Zero-shot Composed Image Retrieval (ZS-CIR) involves diverse tasks with varied visual manipulation intents across domains, scenes, objects, and attributes. A key challenge is that existing datasets contain limited intent-relevant annotations, making it hard for models to infer human intent from textual modifications. We introduce an intent-centric image–text dataset generated via reasoning by a Multimodal Large Language Model (MLLM) to better train ZS-CIR models for human manipulation intent understanding. Building on this dataset, we propose De-MINDS, a framework that distills the MLLM’s reasoning ability to capture manipulation intent and enhance models’ comprehension of modified text. A simple mapping network translates image information into language space and combines it with the manipulation text to form a query. De-MINDS then extracts intention-relevant information from this query and encodes it as pseudo-word tokens for accurate ZS-CIR. Across four ZS-CIR tasks, De-MINDS shows strong generalization and improves over existing methods by 2.15% to 4.05%, establishing new state-of-the-art results with comparable inference time.

Network Covert Timing Channels (NCTCs) pose a serious threat to network security, through which attackers transmit hidden information by manipulating inter-packet delays (IPDs). Existing methods have shown strong performance in IPv4 networks by relying solely on timing features. However, more flexible routing mechanisms may introduce additional timing jitter into benign traffic in IPv6; meanwhile, the heterogeneous processing of optional IPv6 extension headers by routers make per-hop processing delays across routers increasingly unpredictable. These factors collectively increase the complexity of IPv6 IPD patterns, making timing-only detection methods insufficient for accurately modeling legitimate baseline behavior. To address such challenges, we propose TranCTC , a Transformer-based anomaly detection method. By modeling temporal-structural alignment, TranCTC effectively overcomes the limitations of timing-only baseline construction and learns a multidimensional representation of legitimate IPv6 traffic. On the public CAIDA dataset, TranCTC significantly outperforms existing approaches across multiple NCTC types in the IPv6/TCP setting, and ablation studies show that incorporating structural features and contextual modeling substantially improve detection accuracy. TranCTC fills the gap in detecting covert timing channels in IPv6 networks.

Machine learning (ML) is highly effective for accurate encrypted malicious traffic identification by using highquality training data. In fact, obtaining such data is costly and challenging. As a result, many ML-based models are inevitably trained on low-quality data and perform poorly. To enhance performance, some methods utilize various sample selection techniques to choose confident samples for model training. However, they often rely on a single metric for this selection, which restricts their adaptability across diverse datasets and noise conditions. In this paper, we propose a robust framework BAPTISM for identifying encrypted malicious traffic with low-quality training data. Particularly, BAPTISM selects a suitable base model for each task, and trains it with early stopping to generate traffic representation before overfitting occurs. Then, we devise an adaptive metric selection strategy to select confident samples. By employing two metrics (JSD and CSD) to assess the characteristic of traffic representation from distinct perspective, we find the more proper metric for each class and apply it for confident sample selection. According to the confident samples and selected metric for each class, we develop a label correction tactic which adapts to class nature to improve the quality of training data. Finally, we employ parallel training strategy to train the base model with the corrected data, further mitigating the impact of low-quality data. We conduct experiments across three real-world malicious traffic datasets with various noise settings. The results demonstrate that BAPTISM is compatible with different base models and outperforms across noise ratios ranging from 20% to 90%. Meanwhile, BAPTISM consistently selects the confident samples with the highest purity and volume under each setting.

Adversarial perturbation generation allows network users to mislead website fingerprinting (WF) classifiers without compromising real-time transmission or data integrity, causing misclassification. However, adversarial perturbations are vulnerable to adversarial training (AT), which enables attackers to improve their classifiers using perturbed adversarial samples, rendering user defenses ineffective. Due to reliance on real and non-redundant data, existing defenses against AT fail to scale to large-scale user scenarios. This paper proposes an improved adversarial perturbation generation method named Splash, which mitigates performance degradation caused by defense configuration collisions in traditional AT-aided attack defenses by applying two real-time traffic obfuscation steps using both global adversarial perturbations and Short Perturbation Blocks placed at random positions. Evaluation shows that Splash performs better traffic obfuscation than three other representative defenses, causing attacker classifiers to misclassify over 97% of traffic. In addition, it offers enhanced functionality by causing 45-60% of traffic to be misclassified into arbitrary target classes. Splash outperforms SOTA defenses such as AWA and ALERT against AT-aided attacks, reducing success rates to below 30%. Furthermore, it demonstrates significantly stronger resilience when attackers adopt the same defense configurations as users.

In recent years, a new fraud method, namely smart contract honeypots, has emerged on the famous blockchain platform Ethereum. The difference from smart contract vulnerabilities is that the contract honeypot essentially has no vulnerabilities, luring victims to call in a seemingly vulnerable form. However, the victims ultimately cannot obtain the desired benefits and will lose certain funds. Deep learning algorithms are preferred among current contract honeypot detection methods because they can learn more general characteristics and do not rely on expert experience. Most previous works use natural language models to learn the opcodes of contract honeypots but overlook the relevant structural features of the source code. We propose a novel method called the Smart Contract Honey-pot Data Flow Graph, which utilizes a data flow graph to extract the calling relationships of critical source code within contract honeypots and employs a pre-trained model for representation learning. First, contract honeypots generally have a code that transfers money to the calling address, which is critical information for constructing a source code data flow graph. Then, the pre-trained model is used to learn the source code representation and perform downstream classification tasks. The F1-score of our model significantly outperforms the state-of-the-art approaches in the contract honeypot classification task and is close to the highest performance in the detection task. In addition, this model is an end-to-end model that can detect unknown-type contract honeypots.

Vision-language models (VLMs) have made significant progress in image classification by training with large-scale paired image-text data. Their performances largely depend on the prompt quality. While recent methods show that visual descriptions generated by large language models (LLMs) enhance the generalization of VLMs, class-specific prompts may be inaccurate or lack discrimination due to the hallucination in LLMs. In this paper, we aim to find visually discriminative prompts for fine-grained categories with minimal supervision and no human-in-the-loop. An evolution-based algorithm is proposed to progressively optimize language prompts from task-specific templates to class-specific descriptions. Unlike optimizing templates, the search space shows an explosion in class-specific candidate prompts. This increases prompt generation costs, iterative times, and the overfitting problem. To this end, we first introduce several simple yet effective edit-based and evolution-based operations to generate diverse candidate prompts by one-time query of LLMs. Then, two sampling strategies are proposed to find a better initial search point and reduce traversed categories, saving iteration costs. Moreover, we apply a novel fitness score with entropy constraints to mitigate overfitting. In a challenging one-shot image classification setting, our method outperforms existing textual prompt-based methods and improves LLM-generated description methods across 13 datasets. Meanwhile, we demonstrate that our optimal prompts improve adapter-based methods and transfer effectively across different backbones. Our code is available at here.

Zero-Shot Composed Image Retrieval (ZS-CIR) involves diverse tasks with a broad range of visual content manipulation intent across domain, scene, object, and attribute. The key challenge for ZS-CIR tasks is to modify a reference image according to manipulation text to accurately retrieve a target image, especially when the reference image is missing essential target content. In this paper, we propose a novel prediction-based mapping network, named PrediCIR, to adaptively predict the missing target visual content in reference images in the latent space before mapping for accurate ZS-CIR. Specifically, a world view generation module first constructs a source view by omitting certain visual content of a target view, coupled with an action that includes the manipulation intent derived from existing image-caption pairs. Then, a target content prediction module trains a world model as a predictor to adaptively predict the missing visual information guided by user intention in manipulating text at the latent space. The two modules map an image with the predicted relevant information to a pseudo-word token without extra supervision. Our model shows strong generalization ability on six ZS-CIR tasks. It obtains consistent and significant performance boosts ranging from 1.73% to 4.45% over the best methods and achieves new state-of-the-art results on ZS-CIR. Our code is available at https://github.com/Pter61/predicir.

Composed Image Retrieval (CIR) aims to retrieve target images that closely resemble a reference image while integrating user-specified textual modifications, thereby capturing user intent more accurately. Existing training-free zero-shot CIR (ZS-CIR) methods often employ a two-stage process: they first generate a caption for the reference image and then use Large Language Models for reasoning a target description. However, these methods suffer from missing critical visual details and limited reasoning capabilities, leading to suboptimal retrieval performance. To address these challenges, we propose a novel, training-free one-stage method, One-Stage Reflective Chain-of-Thought Reasoning (OSrCIR) for ZS-CIR, which employs Multimodal Large Language Models to retain essential visual information in a single-stage reasoning process, eliminating the information loss in two-stage methods. Our Reflective Chain-of-Thought framework further improves interpretative accuracy by aligning manipulation intent with contextual cues from reference images. OSrCIR achieves performance gains of 1.80% to 6.44% over existing training-free methods across multiple tasks, setting new state-of-the-art results in ZS-CIR and enhancing its utility in vision-language applications. Our code is available at https://github.com/microsoft/ACV/tree/main/OSrCIR.

Temporal Knowledge Graphs (TKGs) are being widely explored to predict the future for they record multi-relational knowledge and the happening time of real-life facts. Existing works learn sequential patterns to infer the future from past facts in TKGs for predictions. Although achieving promising results, they are restricted by the sequential modeling in both efficiency and effectiveness. To resolve these limitations, we propose our efficient and effective non-sequential relational modeling (NoSeq). NoSeq works non-sequentially for temporal patterns where it transforms the happening time into time intervals. Time intervals are the period of time between happening time and prediction time which state the temporal distance clearly. Both time intervals and relations are represented using embeddings and merged non-sequentially into entity embeddings for future predictions. We evaluate NoSeq on four datasets from the perspective of effectiveness, efficiency, sensitivity, and the ability to transfer. Consistent better performances verify our idea.

