The evolution of the Internet of Underwater Things has positioned Autonomous Underwater Vehicles as critical mobile edge nodes, yet the adverse underwater acoustic communication environment, characterized by high latency and low bandwidth, severely constrains the performance of collaborative sensing. To address these challenges, we propose the Kernelized Intrinsic McAulay-Seidman Bound as an online proxy for network Quality of Service. This metric overcomes the optimal test point selection difficulty and theO(L3)computational complexity inherent in the standard Intrinsic McAulay-Seidman Bound. The K-IMSB framework reformulates the discrete problem into a continuous functional optimization within a Reproducing Kernel Hilbert Space. By leveraging variational methods and a heat kernel onSO(3), we derive a closed-form expression that ultimately involves solving an ill-posed Fredholm integral equation of the first kind. To efficiently solve this, a Recursive Ridge Leverage Score Nystr¨om approximation algorithm is introduced, enabling lightweight, energy-efficient computation on the edge. This algorithm utilizes statistical leverage scores to adaptively identify critical manifold regions, thereby solving the dual challenges of operator discretization and numerical instability. Simulation results for an AUV attitude estimation scenario with Out-of-Sequence Measurements demonstrate that the K-IMSB provides a tight lower bound, and the RLS-Nyström method improves computational efficiency by approximately 21.17%, achieving real-time feasibility for IoUT edge deployment.

The rapidly expanding Ethereum ecosystem has driven the flourishing of decentralized applications, but has also brought increasingly severe security risks. Ponzi scheme, in particular, pose a grave threat to platform security and user assets by luring investors with promises of high returns. The current detection methods generally suffer from limitations such as insufficient feature extraction, reliance on a single information source, and poor robustness. To address these challenges, this paper proposes a novel Multi-View Multi-Modal Fusion Framework with Large Language Models for Ponzi scheme detection on Ethereum, named MF2LLM. We first model the contract opcode sequence as an opcode chain graph and design a Time-Stamped Graph Encoder (TS-GE) to capture local temporal dependencies and execution flow relationships between opcodes. Concurrently, we construct an opcode semantic hypergraph based on semantic categories and design a Semantic-Weighted Hypergraph Encoder (SW-HGE) to model higher-order co-occurrence patterns and global associative features. Furthermore, we propose the Opcode Sequence Lightweighting (OSL) method, which significantly compresses the length of opcode sequences while preserving core control logic and semantic information. This provides high-quality structured input for information fusion. To this end, we perform multi-modal instruction fusion on multi-source heterogeneous features and employ LoRA to fine-tune LLMs. This enables the model to achieve cross-modal semantic reasoning and behavioural pattern recognition. Through extensive experimental validation on real-world datasets, MF2LLM demonstrates stable and superior detection performance even under conditions of highly imbalanced sample distributions. Compared to existing state-of-the-art approaches, our method outperforms across all metrics, achieving an ACC of 99.43%, Precision of 96.57%, Recall of 97.06%, and an F1-score of 96.81%. The efficiency and practical value of MF2LLM in detecting Ponzi schemes on Ethereum contribute to enhanced security for the decentralized application ecosystem. The codes are publicly available on Github: https://github.com/yemisua/MF2LLM.

The inherent heterogeneity and mobility of Multi access Edge Computing (MEC) necessitate security protocols that ensure instant connectivity while maintaining resilience against resource exhaustion. This paper presents NiIas, a non-interactive instant authentication and secure data delivery proto col. Unlike conventional protocols that require prior handshakes, NiIas enables immediate payload transmission without session resumption delays. The protocol leverages a multi-authorization identity-based cryptosystem to decentralize trust and eliminate certificate management overhead. Furthermore, NiIas employs an authenticate-before-decryption mechanism as a lightweight admission control. This design filters unauthorized traffic prior to decryption and effectively protects edge verifiers from denial of-service attacks. Rigorous security analysis formally establishes the protocol's cryptographic guarantees. Moreover, numerical simulations on resource-constrained devices and M/D/1 queuing theoretic analysis demonstrate that NiIas achieves superior availability and stability compared to state-of-the-art protocols.

