arXiv subjects

Lingzhi Wang

Publications and source records attributed to Lingzhi Wang.

At least 37 records · Page 2Linked to original sources

arXiv2025

GraphFaaS: Serverless GNN Inference for Burst-Resilient, Real-Time Intrusion Detection

Provenance-based intrusion detection is an increasingly popular application of graphical machine learning in cybersecurity, where system activities are modeled as provenance graphs to capture causality and correlations among potentially malicious actions. Graph Neural Networks (GNNs) have demonstrated strong performance in this setting. However, traditional statically-provisioned GNN inference architectures fall short in meeting two crucial demands of intrusion detection: (1) maintaining consistently low detection latency, and (2) handling highly irregular and bursty workloads. To holistically address these challenges, we present GraphFaaS, a serverless architecture tailored for GNN-based intrusion detection. GraphFaaS leverages the elasticity and agility of serverless computing to dynamically scale the GNN inference pipeline. We parallelize and adapt GNN workflows to a serverless environment, ensuring that the system can respond in real time to fluctuating workloads. By decoupling compute resources from static provisioning, GraphFaaS delivers stable inference latency, which is critical for dependable intrusion detection and timely incident response in cybersecurity operations. Preliminary evaluation shows GraphFaaS reduces average detection latency by 85% and coefficient of variation (CV) by 64% compared to the baseline.

cs.CR↗

arXiv2025

SN 2024gy: Multi-epoch Spectroscopic Features Suggestive of Delayed Detonation in a Type Ia Supernova

We present photometric and spectroscopic observations of SN 2024gy, a Type Ia supernova (SN Ia) exhibiting high-velocity features (HVFs) in its early-time spectra. This SN reaches a peak $B$-band magnitude of $-19.25 \pm 0.29$ mag and subsequently declines by $Δm_{15}(B) \approx 1.12$ mag, consistent with the luminosity-width relation characteristic of normal SNe Ia. Based on the peak thermal luminosity of $(1.2 \pm 0.3) \times 10^{43}$ erg s$^{-1}$, we estimate that $0.57 \pm 0.14~\rm M_{\odot}$ of $^{56}$Ni was synthesized during the explosion. Our dense early spectral monitoring revealed significant velocity disparities within the ejecta. Notably, absorption features from the Ca II near-infrared triplet were observed at velocities exceeding 25,000 km s$^{-1}$, while the Si II $λ$6355 line velocity at the same epoch was significantly lower at $\sim$ 16,000 km s$^{-1}$. This velocity disparity likely reflects distinct ionization states of intermediate-mass elements in the outermost layers. The prominent Ca II HVFs may originate from ionization suppression within the highest-velocity ejecta, potentially indicative of minimal hydrogen mixing in a delayed-detonation explosion scenario. Additionally, the Ni/Fe ratio derived from the nebular spectrum of SN 2024gy provides further support for this model.

astro-ph.HE↗

arXiv2025

VVV-WIT-13: an eruptive young star with cool molecular features

Here we investigate an infrared eruptive source, identified from the decade-long VISTA Variables in the Via Lactea survey (VVV). We named this target after a group of variable sources discovered by VVV, as VVV-WIT-13, with WIT standing for "What Is This?", due to its unique photometric variation behaviour and the mysterious origin of the outburst. This target exhibited an outburst with a 5.7 mag amplitude in the Ks-band, remained on its brightness plateau for 3.5 years, and then rapidly faded to its pre-eruptive brightness afterwards. We aim to reveal the variable nature and outburst origin of VVV-WIT-13 by presenting our follow-up photometric and spectroscopic observations along with theoretical models. We gathered photometric time series in both near- and mid-infrared wavelengths. We obtained near-infrared spectra during the outburst and decaying stages on XSHOOTER/VLT and FIRE/Magellan, and then fitted the detected molecular absorption features using models from ExoMol. We applied 2D numerical simulations to re-create the observables of the eruptive phenomenon. We observe deep AlO absorption bands in the infrared spectra of VVV-WIT-13, during the outburst stage, along with other more common absorption bands (e.g. CO). Our best-fit model suggests a 600 K temperature of the AlO absorption band. In the decaying stage, the AlO bands disappeared, whilst broad blue-shifted H2 lines arose, a common indicator of stellar wind and outflow. The observational evidence suggests that the CO and TiO features originate from an outflow or a wind environment. We find that VVV-WIT-13 is an eruptive young star with instability occurring in the accretion disk. One favoured theoretical explanation of this event is a disrupted gas clump at a distance of 3 au from the source. If confirmed, this would be the first such event observed in real time.

