Shuyuan Jin

Malicious traffic detection in the Industrial Internet of Things (IIoT) faces significant challenges, primarily due to the scarcity of labeled data, high inference latency on resource-constrained edge devices, and the lack of comprehensibility in deep learning models. To overcome these limitations, this paper proposes MeeDet, a novel detection framework that integrates Mamba-based state-space modeling, a dynamic early-exit mechanism, and Large Language Model (LLM)-driven comprehensibility. The proposed MeeDet operates through a four-stage pipeline. First, raw packet captures are preprocessed into header-only, standardized stride-based sequences. Second, a 12-layer unidirectional Mamba backbone is pretrained on unlabeled data using two complementary tasks: Masked Byte Modeling for byte-level semantics and Next-Flow Prediction for long-range flow-level temporal coherence. Third, the model is fine-tuned by attaching lightweight binary heads to each Mamba layer, allowing for the early termination of high-confidence benign samples and adaptive routing of ambiguous flows to deeper layers. Finally, for detected malicious samples, structured prompts containing key network traffic features are processed by an LLM to generate human-readable diagnostic reports, without affecting real-time detection latency. Extensive experiments on five public IIoT datasets demonstrate the superiority of MeeDet over existing baselines. MeeDet achieves F1-scores exceeding 0.98 on key benchmarks while significantly reducing computational overhead. Specifically, at a 1% malicious traffic ratio, MeeDet requires only 1.7 MFLOPs and 1.58 ms of average inference latency, representing a reduction of over 70% in computational cost compared to strong pretrained baselines.

Domain Name System is widely abused by various types of malicious campaigns. Recently, many graph learning models have been proposed to detect malicious domains based on the domain name resolution process and related data. These models focus on associations among domain names, which are defined as heuristic relations in this paper, and typically report an F1-score exceeding 0.95, indicating high detection accuracy achieved in real-world DNS applications. In order to explore how far we are from excellent graph-based malicious domain name detection methods, this paper conducts an in-depth analysis of six representative graph-based models on three experimental datasets and one real-world dataset. Our experiments focus on several aspects of model evaluation, including heuristic relation distributions, heuristic relation selection, feature extraction, graph reduction operation, and imbalance distribution of malicious domain names in the real world. The experimental results demonstrate that all these aspects have a significant impact on the detection performance, existing models are still relatively shallow in utilizing heuristic relations, and that all the studied models do not always work well as claimed. We further propose several possible future works that may contribute to achieving excellent performance in malicious domain name detection.

Information flow tracking technology is commonly used in the security analysis of hardware design. This technology protects the confidentiality and integrity of essential assets by instrumenting trace logic on each operation unit to detect whether critical information has been leaked or tampered with. However, as hardware design becomes increasingly large-scale and complex, the significant performance overhead introduced by instrumentation has become a major challenge. This article proposes Selective Hardware Information Flow Tracking (SHIFT), a constraint-driven optimization technique. The core idea of SHIFT includes selective monitoring of operations and selective optimization of propagation logic. In the intermediate representation of the hardware design, SHIFT scans taint sources in the code statically using a conservative analysis algorithm to determine whether logic structures require monitoring and assigns optimization tags based on known conditions. During the synthesis process, these optimization tags are passed to the netlist, thereby enabling selective instrumentation of the trace logic on the cell. In the Trust-Hub AES test bench, SHIFT reduces the deployment time of the tracking model by 12.1%, decreases the number of cells by 19.9%, and reduces the synthesized area by 35.7%, Additionally, the security verification time of the flow model was reduced by 10.5%. In general, SHIFT reduces the overhead of deploying trace logic without introducing false positives.

Intent vulnerabilities pose a significant threat as they allow attackers to exploit unverified intent messages, leading to sensitive data leaks, privilege escalations, or unauthorized actions that compromise user privacy and system security. Fuzzing methods, as traditional Intent vulnerability detection methods, are guided by the edge coverage of the program‐directed graph and do not focus on sensitive information, resulting in a lack of ability to discover vulnerabilities related to sensitive information, especially long‐path vulnerabilities. This article proposes PathFuzzer, which is an intent‐sensitive information flow path‐guided fuzzing method designed to efficiently detect intent vulnerabilities in Android applications. It leverages intent‐sensitive information flow paths to guide fuzzing by sending test cases along these paths and mutating test cases based on the parameter within the paths. Additionally, PathFuzzer utilizes unique long path encoding and key node identification technology to enable test cases to efficiently test along sensitive information flow paths, while monitoring the test status to form a feedback mechanism for long paths. The evaluation results show that PathFuzzer successfully detected 131 intent vulnerabilities across 500 popular applications from Google Play. Compared to traditional methods, PathFuzzer achieved a 92% average path coverage rate on sensitive paths while improving detection efficiency by an average of up to 64%. In summary, PathFuzzer provides an efficient, accurate, and comprehensive method for detecting Intent vulnerabilities.