The APT attack on the Internet is becoming more serious, and most of intrusion detection systems can only generate alarms to some steps of APT attack and cannot identify the pattern of the APT attack. To detect APT attack, many researchers established attack models and then correlated IDS logs with the attack models. However, the accuracy of detection deeply relied on the integrity of models. In this paper, we propose a new method to construct APT attack scenarios by mining IDS security logs. These APT attack scenarios can be further used for the APT detection. First, we classify all the attack events by purpose of phase of the intrusion kill chain. Then we add the attack event dimension to fuzzy clustering, correlate IDS alarm logs with fuzzy clustering, and generate the attack sequence set. Next, we delete the bug attack sequences to clean the set. Finally, we use the nonaftereffect property of probability transfer matrix to construct attack scenarios by mining the attack sequence set. Experiments show that the proposed method can construct the APT attack scenarios by mining IDS alarm logs, and the constructed scenarios match the actual situation so that they can be used for APT attack detection.

Sparse Bayesian learning (SBL) is applied to the coprime array for underdetermined wideband direction of arrival (DOA) estimation. Using the augmented covariance matrix, the coprime array can achieve a higher number of degrees of freedom (DOFs) to resolve more sources than the number of physical sensors. The sparse-based DOA estimation can deteriorate the detection and estimation performance because the sources may be off the search grid no matter how fine the grid is. This dictionary mismatch problem can be well resolved by the SBL using fixed point updates. The SBL can automatically choose sparsity and approximately resolve the non-convex optimizaton problem. Numerical simulations are conducted to validate the effectiveness of the underdetermined wideband DOA estimation via SBL based on coprime array. It is clear that SBL can obtain good performance in detection and estimation compared to least absolute shrinkage and selection operator (LASSO), simultaneous orthogonal matching pursuit least squares (SOMP-LS) , simultaneous orthogonal matching pursuit total least squares (SOMP-TLS) and off-grid sparse Bayesian inference (OGSBI).

With the improvement of steganography, the difference of statistical distribution caused by information hiding is getting smaller and smaller, increasing the difficulty of steganalysis. The existing steganalysis models value different features equally, while the differences in the importance of high-dimensional features are ignored. That is the influences of feature quality on model performance are not considered. To fill the gap, a novel linguistic steganalysis by enhancing and integrating local and global features is proposed in this letter. It extracts and integrates the features of two dimensions, namely local semantic features and global long-term dependencies, to construct a joint feature map. Then, to improve the quality of features, a group-wise enhancement mechanism is employed, which divides features into multiple groups, enhancing important features in each group while weakening the less important ones by generating an important coefficient for each sub-feature in each semantic group. Finally, the enhanced features are used to further extract high-quality text representation to help the classification module distinguish cover and stego texts more accurately. The experimental results show that the proposed model has better detection performance in multiple hidden scenarios. The ablation experiment manifests that using integrated and enhanced features to extract high-quality text representations can effectively improve the discrimination ability of the model.

While encryption ensures the confidentiality and integrity of user data, more and more attackers try to hide attack behaviours through encryption, which brings new challenges to malicious traffic identification. How to effectively detect encrypted malicious traffic without decrypting traffic and protecting user privacy has become an urgent problem to be solved. Most of the current research only uses a single CNN, RNN, and SAE network to detect encrypted malicious traffic, which does not consider the forward and backward correlation between data packets, so it is difficult to effectively identify malicious features in encrypted traffic. This study proposes an approach that combines spatial-temporal feature with dual-attention mechanism, which is called TLARNN. Specifically, first we use 1D-CNN and BiGRU to extract spatial features in encrypted traffic packets and temporal features between encrypted streams, respectively, which enriches the features of different dimensions, and then, the soft attention mechanism is focused on the encrypted data packets to extract features. Ultimately, the second layer of the soft attention mechanism is used for aggregating malicious features. Several comparative experiments are designed to prove the effectiveness of the proposed scheme. The experimental results demonstrate that the proposed scheme has a significant performance improvement compared to existing ones.

With the development of deepfake technology, deepfake detection has received widespread attention. Although some deepfake forensics techniques have been proposed, they are still very difficult to implement in real-world scenarios. This is due to the differences in different deepfake technologies and the compression or editing of videos during the propagation process. Considering the issue of sample imbalance with few-shot scenarios in deepfake detection, we propose a multi-feature channel domain-weighted framework based on meta-learning (MCW). In order to obtain outstanding detection performance of a cross-database, the proposed framework improves a meta-learning network in two ways: it enhances the model’s feature extraction ability for detecting targets by combining the RGB domain and frequency domain information of the image and enhances the model’s generalization ability for detecting targets by assigning meta weights to channels on the feature map. The proposed MCW framework solves the problems of poor detection performance and insufficient data compression resistance of the algorithm for samples generated by unknown algorithms. The experiment was set in a zero-shot scenario and few-shot scenario, simulating the deepfake detection environment in real situations. We selected nine detection algorithms as comparative algorithms. The experimental results show that the MCW framework outperforms other algorithms in cross-algorithm detection and cross-dataset detection. The MCW framework demonstrates its ability to generalize and resist compression with low-quality training images and across different generation algorithm scenarios, and it has better fine-tuning potential in few-shot learning scenarios.

Deep neural networks (DNNs) have achieved great success in various applications due to their strong expressive power. However, recent studies have shown that DNNs are vulnerable to adversarial examples, and these manipulated instances can mislead DNN into making false predictions. The existing methods of generating adversarial examples include pixel-level perturbation or spatial transformation of images, which cannot consider concurrently with the semantic quality of adversarial examples or success rate of attack. These methods are computationally bulky and slow to generate the adversarial examples. To solve this kind of issue, a two-stage generative adversarial networks (TSGAN) with semantic content constraints is proposed in this paper. The first-stage uses the original example dataset to train generator $G$ , which can help the generator learn the distribution of real examples. Then, the example semantic quality constraint loss function, the adversarial loss function and the distance loss function are adopted in the second-stage, so that the generator $G$ can continue to learn to search the distribution of the adversarial examples, and train the new generator $G_{adv} $ . The adversarial examples generated by generator $G_{adv} $ are better fit the distribution of real examples, and have targeted black-box attack capability. The experiments show that the adversarial examples generated by TSGAN can achieve the success rate of attack at 98.40% in target model, 29.40% success rate in defense-oriented model. And 77.58% success rate is obtained in the transfer test attack. The results show that the adversarial examples generated by the proposed model, which has a highly attack success rate and more difficult to defense. Meanwhile, the improved adversarial examples have stronger transfer ability than the existing models. The proposed model can effectively reduce the expression of target category features of the adversarial examples, and the generated adversarial examples have better semantic quality than others.