Abstract-Due to the harsh deployment environment of the underwater coustic sensor networks (UASNs), a reliable and energy-saving routing algorithm has always been an important challenge and a hot topic. A Non-uniform Clustering (NC) algorithm is designed first in which clusters are genetated according to different node densities. Based on NC, the backbone of the underwater acoustic sensor network is formed in UASNs. To guarantee the reliability of data transmission of the backbone network, a Non-uniform Clustering Routing algorithm based on Virtual Gravitational Potential Field (NC_RVGPF) is proposed. This algorithm (1) establishes a virtual gravitational potential field model to allow data transmission by three-dimensional underwater nodes, (2) designs the virtual gravitational potential energy by combining the transmission distance between the nodes, the residual energy of the nodes, and other parameters, and (3) selects the path of the highest average potential energy as being the optimal path of data transmission. The simulation results show that compared with the classical routing algorithm, NC_RVGPF algorithm has higher transmission efficiency, less energy consumption, and can more effectively extend the network’s lifetime.

With the focus on network security and the goal of meeting the requirements of fast speed and high accuracy of abnormal traffic detection of industrial Internet of Things, this paper proposes a hierarchical abnormal traffic detection method for the industrial Internet of Things. This method includes two abnormal detection methods: the first (crude) one detects traffic frequency based on statistical analysis; the second (sophisticated) one detects traffic attributes based on a clustering algorithm. The hierarchical detection method first detects the abnormal frequency of the network traffic. Property exceptions are then detected for suspected traffic. The paper first calculates the difference in the value of traffic frequency and smoothes it. Then, the exponential weighted moving average model is used to make the data conform to the statistical law, and the deviation correction of the model is proposed to reduce the error caused by the initial value. Focusing on the fact that a fixed threshold is not suitable for a dynamic network environment, a two-layer threshold interval method is proposed to reduce the rate of false alarms. For traffic attribute detection, this paper designs a clustering optimization anomaly detection algorithm for complex attribute feature data. The algorithm classifies the weighted distance and safety coefficient of the data according to the priority of the traffic attribute features, selects the data with the high safety coefficient as the clustering center, clusters the multi-feature data around the center, and applies it to the attribute anomaly detection. The simulation results show that the traffic frequency detection algorithm based on statistical analysis proposed in this paper can quickly detect the traffic frequency anomalies in the network. Moreover, the clustering optimization anomaly detection algorithm based on complex attribute features proposed in this paper can effectively detect the malicious attributes contained in network traffic and achieve a high detection rate and a low false detection rate to ensure the safety and reliability of the industrial Internet of Things.

Cross-site scripting vulnerability (XSS) is one of the most frequently exploited and harmful vulnerabilities among web vulnerabilities. In recent years, many researchers have used different machine learning methods to detect network attacks, but these methods have not achieved high accuracy and recall rates and cannot effectively combat XSS attacks. Designing a model that can achieve high accuracy and truly proactive defense against reflected XSS vulnerabilities has become a top priority for maintaining user network security at this stage. In this paper, we propose a detection model for reflected XSS vulnerabilities based on the paths-attention method (PATS model). Firstly, the model converts vulnerability data into an intermediate representation of abstract syntax trees, then traverses the abstract syntax tree to generate multiple sets of syntactic paths, and then converts them into vector representations through word embedding matrices. The model extracts semantic features using attention mechanisms to improve training effectiveness by assigning appropriate weights to different sets of syntactic paths as it learns with neural networks, which realizes the transformation from passive defense to active defense. Additionally, in the dataset processing section, we point out the shortcomings of current research datasets and construct a reliable dataset composed of 1000 malicious samples from NIST and 10,000 benign samples from GitHub for experimentation purposes. Experimental results show that compared with other machine learning models, the paths-attention method can achieve an accuracy rate of 90.25% and F1-score of 81.62%, while reducing the training time by half to 30 h.

In the rapidly evolving field of cybersecurity, the integration of multi-source, heterogeneous, and fragmented data into a coherent knowledge graph has garnered considerable attention. Such a graph elucidates semantic interconnections, thereby facilitating sophisticated analytical decision support. Central to the construction of a cybersecurity knowledge graph is Named Entity Recognition (NER), a critical technology that converts unstructured text into structured data. The efficacy of NER is pivotal, as it directly influences the integrity of the knowledge graph. The task of NER in cybersecurity, particularly within the Chinese linguistic context, presents distinct challenges. Chinese text lacks explicit space delimiters and features complex contextual dependencies, exacerbating the difficulty in discerning and categorizing named entities. These linguistic characteristics contribute to errors in word segmentation and semantic ambiguities, impeding NER accuracy. This paper introduces a novel NER methodology tailored for the Chinese cybersecurity corpus, termed CSBERT-IDCNN-BiLSTM-CRF. This approach harnesses Iterative Dilated Convolutional Neural Networks (IDCNN) for extracting local features, and Bi-directional Long Short-Term Memory networks (BiLSTM) for contextual understanding. It incorporates CSBERT, a pre-trained model adept at processing few-shot data, to derive input feature representations. The process culminates with Conditional Random Fields (CRF) for precise sequence labeling. To compensate for the scarcity of publicly accessible Chinese cybersecurity datasets, this paper synthesizes a bespoke dataset, authenticated by data from the China National Vulnerability Database, processed via the YEDDA annotation tool. Empirical analysis affirms that the proposed CSBERT-IDCNN-BiLSTM-CRF model surpasses existing Chinese NER frameworks, with an F1-score of 87.30% and a precision rate of 85.89%. This marks a significant advancement in the accurate identification of cybersecurity entities in Chinese text, reflecting the model’s robust capability to address the unique challenges presented by the language’s structural intricacies.

Knowledge graphs in the field of network security can integrate diverse, heterogeneous, and fragmented network security data, further explore the relationships between data, and provide support for deep analysis. Currently, there is sparse security information in the field of network security knowledge graphs. The limited information provided by traditional text encoding models leads to insufficient reasoning ability, greatly restricting the development of this field. Starting from text encoding, this paper first addresses the issue of the inadequate capabilities of traditional models using a deep learning model for assistance. It designs a vBiLSTM model based on a word2vec and BiLSTM combination to process network security texts. By utilizing word vector models to retain semantic information in entities and extract key features to input processed data into BiLSTM networks for extracting higher-level features that better capture and express their deeper meanings, this design significantly enhances understanding and expression capabilities toward complex semantics in long sentences before inputting final feature vectors into the KGC-N model. The KGC-N model uses feature vectors combined with graph structure information to fuse forward and reverse domain features and then utilizes a Transformer decoder to decode predictions and complete missing information within the network security knowledge map. Compared with other models using evaluation metrics such as MR, MRR demonstrates that employing our proposed method effectively improves performance on completion tasks and increases comprehension abilities toward complex relations, thereby enhancing accuracy and efficiency when completing knowledge graphs.

It is critical to detect malicious code for the security of the Internet of Things (IoT). Therefore, this work proposes a malicious code detection algorithm based on the novel feature fusion–malware image convolutional neural network (FF-MICNN). This method combines a feature fusion algorithm with deep learning. First, the malicious code is transformed into grayscale image features by image technology, after which the opcode sequence features of the malicious code are extracted by the n-gram technique, and the global and local features are fused by feature fusion technology. The fused features are input into FF-MICNN for training, and an appropriate classifier is selected for detection. The results of experiments show that the proposed algorithm exhibits improvements in its detection speed, the comprehensiveness of features, and accuracy as compared with other algorithms. The accuracy rate of the proposed algorithm is also 0.2% better than that of a detection algorithm based on a single feature.