astro-ph.SR↗

arXiv2025

AEAS: Actionable Exploit Assessment System

Security practitioners face growing challenges in exploit assessment, as public vulnerability repositories are increasingly populated with inconsistent and low-quality exploit artifacts. Existing scoring systems, such as CVSS and EPSS, offer limited support for this task. They either rely on theoretical metrics or produce opaque probability estimates without assessing whether usable exploit code exists. In practice, security teams often resort to manual triage of exploit repositories, which is time-consuming, error-prone, and difficult to scale. We present AEAS, an automated system designed to assess and prioritize actionable exploits through static analysis. AEAS analyzes both exploit code and associated documentation to extract a structured set of features reflecting exploit availability, functionality, and setup complexity. It then computes an actionability score for each exploit and produces ranked exploit recommendations. We evaluate AEAS on a dataset of over 5,000 vulnerabilities derived from 600+ real-world applications frequently encountered by red teams. Manual validation and expert review on representative subsets show that AEAS achieves a 100% top-3 success rate in recommending functional exploits and shows strong alignment with expert-validated rankings. These results demonstrate the effectiveness of AEAS in supporting exploit-driven vulnerability prioritization.

cs.CR↗

arXiv2025

Counterspeech for Mitigating the Influence of Media Bias: Comparing Human and LLM-Generated Responses

Biased news contributes to societal polarization and is often reinforced by hostile reader comments, constituting a vital yet often overlooked aspect of news dissemination. Our study reveals that offensive comments support biased content, amplifying bias and causing harm to targeted groups or individuals. Counterspeech is an effective approach to counter such harmful speech without violating freedom of speech, helping to limit the spread of bias. To the best of our knowledge, this is the first study to explore counterspeech generation in the context of news articles. We introduce a manually annotated dataset linking media bias, offensive comments, and counterspeech. We conduct a detailed analysis showing that over 70\% offensive comments support biased articles, amplifying bias and thus highlighting the importance of counterspeech generation. Comparing counterspeech generated by humans and large language models, we find model-generated responses are more polite but lack the novelty and diversity. Finally, we improve generated counterspeech through few-shot learning and integration of news background information, enhancing both diversity and relevance.

cs.CL↗

arXiv2025

A Survey of the Evolution of Language Model-Based Dialogue Systems: Data, Task and Models

Dialogue systems (DS), including the task-oriented dialogue system (TOD) and the open-domain dialogue system (ODD), have always been a fundamental task in natural language processing (NLP), allowing various applications in practice. Owing to sophisticated training and well-designed model architecture, language models (LM) are usually adopted as the necessary backbone to build the dialogue system. Consequently, every breakthrough in LM brings about a shift in learning paradigm and research attention within dialogue system, especially the appearance of pre-trained language models (PLMs) and large language models (LLMs). In this paper, we take a deep look at the history of the dialogue system, especially its special relationship with the advancements of language models. Thus, our survey offers a systematic perspective, categorizing different stages in a chronological order aligned with LM breakthroughs, providing a comprehensive review of state-of-the-art research outcomes. What's more, we turn our attention to emerging topics and engage in a discussion on open challenges, providing valuable insights into the future directions for LLM-based dialogue systems. In summary, this survey delves into the dynamic interplay between language models and dialogue systems, unraveling the evolutionary path of this essential relationship. Through this exploration, we pave the way for a deeper comprehension of the field, guiding future developments in LM-based dialogue systems.

