The success of a detection model depends heavily on feature engineering. Deep learning has been successfully applied in numerous research fields as a universal representation learning method. However, the heterogeneity of flow-level communication data obstructs the application of deep learning to communication representation learning, and research on this problem is still lacking. To cope with this problem, we propose a heterogeneous communication data-encoding approach to extract fixed-size encoding data to apply deep learning to heterogeneous communication data by preserving the spatiotemporal characteristics of the data. Then, we propose a feature extractor based on deep learning to automatically learn hierarchical and robust communication representations without expert knowledge. We show that the proposed approach can replicate and optimize the key steps of feature engineering well and learn hierarchical representations directly from heterogeneous communication data. Moreover, compared with features extracted with principal component analysis (PCA), manifold learning and manually crafted methods, the features extracted by deep learning are more robust and are characterized by their better adaptability to various classifiers and datasets. To the best of our knowledge, the initial work here is the first to apply deep learning techniques to heterogeneous flow-level data; consequently, the heterogeneous communication data processing method can provide technical means for the application of deep learning in other communication-related research fields.

Distributed Denial-of-Service (DDoS) attacks remain the most pervasive and operationally disruptive cyber threat and are routinely weaponized in interstate conflict (e.g., Russia–Ukraine and Stuxnet). Although attack-chain models are standard for Advanced Persistent Threat (APT) analysis, they have seldom been applied to DDoS, which is often framed as a single-step volumetric assault. However, ubiquitous intelligence and ambient connectivity increasingly enable DDoS campaigns to unfold as multi-stage operations rather than isolated floods. In parallel, large language models (LLMs) create new opportunities to strengthen traditional DDoS defenses through richer contextual understanding. Reviewing incidents from 2019 to 2024, we propose a three-phase DDoS attack chain—preparation, development, and execution—that captures contemporary tactics and their dependencies on novel hardware, network architectures, and application protocols. We classify these patterns, contrast them with conventional DDoS, survey current defenses (anycast and scrubbing, BGP Flowspec, programmable data planes, adaptive ML detection, API hardening), and outline research directions in cross-layer telemetry, adversarially robust learning, automated mitigation orchestration, and cooperative takedown.

The effectiveness of AI-driven cybersecurity threat detection heavily relies on extensive datasets for deep learning models. However, the scarcity of labeled samples poses a significant challenge to the applicability of deep learning technologies in this domain. To address this challenge, this paper proposes domain adaptation as a form of transfer learning, which leverages abundant labeled data from a source domain to enhance model training in the target domain. Specifically, this paper focuses on overfitting in small sample deep learning models for Advanced Persistent Threat (APT) communication behavior recognition, where traditional domain adaptation techniques have been proven by experimental results to be inadequate for this particular task. To overcome these challenges, we introduce the MultiCenter Domain Adaptation method (MCDA), which has been specifically designed to align with the distinct data distribution characteristics found in real-world communication datasets. Experimental results demonstrate that MCDA significantly improves model performance when addressing overfitting in small sample scenarios. Across various evaluation metrics, the proposed approach yields improvements ranging from 3.7% to 15.2%. As the scarcity of labeled samples is a prominent issue in various security analysis scenarios, our proposed MCDA approach serves as a valuable reference for enhancing threat detection models with limited labeled data.

While encryption enhances data security, it also presents significant challenges for network traffic analysis, especially in detecting malicious activities. To tackle this challenge, this paper introduces combined Attention-aware Feature Fusion and Communication Graph Embedding Learning (AFF_CGE), an advanced representation learning framework designed for detecting encrypted malicious traffic. By leveraging an attention mechanism and graph neural networks, AFF_CGE extracts rich semantic information from encrypted traffic and captures complex relations between communicating nodes. Experimental results reveal that AFF_CGE substantially outperforms traditional methods, improving F1-scores by 5.3% through 22.8%. The framework achieves F1-scores ranging from 0.903 to 0.929 across various classifiers, exceeding the performance of state-of-the-art techniques. These results underscore the effectiveness and robustness of AFF_CGE in detecting encrypted malicious traffic, demonstrating its superior performance.