Most Read articles

Published in last 1 year |  In last 2 years |  In last 3 years |  All

Published in last 1 year

Please wait a minute...


For Selected: Download Citations EndNote Ris BibTeX Toggle Thumbnails

Select

Journal of Information Security Reserach    2025, 11 (E2): 277-.   Abstract （1036）      PDF （1198KB）（16）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 19-.   Abstract （859）      PDF （1799KB）（27）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E2): 80-.   Abstract （815）      PDF （1807KB）（24）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E2): 295-.   Abstract （501）      PDF （893KB）（23）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E2): 197-.   Abstract （340）      PDF （815KB）（21）       Knowledge map    Save Reference | Related Articles | Metrics

Select

A Symbioticbased Framework for AI Safety Governance Journal of Information Security Reserach    2025, 11 (10): 897-.   Abstract （292）      PDF （2070KB）（76）       Knowledge map    Save Artificial intelligence technology is currently developing at an unprecedented pace, with safety concerns becoming a global focal point. Traditional AI safety research has predominantly relied on a “control paradigm”, emphasizing limitations, regulations, and value alignment to control AI behavior and prevent potential risks. However, as AI capabilities continue to strengthen, unidirectional control strategies are revealing increasingly significant limitations, with issues such as transparency illusions, adversarial evolution, and innovation suppression gradually emerging. Industry leaders like Sam Altman and Dario Amodei predict that AI may comprehensively surpass human capabilities in multiple fields within the next 23 years, making the reconstruction of AI governance paradigms particularly urgent. This paper proposes a new perspective—the “symbiotic paradigm”—emphasizing humanmachine collaboration as the core and understanding and trust as the foundation. Through establishing four pillars: transparent communication, bidirectional understanding, creative resonance, and dynamic boundaries, it promotes AI safety’s transition from control to cocreation, serving as one of the foundational paths for digital governance transformation. This paper systematically demonstrates the feasibility and necessity of the symbiotic paradigm through four dimensions: theoretical analysis, technological paths, practical cases, and governance recommendations, aiming to provide a sustainable alternative for future AI safety research and digital governance practices. Reference | Related Articles | Metrics

Select

Research on the Legal Positioning and Liability Allocation of AI Agent Journal of Information Security Reserach    2026, 12 (8): 681-690.   DOI: 10.12379/j.issn.2096-1057.2026.08.01 Abstract （264）      PDF （682KB）（23）       Knowledge map    Save The autonomous operation and continuous functioning capabilities of AI agents have transcended the operational boundaries of traditional generative AI, which centers on the "input-output" paradigm, and present new normative challenges to the existing "tool-control-responsibility" framework a framework predicated on stable human control. In terms of behavior identification, responsibility attribution, and operational regulation, the current legal system is insufficient to fully accommodate the cross-subject, multi interactive, and continuously operating characteristics of AI agents. Against this backdrop, this paper contends that AI agents should not be granted independent legal personality. Instead, it proposes a response grounded in the functional reconstruction of traditional static tool-oriented rules, while preserving the stability of the existing subject system. Adopting "functional instrumentalism" as the fundamental legal orientation for AI agents, this paper constructs a dual track identification framework "technological identity" and "legal attribution" to align behavioral identifiability with responsibility attributability under conditions of continuous operation. Furthermore, it introduces a "relationalist attribution" approach, which takes control relationships, interest structures, and risk sources as analytical dimensions to allocate responsibilities among multiple subjects in a structured manner. Employing the "principle of minimum necessity" as the boundary for institutional expansion, the paper thereby outlines an integrated governance framework that connects current law, special rules, and technical standards. Accordingly, the logic of AI governance is shifting from a static structure centered on behavioral outcomes and one off liability determinations toward a dynamic structure oriented around process of continuous operation. Reference | Related Articles | Metrics

