Table of Content

02 September 2026, Volume 12 Issue 9

Previous Issue   

Research on Federated Learning-based Intrusion Detection Methods for the Internet of Things

2026, 12(9):  780-788.  DOI: 10.12379/j.issn.2096-1057.2026.09.01

Asbtract ( )   PDF (723KB) ( )  

References | Related Articles | Metrics

The rapid expansion of the Internet of Things (IoT) has given rise to pressing cybersecurity challenges. Traditional centralized intrusion detection approaches encounter difficulties in balancing model performance and data privacy protection. Federated learning enables collaborative model training without sharing raw data among participants, which provides a novel paradigm for IoT intrusion detection. This paper presents a systematic review of federated learning-driven IoT intrusion detection methods. It first introduces the fundamental background and typical architectures of this research field. It then categorizes existing methods into three types: federated machine learning, federated deep learning, and federated reinforcement learning, and analyzes the characteristics, application scenarios,and existing limitations of each category. This paper further summarizes common enhancement mechanisms, cutting-edge technologies, public datasets, and evaluation indicators used in this field. Finally, this paper discusses key open challenges, including label scarcity, Non-Independent and Identically Distributed (Non-IID) data, federated multimodal large models and security enhancement, and proposes potential future research directions. This review can provide a useful technical reference for subsequent research and practical applications in this field.

A Construction Method of Hybrid Covert Channels Based on Federated Learning

2026, 12(9):  789-800.  DOI: 10.12379/j.issn.2096-1057.2026.09.02

Asbtract ( )   PDF (3249KB) ( )  

References | Related Articles | Metrics

Federated Learning (FL) is designed to solve the irreconcilable contradiction between data sharing requirements and privacy needs. As a kind of distributed machine learning, FL needs to exchange a large number of model parameters between participants and the central server, which leads to a large amount of data communication. The iterative process of FL model updating depends on distributed data transmission, and once the transmission channel is located, its model data security and integrity will be difficult to guarantee. In this paper, a hybrid Covert Storage-Timing Channel (CSTC) scheme for FL is proposed. The secret message is firstly split into parallel-distributed coding units, and the secret data communication is achieved via adjusting the inter-packet delays to indicate which block is to be transmitted, and the overt traffic’s packet payload is selectively replaced with secret blocks according to the payload content. Thus, the position indicator of a secret block is embedded in both the time and storage features of the overt traffic, while the feature-location correspondence is pre-shared by the receiver and sender, and the adversary cannot grasp a secret message unless all features locating the secret block are obtained. Moreover, three variants of the original CSTC are proposed to fulfill the different performance requirements, and the experiments show that the undetectability and capacity of the proposed schemes are reasonable.

Federated Learning Backdoor Attack Method Based on Dynamic Trigger Transformation

2026, 12(9):  801-812.  DOI: 10.12379/j.issn.2096-1057.2026.09.03

Asbtract ( )   PDF (1674KB) ( )  

References | Related Articles | Metrics

To address the rapid degradation of fixed-trigger backdoor attacks in Federated Learning after attack termination, a backdoor attack method based on dynamic trigger transformation was developed. The method dynamically adjusted the position, size, and pattern of the trigger during federated training, selected trigger states according to historical attack success rates in data preprocessing, and introduced supervised contrastive learning in the adaptation stage to align representations of poisoned samples with the target class and mitigate catastrophic forgetting. Experiments were conducted on MNIST, CIFAR-10, and Tiny-ImageNet under multiple aggregation algorithms and five representative defense mechanisms, evaluating attack effectiveness, stealthiness, and persistence. The attack success rate exceeded 95% across the evaluated defense scenarios. In the CIFAR-10 setting, the attack success rate remained approximately 90% after trigger injection had been stopped for 1,000 rounds. These results indicate that dynamic trigger selection and supervised contrastive learning improve the persistence and adaptability of federated learning backdoor attacks.

A Comprehensive Review of Deepfake Audio Detection Methodologies and Their Applications

2026, 12(9):  813-822.  DOI: 10.12379/j.issn.2096-1057.2026.09.04

Asbtract ( )   PDF (1335KB) ( )  

