Traditional dark channel restoration methods can improve image quality to a certain extent, but they are limited by the accuracy of parameter estimation and cannot completely eliminate degradation phenomena. In this paper, we propose a dual-branch super-resolution residual network for underwater image restoration. The network consists of a preprocessing module, a dual-branch residual module, and a super-resolution module. By introducing the preprocessing module, the network ensures the authenticity of the restored scene while achieving a two-level enhancement. The dual-branch residual module incorporates a high-frequency branch and a CBAM attention mechanism to enhance the network's ability to extract high-frequency features from images. During training, to improve the overall restoration performance of the network, a data degradation strategy is employed to increase the diversity among data. A joint loss function combining mean squared error loss, structural similarity loss, and perceptual loss is utilized to enhance the network's sensitivity to feature differences. Experimental results on the test set demonstrate that the proposed method outperforms other restoration methods, with UIQM and UCIQE metrics reaching 1.718 and 0.478, respectively.

With the widespread of smart devices, a massive number of messages are sent through message applications every day. Currently, most message applications have been designed for single-receiver and group-receiver scenarios. Moreover, the sender device may send messages to multiple-receiver devices selected from the group device set. In this paper, we propose a lightweight hybrid signcryption scheme supporting the single-receiver and multiple-receiver scenarios, which are compatible with the group-receiver scenario. The formal verification results show that our scheme can offer confidentiality and authentication and is resistant to key-compromise impersonation (KCI) attacks. The evaluation results show that it provides an efficient solution with lower compute time and smaller payload size, which is suitable for lightweight message delivery.

System logs can record the system status and important events during system operation in detail. Detecting anomalies in the system logs is a common method for modern large-scale distributed systems. Yet threshold-based classification models used for anomaly detection output only two values: normal or abnormal, which lacks probability of estimating whether the prediction results are correct. In this paper, a statistical learning algorithm Venn-Abers predictor is adopted to evaluate the confidence of prediction results in the field of system log anomaly detection. It is able to calculate the probability distribution of labels for a set of samples and provide a quality assessment of predictive labels to some extent. Two Venn-Abers predictors LR-VA and SVM-VA have been implemented based on Logistic Regression and Support Vector Machine, respectively. Then, the differences among different algorithms are considered so as to build a multimodel fusion algorithm by Stacking. And then a Venn-Abers predictor based on the Stacking algorithm called Stacking-VA is implemented. The performances of four types of algorithms (unimodel, Venn-Abers predictor based on unimodel, multimodel, and Venn-Abers predictor based on multimodel) are compared in terms of validity and accuracy. Experiments are carried out on a log dataset of the Hadoop Distributed File System (HDFS). For the comparative experiments on unimodels, the results show that the validities of LR-VA and SVM-VA are better than those of the two corresponding underlying models. Compared with the underlying model, the accuracy of the SVM-VA predictor is better than that of LR-VA predictor, and more significantly, the recall rate increases from 81% to 94%. In the case of experiments on multiple models, the algorithm based on Stacking multimodel fusion is significantly superior to the underlying classifier. The average accuracy of Stacking-VA is larger than 0.95, which is more stable than the prediction results of LR-VA and SVM-VA. Experimental results show that the Venn-Abers predictor is a flexible tool that can make accurate and valid probability predictions in the field of system log anomaly detection.

Machine learning techniques are essential for system log anomaly detection. It is prone to the phenomenon of class overlap because of too many similar system log data. The occurrence of this phenomenon will have a serious impact on the anomaly detection of the system logs. To solve the problem of class overlap in system logs, this paper proposes an anomaly detection model for class overlap problem on system logs. We first calculate the relationship between the sample data and the membership of different classes, normal or anomaly, and use the fuzziness to separate the sample data of the overlapping parts of the classes from the data of the other parts. AdaBoost, an ensemble learning approach, is used to detect overlapping data. Compared with machine learning algorithms, ensemble learning can better classify the data of the overlapping parts, so as to achieve the purpose of detecting the anomalies of the system logs. We also discussed the possible impact of different voting methods on ensemble learning results. Experimental results show that our model can be effectively applied in a variety of basic algorithms, and the results of each measure have been improved.

