Today's fast-growing Video-on-Demand (VoD) service needs efficient content delivery to guarantee the user experience. To reduce costs, the industry has been exploring the adoption of unstable, heterogeneous, low-performance edge nodes as cost-efficient alternatives to expensive CDN servers. To compensate for the resulting degradation in user experience, Multi-source Parallel Downloading (MPD) is becoming a new VoD transport paradigm. However, existing transport optimization solutions face performance obstacles when applied to the MPD scenarios. They cannot handle the contention between MPD flows of the same download task, which is likely to occur at the shared last-hop, and lack the ability to quickly adapt to the unstable network environments brought by dynamic, heterogeneous, and low-performance edge nodes. To fill this gap, we propose Hermit, a VoD-oriented MPD transport algorithm. Hermit (1) continuously monitors the state of the flows and makes timely scheduling decisions, and (2) efficiently coordinates across the flows to mitigate self-contention at the shared last hop. As a client-driven scheme, Hermit does not require cumbersome coordination among edge nodes, nor does it increase server complexity. Through extensive experiments on real-world large-scale testbed and locally emulated network conditions, we demonstrate that Hermit can improve the consistent downloading rate by 9.2% to 21.3%.

Real-time communication (RTC) applications demand not only low average latency but also tight tail-delay bounds to ensure smooth user experience. However, sudden fluctuations in wireless networks can cause in-flight packets to accumulate in bottleneck queues, delaying or invalidating subsequent frames. Traditional mechanisms focus on rate adaptation but largely overlook managing already enqueued packets that contribute to tail delay. We present Gecko, a lightweight end-to-network coordination mechanism that enables frame-aware queue flushing without requiring any in-network packet modification or protocol negotiation. Gecko-enabled routers monitor queuing delay and implicitly signal the sender, which then makes frame-skipping decisions and conveys flushing intent through minimal in-band RTP markings. This approach preserves end-to-end integrity and is broadly compatible with existing RTC applications. We evaluate Gecko via trace-driven simulations and real-world experiments. Results show that Gecko reduces average frame delay by 21.8% and cuts tail-delay frame ratios by 25% to 91%, demonstrating both its effectiveness and deployability in wireless RTC environments.

As cyberspace continues to expand, identifying the organization or individual behind a website has become increasingly vital in security incident response, phishing website detection, and other cybersecurity subfields. An existing solution for it involves analyzing webpage content and extracting owner names using named entity recognition techniques. However, since these techniques operate on a sentence-by-sentence basis, they struggle to identify the true owner when multiple individual or organizational names appear on a webpage. Moreover, they often perform poorly on non-English websites. To address these limitations, we propose OwnerHunter, a novel multilingual framework powered by large language models, which formulates website owner identification as a multilingual document-level information extraction task and utilizes global information from webpages to identify the owner. In OwnerHunter, we first craft prompts that fully leverage the capabilities of large language models to effectively recognize potential owners on webpages in different languages with minimal examples. To enhance the comprehensiveness and accuracy of recognition, we further design a multimodal augmentation strategy, an example pool strategy, and a self-verification strategy. Then, we devise a semantic and string similarity aggregation-based entity disambiguation technique to eliminate ambiguities among multiple potential owners recognized by large language models and a position-based hybrid ranking technique to exactly select the true owner. To evaluate OwnerHunter, we refine the publicly available English dataset ONER and construct the Chinese dataset WOI-cn with 16,036 real websites. Experimental results show that OwnerHunter achieves F1 scores of 0.9505 on ONER and 0.9621 on WOI-cn, setting new state-of-the-art performance on both datasets.

In recent years, many scanning organizations deploy large numbers of scanners to actively probe the Internet. Identifying the organizations behind these scanners is of significant value. The problem of analyzing the sources of scanners has been investigated in various studies. However, as far as we know, the problem of effectively and generally identifying scanner organizations in real-world scenarios remains unsolved.

