The Domain Name System (DNS), one of the essential basic services on the Internet, is often abused by attackers to launch various cyber attacks, such as phishing and spamming. Researchers have proposed many machine learning-based and deep learning-based methods to detect malicious domains. However, these methods rely on a large-scale dataset with labeled samples for model training. The fact is that the labeled domain samples are limited in the real-world DNS dataset. In this paper, we propose a few-shot malicious domain detection model named MetaDom, which employs a meta-learning algorithm for model optimization. Specifically, We first model the DNS scenario as a heterogeneous graph to capture richer information by analysing the complex relations among domains, IP addresses and clients. Then, we learn the domain representations with a heterogeneous graph neural network on the DNS HG. Finally, considering that only few labeled data are available in the real-world DNS scenario, a meta-learning algorithm with knowledge distillation is introduced to optimize the model. Extensive experiments on the real DNS dataset show that MetaDom outperforms other state-of-the-art methods.

Knowledge Graph Embedding (KGE) aims to learn how to represent the low-dimensional vectors for entities and relations based on the observed triplets in knowledge graph. Most of the existing models use simple structural features, such as node degrees and directed edges, and pay little attention to advanced inherent information of structured knowledge. In this paper, we propose CD-GCN, a curvature-driven KGE method for link prediction. Specifically, we first apply Ricci curvature to knowledge graph. Then, we use curvature information to drive the state update, which aims to further exploit the graph-structured information. Finally, we use a ConvE scoring function to output the link prediction results. Through extensive experiments on public datasets FB15k-237 and WN18RR, CD-GCN has achieved state-of-the-art results compared with all baseline models.

Early exit methods are used to accelerate inference in pre-trained language models and maintain competitive performance on resource-constrained devices. However, existing methods for training early exit classifiers suffer from the problem of poor classifier representations in different layers, leading to difficulties in adapting to diverse natural language processing tasks. To address this issue, we propose MetaBERT: collaborative Meta-learning for accelerating BERT inference. The main goal of MetaBERT is to train early exit classifiers through collaborative meta-learning, in which case, few gradient updates can be quickly adapted to new tasks. Moreover, this novel meta-training approach produces good generalization performance, thus achieving an effective balance between the inference result and efficiency. Extensive experimental results show that our approach outperforms previous training methods by a large margin, and achieves state-of-the-art results compared to other competitive models.

As an important part of network management, website fingerprinting has become one of the hottest topics in the field of encrypted traffic classification. Website fingerprinting aims to identify the specific webpages in encrypted traffic by observing patterns of traffic traces. Prior studies proposed several machine-learning-based methods using statistical features and deep-learning-based methods using packet length sequences. However, these works mainly focus on the website homepage fingerprinting. In fact, people are usually not limited to visiting the homepage. Compared with the homepage classification of websites, it is more difficult to identify different webpages within the same website due to the traffic traces are very similar. In this paper, we propose the Graph Attention Pooling Network for fine-grained website fingerprinting (GAP-WF). We introduce the trace graph to describe the contextual relationship between flows in webpage loading. Then we utilize the Graph Neural Networks to learn the intra-flow and inter-flow features. Considering different flows may have different importance, we utilize the graph attention mechanism to pay attention to key nodes. We collect four datasets covering three different granularity scenarios to evaluate our proposed method. Experimental results demonstrate that GAP-WF not only achieves the best performance of 99.86% in website homepage fingerprinting, but also outperforms other state-of-art methods in all fine-grained webpage fingerprinting scenarios. Moreover, GAP-WF can achieve better performance with fewer training samples.

Summary Regular expression matching as a core component of deep packet inspection is widely used in various kinds of modern network intrusion detection system, traffic classification system, network monitoring system, and so on. In these systems, regular expressions are typically converted to a deterministic finite automaton (DFA), which takes O(1) to scan each input character. However, DFA generally consumes a large amount of memory. This paper proposes a novel, space‐efficient and time‐efficient DFA presentation, called reduced input character set DFA (RICS‐DFA). A character escaping and replacing scheme is first introduced to decrease the size of DFA's character set and then to reduce DFA's space requirement with a series of optimization techniques. Based on transition rewriting, a RICS‐DFA constructing algorithm with time complexity of O(n) is presented in this paper. For real rule‐sets, RICS‐DFA reduces the memory consumption by 68–92%, compared with the original DFA. Finally, this paper designs a scalable RICS‐DFA matching engine on field‐programmable gate array platform in which the reduced state transition matrix is mapped to on‐chip memories. The throughput of executing deep packet inspection for real rule‐sets can achieve 7–50.5 Gbps. Copyright © 2016 John Wiley & Sons, Ltd.

