With the rapid advancement of Internet of Things (IoT) technology, its widespread application has led to numerous conveniences; however, it also presents significant security challenges. Traditional deep learning-based network intrusion detection systems require large datasets for training. In typical IoT environments, anomalous data is scarce. To address the issue of sample scarcity in IoT intrusion detection, this paper introduces D-MAML, which integrates the denoising diffusion probabilistic model (DDPM) with model-agnostic meta-learning (MAML). D-MAML first generates high-quality, diverse samples through iterative denoising via DDPM. It then utilizes these samples in conjunction with MAML to swiftly adapt to new tasks, achieving robust generalization performance in small-sample scenarios with minimal fine-tuning. Extensive experiments on the public datasets CICIDS2017, UNSW-NB15 and TON IoT demonstrate that D-MAML outperforms traditional sample generation methods under both single-attack and mixed-attack conditions, significantly enhancing model accuracy.

With the rapid growth of cloud computing, datacenter networks (DCNs) are facing escalating congestion challenges due to high-bandwidth, low-latency applications. Existing congestion control methods based on Explicit Congestion Notification (ECN) or delay signals struggle with precision and responsiveness, limiting their effectiveness. This paper proposes GFCC, a Global Fast Congestion Control mechanism using Software-Defined Networking (SDN) for proactive and accurate congestion management. GFCC leverages SDN-enabled global network monitoring to gather global flow information, accurately distinguishing between elephant and mice flows. Based on this, it predicts the first RTT congestion and limits the initial TCP window size. When network congestion arises, GFCC employs global traffic information to make accurate, fine-grained congestion adjustments while also providing direct congestion feedback from the switch closest to the sender via SDN’s flow table rules. GFCC can efficiently and precisely manage congestion using the aforementioned methods. Experimental evaluations on Mininet testbeds and large-scale ns-3 simulations demonstrate that GFCC significantly outperforms state-of-the-art protocols like BBR, DCTCP, SDTCP, Swift, Bolt, and HPCC. The results show substantial reductions in flow completion time, improved throughput, and enhanced queuing delay management under diverse workloads.

In the actual Internet of Things (IoT) environment, the proportion of abnormal behavior is much lower than that of normal behavior, and abnormal samples are often scarce, so it is a significant challenge to train efficient network intrusion detection systems using limited labeled samples. Meanwhile, intrusion detection systems based on online learning are prone to catastrophic forgetting, which greatly reduces the performance of online models. Previous research has not comprehensively addressed these two issues. Therefore, this paper proposes a few-shot and anti-forgetting network intrusion detection system based on online meta-learning. The system uses meta-learning as the basic algorithm to efficiently utilize data to train well-performing models with very few samples, thereby addressing the problem of insufficient samples; meanwhile, by saving previous models and invoking them when necessary to combat catastrophic forgetting. The experiments on the CIC-IDS2017 and CIC-IDS2018 datasets show that our proposed detection system can maintain good performance over the long term without forgetting.

As cloud computing advances, datacenter networks (DCNs) face unprecedented pressure due to the increasing prevalence of high bandwidth and low delay applications. Current reliable transmission protocols such as TCP harness packet loss , network delay, and Explicit Congestion Notification (ECN) for congestion control , aiming to maintain low latency and high throughput . We investigate the efficacy of ECN-based protocols against incast congestion in one-hop networks and delay-based protocols for maintaining low end-to-end delay in multi-hop networks, at the expense of throughput fairness. Thus, we introduce a novel TCP protocol, Dual Congestion Control Signals (DCCS), merging ECN and delay signals for a broader congestion control mechanism. DCCS effectively handles burst traffic, prevents packet loss, ensures low end-to-end delay, and resolves throughput unfairness by determining a precise minimum round-trip time (RTT) for each flow through a drain signal. Simulations on ns-3 confirm that DCCS surpasses ECN-based (i.e., DCTCP), delay-based (i.e., DC-Vegas and Swift), and hybrid-based protocols (i.e., EAR) in fat-tree topology under realistic workload, cutting down Flow Completion Time (FCT) by 3.8%–20.5%. This substantiates DCCS’s competency in providing high-quality service for DCNs.

Communication overhead is a significant challenge in distributed deep learning (DDL) training, often hindering efficiency. While existing solutions like gradient compression, compute/communication overlap, and layer-wise flow scheduling have been proposed, they are often coarse-grained and insufficient, especially under network congestion. These congestion-unaware methods can lead to long flow completion times, known as the tail latency, resulting in extended training time. In this paper, we argue that packet loss tolerance methods can mitigate the tail latency issue without sacrificing training accuracy, with the tolerance bound varying across different DDL model layers. We introduce PLOT, a fine-grained packet loss tolerance algorithm, which optimizes communication overhead by leveraging the layer-specific loss tolerance of the DNN model. PLOT employs a UDP-based transmission mechanism for gradient transfer, addressing the tail latency issue and maintaining training accuracy through packet loss tolerance. Our evaluations on both small-scale testbeds and large-scale simulations show that PLOT outperforms other congestion algorithms, effectively reducing tail latency and DDL training time.