QUIC gains significant attention due to its superior transmission performance, achieving widespread adoption in both academia and industry. To improve round-trip time (RTT) estimation, QUIC introduces the Host Delay field, enabling senders to exclude receiver-induced delays. Many delay-based congestion control algorithms (CCAs) rely on these RTT estimates to detect congestion and regulate sending rates. However, we find that malicious Host Delay values can distort RTT measurements, causing inappropriate rate adjustments by CCAs.In this paper, we investigate a new class of attacks leveraging maliciously crafted Host Delay values. To our knowledge, we are the first to analyze the vulnerability of Host Delay and present QUDIT, a universal receiver-driven attack targeting delay-based QUIC CCAs. Unlike prior attacks that presume full network queuing delays visibility and undetected injection capabilities, our attacker model only grants the adversary access as a standard QUIC receiver with limited knowledge of bottleneck conditions. We minimally modify the QUIC receiver to infer bottleneck queuing behavior in real time. Based on these inferences, we design dynamic Host Delay crafting strategies tailored to the specific behavior of various delay-based CCAs and accounting for random network fluctuations. Our attack prompts the sender to overshoot its rate, leading to excessive bandwidth consumption at the bottleneck and degradation of competing flows. Results demonstrate the throughput degradation of victim flow achieves up to 60% within 0.3 s and amplification gains between 200× and 600×. We propose defenses mitigating QUDIT, with vulnerabilities reported to IETF and QUIC maintainers.

We introduce TopoHunter, an efficient IPv6 Internet topology discovery system. The central concept of TopoHunter is to allocate more probing resources to target prefix spaces that yield greater topological benefits, as well as to their surrounding areas. To achieve this, we design a feedback-based target generation module comprised of a Target Prefix Probing Value Forest that maintains the estimated probing values of hierarchical target prefix spaces. Our system has successfully discovered the most extensive and complete IPv6 topology map to date, comprising over 144 million router interfaces and 251 million edges, covering 72.83% of autonomous systems and 43.36% of routing prefixes announced by the BGP system.

The growth of IPv6 networks has led to an expanding number of network routers, but there is not enough research on vendors of these devices. Existing router vendor identification algorithms are based on IPv4, and these static analysis algorithms cannot adapt to dynamically changing IPv6 networks. In this paper, we develop 6RV, a framework for IPv6 router vendors continuous identification based on incremental learning. First, we count the addresses of newly discovered router interfaces every month and obtain router device fingerprints through active probing, and then analyze these data fingerprints through an incremental learning approach to identify the router vendors of new nodes. We validate our identification framework on the ITDK dataset over a period of 8 months, obtaining more than 500K router vendor labels with 94% correctness. Finally, we also analyze the IPv6 router vendor dataset from different perspectives and draw some interesting conclusions.

In recent years, deep learning-based traffic anomaly detection has proven very promising. Although current methods achieve high accuracy in detecting anomalies, they struggle to accurately classify attack types of anomalies due to the imbalanced distribution of attack samples. To address the issue, we propose a highly intelligent system, ALM, which can simultaneously provide accurate traffic anomaly detection and attack types classification with the aid of the Large Language Model (LLM)'s few-shot learning ability. To tackle the challenges of training cost and inference efficiency associated with large models, ALM adopts a two-stage solution, i.e., AnomalyDetector and Anomaly Analyzer, that combines the fine-tuned LLM with small models. In the first stage, AnomalyDetector ensembles a set of lightweight models to handle high-concurrency real-time network traffic anomaly detection. In the second stage, Anomaly Analyzer leverages the LLM's powerful fitting and few-shot learning abilities for traffic anomaly analysis through three processes: LLM task adaption, traffic to sequence, and LLM fine-tuning. This allows Anomaly Analyzer to accurately identify the attack types and potential false positives. Experimental results indicate that ALM achieves over 90% Micro-F1 on four public datasets, with a maximum of 99.94 %, surpassing the baseline. Additionally, it requires minimal training costs while significantly improving inference efficiency compared to the pure LLM mode.