Select

TCNGANbased Temporal Traffic Anomaly Detection Journal of Information Security Reserach    2025, 11 (10): 907-.   Abstract （247）      PDF （2708KB）（59）       Knowledge map    Save In recent years, generative adversarial networks have been widely used in the field of temporal anomaly detection. However, temporal data often has complex timedependence, and problems such as gradient vanishing and training instability are common in existing anomaly detection models. To this end, this paper proposes an unsupervised temporal traffic anomaly detection model based on the combination of temporal convolutional network (TCN) and GAN. The model uses TCN as the infrastructure of generator and discriminator, which can effectively capture the temporal features of the temporal traffic data. During the anomaly detection process, the model constructs an anomaly scoring function based on the reconstruction loss and discriminator loss, and performs anomaly judgment by setting a threshold, thus improving the accuracy of anomaly detection. To verify the performance of the proposed model, experiments are conducted on five different types of datasets. The results show that the average F1 score of the proposed model is 11.02% higher than that of the TAnoGAN model. Reference | Related Articles | Metrics

Select

Research on Critical Information Infrastructure Security Protection Journal of Information Security Reserach    2025, 11 (10): 878-.   Abstract （229）      PDF （324KB）（78）       Knowledge map    Save Related Articles | Metrics

Select

Journal of Information Security Reserach    2026, 12 (2): 98-.   Abstract （216）      PDF （532KB）（134）       Knowledge map    Save Related Articles | Metrics

Select

A Review of Large Language Model-Driven Network Penetration Testing Agents Journal of Information Security Reserach    2026, 12 (8): 691-711.   DOI: 10.12379/j.issn.2096-1057.2026.08.02 Abstract （210）      PDF （3915KB）（18）       Knowledge map    Save With the accelerated development of artificial intelligence, intelligent agents have demonstrated notable advantages in environmental perception, task planning, and multi-tool coordination. Concurrently, breakthroughs in Large Language Models concerning natural language understanding, logical reasoning, and multimodal processing have provided crucial support for the evolution of intelligent agents. The deep integration of these two technological strands has given rise to LLM-driven autonomous agents for network penetration testing, promoting a gradual shift from the traditional "tool-assisted" paradigm toward "autonomous intelligence." This paper systematically reviews the key challenges and principal technical approaches identified in existing research across four core modules: agent role definition, task planning, memory management, and interactive execution. It further examines the limitations of current methods in areas such as multimodal information processing, automated interaction, and context management. To address these issues, and in view of the ongoing technological evolution of intelligent agents, this paper proposes several promising research directions for intelligent penetration testing. These include multimodal fusion mechanisms, collaborative strategies integrating memory enhancement with reinforcement learning, and knowledge-graph-based vulnerability discovery methods. The analysis indicates that LLM-driven agents for network penetration testing provide substantial technical support for advancing the intelligence and autonomy of cybersecurity operations. Reference | Related Articles | Metrics

Select

A Deep Learning Differential Privacy Protection Scheme Based on  Adaptive Clipping Journal of Information Security Reserach    2026, 12 (6): 490-.   Abstract （207）      PDF （1728KB）（108）       Knowledge map    Save To address the issues of utility degradation in deep learning models under differential privacy protection and the gap between theoretical and actual privacy protection effectiveness, this paper proposes a deep learning differential privacy protection scheme based on adaptive clipping. The scheme optimizes the process through a fourstep mechanism: firstly, gradient adaptive clipping controls the gradient magnitude during training by dynamically adjusting the gradient clipping threshold, thereby enabling the control of the magnitude of noise added subsequently; secondly, group label selection identifies the group with the smallest gradient as the privacypreserving object, and more accurate privacy loss can be obtained by training this group; thirdly, optimized privacy loss calculation combines the gaussian mechanism based on subsampling to reduce the computational overhead of model privacy loss calculation; finally, optimized gradient adaptive descent realizes the adaptive descent of gradients by adjusting the conditional smoothing parameter, thus improving the usability of the model. Experiments were conducted on the VGG architecture using the MNIST, CIFAR10, and MedicalMNIST datasets. The results show that the model accuracy rates after training with this scheme are 81.08%, 72.30%, and 67.91% respectively, representing improvements of 15.60%, 10.60%, and 9.71% compared to the traditional DPSGD, and 0.63%, 2.50%, and 4.40% over the widely used Nadam algorithm in recent years. The model training efficiency has been improved by 35.5% and 39.4%, respectively. Reference | Related Articles | Metrics