cs.CL↗

arXiv2025

Deep Sparse Latent Feature Models for Knowledge Graph Completion

Recent advances in knowledge graph completion (KGC) have emphasized text-based approaches to navigate the inherent complexities of large-scale knowledge graphs (KGs). While these methods have achieved notable progress, they frequently struggle to fully incorporate the global structural properties of the graph. Stochastic blockmodels (SBMs), especially the latent feature relational model (LFRM), offer robust probabilistic frameworks for identifying latent community structures and improving link prediction. This paper presents a novel probabilistic KGC framework utilizing sparse latent feature models, optimized via a deep variational autoencoder (VAE). Our proposed method dynamically integrates global clustering information with local textual features to effectively complete missing triples, while also providing enhanced interpretability of the underlying latent structures. Extensive experiments on four benchmark datasets with varying scales demonstrate the significant performance gains achieved by our method.

cs.CL↗

arXiv2025

PentestAgent: Incorporating LLM Agents to Automated Penetration Testing

Penetration testing is a critical technique for identifying security vulnerabilities, traditionally performed manually by skilled security specialists. This complex process involves gathering information about the target system, identifying entry points, exploiting the system, and reporting findings. Despite its effectiveness, manual penetration testing is time-consuming and expensive, often requiring significant expertise and resources that many organizations cannot afford. While automated penetration testing methods have been proposed, they often fall short in real-world applications due to limitations in flexibility, adaptability, and implementation. Recent advancements in large language models (LLMs) offer new opportunities for enhancing penetration testing through increased intelligence and automation. However, current LLM-based approaches still face significant challenges, including limited penetration testing knowledge and a lack of comprehensive automation capabilities. To address these gaps, we propose PentestAgent, a novel LLM-based automated penetration testing framework that leverages the power of LLMs and various LLM-based techniques like Retrieval Augmented Generation (RAG) to enhance penetration testing knowledge and automate various tasks. Our framework leverages multi-agent collaboration to automate intelligence gathering, vulnerability analysis, and exploitation stages, reducing manual intervention. We evaluate PentestAgent using a comprehensive benchmark, demonstrating superior performance in task completion and overall efficiency. This work significantly advances the practical applicability of automated penetration testing systems.

cs.CR↗

arXiv2025

CoMaPOI: A Collaborative Multi-Agent Framework for Next POI Prediction Bridging the Gap Between Trajectory and Language

Large Language Models (LLMs) offer new opportunities for the next Point-Of-Interest (POI) prediction task, leveraging their capabilities in semantic understanding of POI trajectories. However, previous LLM-based methods, which are superficially adapted to next POI prediction, largely overlook critical challenges associated with applying LLMs to this task. Specifically, LLMs encounter two critical challenges: (1) a lack of intrinsic understanding of numeric spatiotemporal data, which hinders accurate modeling of users' spatiotemporal distributions and preferences; and (2) an excessively large and unconstrained candidate POI space, which often results in random or irrelevant predictions. To address these issues, we propose a Collaborative Multi Agent Framework for Next POI Prediction, named CoMaPOI. Through the close interaction of three specialized agents (Profiler, Forecaster, and Predictor), CoMaPOI collaboratively addresses the two critical challenges. The Profiler agent is responsible for converting numeric data into language descriptions, enhancing semantic understanding. The Forecaster agent focuses on dynamically constraining and refining the candidate POI space. The Predictor agent integrates this information to generate high-precision predictions. Extensive experiments on three benchmark datasets (NYC, TKY, and CA) demonstrate that CoMaPOI achieves state of the art performance, improving all metrics by 5% to 10% compared to SOTA baselines. This work pioneers the investigation of challenges associated with applying LLMs to complex spatiotemporal tasks by leveraging tailored collaborative agents.

cs.CL↗

arXiv2025

Enhancing Knowledge Graph Completion with GNN Distillation and Probabilistic Interaction Modeling