Today's real-time communication (RTC) application requires consistent low latency to ensure the user experience. Many end-to-end rate control, as well as in-network active queue management (AQM) methods, have been designed to improve transport latency. However, most of previous work can only address the network issues in a reactive way - packets during the reaction time are still stuck on the way. No matter how fast the sender reacts to network changes in existing schemes, there will still be packets jammed in the network and increases the latency. To enhance the transport performance in wireless network and improve the user experience of RTC application, we propose Gecko, a practical application-oriented end-to-network collaboration scheme. Gecko can efficiently detect and process the congestion signal, early and proactively draining the jammed packets in the bottleneck queue. We conduct both trace-driven simulations and real-world experiments to evaluate the performance of our scheme. Gecko can reduce the overall frame delay by 21.8 % and reduce tail-delay frame ratio by 25% to 91% in our experiments.

Traffic engineering (TE) has attracted extensive attention over the years. Operators expect to design a TE scheme that accommodates traffic dynamics well and achieves good TE performance with little overhead. Some approaches like oblivious routing compute an optimal static routing based on a large traffic matrix (TM) range, which usually leads to much performance loss. Many approaches compute routing solutions based on one or a few representative TMs obtained from observed historical TMs. However, they may suffer from performance degradation for unexpected TMs and usually induce much overhead of system operating. In this paper, we propose ALTE, an adaptive and low-cost TE scheme based on TM classification. We develop a novel clustering algorithm to properly group a set of historical TMs into several clusters and compute a candidate routing solution for each TM cluster. A machine learning classifier is trained to infer the proper candidate routing solution online based on the features extracted from some easily measured statistics. We implement a system prototype of ALTE and do extensive simulations and experiments using both real and synthetic traffic traces. The results show that ALTE achieves near-optimal performance for dynamic traffic and introduces little overhead of routing updates.

Cloud networks continuously upgrade softwarized virtual network devices (VNDs) to meet evolving tenant demands. However, such upgrades may result in unexpected failures. An intuitive idea to prevent upgrade failures is to resolve all compatibility issues before deployment, but it is impractical to replicate all deployed VND cases and test them with lots of replayed real traffic for the VND developers. As a result, the operations team takes upgrade risk to test upgrades by gradually deploying them. Although careful upgrade schedule planning is the most common method to minimize upgrade risk, to the best of our knowledge, no VND upgrade schedule planning scheme has been adequately studied for large-scale cloud networks. To fill this gap, we propose CloudPlanner, the first VND upgrade schedule planning scheme aiming to minimize the VND upgrade risk for large-scale cloud networks. CloudPlanner prioritizes upgrading VNDs that are more likely to trigger failures based on expert knowledge and historical failure-trigger VND properties and limits the number of tenants associated with simultaneously upgraded VNDs. We also propose a heuristic solver which can quickly and greedily plan schedules. Using real-world data from production environments, we demonstrate the benefits of CloudPlanner through extensive experiments.

Mobile web services value a quick loading of contents in the first page, which is quantified by the above-the-fold time of the first page (first AFT) and is likely to fall into the slow start phase in congestion control. However, the widely deployed slow start mechanism is "cold start", which manually hardcodes the parameters and is not suitable for the first AFT of heterogeneous mobile web services. We revisit the slow start mechanism and find that it could be optimized with a priori knowledge. However, blindly relying on a priori knowledge is not robust enough to handle the fluctuating mobile networks and unpredictable application traffic. In this paper, we propose WiseStart, a "hot-start-based" slow start mechanism. WiseStart utilizes the priori knowledge to set the initial parameters, continuously probes the new connection to handle the fluctuating network conditions, and carefully adapts to the application-limit scenarios. We implement WiseStart in a popular mobile web service online in production. Comprehensive experiments demonstrate that WiseStart reduces the First AFT by 25.43% and the average RCT at connection establishment by 16.15% compared to the default slow start mechanism and other state-of-the-art baselines.

