Abstract Packet classification is a cornerstone of network security functions, such as firewalls, access control, and network metering. It involves taking different actions on packets based on security rules to implement these network security functions. As networks continue to evolve and the number of network instances rapidly increases, the complexity and size of network security rule sets are also expanding. Additionally, autonomous defense systems with artificial intelligence that can detect and block online attacks have become a new trend in network security. Packet classifiers need to not only achieve fast rule matching under large rule sets but also support rapid rule updates in order to deploy security rules issued by online defense systems in a timely manner. However, existing packet classification methods struggle to balance lookup speed with update performance. To achieve rapid rule matching and support fast rule updates in networks, we propose a novel approach called the Learned Index Updatable Tree (LIPT) to address this challenge. LIPT partitions the rule set into single-field non-overlapping subsets and constructs dynamic learned index trees for each subset using keys obtained by sampling. To implement rule updates directly within the learned index tree without reconstruction, LIPT employs a gap array layout in the data nodes, which reserves space for rule insertion. To enhance lookup and update performance, LIPT addresses the challenge of direct range validation in the data node through payload-assisted validation, which helps quickly identify lookup and insertion locations. Furthermore, LIPT employs a simple linear regression model to construct the learned index tree, enabling swift lookup based on the predictive results of the linear regression model; it also utilizes a cost model to simplify the construction process. We conduct a comprehensive evaluation of LIPT’s performance, showing that both lookup and update speeds are significantly improved compared to existing algorithms that support rule updating. Compared to the benchmark algorithm PSTSS, LIPT’s update speed increases by 25%, and its classification speed increases by 242%.

Applying Electrical Impedance Tomography (EIT) at the microscopic scale is a promising approach for label-free cellular monitoring in the Internet of Medical Things (IoMT). However, practical deployment faces challenges such as ill-posed inverse problems, low Signal-to-Noise Ratios (SNRs), and the lack of labeled training data. To address these issues, this paper proposes SwinLoAttn-DIP, an unsupervised reconstruction framework designed for a custom miniature sensing system. The core network, SwinLoAttnNet, combines Swin Transformer blocks with a hybrid attention mechanism. Unlike standard convolutional methods that may blur fine details, this architecture captures global dependencies to reconstruct complex microstructures without requiring pre-training. We validated the proposed method using a self-developed 15-mm sensor node. Through systematic comparisons with recent architectures, including pretrained Transformers and Multilayer Perceptron (MLP)-based models, the results demonstrate that our framework achieves superior boundary fidelity and reduced artifacts across simulations,ex vivotissues, and public datasets. This work establishes a robust and data-efficient paradigm for high-precision microscopic imaging, facilitating the implementation of reliable remote biosensing in data-scarce IoMT environments.

Anomaly detection in Service Function Chains (SFCs) is essential for ensuring the security of edge-cloud networks. However, edge servers in Industrial Internet of Things (IIoT) face challenges in meeting the real-time processing requirements for high-precision anomaly detection due to limited computational resources. In order to address this issue, we initially propose an architectural framework for in-band measurement of cloud-native SFC, which can efficiently detect the state information of virtual network functions (VNFs). Secondly, we propose LightSFC, a lightweight distributed edge-cloud network service function chain anomaly detection model. LightSFC achieves comprehensive awareness of the SFC state by collecting multi-source information from both the data plane and the control plane, and utilizes a lightweight deep Autoencoder model for proactive anomaly detection. Our experimental results show that LightSFC is capable of rapidly detecting anomalies with lower resource overhead. Compared to other methods, LightSFC exhibits superior performance in terms of accuracy, precision, recall, and F1-score, thereby substantiating its efficacy in SFC anomaly detection for edge-cloud networks.

The risk of data leakage has become a major challenge for various organizations. However, recent research has highlighted certain deficiencies in traditional data encryption schemes, significantly compromising the overall usability and security of systems especially for data in use. To address these challenges, this paper proposes a novel Linux kernellevel architecture based on zero-trust principles, named ZTKA. This architecture systematically integrates Zero Trust concepts, strictly adhering to the principle of least privilege access, and does not trust any other users or applications running on the same system. It achieves secure data isolation and protection of data in use. Our architecture ensures data security even in the event of partial system compromise by implementing secure key management, real-time data encryption, strict file isolation, and a series of performance optimization measures at the kernel level. The paper reviews the relevant theoretical background and provides empirical results from runtime measurements to compare performance and security with and without the kernel module. Observations indicate that the kernel-level architecture based on Zero Trust principles operates effectively across its modules, significantly enhancing the security of data usage in Linux while maintaining superior performance.

Microservice architectures have gained widespread adoption in cloud-native environments due to their flexibility and scalability. However, these architectures pose significant challenges in the automated generation and dynamic updating of fine-grained security policies. This paper presents LLM2policy, a novel framework that utilizes large language models (LLMs) for end-to-end automated security policy generation. LLM2policy extracts microservice entity information from deployment YAML files and identifies RPC call relationships from distributed tracing data, consolidating this information into a structured knowledge base. This knowledge base is then used to automatically generate Istio-compatible access control policies in YAML format, enabling dynamic policy updates. Evaluation results from five benchmark microservice systems demonstrate that LLM2policy achieves 100% accuracy in entity recognition and dependency extraction, over 98.81% accuracy in semantic extraction by the LLM, and unit test pass rates ranging from 93.75% to 100% for the generated policies. Furthermore, attack simulations confirm that the generated policies effectively mitigate unauthorized access, highlighting the practical applicability and robustness of LLM2policy in automated cloud-native security policy management.