Knowledge graphs (KGs) serve as fundamental structures for organizing interconnected data across diverse domains. However, most KGs remain incomplete, limiting their effectiveness in downstream applications. Knowledge graph completion (KGC) aims to address this issue by inferring missing links, but existing methods face critical challenges: deep graph neural networks (GNNs) suffer from over-smoothing, while embedding-based models fail to capture abstract relational features. This study aims to overcome these limitations by proposing a unified framework that integrates GNN distillation and abstract probabilistic interaction modeling (APIM). GNN distillation approach introduces an iterative message-feature filtering process to mitigate over-smoothing, preserving the discriminative power of node representations. APIM module complements this by learning structured, abstract interaction patterns through probabilistic signatures and transition matrices, allowing for a richer, more flexible representation of entity and relation interactions. We apply these methods to GNN-based models and the APIM to embedding-based KGC models, conducting extensive evaluations on the widely used WN18RR and FB15K-237 datasets. Our results demonstrate significant performance gains over baseline models, showcasing the effectiveness of the proposed techniques. The findings highlight the importance of both controlling information propagation and leveraging structured probabilistic modeling, offering new avenues for advancing knowledge graph completion. And our codes are available at https://anonymous.4open.science/r/APIM_and_GNN-Distillation-461C.

cs.AI↗

arXiv2024

Detection of an Orphan X-ray Flare from a Blazar Candidate EP240709a with Einstein Probe

Blazars are often observed to flare across multiple wavelengths. Orphan flares from blazars have been only detected a few times, providing an opportunity to understand the structure of the jet in the accreting system. We report a remarkable orphan X-ray flare from a blazar candidate EP240709a, detected by Einstein Probe (EP) in July 2024. The multi-band spectral properties and variability support EP240709a as a high-energy peaked BL Lacertae-type object. The flux in 0.5-10 keV increases by at least 28 times to the value of low state in 2020, with non-detection of remarkable flaring in other bands during the same period. EP240709a exhibits the harder-when-brighter tendency in the X-ray band during the orphan flare, while its infrared-optical spectra are featureless. We employ one-zone and two-zone leptonic synchrotron self-Compton models to perform the spectral energy distribution fitting. Detecting this rare orphan flare shows the potential of EP in discovering peculiar activities from AGN in high-cadence X-ray sky surveys.

astro-ph.HE↗

arXiv2024

Selective Forgetting: Advancing Machine Unlearning Techniques and Evaluation in Language Models

This paper explores Machine Unlearning (MU), an emerging field that is gaining increased attention due to concerns about neural models unintentionally remembering personal or sensitive information. We present SeUL, a novel method that enables selective and fine-grained unlearning for language models. Unlike previous work that employs a fully reversed training objective in unlearning, SeUL minimizes the negative impact on the capability of language models, particularly in terms of generation. Furthermore, we introduce two innovative evaluation metrics, sensitive extraction likelihood (S-EL) and sensitive memorization accuracy (S-MA), specifically designed to assess the effectiveness of forgetting sensitive information. In support of the unlearning framework, we propose efficient automatic online and offline sensitive span annotation methods. The online selection method, based on language probability scores, ensures computational efficiency, while the offline annotation involves a two-stage LLM-based process for robust verification. In summary, this paper contributes a novel selective unlearning method (SeUL), introduces specialized evaluation metrics (S-EL and S-MA) for assessing sensitive information forgetting, and proposes automatic online and offline sensitive span annotation methods to support the overall unlearning framework and evaluation process.

cs.CL↗

arXiv2024

Investigating Bias in LLM-Based Bias Detection: Disparities between LLMs and Human Perception

The pervasive spread of misinformation and disinformation in social media underscores the critical importance of detecting media bias. While robust Large Language Models (LLMs) have emerged as foundational tools for bias prediction, concerns about inherent biases within these models persist. In this work, we investigate the presence and nature of bias within LLMs and its consequential impact on media bias detection. Departing from conventional approaches that focus solely on bias detection in media content, we delve into biases within the LLM systems themselves. Through meticulous examination, we probe whether LLMs exhibit biases, particularly in political bias prediction and text continuation tasks. Additionally, we explore bias across diverse topics, aiming to uncover nuanced variations in bias expression within the LLM framework. Importantly, we propose debiasing strategies, including prompt engineering and model fine-tuning. Extensive analysis of bias tendencies across different LLMs sheds light on the broader landscape of bias propagation in language models. This study advances our understanding of LLM bias, offering critical insights into its implications for bias detection tasks and paving the way for more robust and equitable AI systems

cs.CY↗

arXiv2024

PARIS: A Practical, Adaptive Trace-Fetching and Real-Time Malicious Behavior Detection System