As the mainstream encrypted protocols adopt TCP protocol to ensure lossless data transmissions, the privacy of encrypted TCP traffic becomes a significant focus for adversaries. They can leverage Deep Learning (DL) models to infer the sensitive information from encrypted TCP traffic by analyzing its packet size, direction, and timing information. To defend against such DL-based traffic analysis attacks, recent advances reshape the encrypted traffic and achieve desired results. However, they typically require deploying cooperative modules on both communication endpoints and only support specific applications, such as browsers. In this paper, we propose Cactus, a client-side plug-in to obfuscate bidirectional encrypted TCP traffic for a wide range of applications transparently using the inherent TCP semantics and the emerging eBPF technique. In particular, Cactus provides four effective operations to enable bidirectional traffic obfuscation while preserving communication semantics of applications. Besides, Cactus empowers users to specify which applications to conduct traffic obfuscation and what obfuscation level for each application. We conduct comprehensive experiments to demonstrate that Cactus can effectively obfuscate encrypted TCP traffic with low overhead to hinder the traffic analysis efforts in website fingerprinting and application identification.

As cloud services become increasingly widespread, many public cloud tenants opt for Shared Bandwidth Package (sBwp) services for inbound/outbound communication. The sBwp service allows tenants to purchase shared bandwidth for multiple virtual machines (VMs) instead of buying it individually, which is a convenient and cost-effective traffic management mode. However, the sBwp service presents new challenges for operators to identify the root cause of abnormal sBwp traffic, especially in large-scale, globally distributed public clouds with millions of users. Developing a localization system in public cloud faces several challenges, including dynamic scalability, hyper-scale data efficiently obtaining, and complex application scenarios. To address these challenges, we propose a two-stage localization method calledCloudPin-Fast. First,CloudPin-Fastemploys a cold-start mode to meet dynamic requirements. Second,CloudPin-Fastimplements a pre-filter to reduce the transmission and processing of hyper-scale data. Finally,CloudPin-Fastuses an anomaly localization algorithm based on multi-dimensional statistics fusion in the second stage to cover complex scenarios. The evaluation results on four production datasets have shown superior efficiency and effectiveness. We also share lessons learned from deployingCloudPin-Fastfor over a year in a world-renowned public cloud vendor.

When conducting anomaly detection on server monitoring data, it is important to consider the heterogeneity of the data, which is characterized by the diverse and irregular nature of events. The event values can vary widely, encompassing both continuous and discrete values, and there may be a multitude of randomly occurring events. However, many commonly used anomaly detection methods tend to overlook or discard this heterogeneous data, resulting in a significant loss of valuable information. As such, we propose a novel method, called Heterogeneous Time Series Anomaly Detection (HTSAD), to overcome this difficulty. The approach introduces event gates in the Long Short-Term Memory (LSTM) model while using unsupervised learning to overcome the challenges mentioned above. The results of our experiments on real-world datasets show that HTSAD could achieve an f-score of 0.958, which demonstrates the effectiveness of our approach in detecting anomalies in heterogeneous time series data.

IoT devices deployed on campus and enterprise networks facilitate people's lives and work. However, these devices also bring serious network asset management and security management problems. IoT device identification is the premise to solve these problems. Although current IoT identification methods can identify devices with relatively high accuracy in ideal environments, it is difficult to accurately identify devices in real-world complex environments (e.g., campus networks, enterprise networks). Therefore, we propose to use exact features. To solve the problem of different dimensions of exact features, we creatively model the IoT identification problem as a heterogeneous graph representation learning problem and design a new representation learning algorithm. We are the first to propose an approach to accurately identify IoT devices in real-world complex environments and solve this problem through heterogeneous graphs. The evaluation shows that GraphIoT's macro F1 is on average 13.58% and 12.77% higher than the other methods on two public datasets.