Underwater Acoustic Internet of Things Networks (UAIoTNs) can furnish excellent technical support and information services for applications involving marine observation and detection, marine disaster prevention and mitigation, and maritime search and rescue, in which accurate positioning information is the fundamental requirement. The combination of high dynamics and complexity of the ocean environment to the high latency and narrowband of underwater acoustic communication are complex challenges in UAIoTNs. Due to these facts, this work investigates the received signal strength (RSS)-based three-dimensional (3D) target localization in UAIoTNs taking into account the absorption effect, uncertain transmission power (UTP), and a time-varying Path Loss Exponent (PLE). Through Taylor’s first-order expansion and certain approximations, we envision the underwater stratified acoustic propagation localization challenge as an Alternating Non-negative Constrained Least Squares (ANCLS) framework. To address the challenges posed by unknown multi-parameters, a robust coarse-to-fine localization algorithm (RCFLA) is proposed. At first, the coarse localization phase utilizes the Active Set Method (ASM), while the subsequent fine localization one employs the improved Broyden-Fletcher-Goldfarb-Sanno (BFGS) trust region method to enhance convergence towards the global optimal solution. The iterative process refines the underwater target location, UTP, and PLE, using the ASM-derived rough solution as the initial estimate. Analysis of computational complexity and derivation of the Cramér-Rao Lower Bound (CRLB) with stratified propagation and absorption effect demonstrates the superiority of RCFLA. Furthermore, Lyapunov’s second stability theorem is used to prove the stability of the RCFLA and presents a complete proof of global convergence. Numerical simulation and experimental results validate the algorithm’s optimal localization accuracy across various scenarios, showing reduced overhead compared to benchmark algorithms.

Federated Learning (FL) enables collaborative model training across maritime devices without the need to share raw data. However, challenges such as data heterogeneity and unreliable marine communications impede its performance and security. In this work, we propose a Blockchain-based Active Client Selection Strategy for FL in Shipping (BAFLS), which utilizes blockchain technology to create a secure and auditable environment for node registration and parameter exchange. A lightweight consensus algorithm is introduced to dynamically elect aggregation nodes based on residual energy, reputation, and computing power, improving fault tolerance and reducing resource consumption. Based on such, a Top-kactive learning strategy is designed to select the most informative clients, balancing data utility and privacy protection. Security evaluation and analysis demonstrate that BAFLS effectively resists aggregation attacks and privacy inference. Experimentations on FMNIST, HAR, and ShipNetwork10 datasets show that BAFLS achieves up to 2.4% higher accuracy, reduces convergence rounds by up to 44%, and consistently lowers communication overhead compared to the baseline under various degrees of label and feature heterogeneity.

Synthetic Aperture Radar (SAR) is renowned for its all-weather capabilities, exceptional penetration, and high-resolution imaging, making SAR-based ship detection crucial for maritime surveillance and sea rescue operations. However, various challenges, such as blurred ship contours, complex backgrounds, and uneven scale distribution, can impede detection performance improvement. In this study, we propose FastPFM, a novel ship detection model developed to address these challenges. Firstly, we utilize FasterNet as the backbone network to reduce computational redundancy, enhancing feature extraction efficiency and overall computational performance. Additionally, we employ the Feature Bi-level Routing Transformation model (FBM) to obtain global feature information and enhance focus on target regions. Secondly, the PFM module is engineered to collect multi-scale target information effectively by establishing connections across stages, thereby improving fusion of target features. Thirdly, an extra target feature fusion layer is introduced to enhance small ship detection precision and accommodate multi-scale targets. Finally, comprehensive tests on SSDD and HRSID datasets validate FastPFM's efficacy. Compared to the baseline model YOLOX, FastPFM achieves a 5.5% and 4.4% improvement in detection accuracy, respectively. Furthermore, FastPFM demonstrates comparable or superior performance to other detection algorithms, achieving 92.1% and 83.1% accuracy on AP50, respectively.

Underwater acoustic Internet of Things Networks (UAIoTNs) play a crucial role in oceanographic and environmental monitoring, necessitating precise localization for optimal functionality. However, the underwater setting introduces significant challenges, encompassing the stratification effect arising from underwater heterogeneity, uncertainty in anchor positions due to currents, and variations in the signal transmission environment. These factors collectively impede the accurate estimation of location. Consequently, this paper addresses these challenges by analyzing and deriving a closed-form solution using a time-of-arrival (TOA)-based technique for 3D localization in UAIoTNs. The investigation establishes an underwater stratified propagation model, drawing inspiration from ray tracing theory and Snell’s law. Employing the Cramér-Rao lower bound (CRLB) framework, we explore scenarios both with and without considering perturbed anchors, utilizing the Banachiewicz-Schur theorem. To quantify the impact of the stratification effect and perturbed anchors on CRLB and mean square error (MSE), we further analyze and derive an MSE expression, employing Taylor-series linearization. Building on our analysis of the detrimental effects of stratification and inaccurate anchors, we introduce a multiple-weighted least squares (MWLS) algorithm to alleviate potential performance losses. This approach integrates a matrix operator in the update step, eliminating variable dependencies and resulting in a closed-form solution that circumvents the need for iterative processes. Our simulation results validate our analytical findings and demonstrate the effectiveness of the proposed method, showcasing improved localization accuracy across various scenarios when compared to state-of-the-art approaches.