Temporal Knowledge Graphs (TKGs) represent real-life facts using entities, relational types, and timestamps where relational types state the semantic scenario of facts. Current methods learn embeddings by merging facts of multiple types (e.g. sport and family) for predictions. Such embeddings associate well with relations of multiple types. However, the prediction needs only information of a single type, i.e. embeddings contain irrelevant relational types. In this paper, we explore whether embeddings with irrelevant information confuse predictions and propose RefE to improve embeddings by refining meanings. RefE enhances the ability for predicting links of a specific type while maintaining associations of multiple relational types. RefE consists of general learning and embedding refining modules. General learning embeds facts of multiple types to represent general meanings, and embedding refining emphasizes facts of the single type that matches the prediction. RefE uses both general and refined embeddings for predictions. Experimental results on four datasets verify the effectiveness of RefE.

The widespread adoption of encrypted network protocols has made traffic encryption ubiquitous, creating substantial challenges for network management and security. This paper introduces a novel encrypted traffic classification system, ANASETC, which combines traffic burst features with Neural Architecture Search (NAS) to automatically design efficient neural network architectures. ANASETC autonomously generates high-performance classification models, significantly reducing manual intervention while maintaining high classification accuracy. To enhance search efficiency, we introduce a new search space called ETNasnet, which optimizes the training process through parameter sharing among sub-models. We evaluate ANASETC’s performance on three public datasets and a real-world satellite network traffic dataset. The results show that ANASETC achieves an optimal balance between classification accuracy and search efficiency, demonstrating strong robustness and adaptability across various task scenarios, outperforming state-of-the-art methods.

A significant aspiration of offline reinforcement learning (RL) is to develop a generalist agent with high capabilities from large and heterogeneous datasets. However, prior approaches that scale offline RL either rely heavily on expert trajectories or struggle to generalize to diverse unseen tasks. Inspired by the excellent generalization of world model in conditional video generation, we explore the potential of image observation-based world model for scaling offline RL and enhancing generalization on novel tasks. In this paper, we introduce JOWA: Jointly-Optimized World-Action model, an offline model-based RL agent pretrained on multiple Atari games with 6 billion tokens data to learn general-purpose representation and decision-making ability. Our method jointly optimizes a world-action model through a shared transformer backbone, which stabilize temporal difference learning with large models during pretraining. Moreover, we propose a provably efficient and parallelizable planning algorithm to compensate for the Q-value estimation error and thus search out better policies. Experimental results indicate that our largest agent, with 150 million parameters, achieves 78.9% human-level performance on pretrained games using only 10% subsampled offline data, outperforming existing state-of-the-art large-scale offline RL baselines by 31.6% on averange. Furthermore, JOWA scales favorably with model capacity and can sample-efficiently transfer to novel games using only 5k offline fine-tuning data (approximately 4 trajectories) per game, demonstrating superior generalization.

Malware poses a significant threat to the security of cyberspace. For malware detection, utilizing machine learning or deep learning techniques to analyze API sequences has been proven to be effective. However, the existing methods fail in mitigating the interference caused by redundant information when processing excessively lengthy or behavior-masking sequences. To address this issue, we propose MalSE, a novel malware detection framework based on API call sensitivity estimation. MalSE aims to highlight key information in the sequence and minimize the interference of redundant information, thereby increasing detection performance. Firstly, MalSE uses a novel statistical-based method to annotate parameter sensitivity labels, which provide a foundation for subsequent module training. Secondly, MalSE employs a Bert-based estimator to transform the parameters into the semantic space and then predict the parameters’ sensitivities. Thirdly, MalSE assesses the sensitivity of each API call by aggregating the sensitivities of parameters, thus providing powerful features for detection tasks. Finally, MalSE employs an attention-based sequence model, which can concentrate on crucial information within the sequence to enhance the detection performance. We evaluate MalSE on 2 binary classification tasks and 1 multi-classification task. MalSE outperforms other methods across all tasks, demonstrating superior and robust detection capabilities under different scenarios.

Traditional deep learning-based encrypted traffic classification models generally suffer from weak interpretability and struggle to effectively model the nonlinear relationships between features, resulting in poor generalization when faced with out-of-distribution data. Kolmogorov-Arnold Networks (KAN), known for their high interpretability and nonlinear modeling capabilities, have not been fully explored in the field of encrypted traffic. We proposed the KAN-ResNet model, drawing on the working principle of KAN, to enable end-to-end interpretable encrypted traffic classification by replacing different parts of ResNet with KAN layers and KAN convolutional layers. Experiments on the ISCX-Botnet-2014 and ISCX-Tor-2016 datasets demonstrated that our method outperforms traditional classification models (such as ViT) in terms of accuracy and F1 score. By visualizing the features extracted by the KAN network and the B-spline functions within the network, we interpreted the feature extraction of the KAN network from an interpretability perspective, showcasing its great potential in encrypted traffic classification. However, when the Residual Block organized by the KAN network is too deep, the increased training complexity and overfitting issues have become current limitations of its capabilities.

Website fingerprinting (WF) attacks undermine the privacy promised by anonymizing networks such as Tor by inferring the websites a user visits from encrypted-traffic side-channels. Recent criticisms of the single-tab assumption have shifted attention to the more realistic multi-tab setting, where concurrent page loads create severe noise. Existing multi-tab studies rely on direction sequences that ignore temporal structure and therefore provide only limited discriminative power. Our experiments show that packet-level timestamps do carry extra signal, yet their raw form is fragile under overlapping tabs and timing-obfuscation defences. We propose the PacketBurst Counts (PBC) feature—a$4 \times L$matrix that, for each time interval, stores the counts of upstream packets, downstream packets, upstream bursts and downstream bursts. PBC preserves coarse temporal structure while discarding noisy finegrained timings, striking a balance between expressiveness and robustness. Building on PBC, we design PBC-MWF, an end-to-end framework that (i) uses a residual CNN to learn local embeddings and (ii) applies an adaptive sparse transformer to capture global correlations while suppressing tab-overlap noise. Unlike prior work, which evaluates on datasets with a fixed number of tabs and reports top-k accuracy, we additionally merge datasets with varying tab-count and perform threshold-based inference; the threshold is tuned on the validation set before testing. To the best of our knowledge, PBCMWF is the first WF framework to simultaneously address the multi-tab setting's challenges of fine-grained webpage identification and resilience against WF defences. Evaluations on three public multi-tab datasets demonstrate PBC-MWF's enhanced robustness: compared against nine baselines, it surpasses the best prior method-improving F1 by up to 12.4 % on site-level, 8.4 % on page-level, and over 10 % under defenses.

IPv6 address correlation attacks determine whether two temporary addresses belong to the same user, compromising user privacy. Particularly, existing works have shown that methods based on TLS traffic analysis can be used to perform correlation attacks. However, they suffer from inaccurate differentiation of complex user behaviors and low correlation efficiency, leading to limitations in practical applications. In this paper, we propose a 6RIS model to improve IPv6 address correlation attacks on TLS-encrypted traffic. 6RIS learns the joint representation of interaction and sequential behavior from traffic, which is used to construct a KD-Tree for efficient correlation. Statistical aggregation and semantic preference modules are designed to extract generalized features from complex interaction behavior. To model sequential behavior, we utilize a sequence learning module to capture service dependencies, enhancing behavior representation. Experiments on a real-world IPv6 dataset show that 6RIS ($\mathbf{9 1. 8 6 \%}$TPR,$\mathbf{0. 8 3 \%}$FPR) outperforms state-of-theart methods. The correlation efficiency of 6RIS improves by at least 57 % compared to existing methods. Additionally, we further confirm through 6RIS that persistent session IDs in TLS session resumption can directly expose IPv6 temporary addresses to correlation attacks.

The emerging low earth orbit (LEO) satellite Internet has gained worldwide popularity. Starlink, a prominent LEO satellite Internet service provider, has attracted the most users due to its low latency, wide coverage, and strong usability. Current research on Starlink primarily focuses on the space segment and its impact on network performance. However, as an essential component, the architecture and unique features of the Starlink Terrestrial Network (SLTN) are not well-explored, which significantly affects the performance, security, and development of the whole network. In this paper, we fill this gap by conducting a thorough measurement study to profile the SLTN from various aspects and reveal its potential effects, with specific attention to the network assets, topology, and routing strategies. We developed a novel framework including active and passive measurement methods for collecting multiple network assets, tracing different route paths, and scanning active service of the SLTN. The open source intelligence was utilized for the first time to collect extensive real-user network status. Leveraging these techniques, we observed a rapid expansion of the Starlink service with the latest network assets, collected in January 2025, including over 23.5K/28 IP prefixes residing in 143 countries. We mapped the consistent topology of the global Starlink Internet access service and identified the specific IP addresses associated with the four types of network routing nodes. Multiple internal routing strategies were uncovered, which facilitate direct user-to-user interactions. Particularly, we revealed the switches of terrestrial infrastructure that users connected and the changes in routing strategies, which should be considered in future quality of service (QoS) evaluations. Our measurement also provides methods for improving users' perceptions and serves as a basis for studies like security risk evaluation and service discovery.

