Correctly measuring the importance of nodes in a complex network is critical for studying the robustness of the network, and designing a network security policy based on these highly important nodes can effectively improve security aspects of the network, such as the security of important data nodes on the Internet or the hardening of critical traffic hubs. Currently included are degree centrality, closeness centrality, clustering coefficient, and H-index. Although these indicators can identify important nodes to some extent, they are influenced by a single evaluation perspective and have limitations, so most of the existing evaluation methods cannot fully reflect the node importance information. In this paper, we propose a multi-attribute critic network decision indicator (MCNDI) based on the CRITIC method, considering the H-index, closeness centrality, k-shell indicator, and network constraint coefficient. This method integrates the information of network attributes from multiple perspectives and provides a more comprehensive measure of node importance. An experimental analysis of the Chesapeake Bay network and the contiguous USA network shows that MCNDI has better ranking monotonicity, more stable metric results, and is highly adaptable to network topology. Additionally, deliberate attack simulations on real networks showed that the method exhibits high convergence speed in attacks on USAir97 networks and technology routes networks.

The network intrusion detection system (NIDS) plays a crucial role as a security measure in addressing the increasing number of network threats. The majority of current research relies on feature-ready datasets that heavily depend on feature engineering. Conversely, the increasing complexity of network traffic and the ongoing evolution of attack techniques lead to a diminishing distinction between benign and malicious network behaviors. In this paper, we propose a novel end-to-end intrusion detection framework based on a contrastive learning approach. We design a hierarchical Convolutional Neural Network (CNN) and Gated Recurrent Unit (GRU) model to facilitate the automated extraction of spatiotemporal features from raw traffic data. The integration of contrastive learning amplifies the distinction between benign and malicious network traffic in the representation space. The proposed method exhibits enhanced detection capabilities for unknown attacks in comparison to the approaches trained using the cross-entropy loss function. Experiments are carried out on the public datasets CIC-IDS2017 and CSE-CIC-IDS2018, demonstrating that our method can attain a detection accuracy of 99.9% for known attacks, thus achieving state-of-the-art performance. For unknown attacks, a weighted recall rate of 95% can be achieved.

Network protocol implementations, as integral components of information communication, are critically important for security. Due to its efficiency and automation, fuzzing has become a popular method for protocol security detection. However, the existing protocol-fuzzing techniques face the critical problem of generating high-quality inputs. To address the problem, in this paper, we propose MSFuzz, which is a protocol-fuzzing method with message syntax comprehension. The core observation of MSFuzz is that the source code of protocol implementations contains detailed and comprehensive knowledge of the message syntax. Specifically, we leveraged the code-understanding capabilities of large language models to extract the message syntax from the source code and construct message syntax trees. Then, using these syntax trees, we expanded the initial seed corpus and designed a novel syntax-aware mutation strategy to guide the fuzzing. To evaluate the performance of MSFuzz, we compared it with the state-of-the-art (SOTA) protocol fuzzers, namely, AFLNET and CHATAFL. Experimental results showed that compared with AFLNET and CHATAFL, MSFuzz achieved average improvements of 22.53% and 10.04% in the number of states, 60.62% and 19.52% improvements in the number of state transitions, and 29.30% and 23.13% improvements in branch coverage. Additionally, MSFuzz discovered more vulnerabilities than the SOTA fuzzers.

In recent years, as cybersecurity threats have become increasingly severe and cyberattacks have occurred frequently, higher requirements have been put forward for cybersecurity protection. Therefore, the Named Entity Recognition (NER) technique, which is the cornerstone of Cyber Threat Intelligence (CTI) analysis, is particularly important. However, most existing NER studies are limited to recognizing single-layer flat entities, ignoring the possible nested entities in CTI. On the other hand, most of the existing studies focus on English CTIs, and the existing models performed poorly in a limited number of Chinese CTI studies. Given the above challenges, we propose in this paper a novel unified model, RBTG, which aims to identify flat and nested entities in Chinese CTI effectively. To overcome the difficult boundary recognition problem and the direction-dependent and distance-dependent properties in Chinese CTI NER, we use Global Pointer as the decoder and TENER as the encoder layer, respectively. Specifically, the Global Pointer layer solves the problem of the insensitivity of general NER methods to entity boundaries by utilizing the relative position information and the multiplicative attention mechanism. The TENER layer adapts to the Chinese CTI NER task by introducing an attention mechanism with direction awareness and distance awareness. Meanwhile, to cope with the complex feature capture of hierarchical structure and dependencies among Chinese CTI nested entities, the TENER layer solves the problem by following the structure of multiple self-attention layers and feed-forward network layers superimposed on each other in the Transformer. In addition, to fill the gap in the Chinese CTI nested entity dataset, we further apply the Large Language Modeling (LLM) technique and domain knowledge to construct a high-quality Chinese CTI nested entity dataset, CDTinee, which consists of six entity types selected from STIX, including nearly 4000 entity types extracted from more than 3000 threatening sentences. In the experimental session, we conduct extensive experiments on multiple datasets, and the results show that the proposed model RBTG outperforms the baseline model in both flat NER and nested NER.

Scanning the large-scale topology of the IPv6 internet presents a significant challenge in network engineering, particularly for understanding the underlying network structure and assessing network security. The sheer size of the IPv6 address space makes traditional brute-force scanning techniques, such as traceroute, inefficient and impractical. Existing methodologies are often unable to cope with the inherent complexity of IPv6’s network structure and its probing requirements, leading to issues such as redundant probes, ICMPv6 rate limits, and network congestion. To address these challenges, this paper introduces 6Trace, an innovative solution that mitigates the impact of rate-limiting and congestion by distributing scanning traffic across the network. Furthermore, 6Trace incorporates a stateless, asynchronous scanning approach combined with a bisection-like dynamic probing strategy, significantly reducing redundancy. Experimental results demonstrate that 6Trace enhances scanning efficiency by 70% over current solutions, discovering the maximum number of interface addresses while minimizing probing time. Notably, this paper also provides the first comprehensive analysis of topology probing results across different types of target networks. The insights gained from this study will inform future research on optimal target selection and IPv6 internet measurement techniques.