Existing visual question answering (VQA) methods introduce the Transformer as the backbone architecture for intra- and inter-modal interactions, demonstrating its effectiveness in dependency relationship modeling and information alignment. However, the Transformer’s inherent attention mechanisms tend to be affected by irrelevant information and do not utilize the positional information of objects in the image during the modelling process, which hampers its ability to adequately focus on key question words and crucial image regions during answer inference. Considering this issue is particularly pronounced on the visual side, this paper designs a Knowledge-driven Two-stage Modulation self-attention mechanism to optimize the internal interaction modeling of image sequences. In the first stage, we integrate textual context knowledge and the geometric knowledge of visual objects to modulate and optimize the query and key matrices. This effectively guides the model to focus on visual information relevant to the context and geometric knowledge during the information selection process. In the second stage, we design an information comprehensive representation to apply a secondary modulation to the interaction results from the first modulation. This further guides the model to fully consider the overall context of the image during inference, enhancing its global understanding of the image content. On this basis, we propose a Knowledge-driven Two-stage Modulation Network (KTMN) for VQA, which enables fine-grained filtering of redundant image information while more precisely focusing on key regions. Finally, extensive experiments conducted on the datasets VQA v2 and CLEVR yielded Overall accuracies of 71.36% and 99.20%, respectively, providing ample validation of the proposed method’s effectiveness and rationality. Source code is available at https://github.com/shijingya/KTMN .

[]The Internet has been widely used in various industries, so the anomaly detection of network traffic is of great significance for the security of network applications. Currently, network traffic anomaly detection has a high detection accuracy, but it relies on supervised learning techniques, which have issues with label identification difficulties and limited scalability. To solve the above-mentioned problems, a method combining improved Mahalanobis distance and autoencoder (AE) to detect abnormal network traffic is proposed. To increase detection effectiveness, the approach is trained without using the labels and makes use of an enhanced inverse of the Mahalanobis distance and a threshold to easily differentiate the partly normal data. In this model, the AE and the generative adversarial network (GNN) are fused, and the output of the AE is fed to the discriminator for discrimination. The loss is constructed based on the output of AE and discriminator, which improves the feature extraction ability of the autoencoder, and is more conducive to distinguishing potential anomalies. Experiments show that the proposed method has an anomaly detection precision rate of 96% and 95% F1 value on the CICIDS2017 dataset and an anomaly detection precision rate of 90% on the cicids2018 dataset. This effectively demonstrates the suggested method’s ability to generalize and have strong network traffic anomaly detection.

With the rapid growth of Internet data traffic, the means of malicious attack become more diversified. The single modal intrusion detection model cannot fully exploit the rich feature information in the massive network traffic data, resulting in unsatisfactory detection results. To address this issue, this paper proposes a multimodal hybrid parallel network intrusion detection model (MHPN). The proposed model extracts network traffic features from two modalities: the statistical information of network traffic and the original load of traffic, and constructs appropriate neural network models for each modal information. Firstly, a two-branch convolutional neural network is combined with Long Short-Term Memory (LSTM) network to extract the spatio-temporal feature information of network traffic from the original load mode of traffic, and a convolutional neural network is used to extract the feature information of traffic statistics. Then, the feature information extracted from the two modalities is fused and fed to the CosMargin classifier for network traffic classification. The experimental results on the ISCX-IDS 2012 and CIC-IDS-2017 datasets show that the MHPN model outperforms the single-modal models and achieves an average accuracy of 99.98%. The model also demonstrates strong robustness and a positive sample recognition rate.

Due to the advantages of all-weather capability and high resolution, synthetic aperture radar (SAR) image ship detection has been widely applied in the military, civilian, and other domains.However, SAR-based ship detection suffers from limitations such as strong scattering of targets, multiple scales, and background interference, leading to low detection accuracy.To address these limitations, this paper presents a novel SAR ship detection method, NAS-YOLOX, which leverages the efficient feature fusion of the neural architecture search feature pyramid network (NAS-FPN) and the effective feature extraction of the multi-scale attention mechanism.Specifically, NAS-FPN replaces the PAFPN in the baseline YOLOX, greatly enhances the fusion performance of the model's multi-scale feature information, and a dilated convolution feature enhancement module (DFEM) is designed and integrated into the backbone network to improve the network's receptive field and target information extraction capabilities.Furthermore, a multi-scale channel-spatial attention (MCSA) mechanism is conceptualised to enhance focus on target regions, improve small-scale target detection, and adapt to multi-scale targets.Additionally, extensive experiments conducted on benchmark datasets, HRSID and SSDD, demonstrate that NAS-YOLOX achieves comparable or superior performance compared to other state-ofthe-art ship detection models and reaches best accuracies of 91.1% and 97.2% on AP 0.5 , respectively.

