The security threats to software-defined networks (SDNs) have become a significant problem, generally because of the open framework of SDNs. Among all the threats, distributed denial-of-service...

Network intrusion discovery aims to detect the network attacks and abnormal network intrusion efficiently, that is an important protection implement in the field of cyber security. However, the traditional network intrusion discovery method are difficult to extract high-order features (such as spatial-temporal information) from network traffic data. In this paper, we proposed an improved method of network intrusion discovery based on convolutional long-short term memory network. This method implements the convolution operation in deep learning into the network structure of long-short term memory and improves the accuracy of network intrusion discovery. In the experimental section, we compared with other similar methods, the result shows that the proposed method has some advantages in the aspects of overall network intrusion discovery index, detection index of different types, and AUC evaluation index. In addition, we applied our method to the network intrusion discovery scenarios of video surveillance system (VSS). The result shows that the proposed method has advantages in accuracy, recall, precision, and other similar methods.

Cyber security situation awareness,has become a hotpot of research. However, the existing cyber security situation awareness methods are difficult to extract high-order features from network traffic data. In this work, we present an improved cyber security situation awareness method based on ResMLP and LSTM network from a new perspective. Our work focus on cyber attack behavior analysis, that is a key research content of cyber security situation awareness. It introduces the Residual Multi-Layer Perceptrons in deep learning into the network structure of long-short term memory. It can effectively extract the spatial and temporal characteristics of network traffic data, reduce the computational complexity, and improve the accuracy of cyber security situation awareness. Firstly, we extract the spatial features using the ResMLP network. Secondly, we extract the temporal characteristics using the LSTM network. The architecture of the ResMLP network replaces the self-noticing layer with a linear interaction layer, and this design architecture allows the model to guarantee accurate cyber attack behavior analysis performance while balancing the computational cost of the model, which can improve the detection efficiency of the model. Considering that the network data are fed into the model in the form of time series after processing, the model incorporates LSTM networks to avoid the gradient problem while better bringing up the temporal characteristics in the data.The experimental results show that the proposed method can model the future cyber security situation in a network environment more accurately than other similar methods.

Dual-domain terminal with two built-in independent operating systems - Life Domain and Work Domain, provides convenience for daily use and mobile office. However, the security isolation between the two domains also causes that message reminders cannot be delivered and viewed across domains, which restricts the improvement of work efficiency and the expansion of mobile services. This paper conducts an in-depth study on this pain point and proposes the concept and implementation method of a cross-domain instant messaging reminder service system for mobile office, focusing on solving the problems of: cross-domain isolated boundary exchange of message reminders, timeliness and delivery rate guarantee of message reminders, and security check filtering of message contents. Technically, on the side of mobile office platform, based on AMQP technical framework and protocol, the cross-domain isolated border message queue push and synchronization services are built, which are real-time, reliable and high-throughput.

This paper studies the collection of large-scale log data of information system and puts forward a dynamic adaptive mechanism for large-scale unified log data collection. Furthermore, we design and implement our method for pan-government industry safety operation management platform. The data flow processing architecture based on message queue is adopted to realize the decoupling of log collection, log processing and log reporting. The traffic peak clipping technology of message queue is adopted to ensure the safety and reliability of log transmission. According to the characteristics of log traffic, a design mode supporting dynamic adjustment of consumption group is proposed to meet the high-performance requirements of the system. The whole system can meet the centralized analysis, security threat perception and intelligent analysis of various security data. Meanwhile, we analyzed and compared with the traditional open-source log collection technology, our proposed method and system has clear advantages.

In recent years, the analysis of human interaction data has led to the rapid development of graph embedding methods. Topological information is typically interpreted into embedded vectors or convolution kernels for link-based classification problems. This paper introduces a Bayesian graph embedding model for such problems, integrating network reconstruction, link prediction, and behavior prediction into a unified framework. Unlike the existing graph embedding methods, this model does not embed the topology of nodes or links into a low-dimensional space but sorts the probabilities of upcoming links and fuses the information of node topology and data domain via sorting. The new model integrates supervised transaction predictors with unsupervised link prediction models, summarizing local and global topological information. The experimental results on a financial trading dataset and a retweet network dataset demonstrate that the proposed feature fusion model outperforms the tested benchmarked machine learning algorithms in precision, recall, and F1-measure. The proposed learning structure has a fundamental methodological contribution and can be extended and applied to various link-based classification problems in different fields.