Many authoritative servers today return different responses based on the perceived geographical location of the resolvers' IP addresses, to bring the content as close to the users as possible. RFC7871 proposes an EDNS Client Subnet (ECS) extension to carry part of the client's IP address in the DNS packets for authoritative server. Compared with the resolver's IP address in the DNS packets, ECS can help the authoritative server to guess the user's geographical location more precisely. However, ECS raises some privacy concerns since it leaks client's subnet information on the resolution path to the authoritative server. In order to find a right balance between privacy improvement and end-user experience optimization, in this paper we introduce an EDNS ISP Location (EIL) extension to address the client subnet leakage problem of ECS. Note that EIL can reduce the dependence on high quality IP geolocation database, while this is crucial to ensure DNS response's accuracy in ECS.

Learning-based face super-resolution approaches rely on representative dictionary as self-similarity prior from training samples to estimate the relationship between the low-resolution (LR) and high-resolution (HR) image patches. The most popular approaches, learn mapping function directly from LR patches to HR ones but neglects the multi-layered nature of image degradation process (resolution down-sampling) which means observed LR images are gradually formed from HR version to lower resolution ones. In this paper, we present a novel deep linear mappings learning framework for face super-resolution to learn the complex relationship between LR features and HR ones by alternately updating multi-layered embedding dictionaries and linear mapping matrices instead of directly mapping. Furthermore, in contrast to existing position based studies that only use local patch for self-similarity prior, we develop a feature-induced nonlocal dictionary pair embedding method to support hierarchical multiple linear mappings learning. With coarse-to-fine nature of deep learning architecture, cascaded incremental linear mappings matrices can be used to exploit the complex relationship between LR and HR images. Experimental results demonstrate that such framework outperforms state-of-the-art (including both general super-resolution approaches and face super-resolution approaches) on FEI face database.

Patch-based face hallucination algorithms utilize either local patches (e.g., position-patch approaches) or nonlocal patches (e.g., dictionary-learning approaches) to exploit self-similarity prior from training samples. Although they yield decent results, solo source patches limit their performance due to not fully taking self-similarity prior from both local and nonlocal ones. In order to overcome this shortcoming, we propose a novel and efficient deep collaborative representation (DCR) based approach, to exploit both local and nonlocal self-similarity patches, for boosting face hallucination performance. First we learn a feature-inducing dictionary pair to represent local and nonlocal self-similarity prior, then deep (multiple-layer) representation weights and corresponding support dictionaries are iteratively updated to exploit accurate prior from coarse to fine. Finally, the high resolution (HR) output are optimized layer by layer. Experimental results outperform some state-of-the-art (e.g. Convolutional Neural Network based deep learning approach) which verify the validity of the proposed approach.

As the largest country code Top Level Domain (ccTLD) name service, .CN receives billions of queries every day. Under the threat of Distributed Denial-of-Service (DDoS) attacks, effective mechanism for client classification is especially important for such busy ccTLD service. In this paper, by analyzing the query log of .CN name service, we propose a novel client classification method based on client query entropy and global recursive DNS service architecture. By checking with the query frequencies of the clients, we validate the effectiveness of the proposed method on both busy and long-tailed clients. We find that 2.32% clients can cover the most important web spiders, recursive servers, and well-known internet services, etc. The results indicate that, our method can bring significant benefits for creating the client whitelist, which is useful for mitigating DDoS attack towards Top Level Domain (TLD) name service.

Recently, a new type of domain names, namely temporary domain names, has become heavily used by many kinds of Internet services, such as cloud storage and social networks. Generally, these services would generate a large volume of temporary domain names within their private domain zones, and use them to convey “one-time-signals” with their customers. By analyzing the real world DNS traffic, we find that over 40% of observed domain names from the Internet are temporary. While this creative usage of temporary domain names could benefit many Internet services, it may also cause some unanticipated (even negative) consequences to the DNS infrastructure. In this paper, we first describe the critical features of temporary domain names and present our observation results of their pervasiveness based on real world DNS traces collected from some major ISP. Then we verify and analyze quantitatively the negative impact that temporary domain names would cause on the DNS, especially on the DNS caching functionalities. To solve this problem, we finally introduce segmented caching strategies into the DNS cache, and further validate its capability for ensuring the effectiveness of DNS caching when facing the temporary domain name problems.