The rich semantic information in Control Flow Graphs (CFGs) of executable programs has made Graph Neural Networks (GNNs) a key focus for malware detection. However, existing CFG-based detection techniques face limitations in node feature extraction, such as information loss, neglect of execution sequence information, and redundancy in representation vectors. These limitations compromise the balance between high efficiency and precision when training detectors. Addressing this, we introduce an innovative Malware CFG Node Embedding (MalGNE) method. This approach utilizes a novel instruction encoding rule to address the Out-Of-Vocabulary(OOV) problem, generates high-quality initial vectors. Then, it employs aggregation layer and sequence layer to extract node aggregation feature and execution sequence feature, in conjunction with GNNs to develop a pre-trained node embedding model. The model maps the semantic information of node assembly instruction sequences into a compact, low-dimensional continuous space, ensuring high-quality feature extraction, and enhancing the performance and efficiency of the detector. We trained the MalGNE model using the BIG 2015 dataset and validated MalGNE-enhanced detector on the SOREL-20M and BODMAS datasets. MalGNE-enhanced detector demonstrates outstanding performance and efficiency in low-dimensional spaces, especially when the dimensionality of the node feature vector is reduced to 16. MalGNE-enhanced detector not only maintains a high detection accuracy of 95.49%. sacrificing only about 1.7% of accuracy to save approximately 73% of training time compared to 128 dimensions.
The emerging Industrial Internet of Things (IIoT) provides industries with an opportunity to collect, aggregate, and analyze data from sensors, including motion control, machine‐to‐machine communication, predictive maintenance, smart energy grid, big data analysis, and other smart connected medical systems. The physical systems and the cyber systems are organically integrated, forming an interdependent IIoT. This system provides us with enormous advantages, but at the same time, it also introduces the main safety challenges in the design and operation phase. To exploit the security threats of IIoT systems, in this paper, we propose a novel security‐by‐design approach for interdependent IIoT environments across two different levels, namely, theory modeling and runtime simulation. Our method theoretically analyzes the cascading failure dynamics of the intentional attack network. Simultaneously, we verified the theoretical results through simulations and gave the risk factors that affect the system’s security to mitigate potential security attack threats. Besides, we prove its applicability through comparative simulation experiments to study application environments that rely on IIoT, which shows that our method helps identify risk factors and mitigate IIoT attacks’ mechanism.
6 December 2023 in IEEE Transactions on Dependable and Secure Computing
Designing a query-efficient attack strategy to generate high-quality adversarial examples under the hard-label black-box setting is a fundamental yet challenging problem, especially in natural language processing (NLP). The process of searching for adversarial examples has many uncertainties (e.g., an unknown impact on the target model's prediction of the added perturbation) when confidence scores cannot be accessed, which must be compensated for with a large number of queries. To address this issue, we propose TextCheater, a decision-based metaheuristic search method that performs a query-efficient textual adversarial attack task by prohibiting invalid searches. The strategies of multiple initialization points and Tabu search are also introduced to keep the search process from falling into a local optimum. We apply our approach to three state-of-the-art language models (i.e., BERT, wordLSTM, and wordCNN) across six benchmark datasets and eight real-world commercial sentiment analysis platforms/models. Furthermore, we evaluate the Robustly optimized BERT pretraining Approach (RoBERTa) and models that enhance their robustness by adversarial training on toxicity detection and text classification tasks. The results demonstrate that our method minimizes the number of queries required for crafting plausible adversarial text while outperforming existing attack methods in the attack success rate, fluency of output sentences, and similarity between the original text and its adversary.
3 October 2025 in IEEE Transactions on Reliability
In the real world, the stable operation of a network is usually inseparable from the mutual support of other networks. In such an interdependent network, a node in one layer may depend on multiple nodes in another layer, forming a complex one-to-many dependence relationship. Meanwhile, there may also be higher-order interactions between multiple nodes within a layer, which increase the connectivity within the layer. Interlayer dependencies and intralayer connectivity may become key factors affecting network reliability, because failures within a layer will propagate to another layer through dependencies, and the cascading effects within and between layers may trigger catastrophic network collapse. However, existing research on one-to-many interdependence often neglects intralayer higher-order structures and lacks a unified theoretical framework for interlayer dependencies. Moreover, current research on interdependent higher-order networks typically assumes idealized one-to-one interlayer dependencies, which does not reflect the complexity of real-world systems. These limitations hinder a comprehensive understanding of how such networks withstand failures. Therefore, this article investigates the robustness of one-to-many interdependent higher-order networks under random attacks. Depending on whether node survival requires at least one dependence edge or multiple dependence edges, we propose four interlayer interdependence conditions and analyze the network’s robustness after cascading failures induced by random attacks. Using percolation theory, we establish a unified theoretical framework that reveals how higher-order interaction structures within intralayers and interlayer coupling parameters affect network reliability and system resilience. In addition, we extend our study to partially interdependent hypergraphs. We validate our theoretical analysis on both synthetic and real-data-based interdependent hypergraphs, offering insights into the optimization of network design for enhanced reliability.
In the real Internet of Everything scenario, many large-scale information systems can be converted into interdependent sensor networks, such as smart grids, smart medical systems, and industrial Internet systems. These complex systems usually have multiple interdependent sensor networks. Small faults or failure behaviors between networks may cause serious cascading failure effects of the entire system. Therefore, in this paper, we will focus on the security of interdependent sensor networks. Firstly, by calculating the size of the largest functional component in the entire network, the impact of random attacks on the security of interdependent sensor networks is analyzed. Secondly, it compares and analyzes the impact of cascading failures between interdependent sensor networks under different switching edge strategies. Finally, the simulation results verify the effect of the security of the system under different strategies, and give a better exchange strategy to enhance the security of the system. In addition, the research work in this article can help design how to further optimize the topology of interdependent sensor networks by reducing the impact of cascading failures.