The failure of the online service system will seriously affect the user experience and bring huge economic losses. Therefore, the operators usually monitor service-level metrics and machine-level metrics to help quickly find failures, locate root-cause metrics, and reduce MTTR(mean time to repair). Many methods have emerged in recent years to automatically locate root-cause metrics. However, the existing methods cannot meet the requirements of efficiency, accuracy, and ease of deployment at the same time, and are difficult to use in practice. To overcome their limitations, we propose MetricMiner- a multi-stage location method for root-cause metrics in online service systems. Our approach is based on a key observation from numerous real-world cases: root-cause metrics tend to be unique in both the time dimension and the machine dimension. Therefore, we divide the root-cause metrics localization into three stages: first, quickly filter out normal metrics with limited historical data; second, obtain sufficient historical data to eliminate abnormal metrics; finally, according to the clustering of abnormal metrics between machines to sort and locate root-cause metrics. Experimental results on two real-world datasets with 194 cases show that our method can significantly outperform the state-of-the-art methods. Moreover, MetricMiner has been deployed to multiple banking services for more than six months, and we also shared some lessons learned from real deployment.

To improve the performance of mobile web services, a new transport protocol, QUIC, has been recently proposed as a substitute for TCP. However, with pros and cons of QUIC, it is challenging to decide whether and when to use QUIC in large-scale real-world mobile web services. Complex temporal correlation of network conditions, high user heterogeneity in a nationwide deployment, implementation diversity of QUIC variants limited, and resources on mobile devices all affect the selection of transport protocols. In this paper, we present WiseTrans, an adaptive transport protocol selection mechanism, to switch transport protocols for mobile web services online and improve the completion time of web requests. WiseTrans introduces machine learning techniques to deal with temporal heterogeneity, makes decisions with historical information to handle spatial heterogeneity, adopts an online learning method to keep pace with implementation variation, and switches transport protocols at the request level to reach high performance with acceptable overhead. We implement WiseTrans on two platforms (Android and iOS) in a popular mobile web service application of Baidu. Comprehensive experiments demonstrate that WiseTrans can reduce request completion time by up to 25.8% on average compared to the usage of a single protocol.

To improve the performance of mobile web service, a new transport protocol, QUIC, has been recently proposed. However, for large-scale real-world deployments, deciding whether and when to use QUIC in mobile web service is challenging. Complex temporal correlation of network conditions, high spatial heterogeneity of users in a nationwide deployment, and limited resources on mobile devices all affect the selection of transport protocols. In this paper, we present WiseTrans to adaptively switch transport protocols for mobile web service online and improve the completion time of web requests.

Traffic engineering (TE) attracts extensive researches over the years. Operators expect to design a TE scheme which accommodates traffic dynamics well and achieves good TE performance with little overhead. Some approaches like oblivious routing compute an optimal static routing based on a large traffic matrix (TM) range, which usually leads to much performance loss. Many approaches compute routings based on one or a few representative TMs obtained from observed historical TMs. However, they may suffer performance degradation for unexpected TMs and usually induce much overhead of system operating. In this paper, we propose ALTE, an adaptive and low-cost TE scheme based on TM classification. We develop a novel clustering algorithm to properly group a set of historical TMs into several clusters and compute a candidate routing for each TM cluster. A machine learning classifier is trained to infer the proper candidate routing online based on the features extracted from some easily measured statistics. We implement a system prototype of ALTE and do extensive simulations and experiments using both real and synthetic traffic traces. The results show that ALTE achieves near-optimal performance for dynamic traffic and introduces small overhead of routing updates.

