous driving scheme to minimize the cost for completing the driving process becomes a new challenge. To this end, we regard collaboration as a service and propose a digital twins (DT)-based scheme to facilitate the collaborative and distributed autonomous driving. Specifically, we first design the DT for each AV and develop a DT-enabled architecture to help AVs make the collaborative driving decisions in the virtual networks. With this architecture, an auction game-based collaborative driving mechanism (AG-CDM) is then designed to decide the head DT and the tail DT of each group. After that, by considering the computation cost and the transmission cost of each group, a coalition game-based distributed driving mechanism (CG-DDM) is developed to decide the optimal group distribution for minimizing the driving cost of each DT. Simulation results show that the proposed scheme can converge to a Nash stable collaborative and distributed structure and can minimize the autonomous driving cost of each AV.

As a crucial internet infrastructure, Content Delivery Network (CDN) is widely deployed. Detecting CDN-hosted nodes from network traffic is important for Quality of Service (QoS), malware detection and firewall rule-sets. Current researches use hand-crafted rules, classification or clustering methods. However, those methods relying on plaintext are limited by the invisibility of plaintext due to encryption, as well as the limitations of DNS Resource Records, such as unreliability. Besides, those methods don't dig the structural information of domains and IPs. To overcome those shortcomings, we present CDNFinder, a novel method to detect CDN-hosted nodes by graph-based semi-supervised classification. Based on the active datasets collected in 10 vantage points, we construct the graph and extract innovative attributes. By modifying Graph Neural Network (GNN), CDNFinder outperforms classical machine learning methods, especially in recall rate (around 98%). Meanwhile, CDNFinder shortens the runtime of classical GNN algorithm by about 31% with no loss in metrics.

Deep Convolutional Neural Networks (DCNN), despite imitating the human visual system, present no such decision credibility as human observers. This phenomenon, therefore, leads to the limitations of DCNN's applications in the security and trusted computing, such as self-driving cars and medical diagnosis. Focusing on this issue, our work aims to explore the way DCNN makes decisions. In this paper, the major contributions we made are: firstly, provide the hypothesis, “point-wise activation” of convolution function, according to the analysis of DCNN's architectures and training process; secondly, point out the effect of “point-wise activation” on DCNN's uninterpretable classification and pool robustness, and then suggest, in particular, the contradiction between the traditional and DCNN's convolution kernel functions; finally, distinguish decision-making interpretability from semantic interpretability, and indicate that DCNN's decision-making mechanism need to evolve towards the direction of semantics in the future. Besides, the “point-wise activation” hypothesis and conclusions proposed in our paper are supported by extensive experimental results.