DASH is becoming the unified adaptive bitrate (ABR) streaming open-source standard in video streaming. However, existing ABR algorithms lack accuracy and real-time performance in bandwidth estimation. Incorporating a wider range of information can enhance ABR algorithm performance. Positioned at the application layer, QUIC offers high scalability and can provide richer decision-making information for ABR algorithms. In this paper, we introduce an enhanced ABR algorithm enriched with multi-metric information, referred to as MM-ABR. MM-ABR surpasses the capabilities of existing ABR algorithms by additionally predicting network congestion, thereby improving the smoothness of video playback. To obtain the multi-metric information required for MM-ABR, we extend the implementation of the QUIC protocol, which allows us to integrate not only more accurate bandwidth data but also RTT and packet loss information into the DASH client application. We conduct simulations using NS-3 and compare MM-ABR with traditional ABR algorithms. The results demonstrate that MM-ABR offers higher video quality and Quality of Experience (QoE).

Currently, data center networks (DCNs) face a significant challenge known as the TCP incast problem, resulting from many-to-one communication. This problem leads to reduced throughput and increased flow completion time, greatly impacting application performance. Researchers have explored various methods like ECN, latency, and SDN to address this problem. However, these approaches suffer from issues such as inaccurate congestion detection, untimely congestion feedback, and imprecise congestion adjustment. To tackle these concerns, this paper proposes a two-stage fast congestion control algorithm (TSFCC) that leverages SDN’s global perspective. TSFCC leverages the programmability and global view of SDN to accurately predict the occurrence of concurrent flows and proactively control the sending rate, effectively mitigating TCP incast problem. Subsequently, TSFCC monitors network congestion in real-time and employs SDN technology to provide congestion feedback directly to switches nearest to senders, ensuring more timely feedback. Finally, the SDN controller differentiates between mouse flows and elephant flows, allocating more bandwidth precisely to mouse flows to accommodate more bursty flows and further alleviate TCP incast problem. To assess the performance of TSFCC, we conduct a custom experimental testbed using Mininet and OpenFlow to validate and demonstrate the effectiveness of our algorithm. The results demonstrate that TSFCC can significantly improve mouse flow completion time, tolerate a higher number of concurrent flows, and achieve more stable queue lengths in large-scale networks.

Nowadays, the IoT (internet of things) botnet has become a huge threat to network security. In response to this threat, we present a cooperative adaptive network intrusion detection system (IDS) framework with fog computing. The core part is cooperation detection architecture based on online adaptive machine learning algorithms. Our CAD-IDS aims to decrease the new attack detection time for all the IoT nodes and reduce the complexity of the cooperative IDS framework. The results of the experiment indicate that our CAD-IDS can detect IoT attacks efficiently and timely. Our ML code is available in https://github.com/LiQianchang/CAD-IDS-ML-Code.

In recent years, distributed deep learning (DDL) has been widely used to scale out and accelerate deep neural network training. In DDL, each worker trains a copy of the deep learning model with different training inputs and synchronizes the model gradients at the end of each iteration. However, it is well known that the network communication for synchronizing model parameters is the main bottleneck in DDL. In this paper, we propose a new idea to relieve network congestion. Through the gradient transmission time prediction, we can predict the arrival time of burst traffic in advance. It provides support for prevention efforts ahead of time. We propose a memory improved LSTM prediction algorithm called MILP to predict gradient transmission time. MILP designs an improving memory for LSTM to overcome the drawback of LSTM that is too conservative in predicting gradient transmission time. We compare the performance of MILP with other time series forecasting (TSF) models on our data sets. Our experiments show that MILP is more accurate than other classical TSF models in predicting gradient transmission time. The average error rate is 13.17 % lower than the LSTM model. Our code is available at https://github.com/surprisejxb789/MILP.

