Insider threat makes enterprises or organizations suffer from the loss of property and the negative influence of reputation. User behavior analysis is the mainstream method of insider threat detection, but due to the ...
详细信息
ISBN:
(纸本)9781665418164
Insider threat makes enterprises or organizations suffer from the loss of property and the negative influence of reputation. User behavior analysis is the mainstream method of insider threat detection, but due to the lack of fine-grained detection and the inability to effectively capture the behavior patterns of individual users, the accuracy and precision of detection are insufficient. To solve this problem, this paper designs an insider threat detection method based on user historical behavior and attention mechanism, including using Long Short Term Memory (LSTM) to extract user behavior sequence information, using Attention-based on user history behavior (ABUHB) learns the differences between different user behaviors, uses Bidirectional-LSTM (Bi-LSTM) to learn the evolution of different user behavior patterns, and finally realizes fine-grained user abnormal behavior detection. To evaluate the effectiveness of this method, experiments are conducted on the CMU-CERT Insider Threat Dataset. The experimental results show that the effectiveness of this method is 3.1% to 6.3% higher than that of other comparative model methods, and it can detect insider threats in different user behaviors with fine granularity.
Federated learning (FL) has been demonstrated to be susceptible to backdoor attacks. However, existing academic studies on FL backdoor attacks rely on a high proportion of real clients with main task-related data, whi...
详细信息
With the advent of the multimedia era and the age of picture-reading, the recognition effect of sensitive content of image data has become the key to maintain the information security of network communities. At presen...
详细信息
ISBN:
(纸本)9781665418164
With the advent of the multimedia era and the age of picture-reading, the recognition effect of sensitive content of image data has become the key to maintain the information security of network communities. At present, the image classification and recognition technology for sensitive images in network communities cannot obtain the semantic content of images, and it is difficult to combine the image information with the knowledge in network communities, resulting in low recognition accuracy and poor interpretability, and it is difficult to trace the transmission and fermentation of image information in network communities. To solve this problem, this paper proposes a sensitive image information recognition model of network community based on content text by using image caption technology. Through the text description of the image content of the network community, and the integration of a large number of network community text knowledge, the model can finally identify the images containing sensitive content more accurately and more understandable, and the transmission of image information on the network can be traced through the content text. In this paper, MSCOCO(Microsoft Common Objects in Context) dataset and sensitive image self-made dataset of network community are used as the training set. The experimental results show that the method presented in this paper is significantly better than the model based on image classification task in terms of accuracy and traceability of image sensitive information recognition results, which proves the feasibility and effectiveness of sensitive image information recognition in network communities based on content text.
The interactive behavior of comments within the user group on microblog website is bidirectional and dynamic, reflecting the level of familiarity among users. Predicting the future comment interaction behavior within ...
详细信息
ISBN:
(纸本)9781665418164
The interactive behavior of comments within the user group on microblog website is bidirectional and dynamic, reflecting the level of familiarity among users. Predicting the future comment interaction behavior within the user group is of great significance for commercial recommendation and crime fighting. Related research groups regard it as a temporal link prediction problem, assume the evolution is smooth or there is no evolution at all. Meanwhile, the feature in those studies is too unitary, leading to low link prediction performance. In this paper, we propose a method called User Group Comment Interaction Behaviour Prediction (UGCIBP), which combines structure extraction layer and evolution extraction layer to do dynamic graph representation learning to acheive the modeling of user group historical comment interaction graphs, and build the features of communication weight, interest similarity, and common degree of activity between users on microblog website. Then, we combine dynamic graph representation learning and the constructed features to do link prediction, finally, the purpose of predicting comment interaction is acheived. Experiments are conducted on the public datasets Enron and Twitter datasets to evaluate the method. The results show that the AUC scores of this method are 4.74% and 9.95% higher than existing methods, respectively, which proves the effectiveness of the UGCIBP method.
Dynamic searchable symmetric encryption (DSSE) enables users to delegate the keyword search over dynamically updated encrypted databases to an honest-but-curious server without losing keyword privacy. This paper studi...
详细信息
Static analysis is often impeded by malware obfuscation techniques,such as encryption and packing,whereas dynamic analysis tends to be more resistant to obfuscation by leveraging concrete execution ***,malware can emp...
详细信息
Static analysis is often impeded by malware obfuscation techniques,such as encryption and packing,whereas dynamic analysis tends to be more resistant to obfuscation by leveraging concrete execution ***,malware can employ evasive techniques to detect the analysis environment and alter its behavior *** known evasive techniques can be explicitly dismantled,the challenge lies in generically dismantling evasions without full knowledge of their conditions or implementations,such as logic bombs that rely on uncertain conditions,let alone unsupported evasive techniques,which contain evasions without corresponding dismantling strategies and those leveraging unknown *** this paper,we present Antitoxin,a prototype for automatically exploring evasive *** utilizes multi-path exploration guided by taint analysis and probability calculations to effectively dismantle evasive *** probabilities of branch execution are derived from dynamic coverage,while taint analysis helps identify paths associated with evasive techniques that rely on uncertain ***,Antitoxin prioritizes branches with lower execution probabilities and those influenced by taint analysis for multi-path *** is achieved through forced execution,which forcefully sets the outcomes of branches on selected ***,Antitoxin employs active anti-evasion countermeasures to dismantle known evasive techniques,thereby reducing exploration ***,Antitoxin provides valuable insights into sensitive behaviors,facilitating deeper manual *** experiments on a set of highly evasive samples demonstrate that Antitoxin can effectively dismantle evasive techniques in a generic *** probability calculations guide the multi-path exploration of evasions without requiring prior knowledge of their conditions or implementations,enabling the dismantling of unsupported techniques such as C2 and signific
This paper describes the implementation of transmission-line matrix (TLM) method algorithms on a massively parallel computer (DECmpp 12000), the technique of distributedcomputing in the UNIX environment, and the comb...
详细信息
This paper describes the implementation of transmission-line matrix (TLM) method algorithms on a massively parallel computer (DECmpp 12000), the technique of distributedcomputing in the UNIX environment, and the combination of TLM analysis with Prony's method as well as with autoregressive moving average (ARMA) digital signal processing for electromagnetic field modelling. By combining these advanced computation techniques, typical electromagnetic field modelling of microwave structures by TLM analysis can be accelerated by a few orders of magnitude.
The Vanishing & Appearing Sources during a Century of Observations (VASCO) project investigates astronomical surveys spanning a time interval of 70 years, searching for unusual and exotic transients. We present he...
详细信息
Hi-GAL is a large-scale survey of the Galactic plane, performed with Herschel in five infrared continuum bands between 70 and 500 µm. We present a band-merged catalogue of spatially matched sources and their prop...
详细信息
暂无评论