References | Related Articles | Metrics

With the rapid advancement of generative AI technologies, speech synthesized through text to speech and voice conversion has become increasingly realistic,posing a serious threat to public safety. This paper systematically reviews deepfake audio detection methods and their applications across various domains which aids in clarifying the technical developments and application landscape within the field of deepfake audio detection, thereby providing theoretical support and practical references for public safety governance. This study conducted a comprehensive literature review based on an analysis of 70 selected publications from the China National Knowledge Infrastructure (CNKI) and Web of Science databases, covering the period from 2017 to 2025. The research systematically examined progress in deepfake audio technology, experimental datasets, evaluation metrics, and detection methodologies. Furthermore, it synthesized the application status of these detection methods across various domains, including online public opinion monitoring, user privacy protection, multimodal misinformation governance, and voice fraud detection. Findings indicate that current deepfake audio detection primarily relies on end-to-end architectures, which demonstrate superior performance yet limited interpretability, and have been successfully deployed in multiple task scenarios within public security governance. Nevertheless, challenges remain, such as insufficient diversity in deepfake audio datasets, limited generalizability and interpretability of detection techniques, and the need for broader application scenarios. Future research should prioritize the development of more diverse datasets, enhance the generalizability of detection methods, and expand into more varied application domains.

Log Anomaly Detection Method based on LLM-Enhanced Dynamic Graph Relational Learning and Explainable Diagnosis

2026, 12(9):  823-830.  DOI: 10.12379/j.issn.2096-1057.2026.09.05

Asbtract ( )   PDF (979KB) ( )  

References | Related Articles | Metrics

System logs record the complete operational data of computer systems, and form the core foundation for system stability assurance, security guarantee and fault diagnosis. Existing graph-based log anomaly detection methods are incapable of extracting deep log semantics, mitigating class imbalance, modeling complex temporal dependencies, and providing intuitive anomaly interpretation simultaneously. This paper presents an anomaly detection scheme that integrates Large Language Model and dynamic graph networks. Based on the classic Graph Log Anomaly Detection framework, this paper incorporates semantic augmentation, data augmentation and multi-scale temporal graph modeling to propose LLM-GLAD, an LLM-driven log relational anomaly detection framework. An interpretable diagnosis module based on LLM is constructed to generate natural language anomaly explanations and root cause suggestions for practical deployment. Comparative experiments conducted on three public log datasets demonstrate that the proposed method achieves a precision of 96.45%, a recall of 93.43% and an F1-score of 94.92%.

An Intrusion Detection Method for Industrial Control Systems Integrating Memory Autoencoder and CNN-Transformer

2026, 12(9):  831-841.  DOI: 10.12379/j.issn.2096-1057.2026.09.06

Asbtract ( )   PDF (1467KB) ( )  

References | Related Articles | Metrics

To address the problems of high false alarm rate in unsupervised detection and insufficient generalization capability of supervised detection in existing industrial control system intrusion detection methods, this paper proposes an intrusion detection method integrating memory autoencoder and CNN-Transformer. First, the sliding window technique is employed to construct temporal contexts, so as to mitigate detection blind spots caused by static features. Second, multi-dimensional feature enhancement is implemented to expand the original data representation, which improves the model's robustness against complex attack patterns and reduces misclassification caused by insufficient dimensionality. Furthermore, a Memory AutoEncoder (MemAE) and a Transformer-equipped Convolutional Neural Network (CNN-Transformer) are constructed as supervised models, and a parallel intrusion detection model termed MemAE-CT is established by combining the two modules. The proposed model incorporates an adaptive weight distribution mechanism to dynamically adjust the decision contribution of each component, thereby balancing the accurate identification of known attacks and the generalized detection of unknown threats. The proposed method achieves an accuracy of 97.26% and an F1-score of 96.23% on the natural gas pipeline dataset released by Mississippi State University, which verifies its excellent performance. Its generalization capability is further validated on the CICIDS2017 dataset, and the method provides a reliable solution for industrial control system security.

SAFE-SCVDM: Sequence Feature-Enhanced Smart Contract Vulnerability Detection Model

2026, 12(9):  842-849.  DOI: 10.12379/j.issn.2096-1057.2026.09.07

Asbtract ( )   PDF (943KB) ( )  

References | Related Articles | Metrics

Aiming at the insufficient integration of local features and global features in existing smart contract vulnerability detection methods, as well as inadequate modeling of code contextual dependencies, this paper proposes a sequence feature-enhanced vulnerability detection model for smart contracts-SAFE-SCVDM. The model innovatively integrates multi-dimensional code representations through a three-stage feature extraction architecture to improve detection accuracy. First, we design a structured traversal based transformation strategy for abstract syntax trees , converting AST into sequential structures that preserve lexical and hierarchical features. Second, a node extraction script is developed to mine token-level information from smart contract code, retaining semantic characteristics. Subsequently, global contextual dependencies are captured by leveraging a large-scale code model to generate code comments from source code, thereby preserving cross-function semantic relationships. Finally, an enhanced LoRA detection model is proposed, utilizing a self-attention mechanism to jointly model textual sequences (code tokens), structural sequences (SBT-AST), and global annotations (code comments). Experimental results demonstrate that the proposed method achieves an accuracy of 88.41% in smart contract vulnerability detection, outperforming state-of-the-art baseline models by 9.8%.