With the rapid development of traffic encryption technology and the continuous emergence of various network services, the classification of encrypted zero-day applications has become a major challenge in network supervision. More seriously, many attackers will utilize zero-day applications to hide their attack behaviors and make attack undetectable. However, there are very few existing studies on zero-day applications. Existing works usually select and label zero-day applications from unlabeled datasets, and these are not true zero-day applications classification. To address the classification of zero-day applications, this paper proposes an Encrypted Zero-day Applications Classification (EZAC) method that combines Convolutional Neural Network (CNN) and K-Means, which can effectively classify zero-day applications. We first use CNN to classify the flows, and for the flows that may be zero-day applications, we use K-Means to divide them into several categories, which are then manually labeled. Experimental results show that the EZAC achieves 97.4% accuracy on a public dataset (CIC-Darknet2020), which outperforms the state-of-the-art methods.

Due to the increasing variety of encryption protocols and services in the network, the characteristics of the application are very different under different protocols. However, there are very few existing studies on encrypted application classification considering the type of encryption protocols. In order to achieve the refined classification of encrypted applications, this paper proposes an Encrypted Two-Label Classification using CNN (ETCC) method, which can identify both the protocols and the applications. ETCC is a two-stage two-label classification method. The first stage classifies the protocol used for encrypted traffic. The second stage uses the corresponding classifier to classify applications according to the protocol used by the traffic. Experimental results show that the ETCC achieves 97.65% accuracy on a public dataset (CICDarknet2020).

Summary Most existing quality of service (QoS) control algorithms of Web applications take into account Web Server or database connections which can be released immediately. However, many applications are deployed on virtual machines (VMs) or even Spot VMs elastically rented from public Clouds. To save costs, interval‐priced VMs are not released until the ends of rented intervals. Such delays of control effects make existing methods rent or release excess VMs leading to overcontrol. Fluctuated prices make Spot VMs unreliable due to unexpected termination which makes fault‐tolerant strategies crucial. In this article, an unequal‐interval‐based loosely coupled control method is proposed to improve the quality of service (QoS) control ability of fault‐tolerant strategies. A queuing model with arrival‐rate‐adjustment coefficient is used to predict required capacity as a feedforward controller. Another two‐threshold and queuing‐model‐based method is applied to update the coefficient as a loosely coupled feedback controller. Meanwhile, unequal‐interval controller collaborating method is proposed to avoid overcontrol and react quickly to workload changes. Our approach is evaluated on both a simulation platform and a real Kubernetes Cluster. Experimental results illustrate that our approach decreases the percentage of waiting times larger than service level agreements with similar or lower rental costs compared with existing algorithms.

Nowadays, TCP has been used as the de facto transport layer protocol on the Internet. However, TCP incast happens inevitably in data centers, where exist massive concurrent flows, leading to packets loss, unacceptable long transmission time, and throughput collapse. Furthermore, DCTCP is widely used to solve these problems. Unfortunately, DCTCP cannot work well under a high concurrency environment. To this end, in this paper, we introduce a two-stage congestion control algorithm (TS-TCP) for high concurrency flows. The first step is to reduce the congestion window of long-lived flows aggressively to release bandwidth for short-lived flows. The second step is to decline the sending rate by adjusting the sending interval. Through the above steps, the proposed algorithm can mitigate the TCP incast effectively. The results, by using extensive ns3 simulation, show that TS-TCP can significantly outperform the DCTCP and TCP NewReno in terms of throughput and flow completion time. Moreover, TS-TCP can support hundreds of concurrent flows while maintaining about 85% link utilization.

With the rapid development of Internet technology and the explosive growth of data, the storage system designed by tightly coupled hardware and software is limiting the development of storage technology severely, and unable to meet the fast changing needs in the mobile Internet and exploding big data era. Software Defined Storage (SDS) as a new storage system architecture is more suitable for the development of the next-generation data centers. This paper proposed a new Controller-based FC Storage Network (CSN) architecture using the idea of SDS technology. CSN decoupling control plane protocol of FC switch from data plane deployed control plane protocol and distributed functions in the controller. This paper described the design and implementation of this architecture and verifies the feasibility through the actual development environment. Finally, as a result of experiments, server can establish a connection with the storage more quickly in CSN, furthermore, CSN has a faster convergence, as well as more reliability and scalability.

TCP incast usually happens when a receiver requests the data from multiple senders simultaneously. This many-to-one communication pattern constantly appears in the data center networks due to the data are stored at multiple servers. With Software Defined Networks (SDN), the centralized control methods and the global view of the network can be an effective way to handle this problem. In this paper, we propose a SDN-based TCP (SDTCP) congestion control mechanism at network side. Our approach enables controller to select a long-lived flow to reduce sending rate by adjusting the TCP receive window of ACK packet after OpenFlow-switch triggered a congestion message to controller. The key benefit of SDTCP is that, with global perspective, we can accurately decelerate the rate of long-lived flow to ensure the performance other flows. The experiments indicate that we can achieve almost zero packet loss for TCP incast and guarantee goodput for the high propriety flows.