Table of Content

10 June 2026, Volume 26 Issue 6 Previous Issue   

---

For Selected:

Download Citations EndNote Ris BibTeX

Toggle Thumbnails

Select

Advances in Advanced Persistent Threat Detection and Provenance Research SUN Yu, ZHANG Xuanrui, LIU Xinyu 2026, 26 (6):  833-853.  doi: 10.3969/j.issn.1671-1122.2026.06.001 Abstract ( 105 )   HTML ( 23 )   PDF (26418KB) ( 53 )   In recent years, advanced persistent threat (APT) attacks have experienced explosive growth, posing severe challenges to government agencies and critical infrastructure. Provenance-based intrusion detection systems (PIDS), which capture and analyze system-level dependency relationships, provide a key means for detecting complex and stealthy APT attacks. This paper first analyzed various benchmark datasets supporting PIDS research, highlighting their limitations in scale, complexity, attack coverage, and annotation quality. Furthermore, based on provenance graphs, it classified existing APT detection and investigation methods, revealing the technological evolution from early rule-based matching to machine learning and current approaches utilizing Large Language Model (LLM). The advantages and disadvantages of each category were summarized. This work presented systematic review of the paradigm for LLM-based APT detection and investigation and clarified the key challenges faced in this field. Finally, it outlined prospects for future research directions. Figures and Tables | References | Related Articles | Metrics

Select

A Study on Intrusion Detection Methods Based on Explainable Artificial Intelligence YANG Wang, ZHENG Weite 2026, 26 (6):  854-869.  doi: 10.3969/j.issn.1671-1122.2026.06.002 Abstract ( 96 )   HTML ( 21 )   PDF (18518KB) ( 38 )   To address the issues of opaque decision-making processes and poor generalization ability against variant attacks in deep learning-based intrusion detection systems, this paper proposed an explainability-guided intrusion detection method (EGA-ID). This method breaked the limitation of traditional ensemble learning, which selected base learners solely based on accuracy, and introduced explanation consistency as a key dimension to measure model complementarity. By constructing a unified explanatory vector space, the differences in decision-making logics of heterogeneous models were quantified, thereby selecting a subset of models with diverse and complementary decision-making perspectives. Meanwhile, combined with FGSM-based adversarial augmentation training and a multi-layer fusion decision mechanism comprising Platt Scaling probability calibration and a meta-learner, a robust and transparent end-to-end detection architecture was established. Experimental results on both NSL-KDD and UNSW-NB15 datasets demonstrate that EGA-ID outperforms deep learning baselines and traditional ensemble models in F1-score and detection accuracy. Furthermore, it significantly improves the recall rate for sparse and variant attack samples while maintaining high precision. In addition, the method achieves extremely high explanation fidelity and stability, verifying that high-quality explainability can feedback and enhance model performance, thus achieving a favorable balance between high performance and explainability in the evaluated scenarios. Figures and Tables | References | Related Articles | Metrics

Select

A Multi-Keyword Dynamic Symmetric Searchable Encryption Scheme Based on SGX LIU Peishun, LI Xinyue, CHEN Ping, MO Wenqing, LI Shuangying 2026, 26 (6):  870-885.  doi: 10.3969/j.issn.1671-1122.2026.06.003 Abstract ( 46 )   HTML ( 13 )   PDF (18028KB) ( 14 )   With the widespread adoption of cloud computing, user data security faces significant challenges, especially during data storage and processing, where privacy protection has become a critical issue. Although existing searchable encryption techniques can ensure data privacy, most of them only support single-keyword queries, while the few schemes that support multi-keyword queries still suffer from efficiency and security issues. To address these problems, this paper proposed an SGX-based multi-keyword dynamic symmetric searchable encryption scheme. The scheme introduce a dynamic cross-tagging technique to achieve efficient multi-keyword search. Combined with a result-hiding filter, it eliminate the risk of information leakage. The client relie on SGX to generate trapdoors, significantly reducing computational burden and communication overhead. Furthermore, by leveraging SGX technology, the scheme achieved forward and backward security within a trusted execution environment, effectively defending against threats such as file injection attacks. Finally, theoretical analysis and experimental simulations demonstrate the security of the proposed scheme, as well as its superior search efficiency and overall performance. Figures and Tables | References | Related Articles | Metrics

Select

Deniable Ring Signature Scheme Based on TUOV Digital Signature Algorithm ZHANG Yanshuo, YAN Ziyang, LI Baiheng, CHEN Huiyan, LIU Bing 2026, 26 (6):  886-898.  doi: 10.3969/j.issn.1671-1122.2026.06.004 Abstract ( 45 )   HTML ( 8 )   PDF (14025KB) ( 14 )   Deniable ring signature is a signature scheme that allows ring members to confirm or deny their identity as the signer in the absence of a trusted third party. It effectively balances privacy protection and controllable supervision, and has broad application prospects. To improve and expand the multivariable post-quantum cryptosystem, this paper proposed a denial-of-service ring signature scheme based on the triangular unbalanced oil and vinegar (TUOV) digital signature algorithm, which achieved verifiability and deniability of signatures. Through formal proof, the security and effectiveness of the scheme in terms of correctness, unforgeability, anonymity, traceability, and non-defamation were verified. Furthermore, this paper conducted a comparative analysis with the reputation ring signature (RRS)scheme based on lattices and the Denial-of-Service ring signature scheme based on the Shangyong mima 2 (SM2) standard in terms of communication and computational overhead, demonstrating good practicality. Figures and Tables | References | Related Articles | Metrics