Select

Research on Security Assurance of Egovernment Journal of Information Security Reserach    2025, 11 (10): 879-.   Abstract （207）      PDF （865KB）（60）       Knowledge map    Save government encompasses critical domains including government operations, public services, and data management, and its security directly affects national interests, public wellbeing, and social stability. In recent years, cyberattacks targeting Egovernment systems have become more frequent and continue to rise, security risks of government administrative networks continued to mount up and challenge security protection. This paper analyzes the development paths of Egovernment security protection at home and abroad and proposes relevant policy recommendations, with the aim of providing strong support for building a more perfect and optimized Egovernment security protection system. Reference | Related Articles | Metrics

Select

Research on Frontier Technologies for Critical Information  Infrastructure Security Protection Journal of Information Security Reserach    2025, 11 (12): 1075-.   Abstract （207）      PDF （994KB）（53）       Knowledge map    Save Currently, China’s critical information infrastructure (CII) faces significant threats, including statesponsored cyber attacks and supply chain disruptions. This research aims to systematically analyze the key technological frameworks and development trends in CII security protection, assess China’s current technological capabilities and core bottlenecks in this domain, and propose development strategies and implementation pathways aligned with national conditions. Focusing on key technology clusters such as dynamic active defense, intelligent analysis and response, and resilience architectures, the study explores their synergistic application mechanisms and integration points with existing policies. The study seeks to provide critical technical support and policy recommendations for enhancing the security resilience and compliance of CII. Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 9-.   Abstract （207）      PDF （1462KB）（20）       Knowledge map    Save Reference | Related Articles | Metrics

Select

The Enlightenment and Reference of Cybersecurity Protection Policies for  Critical Information Infrastructure Journal of Information Security Reserach    2025, 11 (10): 885-.   Abstract （206）      PDF （920KB）（38）       Knowledge map    Save The security and stability of critical information infrastructure (CII) are of crucial importance to national security, economic development, and social stability. The insights and lessons learned from the CII security safeguards policies of countries and organizations such as the European Union, Japan, the United States, and Russia merit reference. CII security safeguards policies in China has gone through the stages of early exploration, rapid development, and comprehensive advancement; it is confronted with real predicaments including insufficient policy foresight, inadequate crossdomain coordination and collaboration, poor coordination and alignment of standards, and weak discourse power in international rules. It is suggested that China should strengthen the strategic guidance and toplevel design for CII, improve the crossdomain overall planning and linkage mechanism, formulate and refine CII protection standards. Reference | Related Articles | Metrics

Select

Research on Traffic Anomaly Detection Method and System for API Gateway Journal of Information Security Reserach    2025, 11 (10): 917-.   Abstract （206）      PDF （1061KB）（43）       Knowledge map    Save With the rise of cloud services and the widespread use of API technology, many network capabilities of operators are usually outputted and empowered through APIs. API gateways have become an important way for northsouth and eastwest system interconnection and data sharing. This paper proposes a method for API gateway traffic anomaly detection based deep learning. Firstly, a heterogeneous graph is constructed to comprehensively represent the gateway traffic network. Then, based on graph attention neural network, node representations in the heterogeneous graph are learned by considering both structural and temporal dimensions. We introduce graph structure refinement to compensate for sparse connections between entities in the heterogeneous graph and obtain more robust node representation learning; Finally, the meta learning algorithm is used to optimize the model and improve its generalization ability in small sample scenarios. The model can be deployed on gateway devices. The algorithm model was experimentally evaluated on the CICIDS2017 dataset, and the results showed that compared with the baseline algorithm, the detection method proposed in this paper has good performance in small sample and multi classification problems. Reference | Related Articles | Metrics