Biometric technology has driven the rise of Biometrics as a Service (BaaS) due to its unique security and convenience. However, in the traditional cloud-based BaaS systems, raw biometric data leakage and biometric efficiency issues are still concerns, which may reduce user trust and engagement in biometric services. In this paper, we propose an innovative BaaS system named Bio-CEC in a Cloud-Edge Cooperative environment. Bio-CEC features a novel biometric template transformation scheme, rooted in multivariate polynomial transformation and random virtual feature replacement. This innovative scheme enables the revocation and regeneration of biometric templates, enhancing security in case of system breaches. For the biometric template protect scheme, a template matching algorithm using filtering operations is proposed, aiming to facilitate secure and accurate authentication within the transformation domain. Our comprehensive experiments and in-depth safety analysis verify the superiority of Bio-CEC. The results clearly demonstrate that Bio-CEC outperforms traditional cloud-based biometric system and provides a safer and more efficient solution for practical biometric system applications.

Chinese Grammatical Error Diagnosis (CGED) suffers the problems of numerous types of grammatical errors and insufficiency of training data. In this paper, we propose a string editing based CGED model that requires less training data by using a unified workflow to handle various types of grammatical errors. Two measures are proposed in our model to enhance the performance of CGED. First, the detection and correction of grammatical errors are divided into different stages. In the stage of error detection, the model only outputs the types of grammatical errors so that the tag vocabulary size is significantly reduced compared with other string editing based models. Secondly, the correction of some grammatical errors is converted to the task of masked character inference, which has plenty of training data and mature solutions. Experiments on datasets of NLPTEA-CGED demonstrate that our model outperforms other CGED models in many aspects.

In recent years, Autonomous Moving Platforms (AMP) have gradually become an essential part of industry and life, including a variety of water, land and air mobile platforms. 5G networks provide AMP with low-latency and high-speed communication services which can promote the construction of smart cities. However, the mobility of smart-AMP affects the handover in 5G networks. With the intensive deployment of gNBs, unreasonable handover will increase the power con-sumption of AMP and reduce the quality of service (QoS) of AMP communications. Thus, we propose a 5G handover method based on AMP trajectory prediction in this paper. A CNN-STLSTM neural network which combines a convolutional neural network (CNN) and Spatioal-Timporallong short-term memory (ST- LSTM) is proposed to predict the trajectory of AMP. Then, the gNB is selected to handover through the AMP's trajectory points predicted by the prediction model. The evaluation results show that the proposed mechanism can effectively reduce the number of hand over and improve the efficiency and stability of AMP networks.

3-D interferometric inverse synthetic aperture radar (InISAR) imaging of ship targets has always been a hot and difficult issue in research, and how to preserve the interferometric phase while performing high-resolution 2-D ISAR imaging of the complex echoes is the key to 3-D InISAR imaging. In this letter, a novel 3-D InISAR imaging algorithm of the ship target based on joint cross S-method is proposed. First, the azimuth short-time Fourier transform (STFT) is applied to the 1-D range profiles after motion compensation and image coregistration. Then, extract the interferometric phase matrices after performing the joint cross S-method transformation of the STFT results along the two baselines. Besides, the S-method transformations are implemented recursively for the joint cross S-method transformed results to obtain high-resolution ISAR images. Finally, the 3-D InISAR imaging can be achieved by combining the phase matrices and ISAR images at the same time. Simulation results verify the effectiveness and superiority of the proposed algorithm.

A novel algorithm for 3-D interferometric inverse synthetic aperture radar (InISAR) imaging of ship target with complex motion via orthogonal double baseline is presented. For the ship target with a certain translational velocity and 3-D rotation, the distance between any scatterers on the target and the radar is analyzed in detail, and the keystone transform is used to reduce the impact of migration through resolution cell of ship target with big size. Then, the fractional Fourier transform is adopted to achieve the 2-D ISAR image of the target, and the mismatch of the ISAR images achieved by the three radars is solved by the image coregistration method according to the 1-D range profile. Finally, the 3-D InISAR image of the ship target is achieved with the interferometric operation with the three ISAR images. The effectiveness of the proposed method is proved by some simulation results, and the influence of different motion parameters on the 3-D imaging of ship target is analyzed simultaneously in this paper.

Per-flow queuing is believed to be able to guarantee advanced Quality of Service (QoS) for each flow. With the dramatic increase of link speed and number of traffic flows, per-flow queuing faces a great challenge since millions of queues need to be maintained for implementation in a traditional sense. In this paper, by setting only a small number of physical queues, we propose a Dynamic Queue Sharing (DQS) mechanism to achieve an equal performance to the pure per-flow queuing with a lower cost. The proposed mechanism is based on an interesting fact that the number of simultaneous active flows in the router buffer is far less than that of in-progress flows. In DQS, a physical queue is dynamically created on-demand when a new flow comes and then dynamically released when the flow temporarily pauses. Hashing and binary sorting tree (or linked list) are combined to manage the mapping between flows and queues, so as to isolate flows in different queues. Theoretical analysis and traces experiments are conducted to evaluate DQS. The results demonstrate that when the parameters are well set, the operation delay is less than two time cycles in average with an extra memory of 16k bits.