Table of Content

12 August 2026, Volume 12 Issue 8

Previous Issue   

Research on the Legal Positioning and Liability Allocation of AI Agent

2026, 12(8):  681-690.  DOI: 10.12379/j.issn.2096-1057.2026.08.01

Asbtract ( )  

References | Related Articles | Metrics

The autonomous operation and continuous functioning capabilities of AI agents have transcended the operational boundaries of traditional generative AI, which centers on the "input-output" paradigm, and present new normative challenges to the existing "tool-control-responsibility" framework a framework predicated on stable human control. In terms of behavior identification, responsibility attribution, and operational regulation, the current legal system is insufficient to fully accommodate the cross-subject, multi interactive, and continuously operating characteristics of AI agents. Against this backdrop, this paper contends that AI agents should not be granted independent legal personality. Instead, it proposes a response grounded in the functional reconstruction of traditional static tool-oriented rules, while preserving the stability of the existing subject system. Adopting "functional instrumentalism" as the fundamental legal orientation for AI agents, this paper constructs a dual track identification framework "technological identity" and "legal attribution" to align behavioral identifiability with responsibility attributability under conditions of continuous operation. Furthermore, it introduces a "relationalist attribution" approach, which takes control relationships, interest structures, and risk sources as analytical dimensions to allocate responsibilities among multiple subjects in a structured manner. Employing the "principle of minimum necessity" as the boundary for institutional expansion, the paper thereby outlines an integrated governance framework that connects current law, special rules, and technical standards. Accordingly, the logic of AI governance is shifting from a static structure centered on behavioral outcomes and one off liability determinations toward a dynamic structure oriented around process of continuous operation.

A Review of Large Language Model-Driven Network Penetration Testing Agents

2026, 12(8):  691-711.  DOI: 10.12379/j.issn.2096-1057.2026.08.02

Asbtract ( )  

References | Related Articles | Metrics

With the accelerated development of artificial intelligence, intelligent agents have demonstrated notable advantages in environmental perception, task planning, and multi-tool coordination. Concurrently, breakthroughs in Large Language Models concerning natural language understanding, logical reasoning, and multimodal processing have provided crucial support for the evolution of intelligent agents. The deep integration of these two technological strands has given rise to LLM-driven autonomous agents for network penetration testing, promoting a gradual shift from the traditional "tool-assisted" paradigm toward "autonomous intelligence." This paper systematically reviews the key challenges and principal technical approaches identified in existing research across four core modules: agent role definition, task planning, memory management, and interactive execution. It further examines the limitations of current methods in areas such as multimodal information processing, automated interaction, and context management. To address these issues, and in view of the ongoing technological evolution of intelligent agents, this paper proposes several promising research directions for intelligent penetration testing. These include multimodal fusion mechanisms, collaborative strategies integrating memory enhancement with reinforcement learning, and knowledge-graph-based vulnerability discovery methods. The analysis indicates that LLM-driven agents for network penetration testing provide substantial technical support for advancing the intelligence and autonomy of cybersecurity operations.

Research of Few-Shot Intrusion Detection Based on the Meta-SGD+ANIL Meta-Learning Framework

2026, 12(8):  712-720.  DOI: 10.12379/j.issn.2096-1057.2026.08.03

Asbtract ( )  

References | Related Articles | Metrics

Aiming at the problems of scarce samples for certain attack types, attack sample imbalance, and difficulty in detecting new attacks in network intrusion detection, this paper proposed a meta-learning framework based on the Meta-SGD+ANIL algorithm. The goal is to improve the efficiency and accuracy of few-shot intrusion detection, and enhance the model’s ability to recognize minority-class attacks and unknown attacks. Starting from the application and optimization of data augmentation and meta-learning algorithms, we first perform oversampling and undersampling on imbalanced datasets, then dynamically generate few-shot tasks to provide training scenarios for the model. Using the Meta-SGD algorithm, we enable the model to learn an adaptive learning rate for each parameter of the specific network, thereby improving the parameter update efficiency in different attack scenarios. Secondly, we introduce ANIL’s core idea on top of Meta-SGD: only the parameters of the classification layer or partial network layers are subject to dynamic learning rate adjustment, which effectively balances model adaptiveness and computational efficiency. Experiments on the few-shot image dataset Omniglot show that time overhead is reduced by 20% with only a slight drop in accuracy. On the CIC-IDS2017 and CSE-CIC-IDS2018 datasets, compared with traditional methods, the Meta-SGD algorithm improves the model’s accuracy by an average of 8.89%. After introducing ANIL, accuracy decreases only slightly, while training time is reduced by 18 % and 22 % respectively.

