Determining the source of encrypted video traffic is an important task in network regulation. In the context of Dynamic Adaptive Streaming over HTTP (DASH), the newly emerged mixed segment transmission pattern introduces substantial difficulties for fingerprint matching, especially under adverse network conditions. To address these challenges, we propose Blazer, a DASH encrypted video traffic identification method for the mixed segment transmission pattern. First, we design a novel fingerprint that integrates video and audio segment sequences. Then, we extract the traffic fingerprint from the TLS record layer of video traffic. Finally, by observing implicit segment-mixing constraints, we design a targeted prompt and Retrieval Augmented Generation (RAG) that enables Large Language Models (LLMs) to perform fingerprint matching effectively. Across 12 network scenarios, Blazer delivers substantially better performance than the other 4 SOTA methods.

Although encryption is widely employed to protect video content during transmission, protocols like DASH can still inadvertently expose critical information about the online video being watched. Attackers can potentially identify the video a user is viewing by analysing undecrypted traffic patterns. Recently, however, popular video platforms like YouTube have updated their streaming technology by utilizing audio-video multiplexing to create dynamic traffic patterns, which significantly reduce the effectiveness of previous attack methods that treat audio and video traffic as separate tracks. In this paper, we are the first to reveal the vulnerabilities about this latest streaming technology and introduce a novel attack approach named Anya. By constraining audio and video timelines, Anya constructs stable audio-video fingerprints and enhances attack accuracy and efficiency through fuzzy searching strategy. Experimental results demonstrate that Anya achieves accuracy of 0.971, 0.933 in ideal and poor network scenarios, with only one minute of traffic eavesdropping time. Finally, we propose defense strategies for streaming platform developers to protect users' privacy.

Classical classification methods often fail in dynamic environments where data distributions shift over time, known as concept drift. Applications like flight delay prediction and weather forecasting require handling such dynamic data streams. Concept drift can be either virtual, affecting unconditional probability distributions, or real, affecting conditional distributions. While most research focuses on real drift, virtual drift and noise also degrade classifier performance. In this paper, we propose gaussian mixture models based on contrastive learning (GMMCL), a novel approach that integrates noise handling, contrastive learning, drift detection, and gaussian mixture models. Our method significantly enhances adaptability to noisy and drifting data streams, outperforming mainstream approaches across twelve synthetic and real-world datasets. This provides a robust solution for managing concept drift and noise in dynamic classification tasks.

Next point-of-interest (POI) recommendations have garnered significant attention in industry and academia due to their crucial role in location-based social networks (LBSNs). Recent approaches have integrated sequence and geographical data to improve recommendation accuracy. However, traditional methods do not explicitly learn user similarity, which may result in suboptimal POI prediction outcomes. To address these limitations, we propose the contrastive learning with augmented spatio-temporal(COAST) model, which more effectively utilizes user check-in sequences and geographical influences. Our approach includes five techniques for augmenting check-in records and a novel Two-Head Self-Attention Encoder (THSE) to capture spatio-temporal and structural patterns. Extensive experiments on three real-world datasets demonstrate the superiority of our model compared to existing methods.

As many mobile apps generate substantial background traffic without active user interaction, network operators face increasing challenges in traffic management and analysis. However, existing approaches lack systematic methods for analyzing and identifying app background traffic. This paper presents BACKTRACKER, a novel background traffic identification system for mobile apps. To establish a reliable background traffic dataset, we design a semi-automated traffic collection framework integrating Android device with network traffic interception. We propose a URL similarity algorithm based on Levenshtein distance for accurate foreground-background traffic differentiation. Furthermore, we develop a hierarchical recognition model that combines statistical stability with deep learning expressiveness, integrating data augmentation, multi-head attention and BiLSTM networks for robust feature learning. Our extensive evaluation shows that BACKTRACKER significantly outperforms baseline methods, achieving 98.36% F1-score in background traffic identification. The results demonstrate BACKTRACKER’s effectiveness in background traffic analysis under encrypted network environments.