Select

Compound Admissibility Rules of Blockchain Evidence in Online Litigation Journal of Information Security Reserach    2026, 12 (2): 134-.   Abstract （182）      PDF （1088KB）（48）       Knowledge map    Save Blockchain evidence offers a solution to the limitations of traditional electronic evidence by establishing a new model of “evidence selfauthentication”. However, current regulations in China exhibit obvious limitations, failing to fully cover the application of blockchain evidence in both online and offline spaces, while prioritizing authenticity at the expense of admissibility. To realize the proper application of blockchain evidence in the Chinese context, this paper proposes a dualspace framework integrating technological selfauthentication with legal presumptions. This approach aims to achieve consensual justice, composite admissibility rules for preservation, presentation, crossexamination, and authentication, and thereby foster a novel form of evidence rule of law with benign interaction between rule of law and technical rule of law. Reference | Related Articles | Metrics

Select

Government Data Catalog Security Sharing Model Based on Editable Blockchain Journal of Information Security Reserach    2025, 11 (10): 966-.   Abstract （175）      PDF （6159KB）（74）       Knowledge map    Save As government demand for data sharing rises, ensuring data security and reliability has become critical. This paper proposes a secure sharing model for government data catalogs using editable blockchain, which facilitates collaborative updates both onchain and offchain, incorporates finegrained editing permissions, and implements robust security controls. The model employs a dualtrapdoor chameleon hash function with a temporary trapdoor key for onchain updates, addressing the problem that traditional key splitting and recovery schemes cannot balance security and efficiency. Additionally, it introduces an editing permission authorization mechanism that combines user IDbased multiinstitution attribute encryption with temporary trapdoor keys, ensuring accurate permission management across departments. A thorough security analysis confirms the model’s effectiveness in mitigating various security threats. The analysis reveals that the proposed model significantly enhances the trustworthiness of government data sharing by effectively addressing security challenges and ensuring data integrity. These findings highlight the potential of editable blockchain technology in transforming how government entities manage and share sensitive information. Reference | Related Articles | Metrics

Select

Robust Malicious Encrypted Traffic Detection Method Based on  Dual Confidence Sample Selection Journal of Information Security Reserach    2025, 11 (10): 924-.   Abstract （172）      PDF （1679KB）（25）       Knowledge map    Save In the task of detecting malicious encrypted traffic, the existence of noise tags seriously affects the generalization ability and detection accuracy of the model. To solve the above problems, a noise label learning method based on DCASS (dualconfidence adaptive sample selection) is proposed to realize robust malicious encryption traffic detection. Firstly, the low dimensional features of samples are extracted by self encoder, and the feature confidence of samples is constructed.Then, the label confidence of samples is evaluated according to their performance in classification training. Finally, an adaptive selection threshold is proposed to select samples based on the dual confidence of feature space and label space, and filter noise samples dynamically to improve the robustness of the model. Experiments on CIRACICDoHBrw2020 dataset show that the proposed method has good performance and stability in dealing with noise labels. The F1 scores of the method reach 86.686%, 86.749%, 83.199% respectively when the noise rate is 20%, 30%, 40%. Compared with the existing three methods, the method proposed in this paper shows the best performance under different noise rates, with the average performance improvement of 18.89%, 37.34%, 6.32% respectively. Reference | Related Articles | Metrics

Select

Imperceptible Proactive Defense Method Against Face Attribute Editing Journal of Information Security Reserach    2025, 11 (10): 941-.   Abstract （170）      PDF （2504KB）（26）       Knowledge map    Save Although the face attribute editing forgery active defense method based on generative adversarial network (GAN) generates adversarial perturbations faster than the gradient attackbased methods, existing methods still fail in balancing the proactive defense effect with the imperceptibility of generated perturbations. Therefore, this paper proposed a highly imperceptible proactive defense method against face attribute editing based on GAN. To enhance the imperceptibility of the perturbations, the method designed a highfrequency information compensation mechanism to enable the generator to generate more highfrequency perturbations that are less sensitive to the human eye. To improve the proactive defense performance of generated perturbations, the proposed method also designed a multilevel dense connection mechanism for reducing semantic loss during the encoding process. Meanwhile, the method introduced face saliency adversarial loss in training stage to enable perturbations to disrupt face forgery areas better. The experiments were conducted in both singlemodel and crossmodel defense scenarios. The results indicate that compared to existing methods, the proposed method generates more imperceptible adversarial perturbations and obtains high success rates for defending against target models. Related Articles | Metrics

