Cyber security systems generally have the phenomena of passive defense and low-efficiency early warnings. Aiming at the above problems, this study proposes a real-time warning and plans an AI defense strategy for a cyber security system aided by a security ontology. First, we design a security defense ontology that integrates attack graphs, general purpose and domain-specific knowledge bases, and on this basis, we (1) develop an ontology-driven method of early warnings of real-time attacks, which supports non-intrusive scanning attack detection and (2) combine artificial intelligence planning and bounded rationality to recommend and automatically execute defense strategies in conventional defense scenarios. A case study has been performed, and the results indicate that: (1) the proposed method can quickly analyze network traffic data for real-time warnings, (2) the proposed method is highly feasible and has the ability to implement defense strategies autonomously, and (3) the proposed method performs the best, with a 5.4–11.4% increase in defense effectiveness against the state-of-the-art counterparts considering the APT29 attack. Overall, the proposed method holds the potential to increase the defense effectiveness against cyberattacks under high computing resource constraints.

In the Internet of Vehicles (IoV), certificateless-based authentication has emerged as a promising approach to secure federated learning (FL) participation. However, existing certificateless-based authentication schemes still exhibit three notable limitations: 1) some schemes cannot provide security against public-key replacement (PKR) attacks and key-leakage threats; 2) most existing schemes do not take realistic coalition attacks into account; and 3) while some schemes applicable to FL settings can offer relatively comprehensive security guarantees, they often rely on costly cryptographic operations. These limitations make it challenging for certificateless authentication frameworks to simultaneously ensure high security and low latency, particularly in resource-constrained FL deployments within IoV environments. To address these challenges, we propose FedAuth, a certificateless, lightweight, and privacy-enhanced authentication scheme tailored for FL in IoVs. First, FedAuth establishes a structured pseudonymization mechanism that enables vehicles to anonymously participate in the FL process while maintaining accountability. Afterward, FedAuth ensures robust authentication security by cryptographically anchoring key generation to each vehicle’s pseudonym, enforcing strict key validation, and introducing hash-bound multilayered signature verification that prevents signature recombination, thereby resisting PKR attacks, coalition attacks, and key-leakage threats. Second, FedAuth guarantees the authenticity and integrity of gradients through lightweight signature construction, which supports batch authentication while avoiding expensive operations, such as bilinear pairings, thereby reducing latency. Security analysis shows that FedAuth preserves identity privacy and ensures model integrity in the face of adversarial conditions. The experimental results confirm that FedAuth significantly reduces computational overhead by at least 43.42% and saves not less than 19.8 kB of communication cost per 100 vehicles, outperforming state-of-the-art schemes in both efficiency and robustness.

The widespread use of the internet has led to frequent cryptographic attack event incidents, which pose various risks, including the leakage of personal information, privacy data, identity theft, and potential legal liabilities. However, conventional event detection models depend on expert-annotated trigger words, which are costly to obtain and constrain the applicability of detection methods in cryptographic security. Detecting cryptographic attack events faces two challenges: 1) Semantic complexity: terminology and abbreviations are diverse, and the same event is described using different vocabulary, sentence structures, and contexts, making it difficult for models to accurately identify specific events; 2) Lack of annotated features: This field relies on manually annotated data for feature learning, but there is a lack of publicly available datasets, and related research is scarce. Thus, we propose a method CLAD: Contrastive Learning Algorithm for Detecting Low-resource Cryptographic Attack Event. By comparing similarities and differences between samples, richer feature representations can be extracted. Additionally, assigning appropriate weights to keywords of different event types and employing clustering methods for effective classification reduce reliance on manually labeled data, thereby facilitating the training of an efficient cryptographic attack event detection model. To evaluate the effectiveness of the proposed method, we analyzed 916 cryptographic attack events collected from news blogs. The evaluation results show that the proposed method achieved an F1 score of 82.05% in detecting cryptographic attack events in low-resource scenarios, significantly outperforming state-of-the-art solutions. It reduces reliance on manual annotation and effectively handles semantic complexity using contrastive learning and clustering techniques.

This study proposes a systematic annotation framework to improve the robustness of end-to-end automatic speech recognition (ASR) in a complex low-resource dialect setting, using Hainan Lingao dialect as a case study. The framework consists of three components: semantically complete utterance segmentation instead of fixed-duration clipping; structured annotation at the lexical, sentence, and pragmatic-behavior levels, including explicit tags for dialectal variation, environmental noise, and unintelligible speech as well as rules for handling overlapping speech; and a three-stage quality-assurance workflow with iterative guideline refinement. The framework was implemented in the construction of a Hainan Lingao dialect corpus from 16 speakers and evaluated using 80 h/10 h/10 h training, validation, and test splits under an identical Conformer-based ASR configuration. Compared with a plain-transcription baseline using no special tags and fixed 3 s segmentation, the full specification reduced character error rate (CER) from 8.7% to 7.9%, 24.3% to 18.5%, 19.5% to 15.2%, and 15.2% to 13.1% on clean, noisy, dialogue, and dialect-variation test sets, respectively. The corresponding sentence error rate (SER) decreased from 17.5% to 15.2%, 39.6% to 32.1%, 34.2% to 27.8%, and 28.3% to 24.5%. Ablation experiments further examined the individual contributions of pragmatic-behavior tags, noise tags, semantic segmentation, and dialect-feature annotation. Paired bootstrap testing with 10,000 resamples showed that all baseline-to-full-specification improvements were statistically significant (p < 0.01). These results indicate that systematic annotation can improve ASR robustness in this Lingao low-resource dialect setting, with the largest relative CER reductions observed in the noisy (23.7%) and dialogue (22.1%) scenarios.