Effective congestion control algorithms (CCAs) are crucial for the smooth operation of Internet communication infrastructure. CCAs adjust transmission rates based on congestion signals, optimizing resource utilization and user experience. However, existing studies, both rule-based and learning-based CCAs, often struggle with generalization and underperform when deployed in real-world environments. When applied to unseen network conditions, hand-crafted schemes or pre-trained models may experience significant performance degradation. To address this challenge, we propose MetaCon, a novel adaptive Internet congestion control approach based on meta-reinforcement learning. MetaCon leverages knowledge learned from prior scenarios to quickly adapt to new environments. Experimental results show that MetaCon outperforms existing algorithms by exhibiting superior generalization and achieving better transmission performance across a wide variety of network conditions.

Networks regularly face various threats and attacks that manifest in their communication traffic. Recent works proposed unsupervised approaches, e.g., using a variational autoencoder, that are not only effective in detecting anomalies in network traffic, but also practical as they do not require ground truth or labeled data. However, the problem of characterizing anomalies into different attack behaviors is still less explored; in this work, we study this specific problem. We develop APEX, a framework that employs data mining approaches in a semisupervised way to extract the attack patterns from anomalous traffic and links them to specific attack types. APEX comprises two levels of mining: the first level extracts patterns in anomalous network flows, and the second level characterizes behaviors in the extracted patterns into different attack classes. We carry out extensive experiments on real network traces obtained from the MAWI traffic archive. The evaluations demonstrate that APEX is effective in extracting distinguishable behaviors of network attacks from anomalous traffic, and provide useful insights to security analysts investigating the anomalies.

Inherent uncertainties of the air transportation system (ATS) can induce unexpected anomalies in its operations such as deviations in flight schedules, sudden imbalances of demands and capacities, etc.. Current air traffic flow management (ATFM) models rarely consider both demand and capacity uncertainties in their algorithms, and generally focus on minimizing the flight delays under deterministic constraints. Thus, to bridge this gap, we propose a framework for en-route ATFM while scrutinizing uncertainties in en-route capacity and demand and their imbalance, via a chance constraint based probabilistic approach. The proposed framework plays a key role in ensuring the safety of the overall ATS in terms of maintaining the safety separation between flights and constraining the capacity of the sectors as well. Moreover, flight level assignments scheme is proposed based on the Base of Aircraft Data (BADA) of the European Organization for the Safety of Air Navigation (EUROCONTROL) with the objective of minimizing the fuel consumption. The model further minimizes the overall expected delay of the system using the control actions of ground holding, speed control, rerouting, and flight cancellations. At the implementation stage, two phases of ATFM as pre-tactical and tactical are considered, in which the former focuses on generating optimal trajectories and the latter focuses on real-time updates of flight plans. The computational complexity is reduced by shrinking the feasibility region and decomposing the problem into maximum weighted independent sets. The experimental results of realistic large-scale problems demonstrate the effectiveness and computational feasibility of our ATFM framework.

The fast-growing Internet-of-Things (IoT) market has opened up a large threat landscape, given the wide deployment of IoT devices in both consumer and commercial spaces. Attacks on IoT devices generally consist of multiple stages and are dispersed spatially and temporally. These characteristics make it challenging to detect and identify the attack stages using solutions that tend to be localized in space and time. In this work, we present Adept, a distributed framework to detect and identify the individual attack stages in a coordinated attack. Adept works in three phases. First, network traffic of IoT devices is processed locally for detecting anomalies with respect to their benign profiles. Any alert corresponding to a potential anomaly is sent to a security manager, where aggregated alerts are mined, using frequent itemset mining (FIM), for detecting patterns correlated across both time and space. Finally, using both alert-level and pattern-level information as features, we employ a machine learning approach to identify individual attack stages in the generated alerts. We carry out extensive experiments, with emulated and realistic network traffic; the results demonstrate the effectiveness of the proposed framework in terms of its ability in attack-stage detection and identification.

In order to efficiently balance the current and future air traffic demands with the system capacity, a proper Air Traffic Flow Management (ATFM) approach is required. The current focus of ATFM is generally on optimally utilizing the available airspace and airport capacities, while maintaining the required safety separation between aircraft. Yet, only a minor focus is given to the inherent uncertainty in the Air Transportation System (ATS), especially to its adverse effect on safety and day-to-day operations. To this end, we propose an ATFM framework scrutinizing the stochastic nature of ATS through a chance-constraint-based probabilistic approach. Moreover, anticipating the high volumes in air traffic in the future, we propose to split the model into two stages, in which the first stage scrutinizes the behavior of a set of flights as a flow, while the second stage transforms them into individual flight plans, enhancing scalability. The two models are formulated as an Integer Linear Programming (ILP) problem, and a Mixed Integer Linear Programming (MILP) problem at stages I and II, respectively. The NP-hard nature of the overall problem is minimized by transforming the problem into a Maximum Weighted Independent Set (MWIS) finding problem.

With the advances in modern communication technologies, the application scale of Internet of Things (IoT) has evolved at an unprecedented level, which on the other hand poses threats to the IoT ecosystem. As the intrusions and malicious actions are becoming more complex and unpredictable, developing an effective anomaly detection system, considering the distributed nature of IoT networks, remains a challenge. Moreover, the lack of sufficiently large amount of data samples of IoT traffic and data privacy pose further challenges in developing a behavior-based anomaly detection system. To address these issues, we present an unsupervised hierarchical approach for anomaly detection through cooperation between generative adversarial network (GAN) and auto-encoder (AE). The problems of data aggregation and privacy preservation are addressed by reconstructing a sampling pool at a centralized controller using a collection of generators from the individual IoT networks. Then, a centralized global AE is trained and passed to individual local networks for anomaly detection after a final adaptation with the local raw data from the IoT nodes. The performance is evaluated using the UNSW Bot-IoT dataset and the results demonstrate the effectiveness of our proposed approach which outperforms other approaches.

