HANDOM: Heterogeneous Attention Network Model for Malicious Domain Detection

Malicious activities on the Internet are one of the most dangerous threats to users and organizations. Because of the flexibility a nd accessibility of domains, cyber criminals often utilize them to launch cyber attacks such as phishing or malware. Most of traditional malicious domain detection methods rely on feature engineering to learn the patterns of malicious domains. However, these methods can be easily evaded by some sophisticated evasion techniques such as Domain-flux or Fast-flux. Some recent studies utilized graph-based models to infer malicious domains and achieved better performance, yet without a fine-grained modeling of DNS scenarios. In this paper, we propose an attributed heterogeneous graph neural network model, GAMD, to detect malicious domains in a semi-supervised learning paradigm. Concretely, we utilize attributed heterogeneous information network to model the DNS scenarios with different types of nodes including domain, host, resolved-IP and different types of relation, such as request and resolution relations. We then design a fine-grained node type-aware feature transformation and edge type-aware aggregation mechanism to fuse the node attributes and structure information simultaneously and complete the inference over DNS graphs. In the experiments, we evaluate the performance of our model on a large-scale realworld passive DNS data and show that the proposed method outperforms the state-of-the-art in most evaluation metrics.

Malicious domains are one of the major resources required for adversaries to run attacks over the Internet. Due to the important role of the Domain Name System (DNS), extensive research has been conducted to identify malicious domains based on their unique behavior reflected in different phases of the life cycle of DNS queries and responses. Existing approaches differ significantly in terms of intuitions, data analysis methods as well as evaluation methodologies. This warrants a thorough systematization of the approaches and a careful review of the advantages and limitations of every group. In this article, we perform such an analysis. To achieve this goal, we present the necessary background knowledge on DNS and malicious activities leveraging DNS. We describe a general framework of malicious domain detection techniques using DNS data. Applying this framework, we categorize existing approaches using several orthogonal viewpoints, namely (1) sources of DNS data and their enrichment, (2) data analysis methods, and (3) evaluation strategies and metrics. In each aspect, we discuss the important challenges that the research community should address in order to fully realize the power of DNS data analysis to fight against attacks leveraging malicious domains.

Deepdom: Malicious domain detection with scalable and heterogeneous graph convolutional networks

Heterogeneous networks, consisting of multi-type objects coupled with various relations, are ubiquitous in the real world. Most previous work on clustering heterogeneous networks either converts them into homogeneous networks or simplifies the modeling of the heterogeneity in terms of specific objects, structures or assumptions. However, few studies consider all relevant objects and relations, and trade-off between integrating relevant objects and reducing the noises caused by relations across objects. In this paper, we propose a general probabilistic graphical model for clustering heterogeneous networks. First, we present a novel graphical representation based on our basic assumptions: different relation types produce different weight distributions to specify intra-cluster probability between two objects, and clusters are formed around cluster cores. Then, we derive an efficient algorithm called PROCESS, standing for PRObabilistic Clustering modEl for heterogeneouS networkS. PROCESS employs a balance-controlled message passing algorithm and mathematical programming for inference and estimation. Experimental results show that our approach is effective and significantly outperforms the state-of-the-art algorithms on both synthetic and real data from heterogeneous networks.

With the widespread application of artificial intelligence (AI) technologies in power systems, the properties of lack of reliability and transparency for AI technologies have revealed gradually. Here, how to build a trustworthy-AI framework based on the power system is the focus. Due to the multidimensional and heterogeneous information of power grid data, the heterogeneous graph attention network (HGAT) model of power grid dispatching is established, and the corresponding explainer (HGAT-Explainer) for the model of power equipment faults is proposed to provide more favorable support for the trustworthy-AI systems.

Comprehensive fault diagnosis for multiple coupled SFCs based on deep learning

With the development of the wireless communication technology and the sensor technology, the wireless sensor network (WSN) has been used in many applications. However, WSNs suffer from some inherent weaknesses because of restricted communication and hardware capabilities. To achieve essentially secure communication in WSNs, a few of key management models have been proposed since it is the crucial important building block for all security goals in WSNs. Recently, Alagheband and Aref proposed a signcryption scheme and used it to construct a dynamic key management model for hierarchical heterogeneous sensor networks. They also proved that their signcryption scheme is provably secure if the elliptic curve discrete logarithm problem is infeasible. Unfortunately, by giving concrete attacks, we indicate that Alagheband and Aref’s signcryption scheme is not secure in their secure model. The analysis also shows that their key management model is not secure. To solve those weaknesses, we also proposed an improved signcryption scheme.

Detection of malware-infected computers and detection of malicious web domains based on their encrypted HTTPS traffic are challenging problems, because only addresses, timestamps, and data volumes are observable. The detection problems are coupled, because infected clients tend to interact with malicious domains. Traffic data can be collected at a large scale, and antivirus tools can be used to identify infected clients in retrospect. Domains, by contrast, have to be labeled individually after forensic analysis. We explore transfer learning based on sluice networks; this allows the detection models to bootstrap each other. In a large-scale experimental study, we find that the model outperforms known reference models and detects previously unknown malware, previously unknown malware families, and previously unknown malicious domains.

This paper is devoted to investigating the impact of the recurrence of rumors and individual behaviors and control strategies related to rumor spreading in online social networks. To do this, a novel susceptible-hesitating-infected-latent-recovered (SHILR) rumor propagation model in heterogeneous networks is presented. Firstly, based on the relevant mean-field equations of the model, the threshold value is examined to demonstrate the existence and stability of rumor-free/spreading equilibrium with the help of the algebraic method. Secondly, the global stabilities of the equilibria are analyzed through applying Lyapunov stability theory and LaSalle’s invariance principle. Next, the optimal control is proposed by taking advantage of Pontryagin’s maximum principle for reducing the number of infected individuals with minimum cost. Moreover, some numerical examples are carried out to test the theoretical results. Finally, combined with practice, a model application is presented.

