In recent years, the popularity of IoT (Internet of Things) applications and services has brought great convenience to people's lives, but ubiquitous IoT has also brought many security problems. Among them, advanced persistent threat (APT) is one of the most representative attacks, and its continuous outbreak has brought unprecedented security challenges for the large-scale deployment of the IoT. However, important research on analyzing the attribution of APT malware samples is still relatively few. Therefore, we propose a classification method for attribution organizations with APT malware in IoT using machine learning. It aims to mark the real attacking organization entities to better identify APT attack activity and protect the security of IoT. This method performs feature representation and feature selection based on APT behavior data obtained from devices in the Internet of Things and selects the features with a high degree of differentiation among organizations. Then, it trains a multiclass model named SMOTE-RF that can better deal with imbalance and multiclassification problems. Our experiments on real dynamic behavior data are combined to verify the effectiveness of the method proposed in this paper for attribution analysis of APT malware samples and achieve good performance. Our method could identify the organization behind complex APT attacks in IoT devices and services.

Fact verification task has emerged as an essential research topic recently due to abundant fake news spreading on the Internet. The task based on unstructured data (i.e., news) has achieved great development, but the task based on structured data (i.e., table) is still in the primary development period. The existing methods usually construct complete heterogeneous graph networks around statement, table, and program subgraphs, and then infer to learn similar semantics on them for fact verification. However, they generally connect the nodes with the same content between subgraphs directly to frame a larger graph network, which has serious sparsity in connections, especially when subgraphs possess limited semantics. To this end, we propose tight-fitting graph inference network (TFGIN), which innovatively builds tight-fitting graphs (TF-graphs) to strengthen the connections of subgraphs and designs inference modeling layer (IML) to learn coherence evidence for fact verification. Specifically, different from traditional connection ways, the constructed TF-graph enhances inter-graph and intra-graph connections of subgraphs through subgraph segmentation and interaction guidance mechanisms. IML could reason the semantics with strong correlation and high consistency as explainable evidence. Experiments on three competitive datasets confirm the superiority and scalability of our TFGIN.

With the continuous increase in the economic value of new digital currencies represented by Bitcoin, more and more cybercriminals use malicious code to occupy victims system resources and network resources for mining without the victims permission, thereby obtaining cryptocurrency. This type of malicious code named malicious mining code has brought considerable influence and harm to society, enterprises and users. The mining code always conceals the fact that it consumes computer resources in a way that is difficult for ordinary people to discover. This paper proposes a malicious mining code detection method based on feature fusion and machine learning. First, we analyze from static analysis methods and statistical analysis methods to extract multi-dimensional features. Then for multi-dimensional text features, feature vectors are extracted through the n-gram model and TF-IDF, and best feature vectors are selected through the classifier and we fuse these best feature vectors with other statistic features to train our detection model. Finally, automatic detection is performed based on the machine learning framework. The experimental results show that the recognition accuracy of our method can reach 98.0%, its f1 score reach 0.969, and the ROCs AUC reach 0.973.