Anomaly detection plays a vital role as a crucial security measure for edge devices in Artificial Intelligence and Internet of Things (AIoT). With the rapid development of IoT ( Internet of Things), changes in system configurations and the introduction of new devices can lead to significant alterations in device relationships and data flows within the IoT, thereby triggering concept drift. Previously trained anomaly detection models fail to adapt to the changed distribution of streaming data, resulting in a high number of false positive events. This paper aims to address the issue of concept drift in IoT anomaly detection by proposing a comprehensive Concept Drift Detection, Interpretation, and Adaptation framework (CDDIA). We focus on accurately capturing the concept drift of normal data in unsupervised scenarios. To interpret drift samples, we integrate a search optimization algorithm and the SHAP method, providing a comprehensive interpretation of drift samples at both the sample and feature levels. Simultaneously, by utilizing the sample-level interpretation results for filtering new and old samples, we retrain the anomaly detection model to mitigate the impact of concept drift and reduce the false positive rate. This integrated strategy demonstrates significant advantages in maintaining model stability and reliability. The experimental results indicate that our method outperforms five baseline methods in adaptability across three datasets and provides interpretability for samples experiencing concept drift.

With the development of network technology, Network Function Virtualization (NFV) provides a good paradigm of sharing network resources, aiming to transfer network functions from hardware-based devices to software-defined Virtual Network Function (VNF) instances. Each type of VNF is mostly multi-instance, and different VNF instances require to be chained in a predefined sequence to form Service Function Chain (SFC) to provide network services. However, due to the resource capacity constraints of edge nodes and the high latency of cloud edge links in cloud-edge system, it is crucial and challengeable to deploy SFC in NFV-enabled networks. In our paper, we study the SFC deployment (SFC-D) problem in cloud-edge environment. We formulate the SFC-D as an Integer Linear Programming (ILP) model aiming to minimize the deployment cost, and propose a resource-aware deployment algorithm (RADA). According to our extensive evaluations, compared with the state-of-the-art counterpart algorithm, RADA performs better in the remaining available resources of nodes, and the average acceptance rate increases by 15%.

Android malware detection is a critical research field due to the increasing prevalence of mobile devices and apps. Improved methods are necessary to address Android apps’ complexity and malware’s elusive nature. We propose an approach for Android malware detection based on Graph Convolutional Networks (GCNs). Our method focuses on learning the behavioral-level features of Android applications using the call graph extracted from the application’s Dex file. Combining the call graph with sensitive permissions and opcodes creates a new subgraph representing the application’s runtime behavior. Subsequently, we propose an enhanced detection model utilizing graph convolutional networks (GCNs) for Android malware detection. The experimental results demonstrate our proposed method’s high precision and accuracy in detecting malicious code. With a precision of 98.89% and an F1-score of 98.22%, our approach effectively identifies and classifies Android malicious code.

As the amount of malware has grown rapidly in recent years, it has become the most dominant attack method in network security. Learning execution behavior, especially Application Programming Interface (API) call sequences, has been shown to be effective for malware detection. However, it is troublesome in practice to adequate mining of API call features. Among the current research methods, most of them only analyze single features or inadequately analyze the features, ignoring the analysis of structural and semantic features, which results in information loss and thus affects the accuracy. In order to deal with the problems mentioned above, we propose a novel method of malware detection based on semantic information of behavioral features. First, we preprocess the sequence of API function calls to reduce redundant information. Then, we obtain a vectorized representation of the API call sequence by word embedding model, and encode the API call name by analyzing it to characterize the API name’s semantic structure information and statistical information. Finally, a malware detector consisting of CNN and bidirectional GRU, which can better understand the local and global features between API calls, is used for detection. We evaluate the proposed model in a publicly available dataset provided by a third party. The experimental results show that the proposed method outperforms the baseline method. With this combined neural network architecture, our proposed model attains detection accuracy of 0.9828 and an F1-Score of 0.9827.

Malware poses a great threat to information security such as user data, privacy, and assets. Early detection before it has a real impact is the main countermeasure. However, the diversity of carriers and technologies has led to a huge gap between the training scenarios and actual scenarios of detection methods. This makes it difficult for supervision-based detection frameworks to identify new malware variants and complicates threat response. We propose a novel method that integrates frequency domain techniques with feature alignment to enhance variant malware detection, reducing distribution differences between labeled (source) and new (target) samples. By converting malware into grayscale images and applying discrete cosine transform (DCT) for improved feature extraction, followed by feature extraction via a deep residual network from both domains, our model systematically aligns features. This alignment is achieved through a tailored domain adaptation technique involving the minimization of classification and domain alignment losses, which ensures the consistent learning of features across varied domains. Such rigorous alignment not only enhances detection accuracy for both known and variant malware but also supports simultaneous detection across significant distribution differences. We conduct extensive experiments on two real-world datasets to evaluate the performance of various deep learning models under consistent and inconsistent domain distributions. Compared to existing methods, our approach improves accuracy by an average of 1.4% on the BIG2015 dataset, 3.2% on the MDA dataset, 2.75% on the Malimg dataset, and also achieves the best performance on the MaleVis dataset, with similar gains in precision, recall, and F1-score across all datasets.