The wide spread of rumors inflicts damages on social media platforms. Detecting rumors has become an emerging problem concerning the public and government. A crucial problem for rumors detection on social media is the lack of reliably pre-annotated dataset to train classification models. To solve this problem, we propose an unsupervised model that detects rumors by measuring how well the tweets follow the normal patterns. However, the problem is challenging in how to automatically discover the normal patterns of tweets. To tackle the challenge, we first propose a novel tree variational autoencoder model that reconstructs the sentiment labels along the propagation tree of a factual tweet. Then we propose a cross-alignment method to align the multiple modalities, i.e. tree structure and propagation features, and output the final prediction results. We conduct extensive experiments on a real-world dataset collected from Weibo. The experiments show that the proposed method significantly outperforms the state-of-the-art unsupervised methods and adapts better to the concept drift than state-of-the-art supervised methods.

Since network systems have become increasingly large and complex, the limitations of traditional abnormal packet detection have gradually emerged. The existing detection methods mainly rely on the recognition of packet features, which lack the association of specific applications and result in hysteresis and inaccurate judgement. In this paper, a task-oriented abnormal packet behavior detection method is proposed, which creatively collects action identifications during the execution of network tasks and inserts security labels into communication packets. Specifically, this paper defines the network tasks as a collection of state and action sequences to achieve the fine-grained division of the execution of network tasks, performs Hash value matching based on random communication string and action identification sequence for packet authentication, and proposes a mechanism of action identification sequence matching and abnormal behavior decision-making based on a finite state machine, according to the fine-grained monitoring of task execution action sequence. Furthermore, to verify the validity of the anomaly detection method proposed in this paper, a prototype based on the FTP communication platform is constructed, on which the simulation experiments, including the DDOS attack and backdoor attack, are conducted. The experimental results show that the proposed task-oriented abnormal behavior detection method can effectively intercept network malicious data packets and realize the active security defense for network systems.

Remote sensing (RS) has been widely used for data acquisition, monitoring, control, and intelligent decision-making. However, most of them are unattended and easily become the target of attack, which means there are still some risks in the sensing terminal processes. Therefore, trust evaluation of the processes associated with the sensing terminal is necessary. The existing trust evaluation model based on the sensing terminal process has some defects, such as low performance, low precision, and difficulty in effectively identifying malicious processes in the sensing terminal. In this paper, an adaptive trust evaluation model based on the entropy weight method is proposed to detect the sensing terminal process (PB-ATEM). By establishing two kinds of trust values, the direct trust value and the reciprocal trust value, we can comprehensively judge whether the process is trustworthy. For the direct trust value, we can dynamically capture the auto-correlation value of processes and establish a dynamic reward and punishment function to improve the response to malicious processes. For reciprocal trust values, k-means cluster analysis is used to classify processes, and the optimal entropy weight method is proposed to calculate the direct trust weight and reciprocal trust weight of each process more accurately, which accelerates the exposure of malicious processes. Finally, these two trust values are weighted to obtain the integrated trust value. The simulation results show that PB-ATEM can respond quickly to malicious processes. Compared with the existing trust evaluation models, it has higher detection accuracy and better ability to identify malicious processes.

Large-scale geospatial data pave the way for geospatial machine learning algorithms, and a good representation is related to whether the machine learning model is effective. Hence, it is a critical task to learn effective feature representation for geospatial data. In this paper, we construct a spatial graph from the locations and propose a geospatial graph contrastive learning method to learn the location representations. Firstly, we propose a skeleton graph in order to preserve the primary structure of the geospatial graph to solve the positioning bias problem of remote sensing. Then, we define a novel mixed node centrality measure and propose four data augmentation methods based on the measure. Finally, we propose a heterogeneous graph attention network to aggregate information from both the structural neighborhood and semantic neighborhood separately. Extensive experiments on both geospatial datasets and non-geospatial datasets are conducted to illustrate that the proposed method outperforms state-of-the-art baselines.

Industrial control terminals play an important role in industrial control scenarios. Due to the special nature of industrial control networks, industrial control terminal systems are vulnerable to malicious attacks, which can greatly threaten the stability and security of industrial production environments. Traditional security protection methods for industrial control terminals have coarse detection granularity, and are unable to effectively detect and prevent attacks, lacking real-time responsiveness to attack events. Therefore, this paper proposes a real-time dynamic credibility evaluation mechanism based on program behavior, which integrates the matching and symmetry ideas of credibility evaluation. By conducting a real-time dynamic credibility evaluation of function call sequences and system call sequences during program execution, the credibility of industrial control terminal application program behavior can be judged. To solve the problem that the system calls generated during program execution are unstable and difficult to measure, this paper proposes a partition-based dynamic credibility evaluation method, dividing program behavior during runtime into function call behavior and system call behavior within function intervals. For function call behavior, a sliding window-based function call sequence benchmark library construction method is proposed, which matches and evaluates real-time measurement results based on the benchmark library, thereby achieving symmetry between the benchmark library and the measured data. For system call behavior, a maximum entropy system call model is constructed, which is used to evaluate the credibility of system call sequences. Experiment results demonstrate that our method performs better in both detection success rate and detection speed compared to the existing methods.