Select

DGA Domain Name Generation Method of BiLSTM Model  Based on Bayesian HPO Journal of Information Security Reserach    2025, 11 (10): 950-.   Abstract （170）      PDF （1488KB）（22）       Knowledge map    Save In recent years, domain generation algorithms (DGA) have been extensively utilized in network attacks to dynamically generate large quantities of random domain names for malicious software communications, posing a severe challenge for security defenses. As DGA structures grow increasingly complex, traditional domain classification methods that rely on manually extracted features struggle to adapt to new variants in a timely manner. Although generationbased deep models can automatically capture latent patterns from data, their large parameter sizes and intricate hyperparameter tuning often hinder stable performance across diverse DGA. To tackle these issues, this paper proposes a DGA domain generation approach based on a bidirectional long shortterm memory (BiLSTM) model enhanced by Bayesian hyperparameter optimization(Bayesian HPO). By automating the tuning of critical hyperparameter, our method significantly reduces manual intervention and training overhead, while strengthening the robustness and generalization capability of the model against various DGA. Experimental results demonstrate that the proposed approach achieves excellent generation accuracy on multiple DGA families, providing a proactive, forwardlooking defense strategy for network security. Reference | Related Articles | Metrics

Select

Research on Domain Adaptive Intrusion Detection Method Based on  Dynamic Feature Fusion Journal of Information Security Reserach    2026, 12 (4): 294-.   Abstract （168）      PDF （1452KB）（107）       Knowledge map    Save Aiming at the problems of incomplete feature extraction and limited model generalization ability in intrusion detection research, a domain adaptive intrusion detection method with dynamic feature fusion is proposed. Firstly, a convolutional neural network is used to extract spatial features, while a bidirectional long shortterm memory network is utilized for temporal feature extraction. This approach enables comprehensive extraction of multidimensional feature information from network traffic data. Secondly, the uncertainty is measured by calculating the information entropy of the two features, and different weights are assigned according to the entropy value, and the extracted features are weighted and fused according to the weights. Finally, during the training process, the proposed adaptive domain weight loss algorithm is used to dynamically adjust the contribution of the source domain and target domain data to improve the generalization ability of the model on the target domain data. Experiments are carried out using the NSLKDD and UNSWNB15 datasets. Compared with the existing mainstream methods, this method has higher detection accuracy, which is 0.8563 and 0.916 respectively. Reference | Related Articles | Metrics

