As a crucial platform, online social networks provide individuals with avenues to exchange ideas and access information, exerting profound impacts on society and nations. In social networks, key users, serving as edge nodes in the process of information dissemination, play a pivotal role because they directly connect users and can process and forward information in real-time. Furthermore, edge nodes enable personalized information dissemination based on users’ social relationships and behavioral characteristics, more accurately reflecting the pathways and influence of information spread. Early research primarily focused on the dynamics of information dissemination in complex networks, aiming to develop general predictive models to understand the overall mechanisms of information spread. However, there is still a lack of research on how the unique social relationships and attributes in social networks affect information dissemination. To address this gap, we conducted an in-depth study of the characteristics of information dissemination in social networks and improved the classic independent cascade model, proposing a novel predictive model for information spread. This enhancement not only improves the accuracy of simulating the information dissemination process in social networks but also demonstrates that our proposed model significantly outperforms other models in terms of accuracy. The findings provide a more effective tool for understanding and predicting information dissemination in social networks.

Network information propagation analysis is gaining a more important role in network vulnerability analysis domain for preventing potential risks and threats. Identifying the influential source nodes is one of the most important problems to analyze information propagation. Traditional methods mainly focus on extracting nodes that have high degrees or local clustering coefficients. However, these nodes are not necessarily the high influential nodes in many real-world complex networks. Therefore, we propose a novel method for detecting high influential nodes based on Internet Topology Dynamic Propagation Model (ITDPM). The model consists of two processing stages: the generator and the discriminator like the generative adversarial networks (GANs). The generator stage generates the optimal source-driven nodes based on the improved network control theory and node importance characteristics, while the discriminator stage trains the information propagation process and feeds back the outputs to the generator for performing iterative optimization. Based on the generative adversarial learning, the optimal source-driven nodes are then updated in each step via network information dynamic propagation. We apply our method to random-generated complex network data and real network data; the experimental results show that our model has notable performance on identifying the most influential nodes during network operation.

Predicting internet user demographics based on traffic behavior analysis can provide effective clues for the decision making of network administrators. Nonetheless, most of the existing researches overly rely on hand-crafted features, and they also suffer from the shallowness of information mining and the limitation in prediction targets. This paper proposes Argus, a hierarchical neural network solution to the prediction of Internet user demographics through traffic analysis. Argus is a hierarchical neural-network structure composed of an autoencoder for embedding and a fully-connected net for prediction. In the embedding layer, the high-level features of the input data are learned, with a customized regularization method to enforce their discriminative power. In the classification layer, the embeddings are converted into the label predictions of the sample. An integrated loss function is provided to Argus for end-to-end learning and architecture control. Argus has exhibited promising performances in experiments based on real-world dataset, where most of the metrics outperform those achieved by common machine learning techniques on multiple prediction targets. Further experiments reveal that the integrated loss function is capable of promoting Argus performance, and the contribution of a specific loss component during the training process is validated. Empirical settings for hyper parameters are given according to the experiments.

The last decades have witnessed the progressive development of research on Internet topology at the router or autonomous systems (AS) level. Routers are essential components of ASes, which dominate their behaviors. It is important to identify the affiliation between routers and ASes because this contributes to a deeper understanding of the topology. However, the existing methods that assign a router to an AS, based on the origin AS of its IP addresses do not make full use of the information during the network interaction procedure. In this paper, we propose a novel method to assign routers to their owners’ AS, based on community discovery. First, we use the initial AS information along with router-pair similarities to construct a weighted router level graph; secondly, with the large amount of graph data (more than 2M nodes and 19M edges) from the CAIDA ITDK project, we propose a fast hierarchy clustering algorithm with time and space complexity, which are both linear for graph community discovery. Finally, router-to-AS mapping is completed, based on these AS communities. Experimental results show that the effectiveness and robustness of the proposed method. Combining with AS communities, our method could have the higher accuracy rate reaching to 82.62% for Routers-to-AS mapping, while the best accuracy of prior works is plateaued at 65.44%.

Network worms spread widely over the global network within a short time, which are increasingly becoming one of the most potential threats to network security. However, the performance of traditional packet-oriented signature-based methods is questionable in the face of unknown worms, while anomaly-based approaches often exhibit high false positive rates. It is a common scenario that the life cycle of network worms consists of the same four stages, in which the target discovery phase and the transferring phase have specific interactive patterns. To this end, we propose Network Flow Connectivity Graph (NFCG) for identifying network worm victims. We model the flow-level interactions as graph and then identify sets of frequently occurring motifs related to network worms through Cascading Motif Discovery algorithm. In particular, a cascading motif is jointly extracted from graph target discovery phase and transferring phase. If a cascading motif exists in a connected behavior graph of one host, the host would be identified as a suspicious worm victim; the excess amount of suspicious network worm victims is used to reveal the outbreak of network worms. The simulated experiments show that our proposed method is effective and efficient in network worm victims’ identification and helpful for improving network security.