Tieming Chen
YOU?
Author Swipe
View article: Doctor: Optimizing Container Rebuild Efficiency by Instruction Re-orchestration
Doctor: Optimizing Container Rebuild Efficiency by Instruction Re-orchestration Open
Containerization has revolutionized software deployment, with Docker leading the way due to its ease of use and consistent runtime environment. As Docker usage grows, optimizing Dockerfile performance, particularly by reducing rebuild time…
View article: APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining
APT Detection via Hypergraph Attention Network with Community-Based Behavioral Mining Open
Advanced Persistent Threats (APTs) challenge cybersecurity due to their stealthy, multi-stage nature. For the provenance graph based on fine-grained kernel logs, existing methods have difficulty distinguishing behavior boundaries and handl…
View article: ActMiner: Applying Causality Tracking and Increment Aligning for Graph-based Cyber Threat Hunting
ActMiner: Applying Causality Tracking and Increment Aligning for Graph-based Cyber Threat Hunting Open
To defend against Advanced Persistent Threats on the endpoint, threat hunting employs security knowledge such as cyber threat intelligence to continuously analyze system audit logs through retrospective scanning, querying, or pattern match…
View article: An Interpretable Network Intrusion Detection Model via Decision Tree Enhanced Deep Attention Network
An Interpretable Network Intrusion Detection Model via Decision Tree Enhanced Deep Attention Network Open
Network intrusion detection (NID) plays a crucial role in cybersecurity by identifying network attacks from network traffic. In recent years, the deep learning technique has become a tendency for the NID problem. However, a major drawback …
View article: ProvADShield: A Multimodel Ensemble Defender Against Adversarial Attacks on Provenance Graph Host Intrusion Detector
ProvADShield: A Multimodel Ensemble Defender Against Adversarial Attacks on Provenance Graph Host Intrusion Detector Open
HID (host intrusion detection) is a security mechanism for detecting malicious activities performed in a host (e.g., a server, an edge device). Recent research has recast HID as a provenance graph learning problem thanks to the advancement…
View article: METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift
METANOIA: A Lifelong Intrusion Detection and Investigation System for Mitigating Concept Drift Open
As Advanced Persistent Threat (APT) complexity increases, provenance data is increasingly used for detection. Anomaly-based systems are gaining attention due to their attack-knowledge-agnostic nature and ability to counter zero-day vulnera…
View article: DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation
DEHYDRATOR: Enhancing Provenance Graph Storage via Hierarchical Encoding and Sequence Generation Open
As the scope and impact of cyber threats have expanded, analysts utilize audit logs to hunt threats and investigate attacks. The provenance graphs constructed from kernel logs are increasingly considered as an ideal data source due to thei…
View article: TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning
TREC: APT Tactic / Technique Recognition via Few-Shot Provenance Subgraph Learning Open
APT (Advanced Persistent Threat) with the characteristics of persistence,\nstealth, and diversity is one of the greatest threats against\ncyber-infrastructure. As a countermeasure, existing studies leverage provenance\ngraphs to capture th…
View article: CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports
CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports Open
Cyber Threat Intelligence (CTI) reports are factual records compiled by security analysts through their observations of threat events or their own practical experience with attacks. In order to utilize CTI reports for attack detection, exi…
View article: MVD-HG: multigranularity smart contract vulnerability detection method based on heterogeneous graphs
MVD-HG: multigranularity smart contract vulnerability detection method based on heterogeneous graphs Open
Smart contracts have significant losses due to various types of vulnerabilities. However, traditional vulnerability detection methods rely extensively on expert rules, resulting in low detection accuracy and poor adaptability to novel atta…
View article: Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports
Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports Open
Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false p…
View article: SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time
SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time Open
As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts c…
View article: HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring
HTTPSmell: A Deep Learning Approach on Malicious HTTP Traffic Detection via Data Augmentation and Label Refactoring Open
Anomaly detection is essential to ensuring system security and reliability. As one of the basic techniques in the cyberattack, the existing malicious traffic classification method has been facing diverse challenges such as insufficient sam…
View article: Language Inclusion Checking of Timed Automata Based on Property Patterns
Language Inclusion Checking of Timed Automata Based on Property Patterns Open
The language inclusion checking of timed automata is described as the following: given two timed automata M and N, where M is a system model and N is a specification model (which represents the properties that the system needs to satisfy),…
View article: A Heterogeneous Graph Learning Model for Cyber-Attack Detection
A Heterogeneous Graph Learning Model for Cyber-Attack Detection Open
A cyber-attack is a malicious attempt by experienced hackers to breach the target information system. Usually, the cyber-attacks are characterized as hybrid TTPs (Tactics, Techniques, and Procedures) and long-term adversarial behaviors, ma…
View article: APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts
APTSHIELD: A Stable, Efficient and Real-time APT Detection System for Linux Hosts Open
Advanced Persistent Threat (APT) attack usually refers to the form of long-term, covert and sustained attack on specific targets, with an adversary using advanced attack techniques to destroy the key facilities of an organization. APT atta…
View article: Privacy-Aware Fuzzy Skyline Parking Recommendation Using Edge Traffic Facilities
Privacy-Aware Fuzzy Skyline Parking Recommendation Using Edge Traffic Facilities Open
Drivers have always been confronted with real-time parking difficulties when driving on urban roads, especially in crowded downtown or beauty spots. On the other hand, privacy leakage risks on users' private parking preferences and the sen…
View article: A Payload Based Malicious HTTP Traffic Detection Method Using Transfer Semi-Supervised Learning
A Payload Based Malicious HTTP Traffic Detection Method Using Transfer Semi-Supervised Learning Open
Malicious HTTP traffic detection plays an important role in web application security. Most existing work applies machine learning and deep learning techniques to build the malicious HTTP traffic detection model. However, they still suffer …
View article: A Collaborative Deep and Shallow Semisupervised Learning Framework for Mobile App Classification
A Collaborative Deep and Shallow Semisupervised Learning Framework for Mobile App Classification Open
With the rapid growth of mobile Apps, it is necessary to classify the mobile Apps into predefined categories. However, there are two problems that make this task challenging. First, the name of a mobile App is usually short and ambiguous t…
View article: DroidVecDeep: Android Malware Detection Based on Word2Vec and Deep Belief Network
DroidVecDeep: Android Malware Detection Based on Word2Vec and Deep Belief Network Open
With the proliferation of the Android malicious applications, malware becomes more capable of hiding or confusing its malicious intent through the use of code obfuscation, which has significantly weaken the effectiveness of the conventiona…
View article: TinyDroid: A Lightweight and Efficient Model for Android Malware Detection and Classification
TinyDroid: A Lightweight and Efficient Model for Android Malware Detection and Classification Open
With the popularity of Android applications, Android malware has an exponential growth trend. In order to detect Android malware effectively, this paper proposes a novel lightweight static detection model, TinyDroid , using instruction sim…
View article: From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT
From Wireless Sensor Networks to Wireless Body Area Networks: Formal Modeling and Verification on Security Using PAT Open
Model checking has successfully been applied on verification of security protocols, but the modeling process is always tedious and proficient knowledge of formal method is also needed although the final verification could be automatic depe…
View article: Formalizing and verifying stochastic system architectures using Monterey Phoenix (SoSyM abstract)
Formalizing and verifying stochastic system architectures using Monterey Phoenix (SoSyM abstract) Open
The analysis of software architecture plays an important role in understanding the system structures and facilitate proper implementation of user requirements. Despite its importance in the software engineering practice, the lack of formal…