Data dissemination is a fundamental, yet one of the pressing issues in vehicular communication due to the associated high dynamicity. The vehicular network topology frequently keeps changing, limiting the lifetime of the links. This imposes serious difficulties in data transmission, especially in multi-hop applications as the vulnerability escalates when the packets are transmitted over multiple hops. The broadcasting based Vehicular Ad-hoc Network (VANET) routing protocols struggle to cope with this dilemma due to the lack of global network information. But, with novel Software Defined Vehicular Network (SDVN), link stability can be better scrutinized pertaining to the availability of global network view . Yet, the architectural challenges in SDVN can limit the availability of network information confining the empowerment of Software Defined Networking (SDN). Thus, in this paper, we introduce a link connectivity aware novel routing framework for a general SDVN acknowledging the limitations in data availability as well. The routing protocol comprises of both centralized and distributed routing techniques and makes use of unicast , broadcast, and store, carry and forward concepts. The resulting tribrid routing framework focuses on finding stable enough shortest routes that can deliver a given set of packets satisfying the required Quality of Services (QoSs) in terms of latency. In case of network uncertainties, the protocol incorporates broadcasting based distributed techniques along with unicast routing . In sparse network conditions, the model aims to deliver the packets in the optimal path with the least store and carry time within the QoS requirement. The routing protocol follows an incremental algorithm where extracted paths are tested for the feasibility on a case by case basis.

The dynamic nature of vehicular networks imposes a lot of challenges in multi-hop data transmission as links are vulnerable in their existence. Thus, the packets frequently find it difficult to get through to the destination as links only exist for a limited amount of time. The broadcasting based conventional routing protocols struggle to cope with these situations due to the lack of global network information. But, with the novel Software Defined Vehicular Network (SDVN) architecture, link stability can be better scrutinized pertaining to the availability of global network view. However, due to the imperfections in the SDVN architectures and dynamicity in vehicular networks, the control plane may not possess all the network information at a given point in time. Considering all these factors, in this paper, we introduce a novel routing framework for SDVN which is composed of both centralized and distributed routing mechanisms. The resulting hybrid routing framework focuses on finding stable multiple short routes that can deliver a given number of packets, and in case of uncertain network conditions, a broadcasting approach is adopted. The overall problem is formulated as a minimum cost capacitated flow problem and the effectiveness is demonstrated comparatively via extensive simulations.

Recently, a new paradigm has emerged, named as Software Defined Vehicular Network (SDVN) which applies the concept of Software Defined Networking (SDN) in Vehicular Ad-hoc Network (VANET), to overcome the shortcomings in vehicular networks. With the introduction of SDN, VANET has been provided with flexibility and programmability along with a performance improvement . However, the improvement comes at a cost of higher operational delay because, the controllers are placed far away from the data plane in the existing SDVN architectures . As an alternative, we have previously proposed to bring the control plane down to Road Side Unit (RSU). In this study, we further extend this work and introduce a hierarchical distributed controller architecture where the top tier of controllers are regionally distributed on the Internet and the bottom tier of controllers are placed in several selected RSUs closer to the vehicles so that the latency induced by the system becomes low. We further present a novel controller placement model for the RSU level controllers based on the p-median facility location problem with the delay and the significance of the RSU location as the factors to achieve the optimization heuristically as an integer quadratic programming problem . With the help of the simulation results, we show that our proposed controller placement model can optimize the placements of controllers with a lower latency compared to other possible controller placement methods including the existing SDVN architectures and conventional VANETs.

Data transmission in vehicular networks suffers heavily from its inherent dynamic nature as the connections between vehicles exist only for a limited amount of time. Therefore, the packets frequently find it hard to get through to the destination in multi hop data transmission as links are vulnerable in their existence. Conventional Vehicular Ad-hoc Network (VANET) routing protocols struggle in this sense, as they do not have a global network view to tackle these scenarios. But Software Defined Networking (SDN) fills this gap in VANET, and the packets can be routed better by coping with the dynamic nature of the network more effectively. However, existing routing schemes in Software Defined Vehicular Networks (SDVN) have utilized this advantage only in finding the shortest path. As an alternative, we introduce a novel packet routing framework which scrutinizes the dynamic nature of wireless links. Rather than just focusing on the shortest path, we also bring the focus to the stability of the route in finding the optimal paths. Thus, we formulate the packet routing problem as a minimum cost capacitated flow problem and find multiple paths which are stable enough to deliver a given number of packets successfully.

Software Defined Vehicular Networks (SDVN) brings a set of attractive features to vehicular networks along with an upgrade in the performance. Yet, SDVN suffers from frequently compelling to contact the centralized control plane, which in turn generates a high latency and packet overhead in the communication. The current solution to reduce the delay, proactive approach, does not bring the packet overhead down and impose a lot of stress on the controller with a decline of Packet Delivery Ratio (PDR). As an alternative, we introduce a source routing based flow instantiation operation with intelligent route caching that reduces the extent of communication with the control plane, but still manages to utilize the knowledge of controller while maintaining a lower latency and packet overhead.