With the continuous evolution of the Internet, as well as the development of the Internet of Things, smart terminals, cloud platforms, and social platforms, botnets showing the characteristics of platform diversification, communication concealment, and control intelligence. This survey analyzes and compares the most important efforts in the botnet detection area in recent years. It studies the mechanism characteristics of botnet architecture, life cycle, and command and control channel and provides a classification of botnet detection techniques. It focuses on the application of advanced technologies such as deep learning, complex network, swarm intelligence, moving target defense (MTD), and software-defined network (SDN) for botnet detection. From the four dimensions of service, intelligence, collaboration, and assistant, a common bot detection evaluation system (CBDES) is proposed, which defines a new global capability measurement standard. Combing with expert scores and objective weights, this survey proposes quantitative evaluation and gives a visual representation for typical detection methods. Finally, the challenges and future trends in the field of botnet detection are summarized.

With the continuous influx of application software onto the application software market, achieving accurate software recommendations for users in the huge software application market is urgent. To address this issue, each application software market currently provides its own classification tags. However, several problems still exist, such as the lack of objectivity, hierarchy, and standardization in these classifications, which in turn affects the accuracy of precise software recommendations. Accordingly, a customized BERTopic model is proposed to cluster the software description texts of the application software and the automatic tagging and updating of the application software tags are realized according to the clusters obtained by topic clustering and the extracted subject words. At the same time, a data enhancement method based on the c-TF-IDF algorithm is proposed to solve the problem of imbalance of datasets, and then the classification model based on the BERT-BiLSTM model is trained on the labeled datasets to classify the software in the dimension of the application function, so as to realize the accurate software recommendation for users. Based on the experimental verification of two datasets, 21 categories in the SourceForge dataset and 19 categories in the Chinese App Store dataset are subclassed by the clustering results of the customized BERTopic model, and the tags of 138 subclasses and 262 subclasses are formed, respectively. In addition, a complete tagged software description text dataset is constructed and the software tags are updated automatically. In the first stage of the classification experiment, the weighted average accuracy, recall rate, and F1 value can reach 0.92, 0.91, and 0.92, respectively. In the second stage, the weighted average accuracy, recall rate, and F1 value can all reach 0.96. After data enhancement, the weighted average F1 value of the classification model can be increased by up to two percentage points.

Predicting function names in stripped binaries, which requires succinctly summarizing semantics of binary code in natural languages, is a crucial but challenging task. Recently, many machine learning based solutions have been proposed. However, they have poor generalizability, i.e., fail to handle unseen binaries. To advance the state of the art, we present large assembly language Model ( llasm ) , a novel framework which fuses encoder-only and decoder-only LLMs for function name prediction. It refines encoder-only models to preserve more binary information and learn better binary representations. Then it adopts a novel architecture to project the encoding to the input space of a decoder-only natural language model, which enables it to have better capability of inferring general knowledge and better generalizability. We have evaluated llasm in the BinaryCorp and Debin datasets. llasm outperforms the state-of-the-art function name prediction tools by up to 19.9%, 40.7%, and 36.5% in precision, recall, and F1 score, with significantly better generalizability in unseen binaries. Our case studies further demonstrate the practical use cases of llasm in analyzing real-world malware, showing the usefulness of function name prediction.

Tunnels, a key technology of traffic obfuscation, are increasingly being used to evade censorship. While providing convenience to users, tunnel technology poses a hidden danger to cybersecurity due to its concealment and camouflage capabilities. In contrast to previous studies of encrypted traffic detection, we perform the first measurement study of tunnel traffic and its unique characteristics and focus on the challenges and solutions in detecting tunnel traffic among traditional and machine learning techniques. This study covers an almost twenty-year research period from 2003 to 2022. First, we present the concepts of two types of tunnels, broad and narrow tunnels, respectively, as well as a framework for major tunnel applications, such as Tor (the second-generation onion router), proxy, VPN, and their relationships. Second, we analyze state-of-the-art methods from traditional to machine learning applications to systematize tunnel traffic detection, including HTTP, HTTPS, DNS, SSH, TCP, ICMP and IPSec. A quantitative evaluation is presented with five crucial indicators applied to the detection methods and reviews. We further discuss the research work based on datasets, feature engineering, and challenges that have are solved, partly solved and unsolved. Finally, by providing open questions and the potential directions, we hope to inspire future work in this area.

Penetration Testing (PT) is an effective proactive security technique that simulates hacker attacks to identify vulnerabilities in networks or systems. However, traditional PT relies on specialized experience and costs extraordinary time and effort. With the advancement of artificial intelligence technologies, automated PT has emerged as a promising solution, attracting attention from researchers increasingly. In automated PT, penetration path planning is a core task that involves selecting the optimal attack paths to maximize the overall efficiency and success rate of the testing process. Recent years have seen significant progress in the field of penetration path planning, with diverse methods being proposed. This survey aims to comprehensively examine and summarize the research findings in this domain. Our work first outlines the background and challenges of penetration path planning and establishes the framework for research methods. It then provides a detailed analysis of existing studies from three key aspects: penetration path planning models, penetration path planning methods, and simulation environments. Finally, this survey offers insights into the future development trends of penetration path planning in PT. This paper aims to provide comprehensive references for academia and industry, promoting further research and application of automated PT path planning methods.