Text-to-video retrieval essentially aims to train models to align visual content with textual descriptions accurately. Due to the impressive general multimodal knowledge demonstrated by image-text pretrained models such as CLIP, existing work has primarily focused on extending CLIP knowledge for video-text tasks. However, videos typically contain richer information than images. In current video-text datasets, textual descriptions can only reflect a portion of the video content, leading to partial misalignment in video-text matching. Therefore, directly aligning text representations with video representations can result in incorrect supervision, ignoring the inequivalence of information. In this work, we propose T2VParser to extract multiview semantic representations from text and video, achieving adaptive semantic alignment rather than aligning the entire representation. To extract corresponding representations from different modalities, we introduce Adaptive Decomposition Tokens, which consist of a set of learnable tokens shared across modalities. The goal of T2VParser is to emphasize precise alignment between text and video while retaining the knowledge of pretrained models. Experimental results demonstrate that T2VParser achieves accurate partial alignment through effective cross-modal content decomposition. The code is available at https://github.com/Lilidamowang/T2VParser.

Process reward model (PRM) has been proven effective in test-time scaling of LLM on challenging reasoning tasks. However, the reward hacking induced by PRM hinders its successful applications in reinforcement fine-tuning. We find the primary cause of reward hacking induced by PRM is that: the canonical summation-form credit assignment in reinforcement learning (RL), i.e. cumulative gamma-decayed future rewards, causes the LLM to hack steps with high rewards. Therefore, to unleashing the power of PRM in training-time, we propose PURE: Process sUpervised Reinforcement lEarning. The core of PURE is the min-form credit assignment that defines the value function as the minimum future rewards. This method unifies the optimization objective with respect to process rewards during test-time and training-time, and significantly alleviates reward hacking due to the limits on the range of values of value function and more rational assignment of advantages. Through extensively experiments on 3 base models, we achieve similar reasoning performance using PRM-based approach compared with verifiable reward-based approach if enabling min-form credit assignment. In contrast, the canonical sum-form credit assignment even collapses training at the beginning. Moreover, when we incorporate 1/10th verifiable rewards to auxiliary the PRM-based fine-tuning, it further alleviate reward hacking and results in the best fine-tuned model based on Qwen2.5-Math-7B with 82.5% accuracy on AMC23 and 53.3% average accuracy across 5 benchmarks. Furthermore, we summary the reward hacking cases we encountered during training and analysis the cause of training collapse.

Smart contracts control critical financial assets on blockchains, with potential weaknesses risking substantial losses. Thus, smart contract vulnerability detection is essential for maintaining blockchain ecosystem stability. Traditional methods depend extensively on expert-driven patterns, resulting in poor scalability. Although deep learning-based approaches have made significant progress, they still suffer from issues such as inflexible representations, insufficient feature modalities, and limited model capabilities. In this paper, we propose FSGDec, a novel smart contract vulnerability detection framework that fuses sequential information and structural features at the bytecode level. Firstly, an efficient node embedding method is developed for contract control flow graphs, flexibly processing node sequences and incorporating node-specific semantic information associated with weaknesses. Then, by modeling node features as time series signals, an adaptive graph wave network is introduced to automatically capture vulnerability-related structural features. Finally, a classifier is deployed to perform bug detection utilizing the extracted graph-level features that integrate semantic information. Evaluated on two real-world smart contract datasets, the experimental results demonstrate that FSGDec achieves superior performance compared to state-of-the-art baselines.

Domain fronting is a covert communication technique, which evades detection by connecting with legitimate domains to imitate normal network traffic. But the imitation is flawed, so current detection methods usually treat domain fronting as abnormal traffic. However, these methods show very low precision due to normal-abnormal traffic imbalance in practice. In the paper, we find that domain fronting’s imitation is limited to popular applications (apps), such as Chrome and Firefox browser. Thus, we mitigate traffic imbalance by defining domain fronting detection as an app discrimination problem, rather than previous anomaly detection task.According to the revised definition, we propose FakeApp, a high-precision method for domain fronting detection in real networks. Using frequent item analysis, FakeApp first extracts the imitated app information from domain fronting tools as symbolic features. Then, through deep neural networks, it discriminates whether traffic belongs to genuine or spoofed apps. Finally, FakeApp integrates symbolic features and neural networks together to identify domain fronting in real networks. Evaluations over 2 million flows show that the precision of FakeApp is over 95%, far surpassing state-of-the-art methods on four domain fronting tools. These results also indicate that we have effectively mitigated the traffic imbalance issue.

Website fingerprinting (WF) attacks exploit distinctive traffic patterns to identify the specific web page a user visits over anonymized connections. While traditional WF attacks have achieved impressive results, they are typically evaluated in abundant labeled data settings and assume that website traffic features remain static. This assumption is often unrealistic in real-world scenarios. Recent methods either rely on deep learning, which still requires large amounts of labeled data, or employ self-supervised pre-training to ease this demand. However, they leave clustering information crucial for few-shot WF attacks underexplored, leaving ample room for performance gains. In this paper, we propose a novel self-supervised pre-training model for few-shot WF attacks, called Swapped Contrastive Clustering (SwCC). SwCC proposes a comprehensive and principled data augmentation scheme, combining Tor-tailored transformations with statistical procedures to foster robust and discriminative feature learning for WF attacks. SwCC further introduces an innovative dual-level contrastive learning framework that jointly leverages instance-level and prototype-based objectives, which can further perform latent-space clustering on extracted features in WF attacks. Our pre-trained model can be fine-tuned in few-shot learning scenarios and achieves state-of-the-art(SOTA) performance on few-shot WF attack tasks. Under a 5-shot learning setting in a closed-world scenario, our SwCC achieves up to 83.5% accuracy when the evaluation traces are collected from an environment unseen by the WF adversary, outperforming the SOTA methods.

Due to the growing demand for privacy protection, encrypted tunnels have become increasingly popular among mobile app users, which brings new challenges to app fingerprinting (AF)-based network management. Existing methods primarily transfer traditional AF methods to encrypted tunnels directly, ignoring the core obfuscation and re-encapsulation mechanism of encrypted tunnels, thus resulting in unsatisfactory performance. In this paper, we propose DecETT, a dual decouple-based semantic enhancement method for accurate AF under encrypted tunnels. Specifically, DecETT improves AF under encrypted tunnels from two perspectives: app-specific feature enhancement and irrelevant tunnel feature decoupling. Considering the obfuscated app-specific information in encrypted tunnel traffic, DecETT introduces TLS traffic with stronger app-specific information as a semantic anchor to guide and enhance the fingerprint generation for tunnel traffic. Furthermore, to address the app-irrelevant tunnel feature introduced by the re-encapsulation mechanism, DecETT is designed with a dual decouple-based fingerprint enhancement module, which decouples the tunnel feature and app semantic feature from tunnel traffic separately, thereby minimizing the impact of tunnel features on accurate app fingerprint extraction. Evaluation under five prevalent encrypted tunnels indicates that DecETT outperforms state-of-the-art methods in accurate AF under encrypted tunnels, and further demonstrates its superiority under tunnels with more complicated obfuscation. Project page: https://github.com/DecETT/DecETT

Laser powder bed fusion (LPBF) is an additive manufacturing process capable of producing intricate structures with high accuracy. Despite this capability, it struggles to achieve the required reliability for mass production—specifically the stability of a production run and repeatability across multiple runs. Parameter optimization, which adjusts process parameters to regulate a specific quantity of interest (QoI), is a crucial means of quality control. Existing methods, however, have not adequately addressed both random and systematic factors in the LPBF process. The stochastic nature of the process is often neglected under the assumption that identical parameter inputs will consistently yield the same QoI. This deviates from reality and is not intended to reduce potential variations in the QoI. Moreover, many studies do not incorporate the systematic neighboring effects between scan tracks into their optimization, so process reliability cannot be guaranteed. To address this issue, this study focuses on optimizing the probability distribution of the QoI. The key idea is not only to increase the likelihood of achieving the ideal QoI but also to reduce its variance. This is achieved by uncertainty-aware modeling and optimization of the LPBF process using machine learning. Specifically, the problem is formulated as maximizing the posterior distribution of scan parameters given an ideal QoI sequence and historical manufacturing data, yielding a large-scale constrained optimization problem. A stochastic, distributed, gradient-based method is proposed to solve this problem, where a coarse-to-fine strategy plays a critical role in accelerating convergence. A case study is then conducted to stabilize the melt pool volume by optimizing laser powers. The solutions are verified in a calibrated finite element-based simulation environment, in which the variations of the melt pool volume are effectively reduced both within a single run and across multiple runs. The implementation of our method is available at https://github.com/qihangGH/uncertainty_aware_param_optim_for_AM.