A Differential Testing Method for Certificate Parsing and Verification based on Template-driven

2026, 12(9):  850-859.  DOI: 10.12379/j.issn.2096-1057.2026.09.08

Asbtract ( )   PDF (1563KB) ( )  

References | Related Articles | Metrics

X.509 certificates constitute the fundamental basis for identity authentication and trust establishment within the Secure Sockets Layer(SSL)/Transport Layer Security(TLS) protocol. The accuracy of their parsing and verification behaviors directly determines the security of the protocol. However, discrepancies exist in certificate processing procedures across different TLS implementations, which can readily lead to semantic deviations, security bypasses, and even vulnerability exploitation. Existing differential testing methodologies predominantly focus on single-stage assessments of either parsing or verification, frequently overlooking the semantic associations between certificate fields. This oversight results in incomplete analysis of defect root causes and yields limited inter-field coverage. Consequently, this paper proposes a template-driven differential testing method for certificate parsing and verification. This approach integrates the RFC standard for X.509 certificates to construct a general certificate template class, programmatically models field structures, value constraints, and mutation operations, captures implementation differences via a differential vector feedback mechanism, and formulates joint mutation strategies based on field associations. These elements collectively establish a comprehensive iterative testing framework. Experimental evaluations conducted on four mainstream TLS implementations involved the construction of nearly 250 test certificate samples. These successfully triggered 133 differential behaviors during parsing and verification stages, ultimately identifying 9 compliance implementation defects.

The Structural Risk Evolution of Virtual Currency Crimes and Chinese Governance Practices

2026, 12(9):  860-866.  DOI: 10.12379/j.issn.2096-1057.2026.09.09

Asbtract ( )   PDF (683KB) ( )  

References | Related Articles | Metrics

With the deep development of blockchain technology and the accelerated integration of the global digital economy, virtual currencies are reshaping the financial ecosystem, but simultaneously giving rise to new types of criminal activities with diverse forms and far-reaching harms. These activities exhibit deep-seated characteristics such as disembedded subject identities, modularized criminal activities, technological iteration of criminal methods, and networked criminal hazards, becoming new structural risk carriers in the financial sector. Based on the triple analytical framework of “technology-institution-capital,” this paper systematically analyzes the evolutionary path and deep-seated generation logic of virtual currency crimes from instrumental application to ecological infiltration. On this basis, transcending simple policy reviews, this paper theoretically refines Chinese practical experience in governing new types of virtual currency crimes. The research shows that China has constructed a comprehensive and penetrative governance system through the reshaping of the institutional dimension, the countermeasures in the technological dimension, and the regulation of the capital dimension. This practice not only effectively curbs local risks but also contributes Chinese wisdom with theoretical depth and practical value to risk governance and order reconstruction in the era of global digital finance.

Risk Analysis and Governance Approaches for Online Protection of Minors in the Age of Artificial Intelligence

2026, 12(9):  867-876.  DOI: 10.12379/j.issn.2096-1057.2026.09.10

Asbtract ( )   PDF (684KB) ( )  

References | Related Articles | Metrics

The rapid advancement of Artificial Intelligence (AI), while offering minors diverse opportunities in education, entertainment, and social interaction. However, it has simultaneously catalyzed a range of complex new victimization risks. These include deepfake identity fraud, virtual sexual exploitation, cyberbullying, internet addiction, misinformation and fraud, algorithmic discrimination, and privacy breaches. Traditional governance models are inadequate to fully address these emerging threats. Through a comparative analysis of legal policies and governance practices across different countries and regions, this study identifies distinct approaches: the European Union emphasizes rights-based orientations and platform accountability, the United States prioritizes interstate innovation and flexible regulation, while China focuses on institutional development and educational guidance. These differences reflect varied governance traditions and offer valuable insights for international mutual learning and cooperation. Consequently, this paper proposes five pathways for protecting minors online in the AI era: Firstly, innovating legal policies to provide agile responses to novel AI risks. Secondly, fostering home-school collaborative education to enhance minors' digital literacy. Thirdly, leveraging technological innovation to promote safe and user-friendly AI interaction design. Fourthly, strengthening platform governance and supervision through targeted rectification of the online environment. Fifthly, facilitating the integration of government, industry, academia, and research to enable multi-stakeholder participation in comprehensive governance. This research aims to provide academic support and policy implications for the theoretical construction and practical pathways of the protection of minors in the AI era, ultimately contributing to the creation of a safe, healthy, and inclusive digital ecosystem for minors.