Machine unlearning aims to eliminate the influence of specific data from trained models to ensure privacy compliance. However, most existing methods assume full access to the original training dataset, which is often impractical. We address a more realistic yet challenging setting: few-shot zero-glance, where only a small subset of the retained data is available and the forget set is entirely inaccessible. We introduce GFOES, a novel framework comprising a Generative Feedback Network (GFN) and a two-phase fine-tuning procedure. GFN synthesises Optimal Erasure Samples (OES), which induce high loss on target classes, enabling the model to forget class-specific knowledge without access to the original forget data, while preserving performance on retained classes. The two-phase fine-tuning procedure enables aggressive forgetting in the first phase, followed by utility restoration in the second. Experiments on three image classification datasets demonstrate that GFOES achieves effective forgetting at both logit and representation levels, while maintaining strong performance using only 5% of the original data. Our framework offers a practical and scalable solution for privacy-preserving machine learning under data-constrained conditions.

Link flooding attacks (LFA) represent a destructive yet stealthy type of Distributed Denial of Service (DDoS) attack that overwhelms target inter-satellite links (ISLs) within low Earth orbit (LEO) satellite networks. However, existing LFA detection and mitigation solutions, while effective in terrestrial networks, are not well-suited to address LFAs in satellite networks due to their unique characteristics. To address this challenge, we propose SatLFAGuard, a novel framework for LFA detection and mitigation. The core innovation lies in reformulating the LFA detection problem as a classification task to identify adjacent abnormal nodes. This classification problem can be effectively tackled using spatial and temporal graph convolutional neural network, which leverages features that capture both satellite node-level information and the spatial topology of LEO networks. For LFA mitigation, we introduce a multipath coordinated transmission strategy that schedules multiple paths within LEO and transmit the congested traffic in parallel, compelling attackers to abandon the attack by substantially increasing their resource cost. Specifically, SatLFAGuard comprises three key components: (1) a satellite node state awareness mechanism based on In-band Network Telemetry (INT), which periodically collects real-time, fine-grained node load levels; (2) a graph-based anomaly detection module leveraging an attention-enhanced spatiotemporal graph convolutional network (ASTGCN) to identify abnormal nodes and (3) a multipath coordinated transmission strategy that dispatches traffic across multiple paths upon attack detection, increasing the cost for adversaries while preserving legitimate communication. The experimental results on the Iridium constellation demonstrate that SatLFAGuard can accurately detect LFA attacks while maintaining a low false positive rate, significantly outperforming than baseline methods. Upon the detection of LFA, SatLFAGuard is able to assimilate the attack traffic in a responsive manner with acceptable resource overhead.

As voice assistants (VAs) become increasingly popular, concerns about their privacy and security have garnered significant attention. VAs nowadays rely on voiceprint authentication to enhance their security. However, this method is susceptible to spoofing attacks, where attackers may use recording or synthesis techniques to mimic the user's voice, thereby bypassing the authentication mechanism. To address this, we introduce “BoneAuth,” a novel liveness detection system in this article. It offers continuous voice authentication for users, enhancing the security of VAs. BoneAuth is designed to be used in wearable devices with built-in microphones, such as Bluetooth earphones. Our basic idea is continuously matching the user's voice signals with the vibration signals produced by their vocal cords during speech. Specifically, our system uses the device's built-in microphone to concurrently capture vibrations from bone conduction (BC) and voices from air conduction (AC). We introduce a signal separation algorithm that, by measuring the unique threshold range of the user, can separate the AC and BC signals from the mixed microphone signals. By continuously comparing the consistency of the two signals, our system can determine whether the user's voice is a real live voice or artificially generated voice. Our system does not require user-specific passphrases for authentication, making it easy to deploy and use without the need for additional user actions or hardware. We demonstrate the feasibility of our method using commercial off-the-shelf Bluetooth earphones. Extensive experiments show an accuracy rate close to 98.15%, proving the effectiveness of our approach.

The right to deletion mandates that data controllers receiving deletion requests not only erase the specified data but also notify other controllers to do the same. Designing a secure and privacy-preserving protocol for distributing deletion notifications across involved data controllers, a topic not previously addressed in the literature, presents significant challenges. In this paper, we introduce CAREFUL, a secure and privacy-preserving deletion notification distribution protocol—the first to address these challenges. It operates within a centralized architecture consisting of regulatory and service planes. The fundamental principle of CAREFUL is that the regulatory plane creates a cryptographic access control structure, ensuring that data controllers in the service plane only identify the next-hop nodes for notification. With CAREFUL, the circulation history of data pending for deletion, which is a special user’s privacy, can be preserved. Moreover, CAREFUL protects the deletion notification distribution from various malicious attacks over untrusted underlay networks. Experimental results validate CAREFUL’s practicality and its efficiency in terms of resource overhead.