Sparse sensor placement strategies are applied to reconstruct a region’s full-state data conditioned to a limited number of sensors; particularly, crucial to ocean monitoring systems. In maritime systems, existing sparse sensor placement methods mainly consider the reconstruction error of data or rely on specific requirements. Considering how sensors acquire essential information for monitoring systems, the utilization of entropy from information theory becomes quite interesting. In this article, we show that entropy measurements on different quantities of information are sensitive to indicate the border areas, thus requiring a balance between the number of sensors needed and the amount of information collected by them in coastal areas. Due to such, we propose: 1) a novel sparse sensor placement strategy based on entropy, where the entropy measurements in temporal dimension are utilized for sample selection, so portions of samples selected are utilized for training data, significantly improving the training efficiency without sacrificing accuracy of subsequent data reconstruction. In the proposed strategy, 2) we use orthogonal triangle decomposition from linear algebra where a low-cost sensor is employed as pivot and in terms of spatial dimension, the entropy of each location is adopted as entropy weight to reconstruct full state data. Additionally, 3) the strategy employs a greedy algorithm of weighted column pivoting for the orthogonal triangle decomposition, which is designed to suit yet effectively seek additional information and minimal reconstruction error in each iteration processing step. Experimental results using sea surface temperature (SST) data show that the proposed strategy outperforms existing methods, acquiring more information, ensuring higher efficiency, and reducing costs while minimizing reconstruction errors.

Most devices in the Internet of Things (IoT) work on unsafe networks and are constrained by limited computing, power, and storage resources. Since the existing centralized signature schemes cannot address the challenges to security and efficiency in IoT identification, this article proposes IdenMultiSig, a decentralized multi-signature protocol that combines identity-based signature (IBS) with Schnorr scheme under discrete logarithms on elliptic curves. First, to solve the problem of offline or faulty devices under unstable networks, we introduce a novel improvement of the existing Schnorr scheme by introducing a threshold Merkle tree for the verification with only$m$valid signatures among$n$participants ($m$–$n$tree), while hiding the real identity to protect the data security and privacy of IoT nodes. Furthermore, to prevent dishonest or malicious behavior of the private key generator (PKG), a consortium blockchain is innovatively applied to replace the traditional PKG as a decentralized and trusted private key issuer. Finally, the proposed scheme is proven to be unforgeable against forgery signature attacks in the random oracle model (ROM) under the elliptic curve discrete logarithm (ECDL) assumption. Theoretical analysis and experimental results show that our scheme matches or outperforms existing research studies in privacy protection, offline device support, decentralized PKG, and provable security.

With the rapid development of network technology, a variety of new malicious attacks appear while attack methods are constantly updated. As the attackers exploit the vulnerabilities of popular third-party components to invade target websites, further improving the classification accuracy of malicious network traffic is the key to improving the performance of abnormal traffic detection. Existing intrusion detection systems may suffer from incomplete feature extraction and low classification accuracy. Thus, this paper proposes an efficient hybrid parallel deep learning model (HPM) for intrusion detection based on margin learning. First, HPM constructs two parallel CNN architectures and fuses the spatial features obtained through full convolution. Secondly, the temporal information of the fused features is parsed separately using two parallel LSTMs. Finally, the extracted spatial-temporal features are fed into the CosMargin classifier for classification detection after global convolution and global pooling. Besides, this paper proposes an improved traffic feature extraction method, which not only reduces redundant features but also speeds up the convergence speed of the network. In the experiment, our HPM has achieved 99% detection accuracy of each malicious class, ranging from 5%–10% improvement with other models, which demonstrates the superiority of our proposed model.

Network abnormal traffic detection can monitor the network environment in real time by extracting and analysing network traffic characteristics, and plays an important role in network security protection. In order to solve the problems that the existing detection methods cannot fully learn the spatio-temporal characteristics of data, the classification accuracy is not high, and the detection time and accuracy are susceptible to the influence of redundant data in the sample. Thus, this paper proposes a network abnormal detection method (PCSS) integrating principal component analysis (PCA) and single-stage headless face detector algorithms (SSH). PCSS applies the PCA algorithm to the data preprocessing to eliminate the interference of redundant data. At the same time, PCSS also combines feature fusion and SSH to enhance the feature extraction of unclear features data, and effectively improve the detection speed and accuracy. Simulation experiments based on IDS2017 and IDS2012 data sets are carried out in this paper. Experimental results show that PCSS is obviously superior to other detection models in detection speed and accuracy, which provides a new method for efficiently detecting traffic attacks.

