Abstract: Major events such as the Olympic Games pose unique cybersecurity challenges due to their high visibility, short duration, and complex system environments, making them prime targets for nation-state–level Advanced Persistent Threats (APTs). With sufficient preparation time, attackers often conduct early reconnaissance, among which large-scale password guessing against event-related systems is a recurrent preparatory behavior frequently observed before and during major events. Traditional defense mechanisms such as firewalls and honeypots can capture direct intrusion attempts but often overlook these pre-attack behaviors, missing valuable opportunities for early detection. To address this gap, we propose a No-Answer Puzzle scheme, a lightweight and non-loginable password-interaction system tailored for major-event scenarios to capture pre-attack preparations from attackers. Based on motivational psychology, the persistent and covert behaviors of APT attacks are all driven by a strong curiosity towards the target systems. Therefore, by the captured interaction data, we define an attacker curiosity metric, design a computational update mechanism, and develop a fuzzy-logic–based model for inferring attacker motivation. The system was successfully deployed during the cybersecurity missions of the 2025 9th Asian Winter Games (Harbin) and the 137th China Import and Export Fair (Canton Fair), and real-world results demonstrate that it effectively captures and identifies potential attackers at an early stage without affecting normal system operations, thereby contributing substantially to achieving zero-incident security for major events.

Abstract: APTs (Advanced Persistent Threats) on critical infrastructure such as smart grids and industrial control systems are growing increasingly severe. Although honeypoints, such as honeypots and honeybaits, have been widely adopted in cybersecurity, they still struggle to counter APTs as they can intelligently adjust strategies based on the current state of the system. Mutating the IP addresses of honeypoints has been recognized as an effective method for defending against various cyber attacks. However, in critical infrastructure, mutating the IP addresses requires careful design since improper strategy could lead to system instability or high costs such as service delay or interruption. Consequently, the defender needs to design a cost-effective honeypoint IP mutation strategy under the consideration of rational and smart APT attackers who can also adjust their attack strategies adaptively. To this end, first, we propose a dynamic two-player zero-sum game model HoneyCenter to characterize the strategic interaction between the defender and the attacker, where, in each state, the defender determines which host the honeypoint IP address should transition to, while the attacker selects one of the hosts to attack. Then, we leverage the Minimax Q-learning algorithm to derive the optimal mutation strategy to maximize the defender’s utility in capturing the attacker. Finally, through extensive experiments, we demonstrate that the proposed game model and the derived IP mutation strategy can significantly enhance the security of the critical infrastructure in a cost-effective manner.

Abstract: The data trading markets are increasingly vulnerable to clean-label attacks, where attackers provide poisoned data through manipulating the feature space of a target object instead of directly altering the target object labels such that trained models make undesirable decisions about the target object. Existing defenses whether high-precision poisoning filters or adversarial-training pipelines are locked in the same asymmetric arms race: attackers can refine perturbations at near zero marginal cost, while defenders must continually retrain, revalidate, and redeploy. Finally, escalating resource burden erodes market trust and resulting in the failure of the whole data markets. To overcome the challenges, we propose a dual incentive mechanism that integrates reputation systems with multi-attribute reverse auctions to mitigate the clean-label attack, where the attackers are less likely to be selected and their data price is also discounted. Specifically, we construct the reputation of data providers based on their clean-attack verification history, which is designed in a hard-to-build but easy-to-crush manner to capture long-term attacking behavior. Then, we formulate the optimal auction problem based on reputation. Furthermore, we design a multi-attribute reverse auction mechanism to effectively incentivize and penalize, thereby preventing clean label attack behaviors. Finally, theoretical analyses and simulations quantitatively demonstrate that the proposed dual incentive mechanism can create a safer data trading markets.