Abstract This paper studies adversarial attacks on network intrusion detection systems (IDSs) based on deep or machine learning algorithms. Adversarial attacks on network IDSs must maintain the functional logic of the attack flow. To prevent the produced adversarial examples from violating the attack behavior, most solutions define some limited modification actions. The result limits the production of adversarial examples, and the produced adversarial examples are not guaranteed to find the attack packets. This paper proposes the concept of flow containers to model packets in a flow. Then, we propose a generative adversarial network framework with dual adversarial training to train the generator to produce adversarial flow containers. Flow containers can correlate attack packets and feature vectors of attack flows. We test the evasion rate of the produced adversarial examples using 12 deep and machine learning algorithms. For experiments on the CTU42 data set, the proposed adversarial examples have the highest evasion rates among all 12 classifiers, with the highest evasion rate as high as 1.00. For experiments on the CIC-IDS2017 data set, the proposed adversarial examples have the highest evasion rate among the five classifiers, and the highest evasion rate is also up to 1.00.

In this paper, we propose a self-stabilizing distance-2 edge coloring algorithm for arbitrary graphs. The algorithm operates correctly under the distributed model and guarantees that two edges within distance 2 of each other receive distinct colors when the system stabilizes. It uses 2Δ (Δ − 1) + 1 colors and stabilizes in 4n + (2Δ (Δ − 1) + 2)m rounds, where n, m, respectively, denote the number of nodes and edges and Δ is the maximum degree of nodes in the graph.

In recent years, users have begun using encrypted tunnels to transport data in order to protect transmitted messages. However, it is very difficult for network engineers to manage the quality of network traffic in encrypted tunnels. Therefore, the issue of how to classify encrypted tunnels becomes more important and it has been studied so far. However, these studies are usually based on the assumption that encrypted tunnels include only one application traffic. In fact, encrypted tunnels may include more than one kind of application traffic. Therefore, this paper proposes a solution to identify whether encrypted tunnels include one specific P2P application traffic or more. In addition, our proposed system can be trained by plain-text traffic. In the experimental results, the system can accurately classify encrypted tunnels when they include more than one kinds of application traffic.

The CDS (connected dominating set) is usually used in wireless sensor networks to construct the virtual backbone. The MCDS (minimum connected dominating set) problem is often applied to this topic but it is NP-hard. In this paper, we propose a weight based CDS construction algorithm to reduce the size of CDS. The algorithm uses one-hop information to count the weight of a node and selects the appropriate dominators based on the value of its weight. The experimental results show that our proposed algorithm with better performance, depending on the size of CDS, is more energy- efficient with the construction, and use the lower number of transmission messages.

In the paper, we propose a two-state alternator algorithm for uniform rings with n processors, where n is any positive integer. Gouda and Haddix defined the concept of the alternator. It discusses a set of concurrent processors, which satisfies the following conditions. (1) If one processor executes the critical phase, no neighbor of the processor executes the critical phase in the same computing phase. (2) Along any infinite computing phases, each processor executes the critical phase infinitely often. (3) An alternator is self-stabilizing to the above conditions. The proposed algorithm achieves the maximal performance in the sense that no additional processor can execute the critical phase without violating the first condition of the alternator. The proposed alternator algorithm has the snap property. It always satisfies condition (1) even when some transient faults occur. The proposed algorithm allows each processor to execute the critical phase every three phases in the worst case. It includes an expected number of log(n) phases and a deterministic number of O((n-2)/2) to achieve the maximal performance.

One of the key design issues for IP routers is the IP lookup mechanism. IP lookup is an important action in router that is to find the next hop of each incoming packet with a longest-prefix-match address in the routing table. In this paper, we put the routing table on a longest prefix first search tree. The tree is constructed as a heap by the prefix length. That makes a router executing IP lookup have the minimal number of memory accesses as compared with Trie [Sklower, K 1991], Patricia [Nilsson, S 1999] and Prefix tree [Berger, M 2003]. Some nodes of our tree can contain two entries of the routing table to reduce the number of tree nodes. For example, a 138286 of a routing table can be stored in 132050 nodes of our tree. Furthermore, the proposed scheme makes the tree can be updated without being reconstructed from scratch when the routing table is changed, and it can be applied in both the IPv4 and IPv6 routers.

We propose a self-stabilizing asynchronous phase synchronization protocol for uniform unidirectional rings. Consider applications with phase bound K, i.e., the phases are phase 0, phase 1, ...; phase K-1, phase 0, phase 1, etc. Under the protocol, when the ring is stabilized, it satisfies the following criterion: No node begins to execute phase (k+1) mod K until all nodes have executed phase k, and after all nodes have executed their phase k, each node eventually executes phase (k+1) mod K. Besides the variable used to denote the phase that a node is working on, each node maintains only one auxiliary variable with b states, where b can be any number greater than or equal to the ring size. Provided that K and b satisfy the limitation: K/spl times/b>n(b-1), the proposed protocol is correct under the parallel model and takes at most 2(K/spl times/b) rounds to stabilize.

This paper proposes a self-stabilizing phase synchronization protocol for uniform rings with an odd size. Nodes in the ring work asynchronously and proceed in a cyclic sequence of K phases, where K is even. The phase values of all the nodes are required to be no more than one apart. A system state which satisfies the requirement is therefore called a legitimate state. The proposed protocol guarantees that no matter with which initial state the system may start, the ring stabilizes eventually at a state after which the closure property on the legitimate state holds. Phase values should never go backward. The closure property on the legitimate states commonly used in previous works on self-stabilization cannot capture this requirement. This paper defines two terms, legitimate step and illegitimate step, to address this issue. An execution step that brings the ring from a legitimate state to another legitimate state in a way that the phase values of the nodes only advance is called a legitimate step. An execution step that observes the closure property on the legitimate states but makes some phase values go backward is modeled as an illegitimate step. It is shown that, for the proposed protocol, only a finite number of illegitimate steps are possible. After all possible illegitimate steps have occurred, the closure property on the legitimate steps holds.