The escalating sophistication of cyber-attacks and the widespread utilization of stealth tactics have led to significant security threats globally. Nevertheless, the existing static detection methods exhibit limited coverage, and traditional dynamic monitoring approaches encounter challenges in bypassing evasion techniques. Thus, it has become imperative to implement nuanced and dynamic analysis to achieve precise behavior detection in real time. There are two pressing concerns associated with current dynamic malware behavior detection solutions. Firstly, the collection and processing of data entail a significant amount of overhead, making it challenging to be employed for real-time detection on the end host. Secondly, these approaches tend to treat malware as a singular entity, thereby overlooking varied behaviors within one instance. To fill these gaps, we propose PARIS, an adaptive trace fetching, lightweight, real-time malicious behavior detection system. Specifically, we monitor malicious behavior with Event Tracing for Windows (ETW) and learn to selectively collect maliciousness-related APIs or call stacks, significantly reducing the data collection overhead. As a result, we can monitor a wider range of APIs and detect more intricate attack behavior. We implemented a prototype of PARIS and evaluated the system overhead, the accuracy of comparative behavior recognition, and the impact of different models and parameters. The result demonstrates that PARIS can reduce over 98.8% of data compared to the raw ETW trace and hence decreases the overhead on the host in terms of memory, bandwidth, and CPU usage with a similar detection accuracy to the baselines that suffer from the high overhead. Furthermore, a breakdown evaluation shows that 80% of the memory and bandwidth savings and a complete reduction in CPU usage can be attributed to our adaptive trace-fetching collector.

cs.CR↗

arXiv2024

Intermediate-Mass Black Holes in Green Pea Galaxies (IMBH-GP) I: a Candidate Sample from LAMOST and SDSS

The scaling relation of central massive black holes (MBHs) and their host galaxies is well-studied for supermassive BHs (SMBHs, $M_{\rm BH}\ \ge 10^6\, M_{\rm \odot}$). However, this relation has large uncertainties in the mass range of the intermediate-mass BHs (IMBHs, $M_{\rm BH}\ \sim10^3-10^{6}\, M_{\rm \odot}$). Since Green Pea (GP) galaxies are luminous compact dwarf galaxies, which may be likely to host less massive SMBHs or even IMBHs, we systematically search for MBHs in a large sample of 2190 GP galaxies at $z < 0.4$, selected from LAMOST and SDSS spectroscopic surveys. Here, we report a newly discovered sample of 59 MBH candidates with broad H$α$ lines. This sample has a median stellar mass of $10^{8.83\pm0.11}\, M_{\rm \odot}$ and hosts MBHs with single-epoch virial masses ranging from $M_{\rm BH}\ \sim 10^{4.7}$ to $10^{8.5}\, M_{\rm \odot}$ (median $10^{5.85\pm0.64}\, M_{\rm \odot}$). Among the 59 MBH candidates, 36 have black hole masses $M_{\rm BH} \le 10^{6}\, M_{\rm \odot}$ (IMBH candidates), one of which even has $M_{\rm BH} \ \lesssim 10^{5}\, M_{\rm \odot}$. We find that the $M_{\rm BH}-M_{\rm *}$ relation of our MBH sample is consistent with the $M_{\rm BH}-M_{\rm bulge}$ relation for SMBHs, while is above the $M_{\rm BH}-M_{\rm *}$ relation for MBHs in dwarf galaxies in the same mass range. Furthermore, we show that 25 MBH candidates, including 4 IMBH candidates, have additional evidence of black hole activities, assessed through various methods such as the broad-line width, BPT diagram, mid-infrared color, X-ray luminosity, and radio emission. Our studies show that it is very promising to find IMBHs in GP galaxies, and the BH sample so obtained enables us to probe the connection between the MBHs and compact dwarf galaxies in the low-redshift Universe.

astro-ph.GA↗

arXiv2024

Incorporating Gradients to Rules: Towards Lightweight, Adaptive Provenance-based Intrusion Detection

