Every day, hundreds of thousands of malicious files are created to exploit zero-day vulnerabilities. Existing pattern-based antivirus solutions face difficulties in coping with such a large number of new malicious files. To solve this problem, artificial intelligence (AI)-based malicious file detection methods have been proposed. However, even if we can detect malicious files with high accuracy using deep learning, it is difficult to identify why files are malicious. In this study, we propose a malicious file feature extraction method based on attention mechanism. First, by adapting the attention mechanism, we can identify application program interface (API) system calls that are more important than others for determining whether a file is malicious. Second, we confirm that this approach yields an accuracy that is approximately 12% and 5% higher than a conventional AI-based detection model using convolutional neural networks and skip-connected long short-term memory-based detection model, respectively.

Container technologies have become integral to modern cloud-native application development, offering flexibility, scalability, and ease of deployment. Although containers offer efficiency and scalability in deploying and managing applications, they face security concerns such as malware and privilege escalation due to their weaker isolation. To address these issues, various security solutions have been developed, among which container image scanning technology is regarded as a fundamental security measure. However, existing approaches mainly focus on OS packages, neglecting manually installed or migrated packages, which limits their effectiveness in detecting real-world threats. In this paper, we propose a novel and rigorous container image vulnerability assessment system designed to ensure the secure deployment of applications across both standard and non-standard container images. Unlike existing methods, the proposed system focuses on direct file system inspection rather than relying on package manager analysis or Dockerfile inspection. In addition, the propose approach enables the system to detect vulnerabilities that may be introduced during container execution or through runtime-installed packages. To evaluate the effectiveness of the proposed system, we conducted extensive experiments on datasets of container images collected from various scenarios, and the experimental results demonstrate that our system significantly outperforms existing solutions in detecting vulnerabilities.

Federated Learning (FL)-based modulation decoding enables collaborative learning across distributed Artificial Intelligence (AI)-powered modulational signal decoding models in large-scale wireless communication networks. Despite significant advancements, FL-based modulation decoding faces two primary challenges: (1) Vulnerability to noisy environments - Current studies often prioritize high-quality datasets during training to ensure model performance, which often results in overfitting since real-world signals involve a wide range of noise levels from various sources. (2) Model divergence in non-Independent and Identically Distributed (non-IID) environments - The aggregation step in a conventional FL leads to divergence on a large federated scale, resulting in the loss of local-specific knowledge. Moreover, existing FL-based modulation decoding studies typically focus on a single non-IID issue, which limits their ability to generalize across large-scale heterogeneous settings. To address these challenges, we propose FedVaccine, a framework that enhances model generalization across diverse noise conditions and non-IID data environments. Instead of relying on high-quality datasets that risk overfitting, FedVaccine employs a harmonic noise resilience approach—akin to a vaccination effect—that deliberately exposes the model to controlled noise, identifying noise tolerance, regularizing training, and ensuring robust decoding performance across varying noise levels. Additionally, FedVaccine incorporates a Federated Split Learning approach to cumulatively update the global model, ensuring adaptive recalibration and mitigating the loss of local knowledge during aggregation. Furthermore, a localized support set is used to ensure effective personalization. Experimental results demonstrate that FedVaccine outperforms existing FL-based modulation classification models and other learning paradigms in both IID and non-IID scenarios using public datasets, showcasing its effectiveness in practical deployment scenarios across wireless networks.

With the advancement in information and communication technology, modern society has relied on various computing systems in areas closely related to human life. However, cyberattacks are also becoming more diverse and intelligent, with personal information and human lives being threatened. The moving target defense (MTD) strategy was designed to protect mission-critical systems from cyberattacks. The MTD strategy shifted the paradigm from passive to active system defense. However, there is a lack of indicators that can be used as a reference when deriving general system components, making it difficult to configure a systematic MTD strategy. Additionally, even when selecting system components, a method to confirm whether the systematic components are selected to respond to actual cyberattacks is needed. Therefore, in this study, we surveyed and analyzed existing cyberattack information and MTD strategy research results to configure a component dataset. Next, we found the correlation between the cyberattack information and MTD strategy component datasets and used this to design and implement the MTD-Diorama data visualization engine to configure a systematic MTD strategy. Through this, researchers can conveniently identify the attack surface contained in cyberattack information and the MTD strategies that can respond to each attack surface. Furthermore, it will allow researchers to configure more systematic MTD strategies that can be used universally without being limited to specific computing systems.

Long-context question answering (QA) remains a significant challenge, particularly when using small-scale language models (SLLMs) with limited computational capacity. Despite their efficiency, SLLMs often struggle to capture complex reasoning patterns and synthesize information from lengthy documents due to constraints in context size and inference depth. Traditional retrieval-augmented generation (RAG) approaches offer partial relief but typically fall short when precise reasoning across multiple passages is required. In this study, we present a novel, lightweight framework designed to improve long-context QA performance in SLLMs by combining two key strategies: (1) instruction-tuned embedding-based retrieval for extracting semantically aligned context, and (2) a question rephrasing mechanism that decomposes complex queries into stepwise subquestions. This dual strategy enables structured reasoning without the need for additional training or model fine-tuning. Experiments on the LongBench and LongBench v2 benchmarks demonstrate consistent performance improvements, with gains of up to 5% over strong baselines. Our method is model-agnostic, effective across diverse input lengths and task difficulties, and compatible with a wide range of SLLMs, including LLaMA and GLM. The proposed approach offers a practical, generalizable solution for deploying robust QA systems in resource-constrained environments.