arXiv subjects

Qixuan Yuan

Publications and source records attributed to Qixuan Yuan.

6 recordsLinked to original sources

arXiv2026

The exact Turán number of the even wheel $W_{2k+2}$ among non-$3$-partite graphs

Let $\mathrm{ex}(n,H)$ denote the Turán number of $H$. A graph is color-critical if there exists an edge $e\in E(H)$ such that $χ(H-e)<χ(H)$. For a color-critical graph $H$ with $χ(H)=r+1$, Simonovits' chromatic critical edge theorem implies that there exists an $n_0(H)$ such that $\mathrm{ex}(n,H)=e(T_{n,r})$ and the Turán graph $T_{n,r}$ is the only extremal graph provided $n\geq n_0(H).$ Let $W_{2k+2}$ be the even wheel obtained by joining a vertex to a cycle of length $2k+1,$ where $k\geq1$ is an integer. Since $W_{2k+2}$ is color-critical and $χ(W_{2k+2})=4$, $T_{n,3}$ is the unique extremal graph for $W_{2k+2}$-free graphs of sufficiently large $n.$ Note that the extremal graph $T_{n,3}$ is 3-partite. In this paper, we determine the exact Turán number of $W_{2k+2}$ in non-$3$-partite graphs and characterize all extremal graphs provided $n$ is sufficiently large.

math.CO↗

arXiv2026

Extremal problems on $[a, b]$-covered graphs

A graph $G$ is $[a,b]$-covered if for each edge $e$ of $G$ there is an $[a,b]$-factor containing it. For $a=b=1$, an $[a,b]$-covered graph is a matching covered graph. The structural theory of matching covered graphs constitutes a cornerstone of modern matching theory. Determining whether a given graph is matching covered is a fundamental problem in structural graph theory. Lucchesi et al. [SIAM J. Discrete Math., 2018] showed that a connected graph $G$ is matching covered if and only if every barrier of $G$ is a stable set. In this paper, we completely characterize the extremal graphs that maximize the size or the spectral radius among all non-matching-covered graphs. For $a \leq b$ and $b \geq 2,$ Hao and Li [Electron. J. Combin., 2024] investigated the extremal problems on $[a,b]$-factor graphs: If $G$ contains no $[a,b]$-factors, then $e(G)\leq \binom{n-1}{2}+a-1$ with equality if and only if $G\cong H_{n,a},$ where $H_{n,a} = K_{a-1} \vee (K_{n-a} \cup K_1).$ Moreover, if $G$ contains no $[a,b]$-factors, then $ρ(G)\leq ρ(H_{n,a})$ with equality if and only if $G \cong H_{n,a}.$ Judging from the structral characterization, non-$[a,b]$-covered graphs exhibit highly complex structures, making the associated extremal problems significantly challenging. To overcome this, we develop a novel minimum-degree forcing technique. Combining this technique and spectral-structural analysis, we in this paper provide complete characterizations of the extremal graphs that maximize the size or the spectral radius within the set of non-$[a,b]$-covered graphs. An intriguing phenomenon revealed by our results is that $H_{n,a}$ remains both the size-extremal graph and the spectral extremal graph for this larger set of non-$[a,b]$-covered graphs. Consequently, our results strengthen the results of Hao-Li.

math.CO↗

arXiv2026

Spectral radius and rainbow Hamiltonicity in bipartite graphs

Let $\mathcal{G}=\{G_1, G_2, \ldots , G_k\}$ be a family of bipartite graphs on the same vertex set. A rainbow Hamilton path (cycle) in $\mathcal{G}$ is a path (cycle) that visits each vertex precisely once such that any two edges belong to different graphs of $\mathcal{G}.$ In this paper, by adopting the technique of bi-shifting, we present tight sufficient conditions in terms of the spectral radius for a family $\mathcal{G}$ to admit a rainbow Hamilton path and cycle, respectively. Meanwhile, we completely characterize the corresponding spectral extremal graphs.

math.CO↗

arXiv2024

CRUcialG: Reconstruct Integrated Attack Scenario Graphs by Cyber Threat Intelligence Reports