The widespread adoption of laser powder bed fusion (LPBF) additive manufacturing is hampered by process unreliability problems. Modeling the melt pool behavior in LPBF is crucial to develop process control methods. While data-driven models linking melt pool dynamics to specific process parameters have shown appreciable advancements, existing models often oversimplify these relationships as deterministic, failing to account for the inherent instability of LPBF processes. Such simplifications can lead to overconfident and unreliable predictions, potentially resulting in erroneous process decisions. To address this critical issue, we propose a probabilistic data-driven approach to melt pool modeling that incorporates process noise and uncertainty. Our framework formulates a problem that includes distribution approximation and uncertainty quantification. Specifically, the Gaussian distribution with higher order priors, aided with variational inference and importance sampling, is used to approximate the probability distribution of melt pool characteristics. The uncertainty inherent in both LPBF process data and the modeling approach itself are then decomposed and approximated by using Monte Carlo sampling. The melt pool model is improved further by using a novel grid-based representation for the neighborhood of a fusion point, and a neural network architecture designed for effective feature fusion. This approach not only refines the accuracy of the model but also quantifies the uncertainty of the predictions, thereby enabling more informed decision-making with reduced risk. Two potential applications, including LPBF process planning and anomaly detection, are discussed. The implementation of our model is available athttps://github.com/qihangGH/probabilistic_melt_pool_model. Note to Practitioners—Modeling the melt pool behavior in laser powder bed fusion (LPBF) processes is pivotal for enhancing its quality control. However, a problem is that most existing data-driven melt pool models learn melt pool behavior with a deterministic function, which predicts the same outputs if its inputs are the same. This deviates from the reality and neglects the uncertainty in LPBF processes. As a consequence, the quality control methods based on such melt pool models lack required reliability. In response to these challenges, this work proposes to model melt pool behavior by using probability distributions with deep learning techniques, which can quantify the uncertainty in both LPBF process data and data-driven models. Aided with an elegantly designed representation for the neighborhood of a fusion point as model input, and a neural network architecture that fuses multi-modal data, the proposed model achieves accurate melt pool size prediction results. More importantly, this work quantifies and decomposes the prediction uncertainty. By accounting for noise and parameter variations, the probabilistic modeling models developed herein offer a more robust foundation for LPBF quality control than the existing ones. They can be readily applied by practitioners to perform improved process planning, defect prognosis, and real-time anomaly detection tasks.

3-D printing, or additive manufacturing (AM), leverages 3-D computer-aided design models and numerical control to produce objects layer-by-layer, playing a key role in Industry 4.0 and Industry 5.0. Despite its potential to revolutionize manufacturing by creating complex structures more efficiently and cost-effectively, 3-D printing still faces quality issues due to a lack of sufficient data, resulting in improper process parameter settings and poor analyzability. This work introduces a data-driven and physics-assisted machine learning (DP-ML) approach for a 3-D-printed BeltClip object, integrating finite element analysis (FEA) and physics-informed machine learning (PIML). The proposed DP-ML framework provides a cost-effective and time-efficient data collection method using Digimat-AM and a warpage classification algorithm. The data collection begins with obtaining the STereoLithography (STL) file of the BeltClip object from Thingiverse and slicing it in Ultimaker© Cura, considering process parameters such as infill amount, toolpath pattern, layer height, print speed, and extrusion temperature. The resulting G-code file is then input into Digimat-AM for further parameter setting and analysis. In Digimat-AM, glass fiber-filled and unfilled material types are set, undergoing the virtual 3-D printing process, followed by a warpage analysis of the printed BeltClip. The collected 3-D printing data is used to build ML models—deep neural network (DNN), decision tree (DT), support vector machine (SVM), logistic regression (LR), and random forest. The DNN contains three architectures—DNN-1, DNN-2, and DNN-3. Based on the metrics of precision, recall, F1-score, and accuracy, DNN-3 outperforms the others and is chosen for the warpage classification algorithm. The presented DP-ML approach is compared with the state-of-the-art methods and shows a promising capability to predicting warpage, optimizing process parameters, and improving the overall quality and efficiency of a 3-D-printed BeltClip.

Encrypted traffic classification is highly challenging in network security due to the need for extracting robust features from content-agnostic traffic data. Existing approaches face critical issues: (i) Distribution drift, caused by reliance on the closedworld assumption, limits adaptability to real-world, shifting patterns; (ii) Dependence on labeled data restricts applicability where such data is scarce or unavailable. Large language models (LLMs) have demonstrated remarkable potential in offering generalizable solutions across a wide range of tasks, achieving notable success in various specialized fields. However, their effectiveness in traffic analysis remains constrained by challenges in adapting to the unique requirements of the traffic domain. In this paper, we introduce a novel traffic representation model named Encrypted Traffic Out-of-Distribution Instruction Tuning with LLM (ETooL), which integrates LLMs with knowledge of traffic structures through a self-supervised instruction tuning paradigm. This framework establishes connections between textual information and traffic interactions. ETooL demonstrates more robust classification performance and superior generalization in both supervised and zero-shot traffic classification tasks. Notably, it achieves significant improvements in F1 scores: APP53 (I.I.D.) to 93.19%(6.62%↑) and 92.11%(4.19%↑), APP53 (O.O.D.) to 74.88%(18.17%↑) and 72.13%(15.15%↑), and ISCX-Botnet (O.O.D.) to 95.03%(9.16%↑) and 81.95%(12.08%↑). Additionally, we construct NETD, a traffic dataset designed to support dynamic distributional shifts, and use it to validate ETooL’s effectiveness under varying distributional conditions. Furthermore, we evaluate the efficiency gains achieved through ETooL’s instruction tuning approach.

Traffic encryption is widely used to protect communication privacy but is increasingly exploited by attackers to conceal malicious activities. Existing malicious encrypted traffic detection methods rely on large amounts of labeled samples for training, limiting their ability to quickly respond to new attacks. These methods also are vulnerable to traffic obfuscation strategies, such as injecting dummy packets. In this paper, we proposeSmartDetector, a robust malicious encrypted traffic detection method via contrastive learning. We first propose a novel traffic representation named Semantic Attribute Matrix (SAM), which can effectively distinguish between malicious and benign traffic. We also design a data augmentation method to generate diverse traffic samples, which makes the detection model more robust against different traffic obfuscation strategies. We propose a malicious encrypted traffic classifier that first pre-trains a model via contrastive learning to learn deep representations from unlabeled data, then fine-tunes the model with a supervised classifier to achieve accurate detection even with only a few labeled samples. We conduct extensive experiments with five public datasets to evaluate the performance of SmartDetector. The results demonstrate that it outperforms the state-of-the-art (SOTA) methods in three typical scenarios. Specifically, in the evasion attack detection scenario, SmartDetector achieves an F1 score and AUC above 93%, with average improvements of 19.84% and 18.17% over the SOTA method, respectively.

A radiance field is an effective representation of 3D scenes, which has been widely adopted in novel-view synthesis and 3D reconstruction. It is still an open and challenging problem to evaluate the geometry, i.e., the density field, as the ground-truth is almost impossible to obtain. One alternative indirect solution is to transform the density field into a point-cloud and compute its Chamfer Distance with the scanned ground-truth. However, many widely-used datasets have no point-cloud ground-truth since the scanning process along with the equipment is expensive and complicated. To this end, we propose a novel metric, named Inverse Mean Residual Color (IMRC), which can evaluate the geometry only with the observation images. Our key insight is that the better the geometry, the lower-frequency the computed color field. From this insight, given a reconstructed density field and observation images, we design a closed-form method to approximate the color field with low-frequency spherical harmonics, and compute the inverse mean residual color. Then the higher the IMRC, the better the geometry. Qualitative and quantitative experimental results verify the effectiveness of our proposed IMRC metric. We also benchmark several state-of-the-art methods using IMRC to promote future related research. Our code is available at https://github.com/qihangGH/IMRC.

Different from the Composed Image Retrieval task that requires expensive labels for training task-specific models, Zero-Shot Composed Image Retrieval (ZS-CIR) involves diverse tasks with a broad range of visual content manipulation intent that could be related to domain, scene, object, and attribute. The key challenge for ZS-CIR tasks is to learn a more accurate image representation that has adaptive attention to the reference image for various manipulation descriptions. In this paper, we propose a novel context-dependent mapping network, named Context-I2W, for adaptively converting description-relevant Image information into a pseudo-word token composed of the description for accurate ZS-CIR. Specifically, an Intent View Selector first dynamically learns a rotation rule to map the identical image to a task-specific manipulation view. Then a Visual Target Extractor further captures local information covering the main targets in ZS-CIR tasks under the guidance of multiple learnable queries. The two complementary modules work together to map an image to a context-dependent pseudo-word token without extra supervision. Our model shows strong generalization ability on four ZS-CIR tasks, including domain conversion, object composition, object manipulation, and attribute manipulation. It obtains consistent and significant performance boosts ranging from 1.88% to 3.60% over the best methods and achieves new state-of-the-art results on ZS-CIR. Our code is available at https://anonymous.4open.science/r/Context-I2W-4224/.

Website classification proves crucial for tasks like malicious website detection and information management. Current methods typically focus on effective feature extraction and algorithm selection to create balanced website datasets, often leading to decreased performance due to data imbalance. In this study, we propose an intelligent website classification method(WebPromptM2) based on prompt-based learning with multimodal features. We design a prompt template which incorporates the textual and visual elements of the website, thereby facilitating a multimodal representation of the website, then leverage domain-specific expertise to establish mapping relationships between website categories and a label word set. Finally, we fine-tune the masked pre-trained language model (PLM) and map the prediction results to the categories. We find that our method increases recognition accuracy of tail classes and achieves superior performance on long-tail and short-tail datasets.

Recent trends in Large Vision Language Models (LVLMs) research have been increasingly focusing on ad-vancing beyond general image understanding towards more nuanced, object-level referential comprehension. In this paper, we present and delve into the self-consistency ca-pability of LVLMs, a crucial aspect that reflects the mod-els' ability to both generate informative captions for spe-cific objects and subsequently utilize these captions to ac-curately re-identify the objects in a closed-loop process. This capability significantly mirrors the precision and reli-ability of fine- grained visual-language understanding. Our findings reveal that the self-consistency level of existing LVLMs falls short of expectations, posing limitations on their practical applicability and potential. To address this gap, we introduce a novel fine-tuning paradigm named Self-Consistency Tuning (SC-Tune). It features the syn-ergistic learning of a cyclic describer-locator system. This paradigm is not only data-efficient but also exhibits gener-alizability across multiple LVLMs. Through extensive ex-periments, we demonstrate that SC- Tune significantly ele-vates performance across a spectrum of object-level vision-language benchmarks and maintains competitive or im-proved performance on image-level vision-language bench-marks. Both our model and code will be publicly available at https://github.com/ivattyue/SC-Tune.