Select

Research on Open-Set Radio Frequency Fingerprint Identification Based on Transfer Learning and Improved OpenMax Algorithm ZHOU Xueguang, ZHAO Yue, CHEN Lu, MAO Yihuan, YAN Meishuang 2026, 26 (6):  899-912.  doi: 10.3969/j.issn.1671-1122.2026.06.005 Abstract ( 42 )   HTML ( 8 )   PDF (16455KB) ( 8 )   At present, most research on radio frequency fingerprinting identification predominantly operate under closed-set assumptions, with less consideration given to the occurrence of unknown samples in the test set. radio frequency signals often require the use of high-precision receivers for collection, making it difficult to obtain high-quality labeled samples. Therefore, the article proposed a method of open-set radio frequency fingerprint identification based on transfer learning and improved OpenMax algorithm. This method modified the input channels of the ResNet18 model to adapt to the grayscale properties of spectrograms and fine-tunes pre-trained parameters during training, achieving cross-domain model transfer from image to spectrogram and finally signal domain. It solved the problems of large sample size requirements and difficulties in practical signal acquisition in the application of deep learning algorithms to radio frequency fingerprint identification. At the same time, Bayesian optimization algorithm was introduced into OpenMax algorithm to solve the problem of manually setting multiple parameters such as confidence threshold and tail number in the original algorithm. In addition, introducing multi-scale tail factors for adaptive distribution fitting of samples of different categories further improves the performance of the model. Experiments demonstrate that the proposed method achieves robust classification performance across varying quantities of unknown samples, with accuracy, recall and F1 score all exceeding 99%, and has good generalization performance. Figures and Tables | References | Related Articles | Metrics

Select

The Network Traffic Classification Method Based on the MoE ZHANG San, MA Yuhang, ZHOU Shiliang, DING Qianwen, ZHOU Manli 2026, 26 (6):  913-924.  doi: 10.3969/j.issn.1671-1122.2026.06.006 Abstract ( 41 )   HTML ( 7 )   PDF (14268KB) ( 8 )   Network traffic classification, as an indispensable fundamental supporting technology for network security management, holds significant theoretical value and practical significance. This work addresses the issues of high feature dependence and low classification accuracy of existing classification methods in dynamic network security environments, and proposes a network traffic classification method based on the mixture of experts (MoE) model. Through a high-order, context-aware gating mechanism, the architecture selectively orchestrated the transient engagement of specialized expert sub-networks, thereby endowing the system with adaptive, precision-tuned representational capacity, and this method achieved efficient classification of heterogeneous traffic. Experimental results on the CIC-IDS2017 benchmark dataset indicate that compared with existing network traffic classification methods, the method has achieved a significant improvement in all aspects, with an accuracy rate of 99% and an extremely low false alarm rate, verifying the robustness and accuracy of the method. Also, the work provides a lightweight and adaptive solution for traffic classification in dynamic network environments. Figures and Tables | References | Related Articles | Metrics

Select

A Consistency Verification Method for Cross-Domain Network Defense Strategies Based on Path Location and Scale Aggregation LIU Xinlu, CHANG Dexian, ZHANG Dawei 2026, 26 (6):  925-943.  doi: 10.3969/j.issn.1671-1122.2026.06.007 Abstract ( 45 )   HTML ( 9 )   PDF (24305KB) ( 8 )   With the generalized deployment of software defined network in the multi-domain environment of cloud-network convergence, the consistency verification of cross-domain defense strategies has become a key challenge in ensuring the quality and security of network services. The traditional full-path verification method is difficult to be applied to lightweight verification scenarios in large-scale cloud network environments due to its excessive computational and communication overheads and lack of dynamic adaptability. This paper proposed a lightweight verification method for cross-domain network defense strategies. Firstly, a hybrid algorithm based on deep reinforcement learning and optimal monitoring allocation was designed to dynamically and accurately locate the critical path and the minimum monitoring point set affected by the strategy, avoiding the distribution and detection across the entire network. Secondly, a multi-objective optimization task scheduling model was constructed. The verification priority was dynamically adjusted by comprehensively considering factors such as the urgency, importance of the strategy, and network load to achieve efficient utilization of verification resources. The experimental results show that, compared with the existing methods, the method proposed in this paper is suitable for large-scale dynamic cross-domain SDN environments. Figures and Tables | References | Related Articles | Metrics