Select

The Mechanism of Disinformation Generation and Governance Pathways in Generative AI Models Journal of Information Security Reserach    2026, 12 (7): 606-612.   Abstract （158）      PDF （1256KB）（45）       Knowledge map    Save While driving transformations in online information order, generative AI models also generate disinformation risks characterized by an “objective+subjective” overlap. An analytical framework tailored to their technical characteristics is urgently needed. This study systematically deconstructs the technical logic of false information production in generative AI models based on their hybrid expert architecture, treelike reasoning patterns, localized semantic understanding attributes, and opensource ecosystem mechanisms. It analyzes the transmission mechanisms of false information risks across four stages: data input, algorithmic operation, content presentation, and cognitive dissemination. To address these risks: At the algorithmic level, implement a processbased oversight scheme encompassing “access reviewoperation disclosurepostevent verification”; at the presentation level, strengthen scenariobased, interactive “warning notice” labeling mechanisms; at the cognitive level, cultivate users' digital literacy and selfrestraintt capabilities to achieve effective information security governance in the AI era. Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E2): 89-.   Abstract （157）      PDF （1508KB）（71）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Research on Highquality Development of New Infrastructures Under  Critical Information Infrastructure Security Protection Journal of Information Security Reserach    2025, 11 (10): 891-.   Abstract （155）      PDF （957KB）（33）       Knowledge map    Save Developing new infrastructure plays a crucial role in enhancing the security protection capabilities of critical information infrastructure. The approaches adopted by relevant countries in advancing new infrastructure—such as boosting global competitiveness, prioritizing key technology R&D, attracting deep private sector participation, promoting unified standards and regulations, and strengthening supply chain resilience—offer valuable insights. Although China’s new infrastructure has seen continuous improvements in recent years regarding development scale, technological autonomy, digital and intelligent capabilities, and its capacity to support critical infrastructure, it also faces challenges such as significant intrinsic security risks, risks associated with introducing new technologies, and lagging standardization efforts. It is recommended in terms of to drive the highquality development of new infrastructure by leveraging intelligent upgrades as the driving force, functional expansion as the connecting link, and boundary governance as the focal point. Reference | Related Articles | Metrics

Select

Fileless Obfuscation Attack Recognition Based on Semantic Recovery and  Large Language Model Journal of Information Security Reserach    2025, 11 (12): 1125-.   Abstract （154）      PDF （1478KB）（19）       Knowledge map    Save With the continuous advancement of fileless attack techniques and strategies, research on identifying fileless malicious attack has garnered significant attention. Among these, fileless obfuscation attack, as a new type of covert, dynamic, and complex attack, can rapidly bypass existing attack engines and rulebased frameworks. To address this problem, this paper proposes an attack script restoration method guided by dynamic partial execution and semantic analysis tree guidance, enabling the restoration of obfuscated code. Furthermore, leveraging the efficiency of large models in attack understanding and semantic recognition, we integrate large models to achieve efficient identification and classification of fileless code. To further alleviate the limitations of large models in handling large code files and long passages, we also provide a semantic code compression strategy to retain critical attack semantics. Experimental results demonstrate that our proposed semantic restoration and large model identification methods can enhance effectiveness by around 10% compared to existing models and methods, while maintaining efficient attack identification efficiency. Reference | Related Articles | Metrics

Select

Survey of Software Supply Chain Security Detection and Assessment Technologies Journal of Information Security Reserach    2026, 12 (7): 586-597.   Abstract （154）      PDF （1750KB）（80）       Knowledge map    Save In the context of the digital era, software supply chain has become a critical component supporting the stable and healthy development of the digital economy. It is an indispensable part of the nation’s key information infrastructure and economic and social systems. The security of software supply chain directly determines the security of the key businesses carried by the software supply chain. Therefore, based on the development needs of the digital age, this article summarizes the current technologies, methods, and development trends related to software supply chain security detection and evaluation, providing reference and guidance for industry insiders, researchers, and decisionmakers. It includes a review and detailed explanation of the background and methods of software supply chain security detection and evaluation technology, detailing the principles of mainstream technologies such as component analysis, vulnerability scanning, code review, runtime monitoring, threat modeling, and fuzz testing, and comparing and analyzing the advantages and disadvantages of various technologies; Analyze the current technical challenges and countermeasures faced by technology; And propose ten major trends for the development of this field in the next decade, in order to improve the security level of the software supply chain and promote the development of the software industry. Reference | Related Articles | Metrics