With the rapid growth of encrypted traffic, methods that use side-channel information to monitor online user behavior have emerged, known as Website Fingerprinting (WF) attacks. These attacks pose a significant threat to the privacy of users’ online activities. To address the threat posed by various WF attacks to network behavior privacy, current methods lack defenses based on the source/target misclassification of traffic. Our goal is to design a WF defense method that transforms the side-channel information of the given original category traffic into that of another category to counter existing DNN-based WF attacks. We utilize adversarial examples and employ a Generative Adversarial Network (GAN) incorporating a WF model to generate perturbations. These perturbations are overlaid onto the given traffic, morphing it into traffic of another category, thereby enhancing the privacy of network behavior. We refer to the proposed method as the Traffic Morphing Generative Adversarial Network (TMGAN). Experimental results demonstrate that this method effectively counters most WF attacks, enhancing the privacy of users’ online behavior. In white-box scenarios, it achieves average perturbation rates of 90-99% and morphing rates of 31-75%. In black-box scenarios, it achieves average perturbation rates of 95-98% and morphing rates of 5-28%.

With the widespread use of tunnel technology, the volume of encrypted tunnel traffic is rapidly increasing. Malicious users can transmit harmful information secretly through tunnels to bypass firewall censorship. Therefore, developing effective techniques to identify tunnel user behaviors is crucial. However, current efforts in tunnel traffic classification primarily focus on coarse-grained application identification and encounter the problem of insufficient extraction of tunnel traffic feature information. In this paper, we refine the previous tunnel traffic identification granularity from prevalent application identification to behavior identification, and propose TF-Net, a novel deep learning framework for fine-grained identification of tunnel user behaviors. TF-Net extracts features from raw bytes, packet length sequence, packet time interval sequence of tunnel traffic. It employs self-supervised pre-training to learn contextual distributions of raw bytes from unlabeled datasets, thereby enhancing the model’s ability to characterize packets in a tunnel flow. Moreover, we fine-tune the model based on the classification objectives of different tasks to achieve more versatile and accurate tunnel identification. Comprehensive experiments are conducted on three real-world encrypted tunnel traffic datasets, demonstrating that TF-Net achieves outstanding performance and outperforms state-of-the-art methods.

Preference-based Reinforcement Learning (PbRL) circumvents the need for reward engineering by harnessing human preferences as the reward signal. However, current PbRL methods excessively depend on high-quality feedback from domain experts, which results in a lack of robustness. In this paper, we present RIME, a robust PbRL algorithm for effective reward learning from noisy preferences. Our method utilizes a sample selection-based discriminator to dynamically filter out noise and ensure robust training. To counteract the cumulative error stemming from incorrect selection, we suggest a warm start for the reward model, which additionally bridges the performance gap during the transition from pre-training to online training in PbRL. Our experiments on robotic manipulation and locomotion tasks demonstrate that RIME significantly enhances the robustness of the state-of-the-art PbRL method. Code is available at https://github.com/CJReinforce/RIME_ICML2024.

Detecting malware in Internet of Things (IoT) networks is crucial for ensuring IoT security. Machine learning based Network Intrusion Detection System (NIDS) has been proven to be effective, but it faces the challenge of achieving high computational efficiency. Previous feature selection methods improve the efficiency of NIDS by removing redundant features. However, these methods fail to consider the significant disparity in computational cost among different traffic features, so they are not fully applicable for resource-constrained environment. To address this issue, we propose a novel framework RecoSelector to select traffic features in a cost-sensitive manner for NIDS. RecoSelector aims to effectively select feature subsets with strong detection capability and low computational cost. Firstly, we quantify and analyze the feature construction cost among IoT short flows, IoT long flows and cross platform flows from 6 scenarios. Based on the flows, we generate computational-loss of 69 flow features through flow transmission frequency. Secondly, we propose Particle Initialization based on Orthogonal Sparse Vector (PIOSV) to optimize search direction and increase the possibility of finding a global optimal solution. Finally, we design an elaborate fitness function RecoFitness, aiming to carry out multi-objective optimization, for iterative selection. We obtain flow feature cost in a real resource-constrained environment. Experiments demonstrate that RecoSelector exhibits superior performance with spending only 3% to 60% of the computational time cost while achieving comparable F1 scores compared to existing methods.

Smart contracts have been increasingly deployed and applied on various blockchain platforms. Nevertheless, vulnerabilities may cause significant financial losses due to the involvement of substantial funds in smart contracts. Traditional analysis tools heavily rely on manually predefined rules. Recent studies have demonstrated the promising potential of deep learning techniques in smart contract vulnerability detection. However, existing approaches often disregard cross-function and cross-contract vulnerability scenarios, focusing primarily on characterization or detection tasks at the function level. In this study, we propose CL-HGAN, a novel framework for smart contract vulnerability detection at the contract level. Firstly, we construct a contract-level heterogeneous graph to embody the relationships between contracts and functions. Specifically, we build the backbone of the heterogeneous graph based on the abstract syntax tree (AST) and multiple types of edges and then incorporate two additional categories of edges to augment its structural information. Subsequently, we design a two-phase feature learning method to automatically generate graph-level representations based on a heterogeneous graph attention network and meta-paths specific to the constructed graph. Finally, we employ a classifier to perform vulnerability detection tasks. In particular, the proposed CL-HGAN comprehensively captures vulnerability features and accurately identifies vulnerabilities at the contract level. Furthermore, we evaluate the CL-HGAN framework on an Ethereum smart contract dataset containing thirty types of vulnerabilities. The experimental results show that the average metrics of our approach outperform the state-of-the-art baselines.

Accurately forecasting the future paths of numerous agents is vital for the efficacy of autonomous systems. In crowded scenarios such as sidewalks, subways and airports, pedestrians instinctively modify their motion pattern in response to the environmental context and social consensus like preserving personal space and circumventing physical contact. Thus, the task to predict future pedestrian trajectory presents considerable challenges owing to the complex interaction among agents and the inherent uncertainty in predicting each agent's subsequent actions. Inspired by the recent success of Graph Neural Networks (GNN), a model named DATraj is introduced for predicting pedestrian trajectory. DATraj first uses a temporal encoder composed of attention mechanism to capture the spatial-temporal dynamics of pedestrians. The encoder can learn the motion pattern and subtle movement of pedestrian in the crowded scenario. Graph Attention Networks (GAT) is used in many models to catch social interaction between individuals. However common GATs compute a static attention: the ranking of the attention scores is unconditioned on the query node. DATraj implement the global interaction parts using the improved dynamic attention which every query uniquely prioritizes the attention coefficients correlated with the keys, this provides a much better robustness to noise. Experiments show that our trajectory prediction model achieves better performance on several public datasets.

Current text-video retrieval methods mainly rely on cross-modal matching between queries and videos to calculate their similarity scores, which are then sorted to obtain retrieval results. This method considers the matching between each candidate video and the query, but it incurs a significant time cost and will increase notably with the increase of candidates. Generative models are common in natural language processing and computer vision, and have been successfully applied in document retrieval, but their application in multimodal retrieval remains unexplored. To enhance retrieval efficiency, in this paper, we introduce a model-based video indexer named T2VIndexer, which is a sequence-to-sequence generative model directly generating video identifiers and retrieving candidate videos with constant time complexity. T2VIndexer aims to reduce retrieval time while maintaining high accuracy. To achieve this goal, we propose video identifier encoding and query-identifier augmentation approaches to represent videos as short sequences while preserving their semantic information. Our method consistently enhances the retrieval efficiency of current state-of-the-art models on four standard datasets. It enables baselines with only 30%-50% of the original retrieval time to achieve better retrieval performance on MSR-VTT (+1.0%), MSVD (+1.8%), ActivityNet (+1.5%), and DiDeMo (+0.2%). The code is available at https://github.com/Lilidamowang/T2VIndexer-generativeSearch.

Recent work shows that documents from encyclopedias serve as helpful auxiliary information for zero-shot learning. Existing methods align the entire semantics of a document with corresponding images to transfer knowledge. However, they disregard that semantic information is not equivalent between them, resulting in a suboptimal alignment. In this work, we propose a novel network to extract multi-view semantic concepts from documents and images and align the matching rather than entire concepts. Specifically, we propose a semantic decomposition module to generate multi-view semantic embeddings from visual and textual sides, providing the basic concepts for partial alignment. To alleviate the issue of information redundancy among embeddings, we propose the local-to-semantic variance loss to capture distinct local details and multiple semantic diversity loss to enforce orthogonality among embeddings. Subsequently, two losses are introduced to partially align visual-semantic embedding pairs according to their semantic relevance at the view and word-to-patch levels. Consequently, we consistently outperform state-of-the-art methods under two document sources in three standard benchmarks for document-based zero-shot learning. Qualitatively, we show that our model learns the interpretable partial association. Code is available at https://github.com/MorningStarOvO/EmDepart.