Cyber Threat Intelligence (CTI) reports are factual records compiled by security analysts through their observations of threat events or their own practical experience with attacks. In order to utilize CTI reports for attack detection, existing methods have attempted to map the content of reports onto system-level attack provenance graphs to clearly depict attack procedures. However, existing studies on constructing graphs from CTI reports suffer from problems such as weak natural language processing (NLP) capabilities, discrete and fragmented graphs, and insufficient attack semantic representation. Therefore, we propose a system called CRUcialG for the automated reconstruction of attack scenario graphs (ASGs) by CTI reports. First, we use NLP models to extract systematic attack knowledge from CTI reports to form preliminary ASGs. Then, we propose a four-phase attack rationality verification framework from the tactical phase with attack procedure to evaluate the reasonability of ASGs. Finally, we implement the relation repair and phase supplement of ASGs by adopting a serialized graph generation model. We collect a total of 10,607 CTI reports and generate 5,761 complete ASGs. Experimental results on CTI reports from 30 security vendors and DARPA show that the similarity of ASG reconstruction by CRUcialG can reach 84.54%. Compared with SOTA (EXTRACTOR and AttackG), the recall of CRUcialG (extraction of real attack events) can reach 88.13% and 94.46% respectively, which is 40% higher than SOTA on average. The F1-score of attack phase verification is able to reach 90.04%.

cs.CR↗

arXiv2024

Nip in the Bud: Forecasting and Interpreting Post-exploitation Attacks in Real-time through Cyber Threat Intelligence Reports

Advanced Persistent Threat (APT) attacks have caused significant damage worldwide. Various Endpoint Detection and Response (EDR) systems are deployed by enterprises to fight against potential threats. However, EDR suffers from high false positives. In order not to affect normal operations, analysts need to investigate and filter detection results before taking countermeasures, in which heavy manual labor and alarm fatigue cause analysts miss optimal response time, thereby leading to information leakage and destruction. Therefore, we propose Endpoint Forecasting and Interpreting (EFI), a real-time attack forecast and interpretation system, which can automatically predict next move during post-exploitation and explain it in technique-level, then dispatch strategies to EDR for advance reinforcement. First, we use Cyber Threat Intelligence (CTI) reports to extract the attack scene graph (ASG) that can be mapped to low-level system logs to strengthen attack samples. Second, we build a serialized graph forecast model, which is combined with the attack provenance graph (APG) provided by EDR to generate an attack forecast graph (AFG) to predict the next move. Finally, we utilize the attack template graph (ATG) and graph alignment plus algorithm for technique-level interpretation to automatically dispatch strategies for EDR to reinforce system in advance. EFI can avoid the impact of existing EDR false positives, and can reduce the attack surface of system without affecting the normal operations. We collect a total of 3,484 CTI reports, generate 1,429 ASGs, label 8,000 sentences, tag 10,451 entities, and construct 256 ATGs. Experimental results on both DARPA Engagement and large scale CTI dataset show that the alignment score between the AFG predicted by EFI and the real attack graph is able to exceed 0.8, the forecast and interpretation precision of EFI can reach 91.8%.

cs.CR↗

arXiv2024

SPARSE: Semantic Tracking and Path Analysis for Attack Investigation in Real-time

As the complexity and destructiveness of Advanced Persistent Threat (APT) increase, there is a growing tendency to identify a series of actions undertaken to achieve the attacker's target, called attack investigation. Currently, analysts construct the provenance graph to perform causality analysis on Point-Of-Interest (POI) event for capturing critical events (related to the attack). However, due to the vast size of the provenance graph and the rarity of critical events, existing attack investigation methods suffer from problems of high false positives, high overhead, and high latency. To this end, we propose SPARSE, an efficient and real-time system for constructing critical component graphs (i.e., consisting of critical events) from streaming logs. Our key observation is 1) Critical events exist in a suspicious semantic graph (SSG) composed of interaction flows between suspicious entities, and 2) Information flows that accomplish attacker's goal exist in the form of paths. Therefore, SPARSE uses a two-stage framework to implement attack investigation (i.e., constructing the SSG and performing path-level contextual analysis). First, SPARSE operates in a state-based mode where events are consumed as streams, allowing easy access to the SSG related to the POI event through semantic transfer rule and storage strategy. Then, SPARSE identifies all suspicious flow paths (SFPs) related to the POI event from the SSG, quantifies the influence of each path to filter irrelevant events. Our evaluation on a real large-scale attack dataset shows that SPARSE can generate a critical component graph (~ 113 edges) in 1.6 seconds, which is 2014 X smaller than the backtracking graph (~ 227,589 edges). SPARSE is 25 X more effective than other state-of-the-art techniques in filtering irrelevant edges.

cs.CR↗