Deep steganography (DS), using neural networks to hide one image in another, has performed well in terms of invisibility, embedding capacity, etc. Current steganalysis methods for DS can only detect or remove secret images hidden in natural images and cannot analyze or modify secret content. Our technique is the first approach to not only effectively prevent covert communications using DS, but also analyze and modify the content of covert communications. We proposed a novel adversarial attack method for DS considering both white-box and black-box scenarios. For the white-box attack, several novel loss functions were applied to construct a gradient- and optimizer-based adversarial attack that could delete and modify secret images. As a more realistic case, a black-box method was proposed based on surrogate training and a knowledge distillation technique. All methods were tested on the Tiny ImageNet and MS COCO datasets. The experimental results showed that the proposed attack method could completely remove or even modify the secret image in the container image while maintaining the latter’s high quality. More importantly, the proposed adversarial attack method can also be regarded as a new DS approach.

In the current digital age, users store their personal information in corporate databases to access services, making data security and sensitive information protection central to enterprise security management. Given the extensive attack surface, system assets continuously face cyber security challenges such as weak authentication, exploitation of system vulnerabilities, and malicious software. Through specific vulnerabilities, attackers may gain unauthorized system access, masquerading as legitimate users, and remaining hidden. Successful attacks can lead to the leakage of user privacy, disruption of business operations, significant financial losses, and damage to corporate reputation. The increasing complexity of attack vectors is blurring the boundaries between insider and external threats. To address this issue, this paper introduces the IDU-Detector, an innovative threat detection framework that strategically integrates Intrusion Detection Systems (IDS) with User and Entity Behavior Analytics (UEBA). This integration aims to monitor unauthorized access and malicious attacks within systems, bridging functional gaps between existing systems, ensuring continuous monitoring and real-time response of the network environment, and enhancing their collective effectiveness in identifying security threats. Additionally, the existing insider threat datasets exhibit significant deficiencies in both depth and comprehensiveness, lacking sufficient coverage of diverse attack vectors. This limitation hinders the ability of insider threat detection technologies to effectively address the growing complexity and expanding scope of sophisticated attack surfaces. To address these gaps, we propose new, more enriched and diverse datasets that includes a wider range of attack scenarios, thereby enhancing the adaptability and effectiveness of detection technologies in complex threat environments. We tested our framework on different datasets, the IDU-Detector achieved average accuracy rates of 98.96% and 99.12%. These results demonstrate the method’s effectiveness in detecting masquerader attacks and other malicious activities, significantly improving security protection and incident response speed, and providing a higher level of security assurance for asset safety.

Malware is proliferating at an exponential rate in cyberspace, posing serious threats to on-device systems characterized by limited computational capabilities. In this work, we address the critical challenge posed by data imbalance—where rare malware families receive inadequate representation—by proposing MalViT, a lightweight Vision Transformer (ViT) architecture that directly operates in the JPEG frequency domain. Rather than converting Huffman-coded signals into RGB spatial images, MalViT leverages Discrete Cosine Transform (DCT) coefficients to reduce data redundancy and computational overhead. We further improve the model's generalization through both pre-training and fine-tuning workflows. Comprehensive evaluations on two large-scale, real-world malware datasets, MalNet-Image (1.26M samples) and BODMAS (51K samples), demonstrate that MalViT accelerates data loading by nearly threefold compared to existing methods. On GPU and CPU, MalViT achieves approximately 2.0× and 4.7× faster inference throughput than MobileViT, respectively, while incurring minimal or even improved accuracy loss. When processing 224×224-pixel JPEG images, MalViT completes inference within an average of 3.12 ms per sample, which is 8.79× faster than VisMal and 5.91× faster than ViT4Mal. Furthermore, its compact design comprises only 1.1M parameters and requires 10M MACs, making it particularly suitable for resource-constrained on-device deployment.

As the main routing device of the network, most routers can be set up and managed through their web enabled admin portal. This paper proposes a new method for router admin portal vulnerability mining fuzzing test (RW-fuzzer: Router Web fuzzer). The mutation samples that generated by Boofuzz are used to construct the test sample set for fuzzy testing. The constructed mutation test cases are more suitable for the attack load or critical value of the router’s Web interface. They can cause unexpected errors for the devices more easily, which achieves the goal of discover potential vulnerabilities, and the practicality is excellent. Based on the proposed RW-fuzzer method, this work conducted fuzzing tests on 4 widely sold router models from manufacturers. Four nday vulnerabilities and one 0day vulnerability have been found. Experiment results show that the proposed RW-fuzzer method is effective.