One attack method that actively deploys smart contract honeypots has recently become popular. A contract honeypot is a smart contract that pretends to have vulnerabilities, enticing victims who call the contract to lose funds. However, previous works detected contract honeypots by individual characteristics, such as codes and ledger details. They overlooked the connection between the two parties in the transaction. Therefore, we propose the HoneyRank algorithm, which uses known honeypots as initial seeds to construct a contract honeypot transaction relationship network (HoneyNet) and source code text similarity detection to discover 0-day honeypots that previous work missed in the same detected block height range. This low-cost method detects only a few highly suspicious smart contracts and does not require machine learning training. Specifically, we trace transaction history data to collect the accounts and relationships of honeypot seeds, attackers, and victims and construct a HoneyNet. Based on transaction behavior inference, we label and calculate the source code similarity between high-risk smart contracts and ground truth honeypots. Finally, we select the high-similarity smart contracts to confirm honeypots manually. Besides, we analyze the criminal associations in a HoneyNet. As far as we know, we are the first to construct a HoneyNet and use it to find new honeypots. These honeypots visually reveal the potential connections between the attackers (creators of the honeypot) and the victims. We discovered 54 0-day honeypots never found by previous methods and mined 11 attacker communities composed of attackers and puppet accounts for the first time.

Abstract Since the traffic of novel attacks exceeds current knowledge, realistic traffic labeling methods are prone to mislabeling, which has a significant impact on machine learning-based intrusion detection systems. Data cleaning typically relies on the ability of supervised deep neural networks to learn correct knowledge. Under high noise conditions, noisy labels can affect a supervised network and render it ineffective. To clean traffic datasets under high noise conditions, we propose an unsupervised learning-based data cleaning framework (called ULDC) that does not rely on labels and powerful supervised networks, hence reducing the impact of noisy labels. ULDC evaluates the confidence of observed labels through the distribution and similarity of samples in low dimensions. Moreover, ULDC maximizes the retention of hard samples through adaptive intra-class threshold evaluation, preserving more hard samples for training and improving generalization. In evaluations of ULDC on the CIRA-CIC-DoHBrw-2020 dataset, the percentage of data correction reached more than 75% under high noise, which is better than that of the state-of-the-art methods. ULDC is applicable to traffic data cleaning in both traditional networks and novel networks such as the Internet of Things and mobile networks, and it has been validated on datasets including CIC-IDS-2017 and IoT-23.

Additive manufacturing (AM) can build up complex parts in a layer-by-layer manner, which is a kind of novel and flexible production technology. The special manufacturing capability of AM shows great application potential in various fields. However, an open-loop control method cannot guarantee the reliability and repeatability of an AM process. Defects often occur to deteriorate product quality and lead to material and time waste, which hinders the development of AM industry. In this regard, a lot of efforts have been made to make an AM process more controllable. This work proposes an AM control framework that divides the related studies into three feedback loops, including the in-situ monitoring of process defects, fault diagnosis of 3-D printers, and closed-loop control of an AM process. These three loops constitute the inspection and control of AM from the machine level to product level. Specifically, the measurement requirements for monitoring techniques, defect detection, fault diagnosis, and closed-loop control are summarized. The challenges and future trends in realizing a more reliable and repeatable AM process are discussed. Note to Practitioners—This survey is motivated by urgent need to solve product quality problems in additive manufacturing (AM) caused by open-loop control. Three feedback loops can be established to solve them. The first one is defect detection that inspects part quality during fabrication. The second one is the fault diagnosis of a 3-D printer that monitors the health and operation conditions of its actuators. The last one is closed-loop control that improves AM process reliability and repeatability by regulating process variables in real time. These three loops are all based on the feedback signals of in-situ monitoring systems. This paper reviews the related studies and provides guidance for establishing the monitoring systems, performing defect detection and fault diagnosis, and designing closed-loop control systems, which helps realize more reliable and repeatable AM.

Multiview 3-D reconstruction holds considerable promise across a wide applications in social manufacturing. Conducting in-depth research on precise and robust multiview 3-D reconstruction holds the potential to significantly empower the domain of social manufacturing. Recently, there has been a burgeoning interest in the domain of neural implicit surfaces learning through volume rendering for the purpose of multiview reconstruction without 3-D supervision. Conventional approaches often overlook explicit multiview geometry constraints, resulting in shortcomings in generating consistent surface reconstructions and recovering fine details. To solve this, we propose geometry-guided neural implicit surface (GG-NeuS), a geometry-guided neural implicit surfaces learning method for multiview surface reconstruction. Our model places a stronger emphasis on maintaining geometry consistency, significantly enhancing the quality of reconstruction. First, we enforce multiview geometry constraints on the surface points by locating the zero-level set of signed distance function (SDF). Second, we incorporate normal cues, predicted by general-purpose monocular estimators, to substantially recover fine geometric details. Additionally, we introduce a voxel-based surface reconstruction methodology that strikes an optimal balance between training time and reconstruction quality. Through comprehensive qualitative and quantitative experiments and analyses, we demonstrate thatGG-NeuSsuccessfully reconstructs fine-grained surface details and achieves superior surface reconstruction quality than state-of-the-art approaches.

The coronavirus disease 2019 (COVID-19) pandemic has changed the world deeply. Urban trajectory big data collected by wireless sensing devices provide great assistance for COVID-19 prevention. However, except for contact tracing, trajectory data are rarely employed in other preventative scenarios against the pandemic. In this article, we try to extend the application of trajectories auto-collected by wireless sensing devices and simulate the epidemic spread in a trajectory data-driven manner. After that, the effects of three nonpharmacological measures are quantified. In contrast to existing studies, additional requirements such as the complex topological networks are needless in our simulation, where the interactions between agents are derived by the intersections of their trajectories. Concretely, the dynamic of virus propagation among individuals is first modeled, and then an agent-based microsimulation environment is built as an artificial system to conduct the epidemic spread simulation. Finally, the trajectories are loaded into the agents as the reliance for their interactions, and the macroscopic changes under different interventions are revealed in a bottom–up way. As a case study, we conduct the simulation based on the trajectories in a real region, in which we find the following. 1) Among the three examined nonpharmacological interventions, community containment is more effective than keeping social distance, which can lower the deaths to nearly 1/9 compared to no action, while travel restrictions play limited roles. 2) There is a strong positive correlation between population densities and mortality. 3) The timing of community containment triggered by confirmed diagnoses is proportional to the number of deaths, thus early containment will significantly decrease mortality.

Additive manufacturing (AM), also called 3-D printing, is a supporting technology in social manufacturing that has gained significant attention recently. As the AM industry grows, collecting and analyzing data are essential to ensure product quality, process efficiency, and cost-effectiveness. However, obtaining experimental data is challenging owing to cost and time constraints. Therefore, cost-effective and time-efficient strategies for collecting AM data are urgently required. This study proposes a novel data-collection approach that integrates the concept of finite element analysis (FEA) and physics-informed machine learning (PIML). We begin by discussing the importance of data collection in AM and the associated challenges. We then present various types of data that can be collected in AM, including the 3-D models and end-to-end data. End-to-end data comprise experimental data (i.e., sensors and images) and simulation data. Moreover, we present a case study that demonstrates the generation of simulation data and provides a detailed analysis of warpage. The STereoLithography (STL) file format of the BeltClip object from the Thingiverse possesses slicing through the Ultimaker© Cura software. The resulting G-code file is input to the Digimat-AM platform for virtual simulation of the BeltClip printing process. Digimat-AM, as a FEA simulation tool, then generates observational sample data. These data function as a roadmap for understanding the application of physical information for learning, which constitutes the observational bias aspect of PIML. The observational data obtained from the Digimat-AM is suggested for building a machine-learning model. Finally, we conclude with a discussion of inductive and learning biases in the prediction, control, and optimization aspects of AM.

Digital light processing (DLP) is a popular additive manufacturing technology that uses light irradiation to fabricate 3-D devices via a projector to achieve laser-sensitive resin curing. However, the performance and reliability of DLP can be affected by internal defects such as printing errors and the accumulation of residual stress. Existing defect detection methods rely on monitoring the printed parts, which leads to resource wastage and struggles to effectively handle imbalanced defect data. In this article, we propose a defect detection method called dual neural network, which involves detecting defects in materials before the printing process to prevent resource wastage and serious consequences. Specifically, to handle the highly imbalanced class distribution problem in online DLP defect detection, dual neural network utilizes a domain learner and balance learner to effectively balance the information of the minority class and learn the generalization knowledge from the imbalanced defect dataset. Experimental results demonstrate the effectiveness of our proposed method, which has also been applied to real-world production equipment successfully.

Simulating human mobility contributes to city behavior discovery and decision-making. Although the sequence-based and image-based approaches have made impressive achievements, they still suffer from respective deficiencies such as omitting the depiction of spatial properties or ordinal dependency in trajectory. In this article, we take advantage of the above two paradigms and propose a semantic-guiding adversarial network (TrajSGAN) for generating human trajectories. Specifically, we first devise an attention-based generator to yield trajectory locations in a sequence-to-sequence manner. The encoded historical visits are queried with semantic knowledge (e.g., travel modes and trip purposes) and their important features are enhanced by the multihead attention mechanism. Then, we designate a rollout module to complete the unfinished trajectory sequence and transform it into an image that can depict its spatial structure. Finally, a convolutional neural network (CNN)-based discriminator signifies how “real” the trajectory image looks, and its output is regarded as a reward signal to update the generator by the policy gradient. Experimental results show that the proposed TrajSGAN model significantly outperforms the benchmarks under the MTL-Trajet mobility dataset, with the divergence of spatial-related metrics such as radius of gyration and travel distance reduced by 10%–27%. Furthermore, we apply the real and synthetic trajectories, respectively, to simulate the COVID-19 epidemic spreading under three preventive actions. The coefficient of determination metric between real and synthetic results achieves 91%–98%, indicating that the synthesized data from TrajSGAN can be leveraged to study the epidemic diffusion with an acceptable difference. All of these results verify the superiority and utility of our proposed method.