Cross-domain sequential recommendation (CDSR) has emerged as an effective solution to address the challenges of data sparsity and cold-start issues in recommendation systems by leveraging shared knowledge across multiple domains. Nevertheless, existing methods face notable long-term challenges, such as ineffective knowledge transfer caused by distributional shifts and sparse overlapping users, insufficient modeling of temporal dynamics and intricate sequential patterns in user behavior, and suboptimal generalization across heterogeneous domains.To tackle these issues, we propose DiTAGInt, a novel diffusion-based generative network with augmented-graph embedding integration. DiTAGInt introduces a dynamic embedding fusion mechanism to harmonize domain-specific and shared-user representations, thereby enhancing generalization and alleviating rigid transfer constraints. Furthermore, it employs a diffusion-based generative module to effectively model temporal dynamics and capture complex sequential patterns in user behavior, facilitating precise user preference learning and significantly advancing recommendation accuracy. Extensive experiments conducted on three public datasets demonstrate the superiority of our method.

The highly dynamic nature of data streams makes streaming data prone to concept drift, making it difficult for traditional machine-learning models to maintain prediction accuracy. Existing drift detection methods usually rely on monitoring error rates or statistical changes, ignoring the impact of feature mining and feature fusion on drift detection. To address these limitations, we propose a concept drift detection method based on Difference Embedding and Drift Type Awareness called DEDT. DEDT enhances the feature representation of error rate differences through TabTransformer embedding and combines an auxiliary drift type classifier to improve detection accuracy. In addition, we propose a joint loss function to improve the generalization ability of the model in different drift scenarios. Compared with traditional methods, DEDT shows excellent detection ability and time efficiency, which has been verified in experimental evaluations on multiple drift datasets. Our scheme not only improves feature representation, detection accuracy, and generalization ability but also shows higher efficiency, making it capable of solving concept drift detection in complex data streams.

A sparse superspreader is a host that establishes connections to a large number of distinct destinations while transmitting only a small number of packets. This phenomenon is frequently observed in various network activities, including network scanning, the early propagation of worm viruses, and spam sending. However, existing methods often fail to simultaneously capture the high spread and low-frequency characteristics of these hosts. In this paper, we propose FLASK-Sketch, a realtime approach for detecting sparse superspreaders. The core idea of FLASK-Sketch is to track both the frequency of a host’s appearances and the number of its distinct connections, and then to integrate their ratio into a scoring mechanism. We evaluate FLASK-Sketch against two baseline methods, SpreadSketch+CM and ExtendedSketch+CM. Experimental results show that FLASK-Sketch improves the F1 score by 28 % and 50 %, reduces the Average Relative Error (ARE) by 54 % and 60 %, and achieves throughput gains of 20 % and 39 % compared to these strawman solutions.

In today’s rapidly evolving network landscape, an increasing number of applications are finding deployment on cloud-based computing platforms. With network traffic growing at an accelerated pace, the rational control of bandwidth utilization by these applications has emerged as a formidable technical challenge. Existing distributed rate limiting algorithms, while capable of enforcing stringent rate limits, often come at the cost of significant bandwidth wastage and lack comprehensive discussions on the global fairness of applications. In response to these challenges, we introduce an innovative distributed rate limiting algorithm termed the Prediction-based Fair Token Bucket, and it achieves equitable rate limiting among applications while optimizing the utilization of the entire network’s capacity. We introduce a TK-CRDT module based on a fair token bucket mechanism, which is integrated into our rate limiting algorithm. Through a comparative analysis against state-of-the-art rate limiting schemes, our algorithm enhances the excessive rate limiting metric by 91% and increases the Jain’s fairness index by 39%.

Load balancers are critical infrastructure in modern distributed systems, and their main function is to evenly distribute client traffic to multiple servers for high availability and scalability. However, current load balancers face challenges in balanced resource utilization. To ensure per-connection consistency, load balancers typically assign subsequent requests from the same client to the same server. While this strategy simplifies session management and reduces the overhead of state synchronization, it also leads to uneven resource utilization.In this paper, we propose P4-FILB, a stateless load balancing scheme that achieves uniform load distribution among servers so that the resources of each server can be optimally balanced when receiving a large number of data streams. The key idea behind the implementation of P4-FILB is that a load balancer between the client and the server keeps track of the size of the packets that are currently being processed by the different servers. It also uses segment routing in IPv6, which uses an ordered list called "segments" to direct packets to servers that are currently utilizing a relatively small amount of resources. And this paper also proposes a two-tier load policy in firewall environment. According to the intelligent routing policy of the firewall, the packets are distributed to different groups of servers, and then the load balancer carries out further request allocation to improve the allocation of network resources. After evaluating the performance of P4-FILB, it is shown that the load balancing scheme performs better than the existing studies in terms of load balancing state between servers. It also reduces the overhead caused by extra packets by means of packets carrying connection information.

