Neural networks have been proved to perform well in network intrusion detection. In order to acquire better features of network traffic, more learning layers are necessarily required. However, according to the results of the previous research, adding layers to the neural networks might fail to improve the classification results. In fact, after the number of layers has reached a certain threshold, performance of the model tends to degrade. In this paper, we propose a network intrusion detection model based on residual learning. After transforming the UNSW-NB15 data set into images, deeper convolutional neural networks with residual blocks are built to learn more critical features. Instead of the cross-entropy loss function, the modified focal loss is calculated to address the class imbalance problem in the training set and identify minor attacks in the testing set. Batch normalization and global average pooling are used to avoid overfitting and enhance the model. Experimental results show that the proposed model can improve attack detection accuracy compared with existing models.

System logs are almost the only data that records system operation information, so they play an important role in anomaly analysis, intrusion detection, and situational awareness. However, it is still a challenge to obtain effective data from massive system logs. On the one hand, system logs are unstructured data, and, on the other hand, system log records cannot be directly analyzed and calculated by computers. In order to deal with these problems, current researchers digitize system logs through two key steps of log parsing and feature extraction. This paper classifies, analyzes, and summarizes the current log analysis research in terms of log parsing and feature extraction by investigating articles in recent years (including ICSE, TKDD, ICDE, IJCAI, ISSRE, ICDM, ICWS, ICSME, etc.). Finally, in combination with the existing research, the research prospects in the field are elaborated and predicted.

Integrated sensing and communication (ISAC) is envisioned as a key enabler of 6 G networks, allowing communication and sensing to share spectrum and hardware resources in a unified manner. Unmanned aerial vehicles (UAVs) can further enhance ISAC systems by providing flexible deployment and reliable line-of-sight (LoS) links. However, the openness of UAV communication channels, coupled with their dynamic mobility and limited energy, makes them highly vulnerable to eavesdropping and exacerbates physical layer security (PLS) concerns. To address these challenges, we propose a reconfigurable intelligent surface (RIS)-assisted framework for enhancing PLS in dynamic and uncertain UAV-enabled ISAC networks. We formulate a secrecy-oriented joint optimization problem that integrates UAV trajectory design, RIS phase shift configuration, beamforming, and decoupled uplink–downlink (DUDe) user association. To render this problem tractable, we adopt a two-stage approach. First, the beamforming subproblem is solved via fractional programming and successive convex approximation to obtain closed-form solutions. Subsequently, with beamforming fixed, we reformulate the remaining coupled design of trajectories, associations, and RIS phases as a Partially Observable Markov Decision Process (POMDP). To address the challenges of high-dimensional sequential decision-making and the need for scalable, real-time coordination inherent in multi-UAV systems, we develop a robust multi-agent deep reinforcement learning (MADRL) solution, effectively circumventing the prohibitive communication overhead of centralized control and the intractability of single-agent formulations suffering from the curse of dimensionality. Specifically, we design a stochastic environment-aware Proximal Policy Optimization (PPO) algorithm that incorporates random environment distribution to capture environmental randomness, intrinsic rewards to guide UAV exploration of secure regions, and uncertainty estimation to refine policy updates. Simulation results verify that the proposed framework significantly outperforms benchmark methods in terms of secrecy rate and robustness, especially under dynamic scenarios with varying numbers of users and eavesdroppers.