Hui Shu

Phishing email detection faces many challenges, as existing detection methods have difficulty in distinguishing phishing-oriented intent from legitimate semantics, lack unified modeling of persuasion strategies and rhetorical structures, and suffer from the impact of class imbalance. To address these issues, this paper proposes a three-stage phishing email detection framework. In the first stage, unsupervised SimCSE is employed to obtain discriminative sentence representations. In the second stage, a multi-task graph construction model, KD-PEPRD-Graph, jointly identifies intra-sentence persuasion principles and inter-sentence rhetorical dependencies, and automatically generates a persuasion–rhetorical dependency graph for each email. Furthermore, a knowledge distillation mechanism is introduced to enhance the generalization ability of the graph construction model using unlabeled emails. In the third stage, the SimCSE-Graphormer-LMF detection model is proposed. Node features are initialized with the SimCSE encoder. Graphormer then performs global reasoning over the constructed graph. To mitigate class imbalance, the large-margin-aware focal loss is also incorporated. The core contribution of this work lies in jointly modeling intra-sentence persuasion principles and inter-sentence rhetorical dependencies within a unified graph structure, thereby uncovering how persuasion principles, organized through rhetorical dependencies, together construct the deceptive narrative of phishing emails. Experiments show that the proposed model achieves F1 scores of 99.15% and 84.31% on the IWSPA-AP and Hard-Example datasets, respectively, outperforming all baseline methods. On the Enron-Nazario dataset, it attains performance comparable with the state-of-the-art large-language-model baseline Gemini 3.1-PPS&RDR. Statistical significance tests based on the McNemar’s test confirmed the reliability of these improvements. Taken together, the results across the three datasets validate the effectiveness of the proposed framework, which achieves high detection performance while maintaining a manageable model size and acceptable inference latency.

With the rapid advancement of artificial intelligence (AI), particularly the widespread adoption of large language models (LLMs) in code comprehension and analysis, their strong semantic parsing capabilities have introduced new threats to software security. Attackers can exploit LLMs to reverse-engineer the deeper semantic logic of code, steal core algorithms, or uncover vulnerabilities, thereby endangering software intellectual property and system security. This work introduces SemAder , a structure–semantics joint induction framework that generates adversarial yet function-preserving binaries to mislead LLMs’ functional judgments in binary analysis, thereby reducing the reliability of LLM-assisted semantic analysis during reverse engineering. SemAder comprises three core components: (1) a control-flow-labeled induced corpus annotated with structural tags and code semantics; (2) a hybrid similarity-driven corpus selection mechanism that favors structural proximity with semantic divergence; and (3) a reinforcement-learning-driven semantic fusion pipeline that incorporates constant externalization and context-aware semantic enhancement to strengthen induction against high-capability LLMs. Experimental results across eight LLM evaluators demonstrate that SemAder consistently shifts model predictions toward the induced target category, achieving an average induction gap of 0.77 and maintaining effectiveness under adversarial prompt variants and multi-agent post-processing workflows. SemAder also misleads the CLAP code classification model (− 63.5% original-class confidence) and reduces similarity scores across four binary similarity detectors (Asm2Vec, BinDiff, SAFE, Gemini) to an average of 0.51, with only 12.7% average binary size increase and 8.8% average runtime overhead.

The integration of machine learning (ML), particularly deep learning (DL), in network intrusion detection systems (NIDSs) has witnessed exponential growth. Notably, these intelligent systems exhibit significant vulnerability to adversarial manipulations, especially in security-critical environments. A critical limitation of conventional adversarial generation approaches—predominantly relying on generative adversarial networks (GANs)—lies in their inability to produce diverse traffic patterns. This shortcoming allows detectors to quickly identify such instances after retraining. To bridge this gap, we propose an adversarial attack framework, TDTCE (Traffic Diffusion Models with Transformers against NIDS in Constrained Environments), which surpasses previous efforts in the following aspects: (i) Generative diversity. TDTCE utilizes a Transformer-based diffusion model to generate adversarial instances that more effectively deceive NIDSs; (ii) Practical feasibility. By restricting prior knowledge, gray-box and black-box attacks are conducted in real-world scenarios and a mapping function is utilized to adjust generated instances for adherence to traffic protocol standards. A comprehensive evaluation of TDTCE using extensive datasets demonstrates that the proposed framework achieves significant gains in adaptive pattern diversity with improvements of up to 79.4% over GAN-based approaches. The framework achieves a minimum detection rate of 9.16%, with an escape increase rate of 89.64%–16.52% higher than state-of-the-art baselines.

