Misuse or malicious access to critical assets of information systems by insiders usually causes significant loss to organizations. The issue of insider threat detection for information systems has received many researchers’ attention in both security and data mining fields, and a lot of related research results were presented. However, there are still many challenges in capturing the behavior difference between malicious insiders and normal users accurately, such as lack of labeled insider threats, the subtle and adaptive nature of insider threats, complexity, heterogeneity, sparsity of the underlying data, etc. To detect insider threats with large and complex audit data, a Multi-Edge Weight Relational Graph Neural Network method (MEWRGNN) for robust anomaly detection is proposed in this paper. Unlike most existing approaches, the MEWRGNN adopts several graph neural networks to capture the contextual relationship of user behaviors over a period of time, which is a critical factor for achieving accurate anomaly identification. The MEWRGNN achieves a certain degree of interpretability through ranking the contribution of different edge-representation features. Evaluation experimental results demonstrate that the MEWRGNN can learn a model from limited sample data sets, and achieve quick and accurate insider threat detection performance. In addition, other feature ranking results allow providing security analysts with understandable insights for investigating the detected insider threats.

Deep learning stands out as a potent state-of-the-art technique for target recognition. Unfortunately, the trustworthiness and reliability of deep learning networks encounter challenges in radar target recognition. In this letter, an inductive conformal prediction (ICP) enhanced long short-term memory spiking neural network (LSTM-SNN) is proposed. It integrates with the concept of conformal prediction in statistical learning theory and deep learning, and applied to birds and drones recognition with radar. The proposed method can provide good recognition results for drones and birds with supplying confidence and credibility for each identification, and yields a confidence interval containing the true value of the estimated at the desired confidence level, such as 98%. The benefits of the LSTM-SNN method were demonstrated with the bird detection datasets obtained by radar in the airport.

As various intelligent networked devices are increasingly introduced and applied or connected to modern vehicles, the services and functions of vehicles with controller area network (CAN) become more powerful and intelligent, however, exposed to the wide external networks. which suffer from serious cyber-security threats. Benefit from the intelligent and networked techniques, CAN for modern intelligent vehicles develops rapidly, but still faces critical security problems since it is lack of strong security protection mechanism. For the threat detection of CAN in modern vehicles, this research proposes a graph node attention network (GNAT) method to extract CAN packet context-dependent features, and improve the accuracy of malicious packet IDs identification in packet sequence windows. First, time-continuous CAN packets are converted into node profile according to the arbitration field, and the obtained nodes are connected to edges based on the time–adjacent relationship, thereby being converted into a graph. Using proper graph construction method, normal and malicious CAN packets can be converted into graphs with different topological structures. Second, the attention values of each node and edge in the graph are calculated with the GNAT through the topology difference between normal and malicious CAN packet conversion graphs, and then the node fusion features are acquired. The fused features are fed to the random forest for training and intrusion detection of CAN. Multiple tests were carried out, and the results show the features extracted by GNAT can help improve the generalization performance of the trained random forest model.

In this paper, distributed linear convolutional spacetime coding (DLC-STC) for two relay full-duplex (FD) 222 cooperative communication networks is presented. A network topology model which consists of two sources, two destinations and one layer of two relays, is considered. In this communication model, two sources may transmit signals to two different destinations with the help of two relays simultaneously, which will cause inter-user interference. As a result, one has to deal with the interuser interference in addition to the self-loop interference at the relays. Most part of the self-loop interference can be cancelled largely with the self-loop interference techniques at the relays, but the residual part is still a problem that requires proper processing. We consider that the two relays work in FD mode with amplify-and-forward (AF) protocol, and the relay self-loop interference may not be cancelled completely from the received signals. Distributed space-time coding for this model is studied, for which the residual part of relay self-loop signal is applied to serve as a self-coding signal. With the self-coding property of the AF FD system, a distributed linear convolutional space time code is formed. Simulation experiments are conducted to evaluate the proposed DLC-STC for the considered FD relay communication network model, and the results illustrate the effectiveness of the presented approach.