Malicious Traffic Detection Method Based on Bayesian Optimization and Spatiotemporal Attention

2026, 12(8):  721-729.  DOI: 10.12379/j.issn.2096-1057.2026.08.04

Asbtract ( )  

References | Related Articles | Metrics

To address the limitations inherent in current malicious network traffic detection methods, specifically suboptimal detection accuracy and reliance on manual hyperparameter tuning, this study proposes a malicious traffic detection method based on Bayesian optimization and a spatiotemporal attention mechanism. It adopts bidirectional long short-term memory (BiLSTM) to extract temporal and spatial features of network traffic data, and leverages Bayesian optimization to search for optimal network hyperparameters.A bidirectional architecture extracts temporal and spatial features from network traffic data, while Bayesian optimization automatically searches for optimal network parameters. Innovatively, we introduce a Multi-scale Traffic Protocol Enhancement Module that significantly enhances spatiotemporal feature representation for complex attack chains through multi-level protocol parsing, dynamic feature fusion, and attention coordination. Concurrently, to establish deep correlations between spatiotemporal features, we propose a Multi-head Spatiotemporal Attention Mechanism. This employs four parallel attention heads to cooperatively model millisecond-level protocol transients, second-level interaction sequences, minute-scale attack chain evolution, and cross-protocol correlation characteristics, effectively improving detection accuracy for stealthy threats. Experimental validation on the CIC-IDS2017 dataset demonstrates that the proposed method achieves multiclass and binary classification accuracies of 99.46% and 99.59%, respectively, outperforming comparative approaches.

API Access Link Characterization and Privacy-Aware Tracing for Microservice Architecture

2026, 12(8):  730-740.  DOI: 10.12379/j.issn.2096-1057.2026.08.05

Asbtract ( )  

References | Related Articles | Metrics

The proliferation of microservice architectures has exacerbated Application Programming Interface (API) security and sensitive data tracing challenges, owing to their inherently distributed and heterogeneous nature. Conventional tools are substantially limited in payload analysis and cross-service data flow reconstruction, often failing to satisfy compliance requirements. This paper proposes a novel methodology for API access path characterization and privacy-aware tracking, based on Interactive Application Security Testing (IAST). By deploying lightweight IAST agents across multilingual microservice instances and integrating a Privacy-Aware Intelligent Rules Engine (PAIRE), our approach enables precise identification of sensitive data and reconstruction of its propagation trajectories. To address complex scenarios involving absent TraceIDs and asynchronous communication, we innovatively devise a multi-dimensional stitching mechanism that synthesizes parameter matching, temporal correlation, service topology, and business identifiers, thereby improving tracking coverage and robustness. Concurrently, a visualization platform is developed to facilitate real-time risk alerts and anomalous behavior response. Experimental validation conducted on the TrainTicket microservice application demonstrates that our method surpasses state-of-the-art solutions in sensitive data detection accuracy, path reconstruction coverage, and performance overhead control, confirming its efficacy and practicality in complex operational environments.

Attribute Inner Product Functional Encryption Based on Hierarchical Access Structure

2026, 12(8):  741-749.  DOI: 10.12379/j.issn.2096-1057.2026.08.06

Asbtract ( )  

References | Related Articles | Metrics

Against the backdrop of growing widespread adoption of data sharing and cloud computing technologies, the simultaneous realization of data privacy protection, flexible access control, and controlled computation over ciphertext has emerged as a key research area in the field of information security. Attribute-Based Inner Product Functional Encryption (ABIPFE) integrates the respective strengths of attribute-based encryption and functional encryption. Nevertheless, the majority of existing ABIPFE schemes are constructed based on static access structures, and cannot support the reuse of original ciphertexts when access policies evolve. This deficiency results in progressively increasing computational and communication overhead when such schemes are deployed in dynamic environments. To resolve this problem, this paper proposes an attribute-based inner product functional encryption scheme that supports dynamic expansion of access structures. This scheme incorporates two categories of extended encryption mechanisms. Instead of re-encrypting the original ciphertexts, the proposed scheme only generates additional ciphertext components for the newly added access structure parts, which effectively reduces the overall system overhead. Experimental implementation and performance evaluation demonstrate that across different attribute scales, message dimensions, and expansion depths, the proposed scheme outperforms the comparison schemes in the key generation, encryption, and decryption phases, while maintaining stable overall operation.