Malware authors increasingly exploit API Hashing to create “invisible” system calls, replacing explicit function names with dynamically computed hashes that evade detection systems. This sophisticated obfuscation technique poses three critical challenges: accurately identifying hash functions within obfuscated code, linking computed hashes to their corresponding API calls, and detecting the growing diversity of hash algorithm variants. Existing rule-based approaches fail against these adaptive threats and cannot identify modern hash variants. We propose GAEDM , a novel framework that combines deep learning with program analysis to address these challenges. Our key innovation integrates static taint analysis with a genetic algorithm-enhanced assembly language model that generates diverse training variants, enabling robust detection of previously unseen obfuscation patterns. Experimental evaluation demonstrates that GAEDM achieves 91.9% MRR and 94.6% Recall@k in hash function identification, representing improvements of 18.4% and 8.2% respectively over state-of-the-art methods. GAEDM detects sophisticated obfuscation patterns that completely evade existing approaches, enabling security analysts to uncover previously undetectable threats and significantly advancing malware defense capabilities.

Binary reverse engineering is pivotal in the realm of cybersecurity, enabling critical applications such as malware analysis, legacy code hardening, and vulnerability detection. However, the challenge of recovering structural information from binaries, especially stripped ones, persists due to the significant loss of variable boundaries, types, names, and dataflow information during compilation. In this article, we introduce Hy brid RE asoning for S tructure Recovery ( HyRES ), an innovative hybrid reasoning technique that energizes static analysis, Large Language Model (LLM), and heuristic methods to recover data structures from stripped binaries. It analyzes the structure layout and proficiently infer its semantics via LLM, and utilizes semantics to perform semantic-enhanced structure aggregation, which overcomes the need for complete dataflow. HyRES outperforms State-of-the-Art (SOTA) solutions in terms of structure pointer identification and layout recovery. Specifically, HyRES achieves 65.1% higher recall and 33.4% higher accuracy than the SOTA, while also being 64.2% faster than existing SOTA solutions. Comprehensive experiments demonstrate HyRES ’s superior performance and practical utility in real-world reverse engineering tasks, marking a significant advancement in binary analysis.

Code obfuscation is essential for software security. However, current obfuscation techniques demonstrate limited resilience against systematic reverse engineering attacks—including taint analysis and code similarity detection. Moreover, these methods often incur considerable resource overheads and recognizable obfuscation features. In this paper, we propose an innovative obfuscation algorithm that integrates the instruction and data flows of two programs at the intermediate representation level. The resulting program maintains the complete functionality of both original programs. This strategy utilizes the static and dynamic features of the parent program to obfuscate the target program. Extracting the target code from the integrated program is a significant challenge, thereby enhancing the target code’s resistance to deobfuscation. We evaluate our algorithm across various metrics: functionality correctness, obfuscation efficiency, protection strength, and resilience to automated reverse engineering techniques. Our comprehensive evaluation demonstrates that our method imposes significantly lower overhead while delivering markedly improved protection effectiveness, marking a significant advancement in software protection.

Predicting function names in stripped binaries, which requires succinctly summarizing semantics of binary code in natural languages, is a crucial but challenging task. Recently, many machine learning based solutions have been proposed. However, they have poor generalizability, i.e., fail to handle unseen binaries. To advance the state of the art, we present large assembly language Model ( llasm ) , a novel framework which fuses encoder-only and decoder-only LLMs for function name prediction. It refines encoder-only models to preserve more binary information and learn better binary representations. Then it adopts a novel architecture to project the encoding to the input space of a decoder-only natural language model, which enables it to have better capability of inferring general knowledge and better generalizability. We have evaluated llasm in the BinaryCorp and Debin datasets. llasm outperforms the state-of-the-art function name prediction tools by up to 19.9%, 40.7%, and 36.5% in precision, recall, and F1 score, with significantly better generalizability in unseen binaries. Our case studies further demonstrate the practical use cases of llasm in analyzing real-world malware, showing the usefulness of function name prediction.

Message structure reconstruction is a critical task in protocol reverse engineering, aiming to recover protocol field structures without access to source code. It enables important applications in network security, including malware analysis and protocol fuzzing. However, existing methods suffer from inaccurate field boundary delineation and lack hierarchical relationship recovery, resulting in imprecise and incomplete reconstructions. In this paper, we propose , a novel method for reconstructing protocol field structures based on program execution slice embedding. extracts code slices from protocol parsing at runtime, converts them into embedding vectors using a data flow-sensitive assembly language model, and performs hierarchical clustering to recover complete protocol field structures. Evaluation on two datasets containing 12 protocols shows that achieves an average F1 score of 0.85 and a cophenetic correlation coefficient of 0.189, improving by 19% and 0.126% respectively over state-of-the-art methods (including BPRE, T, N, and QwQ-32B-preview), demonstrating significant superiority in both accuracy and completeness of field structure recovery. Case studies further validate the effectiveness of in practical malware analysis scenarios.