In recent years, traditional logistics systems are developing toward intelligence based on the Internet of Things (IoT). Sensing devices throughout the logistics network provide strong support for smart logistics. However, due to the insufficient local computing and storage resources of IoT devices, logistics records with sensitive information are generally stored in a centralized cloud center, which could easily cause privacy leakage. In this study, we propose a blockchain-assisted secure storage scheme for logistics data. To be specific, this scheme can be briefly divided into two parts. The first part involves data generation and aggregation, session establishing, records encryption and storage, wherein a blockchain network is used to assist the cloud server with data storage, and smart contracts are deployed to provide reliable storage interfaces. In the second part, an efficient consensus mechanism is introduced to improve the efficiency of the consensus process. Also, the stored records can be securely audited by leveraging the deployed blockchain network. Finally, we analyze the security and privacy properties of this scheme and evaluate its performance in terms of computation and communication overhead by developing an experimental platform. The experimental results indicate that the performance of our scheme is acceptable.

Considered as a promising fine-grained access control mechanism for data sharing without a centralized trusted third-party, the access policy in a plaintext form may reveal sensitive information in the traditional CP-ABE method. To address this issue, a hidden policy needs to be applied to the CP-ABE scheme, as the identity of a user cannot be accurately confirmed when the decryption key is leaked, so the malicious user is traced and revoked as demanded. In this article, a CP-ABE scheme that realizes revocation, white-box traceability, and the application of hidden policy is proposed, and such ciphertext is composed of two parts. One is related to the access policy encrypted by the attribute value, and only the attribute name is evident in the access policy. Another is related to the revocation information and updated when revoking, where the revocation information is generated by the binary tree related to users. The leaf node value of a binary tree in the decryption key is used to trace the malicious user. From experimental results, it is shown that the proposed scheme is proven to be IND-CPA secure under the chosen plaintext attacks and selective access policy based on the decisional q-BDHE assumption in the standard model, efficient, and promising.

Internet of Things (IoT) devices are widely considered in smart cities, intelligent medicine, and intelligent transportation, among other fields that facilitate people's lives, producing a large amount of private data. However, due to the mobility, limited performance, and distributed deployment of IoT, traditional access control methods cannot support the security of private data's access control process in current IoT environments. To address such problems, this article proposes an auditable access control model, based on an attribute-based access control model, and manages the access control policy for private data through the request record, the response record, and the access record stored in the blockchain network. Additionally, a Blockchain-based auditable access control system is also proposed based on the auditable access control model, ensuring private data security in IoT environments and realizing effective management and auditable access to these data. Experimental results show that the proposed system can maintain high throughput while ensuring private data security for real application scenarios in IoT environments.

In the complex Internet of Things(IoT) environment, the security of digital ecosystems connected to the Web is guaranteed by network Intrusion Detection Systems (IDS). So far, the existing unsupervised learning methods extract the features of network traffic at the overall level, which cannot guarantee real-time network intrusion detection. To fill this gap, we propose a hierarchical network intrusion detection model based on unsupervised clustering, which is realized by combining Deep Auto-Encoder(DAE) and Gaussian Mixture Model (GMM). For new network traffic, essential features are extracted based on the first few packets, which guarantee real-time network intrusion detection. The proposed model adopts a two-layer hierarchical structure. The first layer namely the anomaly detection sub-model is based on DAGMM, which can detect abnormal traffic in real-time. The second layer namely the attack recognition sub-model identifies the attack categories of abnormal traffic detected by the anomaly detection sub-model, and getting rid of the difficulty of reconstructing abnormal traffic in DAE. The experimental results on the CICIDS2017 dataset show that the proposed model has better performance in detecting abnormal traffic and identifying the attack categories of abnormal traffic than other existing unsupervised methods.

With the exponential increase in the number of transistors under fast-paced technology progress, the soft error induced reliability issue is becoming even more challenging in heterogeneous multicore processor design. As there are significant opportunities to mitigate the soft error impacts through heterogeneous multicore scheduling, we show in this paper that the correlation among multiple applications exhibits important reliability characteristics, by defining a new metric to measure the system-level vulnerability factor of multiple applications and an approximate estimator to evaluate the metric fast and accurately for effective scheduling decisions. To approach these issues, we propose CASH, a Correlation-Aware Scheduling strategy to optimise heterogeneous multicore system reliability. Comprehensive simulation results demonstrate that the proposed approach is promising, achieving up to 21.4% reliability improvement with only 3.6% performance degradation when compared with performance-oriented scheduling policy.

