Selected work

Representative Papers

Deep Recurrent Hidden Markov Learning Framework for Multi-Stage Advanced Persistent Threat Prediction

Jan 11, 2026arXiv.org

This work addresses the challenge of stage-aware prediction for advanced persistent threats (APTs), which are multi-stage, stealthy, and difficult for existing intrusion detection systems to detect—particularly under sparse or incomplete observations where robust reasoning is lacking. The authors propose E-HiDNet, a novel framework that uniquely integrates deep semantic feature learning with probabilistic state-space modeling. It jointly employs CNNs and RNNs to extract spatiotemporal features from alert sequences and leverages a hidden Markov model to characterize latent APT attack stages and their stochastic transitions. An enhanced Viterbi algorithm enables uncertainty-aware inference even with incomplete observations. Evaluated on the S-DAPT-2026 dataset, the method achieves 98.8%–100% stage prediction accuracy when at least four observations are available, significantly outperforming conventional HMMs and maintaining high robustness under reduced training data.

0 citationsRead paper

S-DAPT-2026: A Stage-Aware Synthetic Dataset for Advanced Persistent Threat Detection

Jan 10, 2026arXiv.org

This study addresses the significant challenges in detecting Advanced Persistent Threats (APTs), which stem from their stealthy, multi-stage nature and the scarcity of real-world labeled data. To this end, the authors construct a comprehensive, structured synthetic APT dataset that explicitly defines the mapping between attack stages and alerts, simulating 14 distinct alert types within realistic campus and organizational network environments. Building upon this dataset, they propose a time-context-aware alert correlation framework that leverages K-nearest neighbor clustering and cosine similarity within sliding time windows to perform semantic association and stage-aware analysis. The approach supports flexible integration of new alert types, substantially enhances APT stage detection performance, and provides a high-quality, reproducible foundation for future research on APT stage prediction.

0 citationsRead paper

Coordinative Learning with Ordinal and Relational Priors for Volumetric Medical Image Segmentation

Nov 14, 2025

Volumetric medical image segmentation faces dual challenges of complex anatomical structures and scarce annotated data. Conventional methods rely on rigid binary thresholds to define positive/negative samples, neglecting the continuous nature of anatomical similarity and the global directional consistency of anatomical evolution across patients—leading to distorted feature representations. To address this, we propose CORAL, a cooperative learning framework that jointly leverages two complementary priors: (i) a contrastive ranking loss to model inter-slice continuous anatomical similarity, and (ii) a sequential consistency constraint to explicitly encode the ordered, population-level anatomical evolution pattern. CORAL integrates local relational and global structural priors within an unsupervised pretraining paradigm. Extensive experiments demonstrate that CORAL achieves state-of-the-art segmentation performance across multiple few-shot benchmarks and learns anatomically interpretable, semantically meaningful feature representations.

0 citationsRead paper

Word Embedding Techniques for Classification of Star Ratings

Apr 18, 2025

This study addresses star-rating classification for telecom customer reviews, systematically evaluating the impact of word embedding methods—including BERT, Word2Vec, and Doc2Vec—on both classification performance and computational energy consumption, while investigating the critical roles of feature engineering and dimensionality reduction. We propose a novel word-vector fusion strategy based on the first principal component (PCA), replacing conventional averaging, and introduce the first unified framework jointly optimizing classification accuracy and energy efficiency. Experimental results demonstrate that the BERT+PCA approach achieves the highest precision, recall, and F1-score among all configurations. Our PCA-based fusion improves F1-score by up to 4.2% while substantially reducing computational energy consumption. These findings provide a reproducible, energy-aware methodology for efficient text classification in resource-constrained environments.

0 citationsRead paper

Optimizing Password Cracking for Digital Investigations

Apr 04, 2025

To address the low efficiency and high resource consumption of password cracking in digital forensics, this paper proposes a lightweight rule-optimization framework grounded in policy compliance and empirical user behavior. Methodologically, it introduces the first dynamic rule-generation mechanism based on policy structures—such as the NCSC’s three-word password guidelines—integrated with password statistical modeling, analysis of public datasets, and user surveys to construct multi-granularity dictionaries and quantitatively assess the real-world vulnerability of three-word passwords under varying high-frequency word ratios. Key contributions include: (1) the first systematic revelation of the inherent tension between usability and security in three-word passwords; (2) a 40% reduction in rule-set size via iterative compression, yielding significantly faster cracking performance; and (3) empirical validation that a compact sub-dictionary comprising only the top 30% most frequent words successfully cracks 77.5% of real-world three-word passwords, confirming substantial practical risk.

