Correctly identifying influential nodes in a complex network and implementing targeted protection measures can significantly enhance the overall security of the network. Currently, indicators such as degree centrality, closeness centrality, betweenness centrality, H-index, and K-shell are commonly used to measure node influence. Although these indicators can identify critical nodes to some extent, they often consider node attributes from a narrow perspective and have certain limitations. Therefore, evaluating the importance of nodes using most existing indicators remains incomplete. In this paper, we propose the multi-attribute CRITIC-TOPSIS network decision indicator, or MCTNDI, which integrates closeness centrality, betweenness centrality, H-index, and network constraint coefficients to identify critical nodes in a network. This indicator combines information from multiple perspectives, including local neighborhood importance, network topological location, path centrality, and node mutual information, thereby solving the issue of the one-sided perspective of single indicators and providing a more comprehensive measure of node importance. Additionally, MCTNDI is validated through the analysis of several real-world networks, including the Contiguous USA network, Dolphins network, USAir97 network, and Tech-routers-rf network. The validation is conducted from four aspects: the results of simulated network attacks, the distribution of node importance, the monotonicity of rankings, and the similarity of indicators, illustrating MCTNDI’s effectiveness in real networks.

In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

Scanning the large-scale topology of the IPv6 internet presents a significant challenge in network engineering, particularly for understanding the underlying network structure and assessing network security. The sheer size of the IPv6 address space makes traditional brute-force scanning techniques, such as traceroute, inefficient and impractical. Existing methodologies are often unable to cope with the inherent complexity of IPv6’s network structure and its probing requirements, leading to issues such as redundant probes, ICMPv6 rate limits, and network congestion. To address these challenges, this paper introduces 6Trace, an innovative solution that mitigates the impact of rate-limiting and congestion by distributing scanning traffic across the network. Furthermore, 6Trace incorporates a stateless, asynchronous scanning approach combined with a bisection-like dynamic probing strategy, significantly reducing redundancy. Experimental results demonstrate that 6Trace enhances scanning efficiency by 70% over current solutions, discovering the maximum number of interface addresses while minimizing probing time. Notably, this paper also provides the first comprehensive analysis of topology probing results across different types of target networks. The insights gained from this study will inform future research on optimal target selection and IPv6 internet measurement techniques.

Network security situational awareness (NSSA) aims to capture, understand, and display security elements in large-scale network environments in order to predict security trends in the relevant network environment. With the internet’s increasingly large scale, increasingly complex structure, and gradual diversification of components, the traditional single-layer network topology model can no longer meet the needs of network security analysis. Therefore, we conduct research based on a multi-layer network model for network security situational awareness, which is characterized by the three-layer network structure of a physical device network, a business application network, and a user role network. Its network characteristics require new assessment methods, so we propose a multi-layer network link importance assessment metric: the multi-layer-dependent link entropy (MDLE). On the one hand, the MDLE comprehensively evaluates the connectivity importance of links by fitting the link-local betweenness centrality and mapping entropy. On the other hand, it relies on the link-dependent mechanism to better aggregate the link importance contributions in each network layer. The experimental results show that the MDLE has better ordering monotonicity during critical link discovery and a higher destruction efficacy in destruction simulations compared to classical link importance metrics, thus better adapting to the critical link discovery requirements of a multi-layer network topology.

Cyber Threat Intelligence (CTI) parsing aims to extract key threat information from massive data, transform it into actionable intelligence, enhance threat detection and defense efficiency, including attack graph construction, intelligence fusion and indicator extraction. Among these research topics, Attack Graph Construction (AGC) is essential for visualizing and understanding the potential attack paths of threat events from CTI reports. Existing approaches primarily construct the attack graphs purely from the textual data to reveal the logical threat relationships between entities within the attack behavioral sequence. However, they typically overlook the specific threat information inherent in visual modalities, which preserves the key threat details from inherently-multimodal CTI report. Therefore, we enhance the effectiveness of attack graph construction by analyzing visual information through Multimodal Large Language Models (MLLMs). Specifically, we propose a novel framework, MM-AttacKG, which can effectively extract key information from threat images and integrate it into attack graph construction, thereby enhancing the comprehensiveness and accuracy of attack graphs. It first employs a threat image parsing module to extract critical threat information from images and generate descriptions using MLLMs. Subsequently, it builds an iterative question-answering pipeline tailored for image parsing to refine the understanding of threat images. Finally, it achieves content-level integration between attack graphs and image-based answers through MLLMs, completing threat information enhancement. The experimental results demonstrate that MM-AttacKG can accurately identify key information in threat images and significantly improve the quality of multimodal attack graph construction, effectively addressing the shortcomings of existing methods in utilizing image-based threat information.