As cyber attacks grow increasingly sophisticated and stealthy, it becomes more imperative and challenging to detect intrusion from normal behaviors. Through fine-grained causality analysis, provenance-based intrusion detection systems (PIDS) demonstrated a promising capacity to distinguish benign and malicious behaviors, attracting widespread attention from both industry and academia. Among diverse approaches, rule-based PIDS stands out due to its lightweight overhead, real-time capabilities, and explainability. However, existing rule-based systems suffer low detection accuracy, especially the high false alarms, due to the lack of fine-grained rules and environment-specific configurations. In this paper, we propose CAPTAIN, a rule-based PIDS capable of automatically adapting to diverse environments. Specifically, we propose three adaptive parameters to adjust the detection configuration with respect to nodes, edges, and alarm generation thresholds. We build a differentiable tag propagation framework and utilize the gradient descent algorithm to optimize these adaptive parameters based on the training data. We evaluate our system using data from DARPA Engagements and simulated environments. The evaluation results demonstrate that CAPTAIN enhances rule-based PIDS with learning capabilities, resulting in improved detection accuracy, reduced detection latency, lower runtime overhead, and more interpretable detection procedures and results compared to the state-of-the-art (SOTA) PIDS.

cs.CR↗

arXiv2024

Probing the Shock Breakout Signal of SN 2024ggi from the Transformation of Early Flash Spectroscopy

We present early-time, hour-to-day cadence spectroscopy of the nearby type II supernova (SN II) 2024ggi, which was discovered at a phase when the SN shock just emerged from the red-supergiant (RSG) progenitor star. Over the first few days after the first light, SN 2024ggi exhibited prominent narrow emission lines formed through intense and persistent photoionization of the nearby circumstellar material (CSM). In the first 63 hours, spectral lines of He, C, N, and O revealed a rapid rise in ionization, as a result of the progressive sweeping-up of the CSM by the shock. The duration of the IIn-like spectra indicates a dense and relatively confined CSM distribution extending up to $\sim 4 \times 10^{14}$ cm. Spectral modeling reveals a CSM mass loss rate at this region exceeding $5 \times 10^{-3}{\rm M}_{\odot}$ yr$^{-1}$ is required to reproduce low-ionization emissions, which dramatically exceeds that of an RSG. Analyzing H$α$ emission shift implies the velocity of the unshocked outer CSM to be between 20 and 40 km s$^{-1}$, matching the typical wind velocity of an RSG. The differences between the inner and outer layers of the CSM and an RSG progenitor highlight a complex mass loss history before the explosion of SN 2024ggi.

astro-ph.HE↗

arXiv2024

Marlin: Knowledge-Driven Analysis of Provenance Graphs for Efficient and Robust Detection of Cyber Attacks

Recent research in both academia and industry has validated the effectiveness of provenance graph-based detection for advanced cyber attack detection and investigation. However, analyzing large-scale provenance graphs often results in substantial overhead. To improve performance, existing detection systems implement various optimization strategies. Yet, as several recent studies suggest, these strategies could lose necessary context information and be vulnerable to evasions. Designing a detection system that is efficient and robust against adversarial attacks is an open problem. We introduce Marlin, which approaches cyber attack detection through real-time provenance graph alignment.By leveraging query graphs embedded with attack knowledge, Marlin can efficiently identify entities and events within provenance graphs, embedding targeted analysis and significantly narrowing the search space. Moreover, we incorporate our graph alignment algorithm into a tag propagation-based schema to eliminate the need for storing and reprocessing raw logs. This design significantly reduces in-memory storage requirements and minimizes data processing overhead. As a result, it enables real-time graph alignment while preserving essential context information, thereby enhancing the robustness of cyber attack detection. Moreover, Marlin allows analysts to customize attack query graphs flexibly to detect extended attacks and provide interpretable detection results. We conduct experimental evaluations on two large-scale public datasets containing 257.42 GB of logs and 12 query graphs of varying sizes, covering multiple attack techniques and scenarios. The results show that Marlin can process 137K events per second while accurately identifying 120 subgraphs with 31 confirmed attacks, along with only 1 false positive, demonstrating its efficiency and accuracy in handling massive data.

cs.CR↗