Threshold Elliptic Curve Digital Signature Algorithm (ECDSA) has attracted a lot of attention due to the wide applications of ECDSA in crypto asset. Although several variants of threshold signature protocols can provide functions, such as key generation and signing, they suffer from two shortfalls. First, these schemes only discuss a single signature computation task in a synchronous algorithm context, which is difficult to adapt to real crypto-asset applications, such as custody. Second, these schemes are computing intensive and not scalable, hence can hardly support large-scale processing operations in real life even after traditional optimization, such as multithreading, is applied. In this article, we propose an innovative computation method called asynchronous threshold ECDSA with batch processing, based on the interactive threshold signature protocols. The method provides a reliable solution for critical operational scenarios, such as threshold signing and distributed key generation (DKG) in crypto-asset custody, and can be a future reference in secure data distribution mechanisms. The performance and scalability of our methods are validated through a benchmark testing.

The quality of the dataset is critical to the performance of neural networks for error prediction in 3-D printing. In order to enlarge the dataset, we propose a customized two-stage framework, cascaded cross-modality generative adversarial networks (CCMGANs), for generating dental crown meshes in an unsupervised manner. At the first stage, a displacement map-guided generative adversarial network (GAN) is used to generate coarse meshes with diverse shapes. At the second stage, fine-grained details are added to the coarse meshes using an image-based GAN. Unlike previous work that integrates a differentiable renderer into the mesh deformation process directly, we adopt a two-step strategy. First, we use a depth image refinement module to achieve the domain transformation from the rendered depth images of the generated meshes to those of the real ones. Then, we propose a mesh refinement module to optimize the coarse meshes in an image-supervised manner. To alleviate the self-intersection problem, we propose a loss to penalize the distances of point pairs in self-intersection regions. Experimental results show that our method is able to generate highly realistic meshes and outperforms the state-of-the-art point cloud generation method TreeGCN in terms of the metrics FDD, MMD-CD, MMD-EMD, and COV-EMD. Furthermore, we utilize the generated data to augment the original dataset, and demonstrate that the generated data can effectively improve the accuracy of the error prediction task in 3-D printing.

Due to the limitations of the existing annotation methods, the prevalence of label noise can be caused in realistic malicious traffic datasets, which has a significant impact on the training and evaluation of deep learning-based intrusion detection models. Recently, various methods have been proposed to deal with noise-containing labeled datasets, and they can be roughly divided into two categories: data cleaning and robust training. However, the different processing ideas lead these two types of methods to ignore the information in different components of the dataset, resulting in a cliff-like drop in performance under high noise conditions. To this end, this study proposes a unified framework for handling noise malicious traffic based on the multidimensional constrained representations named MCRe, which unifies data cleaning and robust training into an ideal representation function approximation. According to the properties of the ideal representation function, information integrity constraints, cluster separability constraints and core proximity constraints are defined to drive MCRe to approximate the ideal representation during iteration. These constraints led MCRe to learn the individual, intra-class, and global levels of distributed knowledge, thus avoiding irrational domain knowledge extraction and ensuring strong label noise robustness of the representation network. We validated MCRe on a dataset that includes 22 types of realistic malicious traffic. Experimental results show that MCRe can outperform the state-of-the-art methods in both data cleaning and robust training downstream tasks, achieving 85% pure sample rate and 82% classification accuracy even under the condition of up to 90% noise labels. In addition, the generalizability of MCRe was verified on several public datasets. Finally, MCRe was also well-extended to enhance other data cleaning and robust training approaches.

Affected by people’s dynamic social activities, the imbalance between vehicle supply and demand in the Mobility-On-Demand(MOD) system is a common phenomenon. To improve traffic efficiency, an Auxiliary Network Enhanced Hierarchical Graph Reinforcement Learning (AHGRL) method is proposed for vehicle repositioning. Firstly, a hierarchical graph reinforcement learning (HGRL) framework is designed. The complex vehicle repositioning problem in real road networks is divided into many sub-tasks and multiple reinforcement learning algorithms are designed to solve decision problems of different levels. Traffic congestion is also considered and road nodes are clustered dynamically. And then an auxiliary graph reinforcement learning (AGRL) algorithm is designed for the actuator. It contains the prediction branch and the repositioning branch. States and rewards of agents could be designed accurately with the support of the prediction branch. The two branches cooperate in an auxiliary way to achieve excellent forecasting and repositioning effects. Finally, to enable efficient multi-vehicle coordination, a discrete Soft Actor-Critic algorithm is adopted in the repositioning branch, which learns multiple optimal actions for vehicles in the same area. Comparative experiments with real data demonstrate the effectiveness of our method. And ablation experiments verify the effectiveness and universality of the HGRL framework and the AGRL algorithm.

Phishing scams have become the most serious type of crime involved in Ethereum. However, existing methods ignore the natural camouflage and sparse distribution of phishing scams in Ethereum leading to unsatisfactory performance, and they are also limited by the data scale which cannot be applied to real-world dynamic scenarios. In this paper, we propose a Transaction Graph Contrast network (TGC) to enhance phishing scam detection performance on Ethereum. TGC inputs subgraphs instead of the entire graph for training, which eases the model’s requirements for machine configuration and data connectivity. Motivated by phishing nodes are surrounded by normal nodes, we design the comparison between node-level to help phishing nodes learn the unique properties of themselves different from their neighbors. Observing the small number and sparse distribution of phishing nodes, we narrow the distance between phishing nodes by comparing node context-level structures, so as to learn universal transaction patterns. We further combine the obtained features with common statistics to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TGC outperforms the state-of-the-art methods in detecting phishing addresses and has obvious advantages in large-scale and dynamic scenarios.

Encrypted traffic classification (ETC) is necessary for network security, which is the process of identifying encrypted network traffic into a specific class, thus there are numerous applications in the security of network. The rapid development of network web services (applications) makes it attractive to tackle classification of encrypted traffic in a continual learning environment. However, the traffic ambiguity and privacy leakage, restrict existing incremental approaches from achieving satisfactory results in the traffic. We introduce a prompt-based continual encrypted traffic classification method (PTC) in this research to progressively learn tasks under multiple process transitions. Prompts are tiny, learnable parameters that are stored in ram according to our suggested structure. The objective is to find the best way to use prompts to help models make predictions, keep both task-peculiar and task-constant knowledge in model, and prevent catastrophic forgetting. We carry out extensive tests using both real-world and open datasets. PTC method can strengthen the existing offline traffic classification works, make them adapt to online scenarios, and outperforms the SOTA online traffic classification method in three datasets. (by 4.54 %, 7.28 % and 11.68 % on three datasets, respectively)

DNS protocol is a plaintext domain name resolution protocol, which has the risk of privacy disclosure. DNS over HTTPS (DOH) protocol is designed to encrypt DNS traffic, which solves the privacy problem. However, many network attackers use the DOH tunnel for malicious transmission. From the passive traffic, there is no obvious difference between normal DOH traffic and DOH tunnel traffic, which brings great challenges to identify them. At present, researches mainly focus on the plaintext DNS covert tunnel, but less on the encrypted DOH tunnel. In this paper, we propose DOH covert tunnel detection method based on core features and machine learning method using two steps. Firstly, we detect DOH traffic according to the threshold of features. On this basis, we use core features and machine learning methods to detect tunnel traffic in all DOH traffic. Finally, we use self collected and public datasets to verify our method. The results show that the method achieves up to 99 % precision and recall that is superior to state of the art method.

Snowflake is a special proxy system against IP-based network blocking. As its IP addresses refresh frequently, faster than IP blacklist’s update, users can exploit it to access blocked websites. To block snowflake, existing methods focus on detecting snowflake proxies. But they are susceptible to various factors, for example, proxy’s location and version. In the paper, we propose a new manner to block snowflake. We observe that to adapt fast IP changes, users need to request latest proxies from proxy database before using snowflake. Thus, adversaries can block snowflake by detecting proxy request instead of proxy itself. To verify our method, we analyse covertness of snowflake proxy requests, that has been protected by imitating normal web requests. After comparing with typical web requests, we find the imitation is vulnerable in packet size, direction, time and network speed, such as, the latency time is higher than normal obviously. Using the four vulnerabilities, we train machine learning algorithm to detect snowflake proxy requests in reality. Experimental results demonstrate that proxy request can be detected accurately across different versions at the beginning of connection. In conclusion, our work paves a new way to block snowflake.

With the increasing number of traffic category, machine learning-based methods have gradually become the mainstream way of traffic classification to support network security and management. Machine learning-based methods require a large amount of high quality labelled data to learn network behavior patterns to achieve better recognition results. In the field of network traffic labeling, manual labeling can achieve more accurate labeling results, but the labeling efficiency is low and the labor cost is high. Deep packet inspection (DPI) technology can greatly improve labeling efficiency and reduce labor costs, but DPI labeling suffers from the problem of inaccurate and incomplete labeling. In this paper, we propose a recurrent self-learning framework (RSL-Labeler) for traffic labeling, which can solve the problem of inaccurate and incomplete DPI labeling. This framework consists of three components: high-quality data generation, class behavior pattern learning, and confidence filtering. Based on high-quality data labeled by multiple DPIs, we build three classifiers to learn the behavior patterns of DPI labeling intelligently from three perspectives. Then, we propose the idea of confidence filtering, which combines the pseudo-labeled data and the confidence values of three learning models to filter the credible samples by combined voting. These samples are added to the self-learning model for recurrent training. Experiments show that our method is able to label application traffic with accuracy of 99%, which is at least 8% better than single DPI.