The ability of ultra-low latency to process market data feed is the premise and foundation for a today's trading system to grab the instant trading profits. The market data feed containing up-to-date information on market changes is multicasted real-timely from financial exchanges to market participants, usually in the form of financial information exchange (FIX) Adapted for STreaming (FAST) protocol. FAST is a differential compression protocol which significantly reduces the bandwidth requirement to transmit market data. However, it also increases the complexity and latency of market data processing. This paper describes a customized architecture for ultra-low latency of market-data processing. Firstly, we propose a bus-based architecture of market-data decoding on Field Programmable Gate Array (FPGA). Our design is a loose-coupled and scalable architecture which is easy to adapt to different FAST templates by connecting different decoders to the main bus. Then we further exploit a dedicated pipelined design to improve the architecture. The pipelined architecture decompresses multiple messages in parallel, overcoming the challenge of data dependency between consecutive differential encoded (FAST) messages. Finally, we implement two prototypes in RTL code and evaluate them on a Xilinx Kintex-7 FPGA. Real test results show that 1) the pipelined processor gains 180% speedup compared with the non-pipelined processor; 2) it achieves an ultra-low decoding latency of 307 ns per message, which is 2 orders of magnitude faster than the software solution.

The speed of market data processing is a key factor to grab the gains and losses of instant trading profits. Typically, the market data processing systems are deployed on software platforms, which introduce high and unpredictable processing latencies. In this paper, we propose a scalable architecture for low-latency market-data processing on Field Programmable Gate Array (FPGA). A market-data processing IP library is implemented by the high-level synthesis (HLS) which automatically translates the C-coded market-data decoders to logic-coded ones. Based on the IP library, we propose a bus-based architecture of market-data decoding engine. A constructor is proposed to automatically build the decoding engines for different market-data templates. We demonstrate our design within a Xilinx Kintex-7 FPGA using three Chinese A-share templates and multiple history market-data sets. Our implementation achieves an ultra-low latency of market data processing, 0.5~1.3us per message on average, 1~2 orders of magnitude faster than a comparable software implementation.

Digital right protection in P2P systems is attracting more and more attentions. In this paper, we present a new stochastic-encryption-based Digital Rights Management (DRM) scheme for P2P content delivery networks. The files are encrypted such that unpaid users cannot access the plaintext content. We exploit the random characteristics of P2P to increase the key space, which can defense collusion attacks. We add piece validation policy during a download process to prevent poisoning attacks. In our scheme, peers make a payment after downloading, and this prevents user loss due to download failures (caused by the dynamics of P2P). Our scheme does not have frequent user authentications or state maintenance. Analysis and simulation experiments show that our scheme can defend against collusion attacks and poisoning attacks with a fairly high probability.

BitTorrent (BT) is a widely-used peer-to-peer (P2P) application. Most of BT's characteristics (except the topology) have been studied extensively by measurement approaches. In this paper, we deploy a measurement system to examine some performance-related topology properties of BT. Our goal is to provide a measurement view of the real-world BT topologies and to verify the previous estimations via simulations and real-world experiments. We observe that at the steady stage, a BT topology has short distances and low clustering coefficients, and its degree-frequency exhibits a Gaussian-like distribution. These indicate that a BT network is very close to a random network rather than a scale-free network or a small world. The proportion of peers with large download percentages is very high at the steady stage, showing that the swarm is robust from the resource perspective. We also find out that most high-degree peers have a very fast download speed. However, the low Spearman's rank correlation coefficient indicates that there is no strong correlation between the peer connection degree and the download speed. Different from previous results, we find that the diameter of a BT network at the initial stage is small even when 95% of peers use the peer exchange extension.

BitTorrent (BT) is one of the most popular Peer-to-Peer (P2P) network applications. Most characteristics (except the topology) of BT network have been examined extensively by measurement approaches. In this work, we deploy a measurement system to study the performance-related properties of BT topologies. We also use our measurement system to verify some previous simulation and experiment results obtained by other researchers. Different from previous results, we observe that a BT swarm has short distance, low clustering coefficient and Gaussian-like degree-frequency distribution. This indicates that a BT swarm is very close to a random network rather than a scale-free network or a small world. We observe that the diameter of a BT network at the initial stage is small even when 95% of peers use the peer exchange extension but the networks are not fully connected at the steady stages.

BitTorrent (BT) is a well-known Peer-to-Peer (P2P) downloading protocol and has been implemented in several versions. New features and extensions used to improve performance of BitTorrent systems also bring some security issues. In this paper, we analyze potential DDoS vulnerabilities of BT and its Peer Exchange extension. We show the ways of launching connection-exhausted DDoS attacks. Our experiments demonstrate these attacks are persistent and incur few costs for the attacker. By analyzing the main causes we find that both the defect of implement and the lack of trust and authentication mechanism are to blame, while the latter is critical. To defend against the DDoS attacks, we propose a score-based peer Reputation Exchange (REX) mechanism. Using REX, the score of a malicious peer is less than that of a good peer after several iterations, hence has less chance to be connected. REX makes it difficult to launch a DDoS attack and it can effectively mitigate the effect of the attack.