The widespread adoption of encryption across web-based services is compelling both malicious attackers and network defenders to tailor their tool repositories to encrypted traffic. For various security applications in encrypted networks, the analysis of encrypted traffic lies as the fundamental basis. Due to the inherent concealment of content-related information in encrypted packets, the dynamics of encrypted traffic emerge as the discernible variable warranting comprehensive analysis. This paper explores inherent temporal correlations within the encrypted traffic and proposes a novel algorithm calledCriss-crossTrafficTransformer (CTT), tailored to address unique challenges in encrypted traffic analysis. CTT distinguishes itself by employing a specialized time series Transformer that innovatively utilizespatchingandcriss-cross attention module(CAM) to dissect and interpret encrypted traffic, with the “criss” part mining the long-/short-term temporal correlations across time, and the “cross” part capturing temporal correlations across multiple feature dimensions of encrypted traffic. CTT provides a unified framework capable of accommodating diverse analytical granularities, including packet-level, flow-level, and packet-to-flow level. Notably, CTT not only encompasses encrypted traffic classification but also extends to encrypted traffic forecasting, an area that remains largely underexplored in existing literature. We evaluate CTT in the context of fingerprinting attacks and malware detection over 5 real-world datasets against 13 benchmarks. The results indicate that CTT achieves up to 15.56% performance improvement over SOTA solutions for encrypted traffic classification. Particularly, CTT demonstrates over 92.5% forecasting accuracy, which is comparable to SOTA performances in the seen-and-classify scenario, suggesting its potential applicability to broader domains like social network behavioral analysis. Our code is available athttps://github.com/Amanda-HuaDing/Criss-cross_Traffic_Transformer.

With the increasing size of Internet of Things (IoT) devices, cyber threats to IoT systems have increased. Federated learning (FL) has been implemented in an anomaly-based intrusion detection system (NIDS) to detect malicious traffic in IoT devices and counter the threat. However, current FL-based NIDS mainly focuses on global model performance and lacks personalized performance improvement for local data. To address this issue, we propose a novel personalized federated meta-learning intrusion detection approach (PerFLID), which allows multiple participants to personalize their local detection models for local adaptation. PerFLID shifts the goal of the personalized detection task to training a local model suitable for the client’s specific data, rather than a global model. To meet the real-time requirements of NIDS, PerFLID further refines the client selection strategy by clustering the local gradient similarities to find the nodes that contribute the most to the global model per global round. PerFLID can select the nodes that accelerate the convergence of the model, and we theoretically analyze the improvement in the convergence speed of this strategy over the personalized federated learning algorithm. We experimentally evaluate six existing FL-NIDS approaches on three real network traffic datasets and show that our PerFLID approach outperforms all baselines in detecting local adaptation accuracy by 10.11% over the state-of-the-art scheme, accelerating the convergence speed under various parameter combinations.

In the real world, the stable operation of a network is usually inseparable from the mutual support of other networks. In such an interdependent network, a node in one layer may depend on multiple nodes in another layer, forming a complex one-to-many dependence relationship. Meanwhile, there may also be higher-order interactions between multiple nodes within a layer, which increase the connectivity within the layer. Interlayer dependencies and intralayer connectivity may become key factors affecting network reliability, because failures within a layer will propagate to another layer through dependencies, and the cascading effects within and between layers may trigger catastrophic network collapse. However, existing research on one-to-many interdependence often neglects intralayer higher-order structures and lacks a unified theoretical framework for interlayer dependencies. Moreover, current research on interdependent higher-order networks typically assumes idealized one-to-one interlayer dependencies, which does not reflect the complexity of real-world systems. These limitations hinder a comprehensive understanding of how such networks withstand failures. Therefore, this article investigates the robustness of one-to-many interdependent higher-order networks under random attacks. Depending on whether node survival requires at least one dependence edge or multiple dependence edges, we propose four interlayer interdependence conditions and analyze the network’s robustness after cascading failures induced by random attacks. Using percolation theory, we establish a unified theoretical framework that reveals how higher-order interaction structures within intralayers and interlayer coupling parameters affect network reliability and system resilience. In addition, we extend our study to partially interdependent hypergraphs. We validate our theoretical analysis on both synthetic and real-data-based interdependent hypergraphs, offering insights into the optimization of network design for enhanced reliability.

The machine-to-machine (M2M) communications, which achieve the implementation of Internet of Things (IoT), can be carried over wireless cellular networks. The massive random access (RA) in M2M communications will cause radio access network congestion in the base station (BS), leading to sharp deterioration in access delay and access probability. Access class barring (ACB) that can directly control the flow of machine-type communication (MTC) devices by an ACB factor is an efficient scheme to prevent the BS from traffic overload. In wireless cellular networks, the RA resources (i.e., preambles) are shared by M2M and human-to-human (H2H) devices, and research on ACB scheme ordinarily assumes that a restricted number of preambles are assigned to M2M traffic. However, when suffering from massive access in M2M communications, it is desirable to rapidly satisfy the access requests from MTC devices using all available preambles, especially in time-sensitive IoT scenarios. In this paper, we study the massive access problem in M2M traffic centered scenarios where M2M and H2H traffic can apply for all available preambles without distinction. Utilizing the self-adaptive learning property of learning automata, we further propose a novel learning automata-based ACB (LA-ACB) scheme. Simulation results show that the LA-ACB scheme achieves the performance close to theoretical optimality. The BS equipped with the LA-ACB scheme can effectively control the M2M traffic by dynamically adjusting the ACB factor under the interference of H2H traffic and provide quality services for both M2M and H2H traffic.