0 citationsRead paper

Recent publications

Latest Papers

Deep Recurrent Hidden Markov Learning Framework for Multi-Stage Advanced Persistent Threat Prediction

Jan 11, 2026arXiv.org

This work addresses the challenge of stage-aware prediction for advanced persistent threats (APTs), which are multi-stage, stealthy, and difficult for existing intrusion detection systems to detect—particularly under sparse or incomplete observations where robust reasoning is lacking. The authors propose E-HiDNet, a novel framework that uniquely integrates deep semantic feature learning with probabilistic state-space modeling. It jointly employs CNNs and RNNs to extract spatiotemporal features from alert sequences and leverages a hidden Markov model to characterize latent APT attack stages and their stochastic transitions. An enhanced Viterbi algorithm enables uncertainty-aware inference even with incomplete observations. Evaluated on the S-DAPT-2026 dataset, the method achieves 98.8%–100% stage prediction accuracy when at least four observations are available, significantly outperforming conventional HMMs and maintaining high robustness under reduced training data.

0 citationsRead paper

S-DAPT-2026: A Stage-Aware Synthetic Dataset for Advanced Persistent Threat Detection

Jan 10, 2026arXiv.org

This study addresses the significant challenges in detecting Advanced Persistent Threats (APTs), which stem from their stealthy, multi-stage nature and the scarcity of real-world labeled data. To this end, the authors construct a comprehensive, structured synthetic APT dataset that explicitly defines the mapping between attack stages and alerts, simulating 14 distinct alert types within realistic campus and organizational network environments. Building upon this dataset, they propose a time-context-aware alert correlation framework that leverages K-nearest neighbor clustering and cosine similarity within sliding time windows to perform semantic association and stage-aware analysis. The approach supports flexible integration of new alert types, substantially enhances APT stage detection performance, and provides a high-quality, reproducible foundation for future research on APT stage prediction.

0 citationsRead paper

Coordinative Learning with Ordinal and Relational Priors for Volumetric Medical Image Segmentation

Nov 14, 2025

Volumetric medical image segmentation faces dual challenges of complex anatomical structures and scarce annotated data. Conventional methods rely on rigid binary thresholds to define positive/negative samples, neglecting the continuous nature of anatomical similarity and the global directional consistency of anatomical evolution across patients—leading to distorted feature representations. To address this, we propose CORAL, a cooperative learning framework that jointly leverages two complementary priors: (i) a contrastive ranking loss to model inter-slice continuous anatomical similarity, and (ii) a sequential consistency constraint to explicitly encode the ordered, population-level anatomical evolution pattern. CORAL integrates local relational and global structural priors within an unsupervised pretraining paradigm. Extensive experiments demonstrate that CORAL achieves state-of-the-art segmentation performance across multiple few-shot benchmarks and learns anatomically interpretable, semantically meaningful feature representations.

0 citationsRead paper

Word Embedding Techniques for Classification of Star Ratings

Apr 18, 2025

This study addresses star-rating classification for telecom customer reviews, systematically evaluating the impact of word embedding methods—including BERT, Word2Vec, and Doc2Vec—on both classification performance and computational energy consumption, while investigating the critical roles of feature engineering and dimensionality reduction. We propose a novel word-vector fusion strategy based on the first principal component (PCA), replacing conventional averaging, and introduce the first unified framework jointly optimizing classification accuracy and energy efficiency. Experimental results demonstrate that the BERT+PCA approach achieves the highest precision, recall, and F1-score among all configurations. Our PCA-based fusion improves F1-score by up to 4.2% while substantially reducing computational energy consumption. These findings provide a reproducible, energy-aware methodology for efficient text classification in resource-constrained environments.

0 citationsRead paper

Optimizing Password Cracking for Digital Investigations

Apr 04, 2025

To address the low efficiency and high resource consumption of password cracking in digital forensics, this paper proposes a lightweight rule-optimization framework grounded in policy compliance and empirical user behavior. Methodologically, it introduces the first dynamic rule-generation mechanism based on policy structures—such as the NCSC’s three-word password guidelines—integrated with password statistical modeling, analysis of public datasets, and user surveys to construct multi-granularity dictionaries and quantitatively assess the real-world vulnerability of three-word passwords under varying high-frequency word ratios. Key contributions include: (1) the first systematic revelation of the inherent tension between usability and security in three-word passwords; (2) a 40% reduction in rule-set size via iterative compression, yielding significantly faster cracking performance; and (3) empirical validation that a compact sub-dictionary comprising only the top 30% most frequent words successfully cracks 77.5% of real-world three-word passwords, confirming substantial practical risk.

0 citationsRead paper