Renhong Cheng

Social bot detection is vital for protecting online platforms from misinformation and manipulation. In recent research, graph neural networks (GNNs) have emerged as a powerful approach, since they leverage relational patterns and social interactions to identify coordinated bot behaviors. However, two key challenges arise from the nature of real-world social networks: First, bots often actively interact with human users through follows, replies, and mentions, creating numerous ''heterophilous'' edges, i.e., connections between different classes. These cross-class ties disrupt the homophily assumption underlying many GNNs, causing messagepassing to propagate and amplify errors. Second, due to the high cost and time required for manual annotation, social media platforms typically contain a large proportion of unlabeled data, with only a small fraction labeled for bot detection. Unlabeled data are often underutilized, making supervision sparse. To address this, we propose OTPCL (Optimal Transport Driven Pseudo-Labeling with Contrastive Learning), a plug-in framework for GNN-based social bot detection. OTPCL first employs contrastive learning to obtain well-separated node representations. It then formulates pseudolabel assignment as an optimal transport problem, which simultaneously generates pseudo-labels and quantifies their reliability via transport scores. These scores guide two key mechanisms: selective removal of unreliable heterophilous edges to purify the graph structure, and reducing the influence of pseudo-labels with transport scores below the dynamic threshold. Extensive experiments on three widely used benchmark datasets demonstrate that OTPCL consistently improves the detection performance across six different GNN backbones, showing strong robustness and generalization in both low-labeled and fully-labeled scenarios.

The "app-in-app" paradigm is an emerging trend in mobile systems, where super applications (short for superApps) such as WeChat, Baidu, TikTok, enable external vendors to develop mini-programs (short for miniApps) on their platforms by providing privileged APIs. To facilitate management, superApps have devised their specific permission configuration (called scope) to grant the APIs access to specific capabilities and resources. Adhering to these scopes during API implementation is crucial for maintaining security; otherwise, the permission management of superApps can be bypassed—a vulnerability we refer to as API-scope misalignment. In this work, we conduct the first systematic study on the API-scope misalignment issues in the app-in-app ecosystems, uncovering root causes and security risks. More importantly, we developed an automatic tool called ScopeChecker to detect the API-scope misalignment in both superApps and miniApps. ScopeChecker extracts the standard API-scope mappings by integrating the Android permission mechanism into the functionalities of superApps. Then, LLM-based code generation is used to create executable API snippets as test cases. The execution results reflect the actual mappings of APIs to their scopes, which are compared with the standard API-scope mappings to identify misalignment. After that, ScopeChecker verifies the identified misalignment in miniApps by matching the misaligned APIs with a tailored method-oriented abstract syntax tree (MAST) of the target miniApp. ScopeChecker identified 38 misaligned APIs in top superApps with manual confirmation, outperforming the state-of-the-art miniApp-focused test methods. As a highlight, we received 11 positive responses from the superApp developers and CNVD, encompassing 9 vulnerability confirmations with rewards: 1 high-risk, 7 medium-risk, and 1 low-risk. To assess prevalence, ScopeChecker evaluated 42𝑘+ miniApps, and found 51% had API-scope misalignment, averaging 1.4 misaligned APIs each. At last, we illustrated 4 types of security threats raised by the API-scope misalignment by analyzing real-world exploitation cases.