Identifying and blocking malicious domains is one of the most direct and effective ways to combat malicious websites. In recent years, tools and technologies such as domain registration services, code repositories, and Domain-Flux have been exploited to generate malicious websites, enabling them to quickly "reincarnate" after being identified and shut down. Detecting methods for such malicious website domains are gradually shifting from the Belief Propagation (BP) algorithm to the Graph Neural Network (GNN) algorithm because the latter excels at aggregating neighboring node information to integrate node representations and graph embeddings. However, cloud services, Content Delivery Network (CDN), and Carrier-Grade Network Address Translation (CGNAT) often lead to benign-malicious co-location for domains, causing miscommunication in messages passing based on domain association relationships, thus reducing detection accuracy. To overcome this limitation, this paper proposes a malicious website domain detection algorithm based on one Multi-Message Passing Heterogeneous Neural Network (HMPN) framework. We apply this method to real-world network traffic scenarios and find that it achieves a Macro-Average F1 score of 91.70%, outperforming the baselines. We further conduct a measurement and analysis of the malicious websites’ industrial characteristics to better explore and detect malicious websites.

As the scale of data on the Internet continues to increase, the management and monitoring of time series data are facing significant challenges. Efficient and stable time-series data anomaly detection methods are necessary for fields such as traffic detection, power grid operation and maintenance, financial stock market, and industry. However, there are fewer abnormal data labels in time series data, and the labeling cost is high. Traditional expert knowledge-based supervised methods have been difficult to adapt to large-scale data metric management and timely abnormal alarms. At the same time, the way based on the new neural network has an extensive time overhead when faced with massive data, and it isn’t easy to apply it in a real-time industrial environment. Therefore, we propose the TSFN model in this paper, an unsupervised method of a transformer-based self-feedback network. Which can capture timing dependencies, learn normal data distribution and improve the self-feedback ability for sensitive areas, and can be used to detect anomalies in multidimensional time series more quickly. Our experimental research on five public datasets shows that our method has fast training speed, good stability, excellent anomaly detection ability, and good generalization ability compared with the baseline method.

With the development of the Internet, online gambling has gradually replaced the traditional way of gambling and became a popular way of making money for illegal organizations. In many countries, online gambling is prohibited by law. But in some countries, these online gambling activities can still attract a variety of victims through their secret promotion channels. In this paper, we propose a gambling website detection method called DRSDetector, which combines domain features, resource features, and semantic features. And this method uses the idea of ensemble learning to fuse different modules. Specifically, we learn the character features of domains based on two stacked Transformer Encoder structures, use the LightGBM to learn resource feature of websites, and learn the semantic feature of websites based on the HAN model. The experimental results show that the performance of DRSDetector is better than the traditional website detection methods. In addition, we also investigated the promotion channels of gambling websites and took China as an example to reveal the 10 major entertainment companies behind these websites. These will help the government to combat online gambling activities more accurately and effectively.

With the rapid development of video streaming, the problem of copyright infringement has become increasingly severe. Despite its explicit illegality in many countries, a large variety of pirated video websites are still active, causing huge damage to copyright holders and security risks to users. Traditional methods for detecting malicious websites, such as blacklists or feature-based classifiers, can be easily bypassed by evading approaches like Domain-Flux. Some researchers recently proposed sophisticated graph-based methods to utilize various relations between websites and convert the detection task into node representation learning. However, the node imbalance issue impairs their performance on real-world datasets. In this paper, given the limitations of the above methods, we propose a model named Heterogeneous Graph Node Re-weighting (HGNR) to detect pirated video websites. We construct a heterogeneous graph with diverse meta relations and design a weight adjustment mechanism to deal with node imbalance issue. The experiments with different imbalance ratios show that HGNR outperforms state-of-the-art graph-based methods. Furthermore, we analyze the best-performed meta relation and disclose how video pirates gain profits, which can help the security community thwart video piracy.