Key-value stores are the key building block of online services such as e-commerce. However, highly skewed workloads (i.e., skewed access frequency and request size) may cause severe load imbalance and head-of-line blocking, resulting in significant performance penalty (e.g., low throughput and high latency). Existing works mitigate skewed workloads, but often struggle to balance CPU efficiency with low tail latency or require specialized hardware. In this paper, we present SkewTide, an in-kernel architecture that breaks this trade-off through workload-aware request pre-processing and bypassing unnecessary network stack operations. Moreover, SkewTide carefully orchestrates size-aware parsing, sharding, caching, and queueing in the kernel. Both designs enable efficient CPU multiplexing and preserve low tail latency without specialized hardware. We implement SkewTide as an out-of-the-box framework using eBPF, making it readily deployable in existing key-value store infrastructure. Evaluation with YCSB traces shows that SkewTide achieves up to 8.1× higher throughput, 37% lower 99th-percentile latency, and 32% lower CPU usage compared to existing systems.

Deep learning has emerged as a leading method for detecting network intrusion threats. However, processing large volumes of data increases computational time costs, and noise in the data can reduce detection rates. To address these challenges, feature selection algorithms are essential for balancing time efficiency and detection accuracy. Feature selection algorithms for intrusion detection systems (IDS) face two primary challenges: selecting the most suitable features for the model and managing data imbalances. Traditional methods often rely on manual selection based on feature importance, which can lead to significant computational errors. And they cannot detect attacks with smaller proportions in complex and variable network traffic. We design a secure network intrusion detection framework SecureNet-AWMI to balance attack distribution by augmenting the low-frequency attack samples and reducing the high-frequency attack samples. The core of SecureNet-AWMI is a feature selection component that uses mutual information theory and adjusts weights to account for different types of attacks. To enhance threat detection and classification, we employ an advanced Convolutional Neural Network (CNN) model enhanced with Bidirectional Long Short-Term Memory (BiLSTM) and an attention mechanism. Comparative experiments on three public datasets – CICIDS2017, UNSW-NB15, and NSL-KDD – show that SecureNet-AWMI outperforms current mainstream feature selection and threat classification techniques.

Supervisory Control and Data Acquisition (SCADA) systems are one of the most common industrial control systems (ICS). As the security threat of SCADA systems has been rising in recent years, intrusion detection has become indispensable. Among SCADA systems, there is a lack of research on intrusion detection of temporal and spatial characteristics, and the effectiveness of the existing intrusion detection approaches could be improved. This paper proposes an intrusion detection model based on spatio-temporal characteristics of SCADA systems, combining the attention mechanism, called STAM, allows a full understanding of the correlation between sensor and controller parameters. Experiments on three typical SCADA system datasets show that STAM proposed in this paper achieves state-of-the-art results and can be better applied to intrusion detection in SCADA systems. The effectiveness of STAM is evaluated by accuracy, precision, recall, and F1-score. The accuracy rates on new gas pipeline, water storage tank, and Secure Water Treatment (SWaT) datasets can reach 95.34%, 98.92% and 99.95% respectively.

The network traffic data is easily monitored and obtained by attackers. Attacks against different network traffic threaten the environment of the intranet. Deep learning methods have been widely used to classify network traffic for their high classification performance. The application of adversarial samples in computer vision confirms that deep learning methods are flawed, allowing existing methods to generate incorrect results with high confidence. In this paper, the adversarial samples are used on the network traffic classification model, causing the CNN model to produce incorrect classification results for network traffic. By training the classification model adversarially, we validate the training effect and improve the classification accuracy by means of the FGSM attack method. By using the adversarial samples to the network traffic data, our approach enables proactive defence against intranet eavesdropping before the attack occurs by influencing the attacker’s classification model to misclassify.

As machine tools are connected to Industrial Ethernet and external interfaces in the wave of the fourth industrial revolution, new attacks and vulnerabilities are emerging. However, there is little security analysis on Distributed Numerical Control (DNC) system and Computerized Numerical Control (CNC) system. Researchers have demonstrated how to combine the characteristics of Industrial Control System (ICS) to augment existing Intrusion Detection System (IDS) solutions. To the best of our knowledge, there is no such work on DNC network. In response to this situation, a fingerprinting method is proposed as an enhancement technology to existing IDS for DNC systems. The first step is to extract the number of data collection points of each machine tool and the length of TCP payload of each packet. And the second step is to use data response processing times of machine tools to construct unique fingerprint for each machine. Finally, the optimum period slice k is selected and classification accuracy is evaluated using a real-world dataset from a small-scale smart factory. It is demonstrated that our fingerprinting method can be a valuable tool to enhance IDS for DNC network.