Information diffusion prediction captures diffusion dynamics of online messages in social networks. Thus, it is the basis of many essential tasks such as popularity prediction and viral marketing. However, there are two thorny problems caused by the loss of spatial–temporal properties of cascade data: “position-hopping” and “branch-independency.” The former means no exact propagation relationship between any two consecutive infected users. The latter indicates that not all previously infected users contribute to the prediction of the next infected user. This article proposes the GR U-like A ttention Unit and S tructural S preading (GRASS) model for microscopic cascade prediction to overcome the above two problems. First, we introduce the attention mechanism into the gated recurrent unit (GRU) component to expand the restricted receptive field of the recurrent neural network (RNN)-type module, thus addressing the “position-hopping” problem. Second, the structural spreading (SS) mechanism leverages structural features to filter out related users and controls the generation of cascade hidden states, thereby solving the “branch-independency” problem. Experiments on multiple real-world datasets show that our model significantly outperforms state-of-the-art baseline models on both ${\text{ hits@}}\kappa $ and ${\text{ map@}}\kappa $ metrics. Furthermore, the visualization of latent representations by t-distributed stochastic neighbor embedding (t-SNE) indicates that our model makes different cascades more discriminative during the encoding process.

Cloud computing eliminates the need for local hardware, addressing the challenge of high computing expenses. However, entrusting data to the cloud may pose the risk of unintentional data loss. Using multiple copies and multi-cloud servers is promising because even if the data on one cloud storage server is compromised, the data proprietor can retrieve the information from alternate cloud storage servers. To protect data security, data needs to be encrypted before uploading to the cloud. However, users cannot directly confirm whether their encrypted documents and copies are stored securely and with integrity on cloud servers. To verify data copies on remote servers without downloading and decrypting, we propose Public Verification Public Key Encryption with Equality Test (PVPKEET). Under PVPKEET, users upload encrypted data to cloud servers, and then the test result and proof will be provided by the cloud server without decryption. The publicly verified proof can be examined by all users, allowing everyone to witness the copies stored correctly. Our approach is resistant to chosen-plaintext attacks and is verifiable. A comparison with prior research demonstrates the efficiency and feasibility of our design.

Network intrusion poses a severe threat to the Internet. Intrusion detection methods based on deep learning are very effective to process and analyze intrusion data. On the one hand, they use the Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) models to extract spatial and temporal features, respectively. However, they either adopt a single model or operate two models in series. And it fails to capture temporal-spatial features effectively. On the other hand, previous methods do not consider the multi-feature correlation of intrusion data. And then they cannot get better classification performance. To address the two above problems, we propose a hybrid neural network (HNN) model by integrating multi-feature correlation and temporal-spatial analysis. First, we adopt a contribution-based feature selection. Second, we reconstruct multi-feature correlation and then apply the CNN and LSTM in parallel to extract temporal-spatial features. Finally, we splice the temporal-spatial features with the correlation features, or study the influence of the temporal-spatial features by attention mechanism. Based on the above operations, we exploit the Deep Neural Network (DNN) to detect intrusion data. The experimental results show that HNN improves 3.78%, 1.31%, 0.21%, and 1.13% accuracy on the UNSW-NB15, AWID, CICIDS 2017, and CICIDS 2018 datasets.

With the popularity of Android and its open source, the Android platform has become an attractive target for hackers, and the detection and classification of malware has become a research hotspot. Existing malware classification methods rely on complex manual operation or large-volume high-quality training data. However, malware data collected by security providers contains user privacy information, such as user identity and behavior habit information. The increasing concern for user privacy poses a challenge to the current malware classification scheme. Based on this problem, we propose a new android malware classification scheme based on Federated learning, named FedHGCDroid, which classifies malware on Android clients in a privacy-protected manner. Firstly, we use a convolutional neural network and graph neural network to design a novel multi-dimensional malware classification model HGCDroid, which can effectively extract malicious behavior features to classify the malware accurately. Secondly, we introduce an FL framework to enable distributed Android clients to collaboratively train a comprehensive Android malware classification model in a privacy-preserving way. Finally, to adapt to the non-IID distribution of malware on Android clients, we propose a contribution degree-based adaptive classifier training mechanism FedAdapt to improve the adaptability of the malware classifier based on Federated learning. Comprehensive experimental studies on the Androzoo dataset (under different non-IID data settings) show that the FedHGCDroid achieves more adaptability and higher accuracy than the other state-of-the-art methods.

Deep learning-based models demonstrate a remarkable level of accuracy in network traffic identification. However, the black-box nature of neural networks often makes the identification results difficult to explain. Although some eXplainable Artificial Intelligence (XAI) methods have been applied to network traffic identification, most of them focus on model explainability and do not provide sufficient credibility. In emerging network systems that use proprietary protocols, low-credibility malicious traffic detection can result in severe consequences. Therefore, it is imperative to deeply understand network traffic features and trust the detection results. In this paper, we propose an explainable architecture for emerging network systems. This architecture enhances the explainability of malicious traffic detection from both input and output perspectives, aiming to understand network traffic data and improve the reliability of the results. The effectiveness of explaining inputs and outputs is verified through experimental analysis in case studies. Furthermore, we review the research on explainable models in the field of network traffic identification and summarize research opportunities.

Android malware poses a significant challenge for mobile platforms. To evade detection, contemporary malware variants use API substitution or obfuscation techniques to hide malicious activities and mask their shallow semantic characteristics. However, existing research lacks analysis of the hierarchical semantic associated with Android apps. To address this problem, we propose ArchSentry, an enhanced Android malware detection via hierarchical semantic extraction. First, we select entities and their relationships relevant to Android software behavior through the software architecture and represent them using a heterogeneous graph. Then, we structure meta-paths to represent rich semantic information to achieve semantic enhancement and improve efficiency. Next, we design a meta-path semantic selection method based on KL Divergence to identify and eliminate redundant features. To achieve a comprehensive representation of the overall software semantics and improve performance, we construct a feature fusion approach based on Restricted Boltzmann Machines (RBM) and AutoEncoder (AE) during the pre-training phase, while preserving the probability distribution characteristics of various meta-paths. Finally, Deep Neural Networks (DNN) process fusion features for comprehensive feature sets. Experimental results on real-world application samples indicate that ArchSentry achieves a remarkable 99.2% detection rate for Android malware, with a low false positive rate below 1%. These results surpass the performance of current state-of-the-art approaches.