Most of the existing outsourced encrypted data schemes are retrieved based on the query keyword entered by authorised users.However, with the increase of the data scale in the cloud storage system, the retrieval efficiency of existing solutions has not been significantly improved.In this paper, a multi-keyword ranked search scheme for ciphertext based on mapping set matching (MSMR) is proposed, where (1) The private cloud server matches the keyword numbering set corresponding to the document index vector and the keyword numbering set corresponding to the query vector and sends the document identifier of the matching keyword numbering to the public cloud server.The public cloud server filters the documents irrelevant to the query request according to the document identifier corresponding to the matching keyword numbering, which effectively reduces the time spent in calculating the correlation score, and (2) the document index vector and query vector are segmented before encrypting them out, reducing the time to construct such vectors.Theoretical analysis shows that the proposed scheme is secure in the known ciphertext model.Experimental results confirm that whenever the data scale grows, the improvement of MSMR retrieval efficiency is more significant.

The rapid development of information technology promotes the development and application of Telecare Information System (TMIS). However, TMIS also has security problems such as information leakage, false authentication, and key loss. In order to solve the safety problems of TMIS, this paper combines Physical Unclonable Function (PUF) and Elliptic Curve Cryptography (ECC) technology to propose an access control and authentication scheme suitable for TMIS. The proposed scheme uses PUF and compact PUF identity authentication models to implement secure mutual authentication between tag and server. The key information in the scheme is generated by PUF, which not only reduces the cost of algorithm design but also avoids the risk of information leakage and key loss. In addition, this article uses ECC technology to encrypt the PUF response information and random numbers, which can ensure that this data information will not be leaked to the attacker. Then through the ProVerif verification tool and security attribute analysis, it is proved that the scheme is safe in the face of major attacks. The comparative analysis results show that the proposed scheme has higher security and is more suitable for TMIS.

With the rapid development and widespread application of cloud computing, cloud computing open networks and service sharing scenarios have become more complex and changeable, causing security challenges to become more severe. As an effective means of network protection, anomaly network traffic detection can detect various known attacks. However, there are also some shortcomings. Deep learning brings a new opportunity for the further development of anomaly network traffic detection. So far, the existing deep learning models cannot fully learn the temporal and spatial features of network traffic and their classification accuracy needs to be improved. To fill this gap, this paper proposes an anomaly network traffic detection model integrating temporal and spatial features (ITSN) using a three-layer parallel network structure. ITSN learns the temporal and spatial features of the traffic and fully fuses these two features through feature fusion technology to improve the accuracy of network traffic classification. On this basis, an improved method of raw traffic feature extraction is proposed, which can reduce redundant features, speed up the convergence of the network, and ease the imbalance of the datasets. The experimental results on the ISCX-IDS 2012 and CICIDS 2017 datasets show that the ITSN can improve the accuracy of anomaly network traffic detection while enhancing the robustness of the detection system and has a higher recognition rate for positive samples.

Whereas traditional scientific applications are computationally intensive, recent applications require more data-intensive analysis and visualization to extract knowledge from the explosive growth of scientific information and simulation data. As the computational power and size of compute clusters continue to increase, the I/O read rates and associated network for these data-intensive applications have been unable to keep pace. These applications suffer from long I/O latency due to the movement of “big data” from the network/parallel file system, which results in a serious performance bottleneck. To address this problem, we proposed a novel approach called “ODDS” to optimize data-locality access in scientific data analysis and visualization. ODDS leverages a distributed file system (DFS) to provide scalable data access for scientific analysis. Through exploiting the information of underlying data distribution in DFS, ODDS employs a novel data-locality scheduler to transform a compute-centric mapping into a data-centric one and enables each computational process to access the needed data from a local or nearby storage node. ODDS is suitable for parallel applications with dynamic process-to-data scheduling and for applications with static process-to-data assignment. To demonstrate the efficacy of our methods, we present and evaluate ODDS in the context of two state-of-the-art, scientific-analysis applications-mpiBLAST and ParaView-along with the Hadoop distributed file system (HDFS) across a wide variety of computing platform settings. In comparison to existing deployments using NFS, PVFS, or Lustre as the underlying storage systems, ODDS can greatly reduce the I/O cost and double overall performance.

In recent years, with the development of intelligent vehicles and wireless sensor network technology, the research on road safety has attracted much attention in vehicular ad-hoc networks (VANETs). By sensing events on the road, vehicles can broadcast information to inform others of traffic jams or accidents. However, the mobile vehicle network has a large transmission delay, which makes real-time content transmission impossible. In this paper, a new certificateless aggregate signcryption scheme (CLASC) is proposed by using a fog computing framework that supports mobility, low latency, and location awareness. It is combined with online/offline encryption (OOE) technology, which reduces many time-consuming operations and improves the security of vehicle users and the efficiency of message authentication. In addition, the scheme has the characteristics of mutual authentication, anonymity, untraceability, and nondeniability. Based on the difficulty of the discrete logarithm problem (DLP) and the computational Diffie-Hellman (CDH) problem, the scheme is further proved to be unforgeability and confidentiality under the random oracle model. The simulation results show that compared with the existing schemes, this scheme can not only ensure the security requirements of the system but also achieve higher efficiency in computing and communication.

