Weiping Wang

As a crucial component of websites, JavaScript is one of the most common attack payloads on malicious websites. Although many methods for detecting malicious JavaScript have been proposed, obfuscation techniques make it difficult for previous approaches to detect disguised malicious JavaScript effectively. To address this problem, we observe that malicious JavaScript often uses obfuscation to fragment key attack semantics and conceal them within data-dependent statements involving variable propagation. This observation suggests that data dependencies between variables can be leveraged to extract potentially malicious functional statements. Therefore, this paper proposes JSCoherence, a novel static detection method for obfuscated malicious JavaScript. Its core principle is to mine statement pairs with data dependencies through data-flow analysis, thereby reconnecting fragmented semantics and recovering locally coherent malicious behavior. Experiments show that JSCoherence achieves an F1 score of 99.77% on public datasets. On the Jfogs, JSObfu, and JavaScript-obfuscator obfuscated datasets, its F1 score consistently exceeds 95%, representing an improvement over the current advanced methods. In addition, JSCoherence provides interpretability by analyzing the semantics of representative data-dependent statement pairs, offering clear explanatory evidence for its detection decisions.

Tactics and techniques information in Cyber Threat Intelligence (CTI) represent the objectives of attackers and the means through which these objectives are achieved. The classification of tactics and techniques descriptions in CTI has been extensively studied to assist security experts in interpreting attack patterns. Although many recent studies have applied various deep learning methods to enhance classification performance, they mainly focus on improving performance from an average or top perspective. However, the imbalance between tactical and technical tag samples, as well as text sparsity, may lead to poor model performance, which has been under-explored. To address these issues, we propose a new tactics and techniques classification model based on adversarial contrastive learning and meta-path (TTC-ACLM). In TTC-ACLM, a novel text representation learning module is first designed. It includes pre-trained language model (PLM) and contrastive adversarial methods, which can better adapt to categories with smaller sample sizes while obtaining better text representations. Then, heterogeneous information networks are used to model the rich relationships between texts and labels (tactics and techniques), which can merge additional information, e.g., processes and tools, to address text sparsity. Next, we defined a meta-path based classifier learning module that maps text, tactics, and meta-path based context to a set of classifiers, which are applied to the text representation generated by the text representation module for better classification. Finally, the classification performance is further improved through the tactics and techniques correlation enhancement matrix. Through in-depth research, we demonstrate that the proposed model can effectively address the impact of sample imbalance and text sparsity. Extensive experimental results indicate that TTC-ACLM achieves state-of-the-art performance.

With the rise of multimedia technology, audio file encryption has become increasingly significant, especially for voice messages in popular social media applications like WhatsApp. Voice messages hold great social significance, and to ensure their security, they must be encrypted before being transmitted over the internet. This paper proposes an efficient algorithm to securely encrypt voice messages. The innovative algorithm is based on a magic cube to reduce the execution time of the advanced encryption standard (AES) cipher algorithm. This is achieved by replacing the MixColumn function with a 3 × 3 × 3 magic cube FG (2^8) irreducible polynomial. This work reduces the execution time of the AES cryptosystem and enhances complexity by utilizing additional keys generated by a 3 × 3 × 3 magic cube. to develop a block cipher algorithm that encodes audio files using two types of finite fields: GF (P) and GF (2^8). This algorithm places a key of three cells and a voice message of six cells on each face of a 3 × 3 × 3 magic cube. Time complexity and encryption quality are evaluated according to National Institute of Standards and Technology standards, and the differential attacks' peak signal-to-noise ratio is calculated. The total complexity achieved for both GF (P) =2569 × 25118 and GF (2^8) = 2569 × 25618 is measured for comparison. Simulation results demonstrate a significant reduction in execution time and increased encryption complexity. Moreover, the magic cube with three faces (3 × 3 × 3) exhibits superior performance in terms of complexity and speed compared to the third-order magic square.

Machine learning-based Android malware detection has consistently demonstrated superior results. However, with the continual evolution of the Android framework, the efficacy of the deployed models declines markedly. Existing solutions necessitate frequent and expensive model retraining to resist the constant evolution of malware accompanying Android framework updates. To address this, we introduce a solution called ASDroid, which generalizes specific APIs into similar API clusters to counteract evolving Android malware threats. One primary challenge lies in identifying analogous API clusters that correspond to specific APIs. Our approach involves extracting semantic information from open-source API source code to construct a heterogeneous information graph, and utilizing embedding algorithms to obtain semantic vector representations of APIs. APIs that are close in embedding distance are presumed to have similar semantics. Our dataset encompasses Android applications spanning nine years from 2011 to 2019. In comparison to existing Android malware detection model aging mitigation solutions like APIGraph, SDAC and MaMaDroid, ASDroid demonstrates greater accuracy and more effective at resisting continuously evolving malware.

Adversarial example attacks are deemed to be a serious threat to deep neural network (DNN) models. Generating adversarial examples in white-box settings has been well-studied, however, it remains challenging to generate transferable adversarial examples that successfully attack black-box models. This work proposes Foolmix, a novel method for generating transferable adversarial examples for black-box attacks. The design of Foolmix is inspired by our observation that adversarial examples with high transferability usually carry multi-class features in the latent space of DNN models. Thus, we propose a dual-blending strategy that blends the image with a set of random pixel-blocks and blends the gradient by calculating the loss of the blended image for both the ground-truth label and a set of random labels. The dual-blending strategy pressures the example to penetrate multiple class regions and gain multi-class features in the latent space, greatly enhancing the transferability of the generated adversarial example. However, the randomness in the blending process might also pressure the example to approach the boundary of the original class region, which lowers the robustness of the example. To mitigate this problem, we further propose an update method in the starting forward direction to guide the generated adversarial example to go deep into multi-class adversarial regions while being globally far away from the original class region. Compared to state-of-the-art transformation-based attacks, Foolmix significantly enhances the transferability of generated adversarial examples, boosting the average transferable attack success rate by 13.2% and 16.9% on mainstream CNNs and ViTs respectively, while achieving better defense breakthrough ability.

Graph Neural Networks (GNNs) have garnered intensive attention for Network Intrusion Detection System (NIDS) due to their suitability for representing the network traffic flows. However, most present GNN-based methods for NIDS are supervised or semi-supervised. Network flows need to be manually annotated as supervisory labels, a process that is time-consuming or even impossible, making NIDS difficult to adapt to potentially complex attacks, especially in large-scale real-world scenarios. The existing GNN-based self-supervised methods focus on the binary classification of network flow as benign or not, and thus fail to reveal the types of attack in practice. This paper studies the application of GNNs to identify the specific types of network flows in an unsupervised manner. We first design an encoder to obtain graph embedding, that introduces the graph attention mechanism and considers the edge information as the only essential factor. Then, a self-supervised method based on graph contrastive learning is proposed. The method samples center nodes, and for each center node, generates subgraph by it and its direct neighbor nodes, and corresponding contrastive subgraph from the interpolated graph, and finally constructs positive and negative samples from subgraphs. Furthermore, a structured contrastive loss function based on edge features and graph local topology is introduced. To the best of our knowledge, it is the first GNN-based self-supervised method for the multiclass classification of network flows in NIDS. Detailed experiments conducted on four real-world databases (NF-Bot-IoT, NF-Bot-IoT-v2, NF-CSE-CIC-IDS2018, and NF-CSE-CIC-IDS2018-v2) systematically compare our model with the state-of-the-art supervised and self-supervised models, illustrating the considerable potential of our method. Our code is accessible through https://github.com/renj-xu/NEGSC.