Link Flooding Attacks (LFA) are increasingly challenging the availability and stability of Software-Defined Networks (SDN), leveraging their distributed and covert nature to escape detection. Existing methods such as packet analysis and behavioral patterns struggle with pinpointing specific target attack paths due to the dynamic routing and distribution of attack traffic across multiple entry points, making it difficult to implement defensive measures effectively. This paper introduces a novel detection method using a Spatial-Temporal Graph Convolutional Network (STGCN), which combines the strengths of Convolutional Neural Networks (CNN) for temporal pattern recognition and Graph Neural Networks (GNN) for spatial topology analysis. Unlike traditional approaches, our model leverages In-Band Network Telemetry (INT) for real-time traffic and topology monitoring, enhancing our ability to pinpoint and mitigate LFAs. We innovatively transform the detection of attacked links into a dual-point anomaly detection problem, significantly increasing the accuracy of identifying compromised links. Experimental results demonstrate that our method not only achieves high detection accuracy but also ensures the efficient use of network resources, making it particularly effective for resource-constrained environments.

Service Function Chaining (SFC) has recently received considerable attentions from both industry and academia, due to its potential for improving the flexibility of provisioning and composition of Virtualized Network Functions (VNFs) to suit application-specific needs. From a security perspective, there is a gap between high-level SFC policy specification and its enforcement in the data plane. It cannot guarantee that the deployed VNFs are always chained in an expected manner, or the packet flows of a particular service chain are sequentially forwarded to the intended and legitimate VNFs strictly compliant with the specified SFC policy. This lack of assurance leaves the door open for attackers to maliciously manipulate the service chain by evading from security functions such as firewall, Deep Packet Inspection (DPI), etc., or deviating the packet flows from their original service function path, ultimately leading to the violation of SFC policy. It is therefore important to have an efficient self-checking mechanism in place, ensuring the SFC to be implemented in a secure and dependable way. This paper presents a new security primitive - Lite Identity-based Ordered Multisignature scheme (ChainSign in short), which enforces all intended VNFs in a particular service chain to sequentially sign the packet received. Then the last hop of the chain will verify the signature, so as to validate whether all of them work as expected and have not been compromised, while satisfying the security properties of concern (i.e., the consistency in VNF chaining, their authenticities and sequences in a service chain). In addition to the implementation, we leverage the IETF Network Service Header (NSH) to carry the signature generated from our proposed scheme. The experiments show that ChainSign can preserve all identified security properties with minimal overhead.

The S-ALOHA (i.e. slotted-ALOHA) protocol is recently regaining interest in Lower Power Wide Area Networks (LPWAN) handling M2M traffic. Despite intensive studies since the birth of S-ALOHA, the special features of M2M traffic and requirements highlight the importance of analytical models taking into account performance-affecting factors and giving a thorough performance evaluation. Fulfilling this necessity is the main focus of this paper: we jointly consider the impact of capture effect, diversity of transmit power levels with imperfect power control. We propose a low-complexity but still accurate analytical model capable of evaluating S-ALOHA in terms of packet loss rate, throughput, energy-efficiency and average number of transmissions. The proposed model is able to facilitate dimensioning and design of S-ALOHA based LPWAN. The comparison between simulation and analytical results confirms the accuracy of our proposed model. The design guides about S-ALOHA based LPWAN deduced from our model are: the imperfect power control can be positive with capture effect and appropriate transmit power diversity strategy. The transmit power diversity strategy should be determined by jointly considering network charges level, power control precision and SINR threshold to achieve optimal performance of S-ALOHA.

Machine-to-machine (M2M) communication is expected to enable billions of devices to be connected by the cellular networks in the near future. The large number of devices involved in M2M will create a huge market potential but at the same time pose some challenges for 3GPP cellular networks. The challenges include massive access management, QoS provisioning, energy/power efficiency, etc. Nowadays, energy-related issues are deemed as the key problems in cellular M2M communications. In this paper, we extend the research framework of [1] by taking into account some important issues that were not yet addressed, mainly the existence of machines with different packet lengths and the effect of imperfect power control. With the proposed system model, we evaluate the power efficiency, energy efficiency and system capacity for uncoordinated CDMA and coordinated FDMA. Through numerical results, we conclude that coordinated FDMA is more resistant to various packet lengths of M2M devices packets in terms of power efficiency and is not influenced by imperfect power control. Thus coordinated multiple strategies, especially FDMA, are more suitable for the future M2M-included cellular networks and deserve further optimization works. With respect to uncoordinated CDMA, although its performance is affected by BS load intensity and power control, it is still a considerable choice due to its simplicity and no signaling overhead, when the BS load intensity is not high and the power control policy is suitable.

Machine Type communication (MTC) in LTE networks is expected to gain a great popularity in the next decade. Due to different traffic characteristics, it poses some challenges for traditional random access procedure and resource allocation algorithm in LTE network. We propose a polling service that avoids contention. This service is integrated into LTE access network, fully compatible with the standard access mechanism and able to manage a large range of polling periods (typically from 1 minute to 28 days). This proposed service reduces the transmission overhead and thus improves the energy efficiency for MTC devices. It also reduces access network overload in radio access network by avoiding random access. Compared with traditional random access mechanism, numerical results show that with proposed service one eNodeB (eNB) can easily support up to 15000 MTC devices without network access collision.