NAND Flash based Solid State Disks (SSDs) are gaining tremendous popularity in today's storage market due to their unique erase-before-write feature. The Flash Translation Layer (FTL) in the SSDs redirects the incoming writes to a free physical address and manages a logical to physical address mapping table. However, this induces significant performance degradation to the SSDs. One of the main reasons is that current cache management in FTLs is mainly optimized for the temporal or spatial locality. However, because of multiple levels of data buffers in the whole storage architecture, the locality of internal disk I/O is relatively low. What's more, the increasing capacity of SSD not only generates large mapping tables, but also imposes high pressure on the efficiency of page-level address mapping. To overcome this limitation, we propose Correlation-Aware Page-level FTL, a.k.a CPFTL, which exploits I/O correlations in the workloads. In CPFTL, we develop a correlation-aware mapping table based on the correlation in read operations. We then build a correlation prediction table to support fast mapping entry lookup in the correlation-aware mapping table. Finally, we split read and write caches and build a skew-aware dirty entry index to improve the cache hit ratio and reduce the garbage collection overhead. Our emulator and prototype are open-sourced at: https://github.com/janzhou/SSD-Emulator. The experimental results show that CPFTL can reduce the average response time by 63.4 percent for read dominant workloads and 32.9 percent for transaction workloads.

Virtualization technologies have been widely deployed in data centers and private clusters to provide highly efficient and elastic resource provisioning. Further, virtualization has been extended to the network layer, known as network virtualization. For example, independent virtual switches have become the primary provider of network services for various virtual machines, such as VMware, Xen and Docker. This approach allows the physical network to be decoupled from the overlying virtual switch networks. However, network virutalization introduces performance degradation and scalability bottleneck to communication-intensive frameworks, such as MPI. We quantify and analyze the performance degradation involved with collective communications as well as bursty asynchronous transmission (BAT) in vswitch network environments. Our experiments illustrate that the performance of MPI communication can be degraded up to 5× in the virtual environment.

In this paper, we study the problem of sub-dataset analysis over distributed file systems, e.g., the Hadoop file system. Our experiments show that the sub-datasets distribution over HDFS blocks, which is hidden by HDFS, can often cause corresponding analyses to suffer from a seriously imbalanced or inefficient parallel execution. Specifically, the content clustering of sub-datasets results in some computational nodes carrying out much more workload than others; furthermore, it leads to inefficient sampling of sub-datasets, as analysis programs will often read large amounts of irrelevant data. We conduct a comprehensive analysis on how imbalanced computing patterns and inefficient sampling occur. We then propose a storage distribution aware method to optimize sub-dataset analysis over distributed storage systems referred to as DataNet. First, we propose an efficient algorithm to obtain the meta-data of sub-dataset distributions. Second, we design an elastic storage structure called ElasticMap based on the HashMap and BloomFilter techniques to store the meta-data. Third, we employ distribution-aware algorithms for sub-dataset applications to achieve balanced and efficient parallel execution. Our proposed method can benefit different sub-dataset analyses with various computational requirements. Experiments are conducted on PRObEs Marmot 128-node cluster testbed and the results show the performance benefits of DataNet.

The distributed file system, HDFS, is widely deployed as the bedrock for many parallel big data analysis. However, when running multiple parallel applications over the shared file system, the data requests from different processes/executors will unfortunately be served in a surprisingly imbalanced fashion on the distributed storage servers. These imbalanced access patterns among storage nodes are caused because a). unlike conventional parallel file system using striping policies to evenly distribute data among storage nodes, data-intensive file system such as HDFS store each data unit, referred to as chunk file, with several copies based on a relative random policy, which can result in an uneven data distribution among storage nodes; b). based on the data retrieval policy in HDFS, the more data a storage node contains, the higher probability the storage node could be selected to serve the data. Therefore, on the nodes serving multiple chunk files, the data requests from different processes/executors will compete for shared resources such as hard disk head and networkbandwidth, resulting in a degraded I/O performance. In this paper, we first conduct a complete analysis on how remote and imbalanced read/write patterns occur and how they are affected by the size of the cluster. We then propose novel methods, referred to as Opass, to optimize parallel data reads, as well as to reduce the imbalance of parallel writes on distributed file systems. Our proposed methods can benefit parallel data-intensive analysis with various parallel data access strategies. Opass adopts new matching-based algorithms to match processes to data so as to compute the maximum degree of data locality and balanced data access. Furthermore, to reduce the imbalance of parallel writes, Opass employs a heatmap for monitoring the I/O statuses of storage nodes and performs HM-LRU policy to select a local optimal storage node for serving write requests. Experiments are conducted on PRObE's Marmot 128-node cluster testbed and the results from both benchmark and well-known parallel applications show the performance benefits and scalability of Opass.