Load balancing in datacenter networks (DCNs) is an important and challenging task for datacenter managers. A number of sophisticated technologies have been proposed to improve load balancing performance in a complicated circumstance, i.e., with various traffic characteristics. Many approaches need a high cost to implement, such as changing switch hardware. The efficiency problem has not been well addressed. MPTCP was proposed as a low-cost approach to improve data transmission in DCNs, which uses subflows to balance workloads across multiple paths. However, current MPTCP is not satisfying, especially when there are rack-local flows or many-to-one short flows. In this article, we propose DCMPTCP to improve the efficacy of MPTCP. We gradually develop three mechanisms. First, DCMPTCP identifies rack-local traffic and eliminates unnecessary subflows to reduce the overhead. Second, DCMPTCP estimates flow length and establishes subflows in a smarter way. Third, DCMPTCP strengthens explicit congestion notification to improve the congestion control performance on inter-rack many-to-one short flows. We have implemented DCMPTCP in both the Linux kernel and ns-3 simulator. Our comprehensive testbed experiments and simulations show that DCMPTCP outperforms MPTCP in both 1 Gbps testbed, and 10 Gbps large-scale simulation network.

Load balancing in datacenter networks (DCNs) is an important and challenging task for datacenter managers. A number of sophisticated technologies have been proposed to improve load balancing performance in a complicated circumstance, i.e., with various traffic characteristics. Many approaches need a high cost to implement, such as changing switch hardware. The efficiency problem has not been well addressed. MPTCP was proposed as a low-cost approach to improve data transmission in DCNs, which uses subflows to balance workloads across multiple paths. However, current MPTCP is not satisfying, especially when there are rack-local flows or many-to-one short flows. In this paper, we propose DCMPTCP to improve the efficacy of MPTCP. We gradually develop three mechanisms. First, DCMPTCP identifies rack-local traffic and eliminates unnecessary subflows to reduce the overhead. Second, DCMPTCP estimates flow length and establishes subflows in a smarter way. Third, DCMPTCP strengthens explicit congestion notification to improve the congestion control performance on inter-rack many-to-one short flows. DCMPTCP has a good compatibility and is easy to deploy. We implement DCMPTCP in ns-3 simulator and evaluate the performance by comprehensive simulations. The results show that DCMPTCP achieves ~65-771X and ~10-15X better FCT than MPTCP for rack-local and inter-rack traffic respectively.

A variety of wireless communication links today, such as HSPA+ access in high speed trains, balloon-based aerial wireless networks and satellite Internet connections have high loss rates. In such environments, Multipath TCP (MPTCP) offers a robust solution compared to regular TCP. However, MPTCP and existing schedulers suffer from performance degradation for both constant bit rate (CBR) and bulk traffic. To tackle this challenge, we develop LAMPS, a novel scheduler for MPTCP, which considers both the loss and delay when selecting subflows and chooses segments based on subflows' state. The design goal of LAMPS is to achieve a steady performance for different traffic and significantly reduce the unnecessary bandwidth consumption, especially in case of bursty losses. We have implemented LAMPS and evaluated its performance for Dynamic Adaptive Streaming over HTTP (DASH), CBR, and bulk traffic. Our experiment results show that LAMPS preserves application latency, keeps low memory consumption, and significantly reduces extra bandwidth consumption in the presence of high packet loss rate.

The vast majority of application traffic in modern data center networks (DCNs) can be classified into two categories: throughput-sensitive large flows and latency-sensitive small flows. These two types of flows have the conflicting requirements on link buffer occupancy. Existing data transfer proposals either do not fully utilize the path diversity of DCNs to improve the throughput of large flows, or cannot achieve a controllable link buffer occupancy to meet the low latency requirement of small flows. Aiming to balance throughput with latency, we develop the eXplicit MultiPath (XMP) congestion control scheme for DCNs. XMP comprises two components: the BOS algorithm brings link queue buffers consumed by large flows under control, while the TraSh algorithm is responsible for shifting traffic from more congested paths to less congested ones, thus achieving high throughput. We implemented XMP and evaluated its performance on traffic shifting, fairness, goodput, buffer occupancy and link utilization by conducting comprehensive experiments and simulations. The results show that XMP outperforms existing schemes and achieves a reasonable tradeoff between throughput and latency.