Finding different types of communities has become a research hot spot in network science. Plenty of the real-world systems containing different types of objects and relationships can be perfectly described as the heterogeneous networks. However, most of the current research on community detection is applied for the homogeneous networks, while there is no effective function to quantify the quality of the community structure in heterogeneous networks. In this paper, we first propose the null model with the same heterogeneous node degree distribution of the original heterogeneous networks. The probability of there being an edge between two nodes is given to build the modularity function of the heterogeneous networks. Based on our modularity function, a fast algorithm of community detection is proposed for the large scale heterogeneous networks. We use the algorithm to detect the communities in the real-world twitter event networks. The experimental results show that our method perform better than other exciting algorithms and demonstrate that the modularity function of the heterogeneous networks is an effective parameter that can be used to quantify the quality of the community structure in heterogeneous networks.

The Domain Name System (DNS) as the foundation of Internet, has been widely used by cybercriminals. A lot of malicious domain detection methods have received significant success in the past decades. However, existing detection methods usually use classification-based and association-based representations, which are not capable of dealing with the imbalanced problem between malicious and benign domains. To solve the problem, we propose a novel domain detection system named KSDom. KSDom designs a data collector to collect a large number of DNS traffic data and rich external DNS-related data, then employs K-means and SMOTE method to handle the imbalanced data. Finally, KSDom uses Categorical Boosting (CatBoost) algorithm to identify malicious domains. Comprehensive experimental results clearly show the effectiveness of our KSDom system and prove its good robustness in imbalanced datasets with different ratios. KSDom still has high accuracy even in extremely imbalanced DNS traffic.

Traditionally, the task of cross-modal retrieval is tackled through joint embedding. However, the global matching used in joint embedding methods often fails to effectively describe matchings between local regions of the image and words in the text. Hence they may not be effective in capturing the relevance between the text and the image. In this work, we propose a heterogeneous attention network (HAN) for effective and efficient cross-modal retrieval. The proposed HAN represents an image by a set of bounding box features and a sentence by a set of word features. The relevance between the image and the sentence is determined by the set-to-set matching between the set of word features and the set of bounding box features. To enhance the matching effectiveness, we exploit the proposed heterogeneous attention layer to provide the cross-modal context for word features as well as bounding box features. Meanwhile, to optimize the metric more effectively, we propose a new soft-max triplet loss, which adaptively gives more attention to harder negatives and thus trains the proposed HAN in a more effective manner compared with the original triplet loss. Meanwhile, the proposed HAN is efficient, and its lightweight architecture only needs a single GPU card for training. Extensive experiments conducted on two public benchmarks demonstrate the effectiveness and efficiency of our HAN. This work has been deployed in production Baidu Search Ads and is part of the PaddleBox'' platform.

The simultaneous use of two or more drugs due to multi-disease comorbidity continues to increase, which may cause adverse reactions between drugs that seriously threaten public health. Therefore, the prediction of drug-drug interaction (DDI) has become a hot topic not only in clinics but also in bioinformatics. In this study, we propose a novel pre-trained heterogeneous graph neural network (HGNN) model named HetDDI, which aggregates the structural information in drug molecule graphs and rich semantic information in biomedical knowledge graph to predict DDIs. In HetDDI, we first initialize the parameters of the model with different pre-training methods. Then we apply the pre-trained HGNN to learn the feature representation of drugs from multi-source heterogeneous information, which can more effectively utilize drugs' internal structure and abundant external biomedical knowledge, thus leading to better DDI prediction. We evaluate our model on three DDI prediction tasks (binary-class, multi-class and multi-label) with three datasets and further assess its performance on three scenarios (S1, S2 and S3). The results show that the accuracy of HetDDI can achieve 98.82% in the binary-class task, 98.13% in the multi-class task and 96.66% in the multi-label one on S1, which outperforms the state-of-the-art methods by at least 2%. On S2 and S3, our method also achieves exciting performance. Furthermore, the case studies confirm that our model performs well in predicting unknown DDIs. Source codes are available at https://github.com/LinsLab/HetDDI.

Scarcity of bandwidth for fixed allocation of frequency and also current growth trends in wireless communications shows that Cognitive Radio Networks (CRNs) are followed strictly. Fluctuating nature of the radio spectrum with a variety of quality services which needs causes some challenges in CRNs, such as spectrum sharing. In many previous works, the problem of performance loss is seen due to the sudden presence of primary user. In such a situation, secondary user has to vacate bandwidth at the moment. This often leads to long wait for secondary user on access the channel. However, Spectrum Pooling concept is used with the ability of secondary utility for licensed frequency band, without reducing quality of service and without requiring new hardware. In this paper, a fair queuing algorithm with weighting and prioritization between different users is recommended. This type of queuing model with weighted fair queuing policy is efficient to share the bandwidth among systems with different priority levels. The proposed algorithm offers shared use of spectrum to invest a fair sharing of bandwidth between cognitive users. The proposed model involves a different service rates for unlicensed users and can be used as an acceptable model in heterogeneous networks. By the use of analytical and simulation results, we can achieve a desirable level of performance and an improvement in fairness.

HAMS: Scalable peer-to-peer multimedia streaming model in heterogeneous networks