With the increasing popularity of cloud computing, current data centers contain petabytes of data in their datacenters. This requires thousands or tens of thousands of storage nodes at a single site. Node failure in these datacenters is normal instead of a rare situation. As a result, data reliability is a great concern. In order to achieve high reliability, data recovery or node reconstruction is a must. Although extensive research works have investigated how to sustain high performance and high reliability in case of node failure at large scale, a reverse lookup problem, namely finding the list of objects for the failed node is not well-addressed. As the first step of failure recovery, this process has a direct impact to the data recovery/node reconstruction. While existing solutions use metadata traversal or data distribution reversing methods for reverse lookup, which are either time consuming or expensive, the deterministic block placement schemes can achieve fast and efficient reverse lookup easily. However, they are designed for centralized, small-scale storage architectures such as RAID etc. Due to their lacking of scalability, they cannot be directly applied in large-scale storage systems. In this paper, we propose Group-Shifted Declustering (G-SD), a deterministic data layout for multi-way replication. G-SD addresses the scalability issue of our previous Shifted Declustering layout and supports fast and efficient reverse lookup. Our mathematical proofs demonstrate that G-SD is a scalable layout that maintains a high level of data availability. We implement a prototype of G-SD and its reverse lookup function on two open source file systems: Ceph and HDFS. Large scale experiments on the Marmot cluster demonstrate that the average speed of G-SD reverse lookup is more than 5× faster than the reverse lookup speed of existing schemes.

Data intensive computing research and technology developments offer the potential of providing significant improvements in several security log management challenges. Approaches to address the complexity, timeliness, expense, diversity, and noise issues have been identified. These improvements are motivated by the increasingly important role of analytics. Machine learning and expert systems that incorporate attack patterns are providing greater detection insights. Finding actionable indicators requires the analysis to combine security event log data with other network data such and access control lists, making the big-data problem even bigger. Automation of threat intelligence is recognized as not complete with limited adoption of standards. With limited progress in anomaly signature detection, movement towards using expert systems has been identified as the path forward. Techniques focus on matching behaviors of attackers to patterns of abnormal activity in the network. The need to stream, parse, and analyze large volumes of small, semi-structured data files can be feasibly addressed through a variety of techniques identified by researchers. This report highlights research in key areas, including protection of the data, performance of the systems and network bandwidth utilization.

The Bulk Synchronous Parallel (BSP) model, which divides a graphing algorithm into multiple supersteps, has become extremely popular in distributed graph processing systems. However, the high number of network messages exchanged in each superstep of the graph algorithm will create a long period of time. We refer to this as a communication delay. Furthermore, the BSP's global synchronization barrier does not allow computation in the next superstrep to be scheduled during this communication delay. This communication delay makes up a large percentage of the overall processing time of a superstep. While most recent research has focused on reducing number of network messages, but communication delay is still a deterministic factor for overall performance. In this paper, we add a runtime communication and computation scheduler into current graph BSP implementations. This scheduler will move some computation from the next superstep to the communication phase in the current superstep to mitigate the communication delay. Finally, we prototyped our system, Zebra, on Apache Hama, which is an open source clone of the classic Google Pregel. By running a set of graph algorithms on an in-house cluster, our evaluation shows that our system could completely eliminate the communication delay in the best case and can achieve average 2X speedup over Hama.

Energy consumption has become an important issue in storage systems. Existing energy control solutions emphasize power consumption without considering re- liability degradation that results from overburden of those long standing disks. In this paper, we develop a novel multiple criteria optimization scheme based on Fuzzy Decision Making theory, for the Cool Energy Efficient Storage System called CEES. CEES aims to enforce a temperature constraint as well as performance requirements while also keeping energy consumption to a minimum. This is achieved by aggregating all the decision criteria, such as I/O performance, power consumption, temperature and frequency of disk-status transition. We first calculate the satisfaction degree of each criteria. Then, we use the weighted averaging satisfaction degree to determine the system control sequence. The experimental results show that CEES is able to reduce disk temperature by 20–30% as compared with existing control methods, while obtaining comparable performance and power consumption.