With the rapid development of the Ethereum platform, phishing fraud has become increasingly rampant, posing significant security risks to both users and the platform. However, existing phishing fraud detection methods are manually designed, requiring substantial human effort, and are unable to adapt to diverse detection scenarios. In this article, we propose phishing detection on Ethereum via graph neural architecture search of transaction subgraph (PETS-GNAS). The phishing detection problem on Ethereum is transformed into a graph classification task, where accounts and transactions are represented as nodes and edges, respectively. Specifically, we acquire account labels and their corresponding transaction information from credible sources and then extract transaction subgraphs centered on labeled accounts as datasets. Subsequently, we introduce a mapping mechanism to extend these transaction subgraphs into corresponding temporal transaction subgraph (TTSG), encoding transaction attributes during the TTSG construction process. Then, graph neural architecture search (GNAS) strategy that incorporates early stopping and L2 regularization is proposed to enhance the feasibility and accuracy of Ethereum phishing detection by avoiding redundant parameters and complex architectures. Extensive experimental results demonstrate that PETS-GNAS achieves strong performance in phishing detection tasks, enabling early and accurate identification of phishing accounts.

Industrial control protocols (ICPs) play a significant role in ensuring dependable interconnection among devices in industrial environments. Protocol reverse engineering (PRE) techniques are commonly used to analyze a large number of agnostic and proprietary protocols based on network traffic traces or programs. However, conventional PRE methods face several challenges in reversing ICPs with complex data representations that contain rich structural features. In this work, we present a new perspective on message representation using the graph, and design a syntax inference framework for ICPs reverse analysis (InSyfer). Specifically, we propose a novel method to construct a single message graph for entire traces, automatically extracting syntactical similarity features. We also design an adaptive message clustering model that abstracts the clustering problem into a binary pairwise-classification framework to judge whether pairs of messages belong to the same groups and jointly optimizes it with feature extraction. The above design enables InSyfer to accurately identify message types and greatly improves the correctness of protocol format inference. We conduct extensive experiments to verify the effectiveness of InSyfer. Evaluations of four standard ICPs and two unknown protocols demonstrate that InSyfer outperforms the state-of-the-art PRE methods.

Reverse engineering of agnostic industrial control protocols (ICPs) based on traffic traces is significant for the security analysis of industrial control systems. Field semantics deduction is an essential step in protocol reverse engineering following the discovery of the message field. Most existing methods rely on knowledge-based analysis for specific fields of common protocols, which require too numerous assumptions and lack semantic knowledge about ICPs. In this paper, we propose a new concept, pattern series, and design the first classification framework for inferring the semantic types of unknown ICPs. Specifically, we first present the definition of pattern series and design the field pattern series generation algorithm for building training data, then develop a field semantics classification model to learn and apply semantic features from known protocols to predict semantic types in unknown protocols. Lastly, we implement a probability-maximizing selection algorithm to obtain optimal semantic types. We demonstrate the effectiveness of the proposed method through extensive experiments with five popular ICPs, including their mixed protocols. Evaluations show that our approach significantly outperforms baseline methods in field semantic recognition, achieving ≥90.8% F1-score.

Pedestrian dead reckoning (PDR) based on inertial measurement units (IMU) is widely applied due to its robustness and low requirements for wear. However, traditional PDR methods only estimate forward motion, and cannot accurately position in backward and sideward walking gaits. To this end, we propose a multi-gait PDR method based on heuristic motion direction estimation (HMDE). Firstly, we propose a method for efficient data collection and then implement a neural network model to accurately estimate step length across different gaits. Building upon this, we construct a model to estimate relative direction based on IMU data, and put forward a method to estimate forward direction by making multi-rule judgments on relative motion direction and heading angle. Experimental results demonstrate the potential of this method to improve PDR accuracy across mixed gait of walking forward, sidestepping and walking backward, and the positioning accuracy is accurate to within 4% of the total distance.

The Industrial Internet of Things (IIoT) offers the manufacturing sector opportunities for transformation and upgrade but also carries significant security risks. Traditional federated learning (FL) as a potential security solution is challenging in complicated application environments with heterogeneous data, imbalanced data, and poisoning attacks. To address these challenges, we construct a clustered FL Framework for IIoT intrusion detection (CFL-IDS) based on local models’ evaluation metrics (EMs). First, we designed an intrusion detection model with a dynamic focal loss (DFL) for all edge nodes (ENs). This model’s performance is enhanced under various imbalanced data partitions by dynamically altering the focus on samples during the loss minimization training process. Second, the time series of EMs of local models to reflect the data distribution of ENs implicitly, and use clustering algorithms to facilitate knowledge sharing among those ENs with similar data distribution to co-optimize a common model for them. Finally, an intelligent cooperative model aggregation mechanism (ICMAM) adaptively adjusts each local model’s weight distribution, which substantially improves the benefits of FL and alleviates subpar models’ alleviates interference from subpar models to FL. Experiments demonstrate that CFL-IDS has stronger robustness and displays superior performance under data imbalance and non-independent and identically distributed (non-IID) situations while being effective against poisoning attacks.

Honeypots have proven to be an effective defense method for industrial control systems (ICSs). However, as attacker skills become more sophisticated, it becomes increasingly difficult to develop honeypots that can effectively recognize and respond to such attacks. In this article, we propose a neural network-based ICS honeypot scheme named NeuPot that improves security from two aspects: 1) honeypot interaction; and 2) cyber threats detection capability. NeuPot can respond to attacker requests depending on a specific industrial scenario without constant communication with the ICS and detect malicious traffic. To create this honeypot scheme, a new seq2seq time-series forecast model guided by Huber loss is designed to simulate the long-term changes in actual ICS physical processes. Second, a Modbus honeypot framework is created to react to changes in these ICS physical processes in their interactions with attackers and to capture various cyber threats against the ICS. Further, a novel loss function for industrial protocol-level malicious traffic detection is devised to identify known and unknown threats. According to our experiments, the proposed honeypot scheme is highly effective and outperforms state-of-the-art schemes in terms of interactivity and in detecting cyber threats.

Abstract A two-branch convolutional neural network (CNN) architecture for feature extraction in person re-identification (re-ID) based on video surveillance is proposed. Highly discriminative person features are obtained by extracting both global and local features. Moreover, an adaptive triplet loss function based on the original triplet loss function is proposed and is used in the network training process, resulting in a significantly improved learning efficiency. The experimental results on open datasets demonstrate the effectiveness of the proposed method.