Select

Research Review on Collaborative Intrusion Detection Based on Federated Learning Journal of Information Security Reserach    2026, 12 (6): 526-.   Abstract （154）      PDF （1168KB）（53）       Knowledge map    Save The increasing complexity of cyber attacks challenges traditional centralized intrusion detection systems. Federated learningbased collaborative intrusion detection enables collaborative modeling and knowledge sharing among multiple nodes without sharing raw data, thereby effectively improving the detection capability for crossdomain and unknown attacks. This paper systematically reviews the research progress of federated learningbased collaborative intrusion detection. Existing methods are classified and analyzed from multiple perspectives, including architectureaware, model adaptation and evolutiondriven, as well as privacy and security enhanced approaches. Commonly used datasets and evaluation metrics are summarized. Finally, the major challenges and future research directions are discussed, providing references for subsequent research in this field. Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 102-.   Abstract （153）      PDF （997KB）（36）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 14-.   Abstract （152）      PDF （999KB）（41）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Malicious Traffic Detection Method Based on Bayesian Optimization and Spatiotemporal Attention Journal of Information Security Reserach    2026, 12 (8): 721-729.   DOI: 10.12379/j.issn.2096-1057.2026.08.04 Abstract （150）      PDF （797KB）（8）       Knowledge map    Save To address the limitations inherent in current malicious network traffic detection methods, specifically suboptimal detection accuracy and reliance on manual hyperparameter tuning, this study proposes a malicious traffic detection method based on Bayesian optimization and a spatiotemporal attention mechanism. It adopts bidirectional long short-term memory (BiLSTM) to extract temporal and spatial features of network traffic data, and leverages Bayesian optimization to search for optimal network hyperparameters.A bidirectional architecture extracts temporal and spatial features from network traffic data, while Bayesian optimization automatically searches for optimal network parameters. Innovatively, we introduce a Multi-scale Traffic Protocol Enhancement Module that significantly enhances spatiotemporal feature representation for complex attack chains through multi-level protocol parsing, dynamic feature fusion, and attention coordination. Concurrently, to establish deep correlations between spatiotemporal features, we propose a Multi-head Spatiotemporal Attention Mechanism. This employs four parallel attention heads to cooperatively model millisecond-level protocol transients, second-level interaction sequences, minute-scale attack chain evolution, and cross-protocol correlation characteristics, effectively improving detection accuracy for stealthy threats. Experimental validation on the CIC-IDS2017 dataset demonstrates that the proposed method achieves multiclass and binary classification accuracies of 99.46% and 99.59%, respectively, outperforming comparative approaches. Reference | Related Articles | Metrics

Select

A Stateaware Fuzzing Method for Trusted Execution Environment Kernel Journal of Information Security Reserach    2026, 12 (3): 198-.   Abstract （149）      PDF （2080KB）（108）       Knowledge map    Save Trusted execution environment (TEE) is widely used, and its kernel security has become a significant area of focus. Fuzzing, a powerful technique for detecting vulnerabilities in operating system, has increasingly been applied to the security analysis of TEE. However, conventional fuzzing tools cannot be directly used for TEE kernels due to their isolation. Coverageguided fuzzers often discard test cases that trigger new states but cover the same code, which limits their effectiveness in discovering vulnerabilities. To address these challenges, a stateaware fuzzing method tailored for TEE kernels is proposed. Initially, a modeling and tracing approach is developed to represent the program state through statevariable values and retaining the test cases that trigger new states, overcoming the limitations of coverageguided fuzzers. Subsequently, we introduce an innovative communication scheme to tackle issues arising from TEE isolation. New seed retention and selection algorithms are proposed to better guide the fuzzer in exploring vulnerabilities. Finally, the NGram model is employed to enhance test case generation and optimize the framework’s performance. A prototype, named TrustyStatefuzz, has been implemented and evaluated on fuchsia, the selfdeveloped microkernel operating system Nebula, and OPTEE. The evaluation results show that TrustyStatefuzz is effective at detecting both new code and vulnerabilities. TrustyStatefuzz discovers 9 unknown vulnerabilities and 23 known vulnerabilities. Additionally, it achieves 13% higher code coverage and 27% higher state coverage than the stateoftheart fuzzer Syzkaller. Reference | Related Articles | Metrics