Network Intrusion Detection with Multi-scale Spatiotemporal Feature Extraction Based on Subspace Distance

2026, 12(8):  750-758.  DOI: 10.12379/j.issn.2096-1057.2026.08.07

Asbtract ( )  

References | Related Articles | Metrics

Aiming at the problems of complex feature redundancy, class imbalance, and insufficient extraction of spatiotemporal features in network intrusion detection, a multi-scale spatiotemporal feature extraction intrusion detection system based on subspace distance is proposed. First, variance-covariance subspace distance is applied to feature selection on preprocessed data to obtain a representative feature subset that effectively approximates the original feature space. Secondly, an improved Focal Loss (FL) is utilized to dynamically adjust the loss contribution of different categories to address the class imbalance problem. Finally, we propose a traffic anomaly detection model based on spatiotemporal feature extraction named Gated Dilated Convolution and LSTM-Channel Attention (GDC-LA) that integrates gated dilated convolution, long short-term memory networks and channel attention. Experimental results on the UNSW-NB15 dataset demonstrate that the proposed model effectively alleviates sample imbalance and achieves high detection accuracy.

Target Function-Guided Fuzzing Method for BMC Firmware

2026, 12(8):  759-771.  DOI: 10.12379/j.issn.2096-1057.2026.08.08

Asbtract ( )  

References | Related Articles | Metrics

As a type of embedded firmware pre-installed in server hardware, the Baseboard Management Controller (BMC) is responsible for managing and monitoring the full operational lifecycle of servers, and its security posture directly determines the overall security and stability of the entire server system. With the rising trend of cyberattacks targeting low-level system components, BMC firmware has gradually become a key attack surface that cannot be ignored.As a mainstream vulnerability detection technology, fuzzing has been widely recognized and applied in both academic research and industrial practice. However, fuzzing testing for BMC firmware still faces multiple non-trivial challenges: on the one hand, the diversity of BMC instruction set architectures and the closed proprietary attribute of firmware increase the difficulty of testing; on the other hand, the large number of complex binary programs contained in BMC firmware also brings great obstacles to the positioning of fuzzing target functions.This paper proposes a target function-guided fuzzing method oriented to closed-source BMC firmware. First, we design a target function discovery algorithm that integrates static analysis and pre-defined dangerous function call relationship rules, which can automatically identify high-value fuzzing targets from BMC firmware. Second, based on the proposed target discovery algorithm, we implement a QEMU-based BMC firmware fuzzer with the support of LibAFL. This fuzzer integrates modern fuzzing technologies including dynamic binary instrumentation and coverage-guided fuzzing to effectively improve fuzzing efficiency.Experimental results show that the proposed target function discovery algorithm significantly reduces the manual workload required for target function selection. Compared with AFL++ running in QEMU mode, the fuzzer proposed in this paper achieves better code coverage and higher testing performance, which verifies the effectiveness of our method in BMC firmware security fuzzing.

Research on the Application of Unbalanced Hierarchical Consensus in Distributed Oracles

2026, 12(8):  772-778.  DOI: 10.12379/j.issn.2096-1057.2026.08.09

Asbtract ( )  

References | Related Articles | Metrics

As the critical interface between blockchains and external data sources, oracles presently contend with substantial resource overhead and diminished execution efficiency. To address the inefficiencies and limited scalability of traditional consensus protocols within heterogeneous decentralized oracle networks, we introduce an unbalanced handshake mechanism that assesses computational disparities among nodes and offloads complex tasks to high-performance nodes, thereby markedly reducing initialization latency. Integrated with a customized multi-stage commit process and data source signature verification, this scheme enhances consensus efficiency while preserving robust security and reliability. Evaluation results demonstrate that UBFTO achieves lower consensus latency compared to existing mechanisms, providing a viable solution for the construction of high-performance distributed oracle services.