Author

Zewei Han

4 papers · 2024–2025

2024peak 2 in 20242025

Frequent co-authors

Papers

showing 1–4 of 4 RSS

GSEDroid: GNN-based Android malware detection framework using lightweight semantic embedding

Jintao Gu, Hongliang Zhu, Zewei Han +2 more

Signal Processing · Computers & Security · 12 Mar 2024 · cited 29× · DOI ↗ · more like this ·

Currently, the prevalence of Android malware remains substantial. Malicious programs increasingly use advanced obfuscation techniques, posing challenges for security professionals with enhanced disguises, a proliferation of variants, and escalating detection difficulty. Leveraging semantic features presents a promising avenue to address these challenges. Rich semantic information encapsulated within opcodes and API call graphs has been identified as crucial in distinguishing benign from malicious applications. Consequently, various Natural Language Processing (NLP) technologies, such as Word2vec, are employed to encode features of Dalvik opcode sequences, thereby yielding embedded representations.Given that malware developers often opt for semantically similar APIs to achieve comparable functionalities, it is posited that the opcode embeddings for such APIs should exhibit similar…

Graph Learning on Instruction Stream-Augmented CFG for Malware Variant Detection

Jiaxin Mi, Qi Li, Zewei Han +2 more

Signal Processing · IEEE Transactions on Information Forensics and Security · 2025 · cited 6× · DOI ↗ · more like this ·

As malware as a service (MaaS) and organized attacks develop and drive a shift in malware variant generation mechanism, current variant detection, designed to counter conventional obfuscation and anti-detection strategies, falls short in facing new challenges, particularly in identifying variants that maintain core functionalities while altering local behaviors, or those sharing similar code logic but diverge in actual functionalities. To tackle the problems, we present ISCMVD, an Instruction Stream-augmented CFG-based Malware Variant Detection scheme, melding control flow structures with machine semantic information from instruction streams within blocks to build a comprehensive functional representation for variants’ basic and detailed behaviors. Leveraging a global-enhanced attentive graph neural network to integrate local and global functional features, we significantly boost the…

ReTrial: Robust Encrypted Malicious Traffic Detection via Discriminative Relation Incorporation and Misleading Relation Correction

Jianjin Zhao, Qi Li, Zewei Han +4 more

Artificial Intelligence · IEEE Transactions on Information Forensics and Security · 11 Dec 2024 · cited 4× · DOI ↗ · more like this ·

Encryption techniques greatly ensure the confidentiality and integrity of network communications. However, they also allow attackers to conceal malicious activities within encrypted traffic, posing severe cybersecurity challenges. Current detection methods primarily rely on statistics and correlation analysis. However, both statistical features and inter-entity relations can be easily obfuscated. Moreover, issues with low-quality data and fixed feature sets limit the generalizability and adaptability to defend against various evasion techniques. Robustifying encrypted malicious traffic detection in adverse conditions is still an open problem. In this paper, we propose R<sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">e</small>T<sc xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">rial</small>, a robust…

Overcoming Fairness and Latency Challenges in BBR With an Adaptive Delay Detection

Zewei Han, Go Hasegawa

Computer Networks and Communications · IEEE Access · 2025 · cited 3× · DOI ↗ · more like this ·

In 2016, Google introduced a new congestion control algorithm called Bottleneck Bandwidth and Round-trip propagation time (BBR). BBR aims to set the data-sending rate of flows to operate at an optimal operating point—maximizing throughput, minimizing delay, and reducing packet loss. However, when multiple BBR flows share a bottleneck link with a deep buffer, they often deviate from the optimal point, resulting in significant queuing delays, and serious fairness issues especially when flows with different RTTs are present. Existing methods to enhance BBR’s performance typically cap the sending rates of longer RTT flows to improve fairness and reduce latency, but these do not tackle the fundamental problem. In this paper, we introduce a modification to BBR, termed BBR Refined (BBR-R), which enhances throughput fairness among diverse RTT flows and lowers queuing delays. By targeting the…