Select

Research on Multimodal Cyberspace Identification Technology  Based on Object Identifier Journal of Information Security Reserach    2025, 11 (10): 960-.   Abstract （149）      PDF （1253KB）（24）       Knowledge map    Save Multimodal cyberspace identification is a basic work for the construction of multimodal cyberspace. This paper summarizes the current state of identification system research both domestically and internationally, and provides a comparative analysis of various identification technologies. In view of the large number of communication devices in multimodal cyberspace and the high requirements of endogenous security, a multimodal cyberspace identification technology based on object identifiers is proposed, and the coding rules of tree structure are used to identify and manage largescale communication devices in multimodal cyberspace to improve management efficiency. Reference | Related Articles | Metrics

Select

Research on Security Challenges and Countermeasures for Critical  Information Infrastructure in the Artificial Intelligence Era Journal of Information Security Reserach    2025, 11 (12): 1087-.   Abstract （146）      PDF （944KB）（47）       Knowledge map    Save With the rapid advancement of artificial intelligence (AI) technologies, critical information infrastructure is confronting unprecedented security challenges. This paper employs systematic analysis and comparative research methods to examine the security threats faced by critical information infrastructure in the AI era, specifically focusing on structural vulnerabilities, governance lag, and dual technical risks. Drawing on the strategic practices of major economies such as the United States, the European Union, and Japan, it proposes that China should enhance AI security policy standards, establish a security risk governance framework, and strengthen security technology innovation. Through these pathways, China can build a selfreliant, secure, and reliable AIenabled critical information infrastructure system, thereby enhancing national digital security capabilities and global competitiveness. Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 5-.   Abstract （145）      PDF （1368KB）（37）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E1): 171-.   Abstract （144）      PDF （612KB）（27）       Knowledge map    Save Reference | Related Articles | Metrics

Select

Research Progress on Detection Technologies for Network Attack Based on Large Language Model#br# Journal of Information Security Reserach    2026, 12 (1): 16-.   Abstract （144）      PDF （1439KB）（100）       Knowledge map    Save Large language model (LLM), with its powerful feature learning ability, the ability to recognize complex patterns, and generalization ability, has paved the way for innovative and powerful methods in network attack detection. Firstly, this paper elaborates on the technical advantages of LLM in network attack detection and proposes a corresponding technical framework. Then, drawing on existing literature, the application status of LLM in network attack detection is reviewed from three aspects: processing original security data, extracting threat features, correlation analysis, and identifying threats in the target environment. Furthermore, the problems and challenges associated with network threat detection using LLM are analyzed. Lastly, the paper outlines the future research directions for network attack detection technology leveraging LLM. This paper aims to provide references for the further development of network attack detection technology based on LLM in the field of network security. Reference | Related Articles | Metrics

Select

Research on AIempowered Cybersecurity Detection and  Assessment Technologies Journal of Information Security Reserach    2026, 12 (6): 559-.   Abstract （144）      PDF （1820KB）（70）       Knowledge map    Save In response to the challenges faced by traditional cybersecurity detection and assessment technologies—such as large system scales, dynamic supply chain risks, and insufficient evaluation depth—this paper explores the application of AI technologie to advance this field. Methodologically, an endtoend implementation framework for largescale models is proposed, consisting of “data preparationdistillation and annotationcluster trainingquantitative deployment.” A localized compliance assessment model based on retrievalaugmented generation (RAG) technology is developed, and a multimodal model supporting joint textimage analysis is deployed. The large model significantly shortens the assessment cycle in scenarios such as provincial government clouds, improves the efficiency of compliance knowledge matching while reducing computational load by 70%, and markedly enhances the detection rate of inherent defects. The conclusion indicates that AI technology can effectively overcome the limitations of traditional assessment methods, promoting cybersecurity detection and assessment toward greater intelligence, adaptability, and comprehensiveness, thereby providing support for building resilient cybersecurity protection systems and fostering related ecosystem development. Reference | Related Articles | Metrics

Select

Journal of Information Security Reserach    2025, 11 (E2): 116-.   Abstract （143）      PDF （725KB）（53）       Knowledge map    Save Reference | Related Articles | Metrics