Select

Deep Active Learning Based Federated Semi-Supervised Intrusion Detection System ZHANG Hao, YE Junwei 2026, 26 (6):  944-957.  doi: 10.3969/j.issn.1671-1122.2026.06.008 Abstract ( 44 )   HTML ( 12 )   PDF (15683KB) ( 7 )   With the expansion of network scale, network security issues have become increasingly prominent. Intrusion detection systems face challenges such as high data annotation costs and data transmission delays. Federated learning provides an effective solution for distributed intrusion detection, but it still suffers from the bottleneck of relying on a large amount of labeled data. To reduce annotation costs, active learning is often applied in intrusion detection; however, the query strategies used to select samples for annotation in active learning are often limited by data distribution. This paper proposed a federated semi-supervised intrusion detection system based on deep active learning, combining diversity sampling with a query strategy based on deep model transfer. First, K-Means clustering was used to select diverse samples for annotation. Then, based on transfer learning, a selector was trained using the prediction results of the classifier on the labeled data. The classifier was used for intrusion detection, while the selector was used to identify unlabeled samples that can help improve detection performance for annotation. Finally, the NSL-KDD and UNSW-NB15 datasets selected for experiments. The experimental results show that the proposed scheme reduces the demand for a large amount of labeled data and improves the adaptability of active learning across different data distributions and scenarios. Figures and Tables | References | Related Articles | Metrics

Select

A Multi-Layer Jump-Based Control Flow Obfuscation Framework for Security Enhancement WANG Yong, HUANG Yunjun, XU Kai 2026, 26 (6):  958-966.  doi: 10.3969/j.issn.1671-1122.2026.06.009 Abstract ( 49 )   HTML ( 7 )   PDF (9995KB) ( 7 )   To address the security threats such as reverse engineering, code tampering, and potential attacks during software distribution and execution, this paper proposes a control flow obfuscation method named GE-FLO, which is based on the Gilbreath conjecture. This method utilized sequences of prime differences to construct unpredictable opaque predicates and integrated dynamic assignment and path scheduling mechanisms to introduce runtime uncertainty, thereby undermining the effectiveness of control flow recovery and symbolic execution. Experimental results demonstrate that GE-FLO can effectively induce an order-of-magnitude increase in the complexity of control flow structures, significantly reduce the efficiency of symbolic execution analysis, and partially impair the functionality of advanced static analysis tools. Compared with existing solutions, GE-FLO enhances obfuscation strength while maintaining reasonable runtime overhead, validating its superiority and practical applicability in real-world security protection scenarios. Figures and Tables | References | Related Articles | Metrics

Select

A Stochastic Game Model for Host Scanning and Anti-Scanning XIE Xiaomin, LI Pengdeng, LIU Yuan, TIAN Zhihong 2026, 26 (6):  967-976.  doi: 10.3969/j.issn.1671-1122.2026.06.010 Abstract ( 45 )   HTML ( 9 )   PDF (12121KB) ( 7 )   In the field of cyber space mapping and anti-mapping, attackers mostly use the batch scanning strategy based on breadth-first search to detect online active hosts and identify potential malicious targets. Defenders mainly adopt the method of setting network traffic thresholds to identify malicious scanning behaviors. However, due to the dynamic and ever-changing nature of the network environment and the flexibility of opponents’ strategic adjustments, traditional static strategies have serious deficiencies in dynamic adaptability. To address this issue, this study designed a stochastic game model for host scanning and anti-scanning. It transformed the continuous grouped scanning process into a Markov decision process, precisely depicting the evolutionary mechanism of the dynamic strategies of both sides. By using the improved asymmetric Nash Q-learning algorithm, the approximate equilibrium solution was successfully obtained. Experimental results show that the dynamic strategy adopted under equilibrium conditions has significant advantages in terms of comprehensive benefits compared with traditional fixed strategies. Figures and Tables | References | Related Articles | Metrics

Select

Chain-of-Thought Poisoning Based Retrieval-Augmented Generation Backdoor Attack MIAO Bo, YUAN Deyu, ZHANG Teng, YANG Yi, HUANG Zan 2026, 26 (6):  977-998.  doi: 10.3969/j.issn.1671-1122.2026.06.011 Abstract ( 45 )   HTML ( 13 )   PDF (26355KB) ( 11 )   The synergy of retrieval-augmented generation (RAG) and chain-of-thought (CoT) enhances LLM reasoning but introduces a critical vulnerability: cognitive deception via manipulated reasoning chains. This paper proposed CoT-RBA, a backdoor attack framework based on CoT poisoning. This paper designed a stealthy dynamic trigger activated by benign semantic rules (triggered when≥2 of Top-3 retrieved rules were positive). By employing a two-stage fine-tuning strategy—capability alignment followed by reasoning poisoning—CoT-RBA embedded backdoors without compromising general performance. Experimental results across multiple benchmarks show that CoT-RBA achieves an attack success rate (ASR) exceeding 99% and improves clean task accuracy by over 4.5% compared to baselines. Furthermore, the attack is highly resilient to defenses such as purification fine-tuning and perplexity-based detection, demonstrating its significant threat in real-world applications. Figures and Tables | References | Related Articles | Metrics