With rapid development of mobile Internet, a great number of mobile applications has emerged, presenting a great explosion in mobile Internet traffic. Therefore, accurate classification of application traffic is necessary to more effectively manage mobile Internet traffic. However, the encryption of mobile application traffic gradually eliminates traditional classification approaches based on specific signatures, greatly increasing the difficulty of the classification of mobile application traffic. Therefore, we propose a novel multi-feature fusion (MFF)- based approach to enhance the accuracy of mobile application traffic classification. We also extract packet length sequence, byte sequence, statistical feature, etc. Then, we perform weighted fusions of features based on Relief-F algorithm to achieve the best set of features. Finally, we use machine learning techniques for application classification. Compared to several other feature extraction methods, MFF achieves an excellent performance with an accuracy of 97.6% for 16 mobile applications and a F1-score of over 99% for VPN-nonVPN.

Tor bridges are hidden entrances of Tor network. Users can exploit bridges to hide their visits of Tor. To restrict hidden Tor visits, many attacks focus on bridge information discovery or bridge traffic detection. But these attacks are less effective because bridges' information cannot be discovered thoroughly and its traffic are often obfuscated. In the paper, we present a novel attack to stop hidden Tor visits. We observe that users need to request information of bridges from a database before visiting Tor network. Thus, attackers can stop Tor visits by detecting the process of bridge requests rather than bridge itself. To verify our attack's feasibility, we analyse covertness of the most widely-used bridge request tool, which imitates normal network request when communicating with bridge database. After comparing with five types of typical web request, we find that this tool fails to imitate in packet time, size and direction, for example, the variation of simulated packet sizes are more dynamic than normal. Based on the three imitation vulnerabilities, we train machine learning algorithms to detect bridge request. Extensive experiments demonstrate that bridge request can be identified with high accuracy and very low false-positive rates in real-world. In conclusion, our work paves a new way to block evasive Tor visits.

Due to its excellent performance in privacy protection, federated learning (FL) technology is gradually introduced into the IoT environment to build a distributed intrusion detection framework. However, the previous frameworks have two limitations: 1) high communication overhead caused by the frequent exchange of model parameters is not friendly for resource-constrained IoT devices; 2) single global model hardly handles not independent and identically distributed (Non-IID) intrusion data on different IoT clients. In this paper, we propose a Federated Multi-Prototype intrusion detection framework (FedMP) to address the above limitations. Specifically, FedMP includes a k-means clustering module that extracts low-dimensional local prototypes for IoT clients and a novel aggregation algorithm that fairly aggregates all local prototypes on the central server to generate global prototypes. By exchanging prototypes instead of model parameters between IoT clients and the central server, FedMP aims to train a unique personalized model for each IoT client to adapt to its local intrusion detection tasks. Experimental results on real-world intrusion detection datasets show that FedMP achieves the best detection performance in Non-IID scenarios while significantly reducing communication overhead compared to other state-of-the-art methods.

Encrypted network traffic classification (ENTC) is crucial in fields including network cyberspace security, network administration and service quality. Combining the machine learning algorithms with manual-designed burst features has been studied extensively in the ENTC community. However, these features depend on professional experience heavily, which needs lots of human effort. These hand-crafted features are task-oriented and incomplete in various complex tasks. What's more, they are also affected by the potential network jitters. In this paper, we propose a novel encrypted traffic classification method FA-Net to mine burst features. We adopt two hierarchical multi-head self-attention encoders to enumerate all potential intra-burst features and inter-burst dependencies completely, and select the optimal associations automatically. For more robust against network jitter, we design an additional burst positional encoding to loose the model's sensitivity about out-of-order packets within bursts. We evaluate the FA-Net on multiple datasets, including website and mobile application classification tasks. The results show the FA-Net model outperforms other state-of-the-art methods in all the datasets, even gains more than 5% absolute improvement in accuracy. Additionally, the quantitative measurements about burst feature similarity show that the burst features learned by FA-Net exhibits more intraclass similarity and more inter-class separation.

The task of user identity linkage across social networks aims to predict whether users from different social networks refer to the same person. This task plays a crucial role in cross-social network information dissemination and intelligent recommendations. However, existing user identity linkage tasks suffer from several challenges: 1) excessive reliance on social network topology, neglecting users’ visual modality information; 2) inadequate handling of noise in user feature data; and 3) ineffective fusion of users’ multimodal information. To address these issues, we investigated a method that utilizes heterogeneous multimodal posts, including user-generated text, images, and check-in messages, to achieve user identity linkage across social networks. We innovatively leveraged a pre-trained model for image-to-text conversion to further explore users’ image data and proposed an adversarial learning model based on the multimodal self-attention mechanism (AMSA). The AMSA model consists of four components: user feature extraction, user feature processing, user feature fusion, and adversarial learning. Specifically, AMSA initially employed advanced pre-trained models to extract features from multiple modalities of users, including images and text. Subsequently, it utilized multiple mechanisms, such as multi-head self-attention, to process data from each modality separately and then fused them into user representation vectors. Finally, AMSA employed adversarial learning to enhance the model’s learning capacity and mitigate semantic disparities in user information across different platforms. We conducted model performance evaluations on publicly available datasets, and experimental results demonstrated the superiority of the proposed AMSA model.

Industrial Control System (ICS) devices with Internet-accessible IP addresses are critical to the smooth functioning of industries, power grids, and other critical infrastructures. Previous methods used to identify ICS devices exposed to the Internet often ignored these remotely managed devices. Specifically, these systems, which do not openly provide ICS-specific port services, remain undetected during Internet-wide scans for such services. The existing method for scanning and discovering this part of remote management devices has a single feature extraction, and discovering such remote management devices is inefficient. In this paper, we propose a novel strategy dedicated to identifying exposed remote managed devices on the Internet by using multidimensional approaches, such as traffic periodicity analysis, device customized field identification, key content extraction via image-to-text conversion, and remote management device access HTTP traffic feature analysis. We have effectively identified 26 different types of remote management devices in Japan, comprising a total of 983 exposed devices, in a shorter timeframe. When juxtaposed with previous methods, our strategy has identified more devices faster. Therefore, our method holds considerable potential for identifying and reducing the attack surface of critical infrastructures on the Internet. Furthermore, it also has substantial significance for protecting global network security.

Coin mixing is a technique used to enhance Bitcoin’s anonymity and can be used to obfuscate the relationship among transaction input addresses. Due to this property, much of the criminal activity on Bitcoin uses coin-mixing techniques to launder money, making these illicit funds difficult to trace. Therefore, it is important to implement the detection of Bitcoin mixing services. Several methods for identifying bitcoin mixing services have been proposed, but balancing their efficiency and generality at the same time is a challenging task. In this paper, We propose STMD (Spatio-Temporal Mixing Detector), which combines local features and global features of Bitcoin transactions to identify coin-mixing transactions. On one hand, we extract and process the statistical features of neighboring nodes of the transaction as local features. On the other hand, we construct a global position encoding (GPE) containing spatio-temporal information of the transaction as global features. Additionally, we employ the attention mechanism to handle these two types of features, effectively combining them. Finally, we utilize linear layers to achieve the detection of coin-mixing transactions. The experimental results show that STMD performs better than existing methods on the same dataset; it also has a higher recall on the test set of other types of coin-mixing transactions, which reflects the generality of the model. In particular, We apply local features and global features for experiments separately and verify the necessity of the two features. The results of the model trained using only global features also outperform the existing methods, which shows that the global position encoding (GPE) we constructed is effective for mixed currency transaction identification.

With the development of the Internet, many industrial control system (ICS) remote management devices for key infrastructure, such as solar power plants, sewage treatment, and buildings, are easily exposed to the Internet through network connections. Existing studies on ICS detection can not detect these remote management devices, which are not open to specific industrial control protocol services. Effectively identifying exposed real-world ICS remote management devices while minimizing the attack surface remains an enormous challenge. To address this challenge, we propose a Multi-level fEature fusioN DiscovEry fRamework (MENDER) for discovering neglected ICS remote management devices. First, we conduct a comprehensive and multi-level data collection in the detection process, including the traffic generated by website access, web resource files and HTML. We build an efficient and comprehensive data detection and acquisition module. Second, we design a novel multi-level feature extraction and fusion model to mine key features from raw data. We perform hierarchical clustering based on HTML features and combine the extracted multi-layered key features to filter potential ICS remote management devices. Third, we use the Random Forest model to classify and predict ICS devices based on the extracted multi-level features, aiming to learn inherent features profoundly for enhanced detection of these remote management devices. In a month, we detect 1, 069 devices in Japan, some of devices are insecure, i.e. allowing access to the status or even the control industrial devices without proper authentication. Compared with existing method, MENDER’s time spent on device discovery has been reduced by 94.1%, the number of device discovery is increased by 20.1%, and 26 different types of devices are found. Our MENDER’s device discover ability is superior to it both in time and quantity.

The intelligent manufacturing is a complex engineering system, and the cyber–physical systems (CPSs) and the industrial Internet are the preliminary infrastructures. When cyber–physical–social systems (CPSSs) are formed by extending CPS into the social aspect, Societies 5.0 era is coming. In the Societies 5.0 era, social manufacturing (SM) is an innovative manufacturing solution for intelligent manufacturing. In this article, a survey on SM is introduced. It includes the definition and theory of SM, and comparison between SM and other manufacturing paradigms. Moreover, the key supporting technologies are presented, which can be used to realize SM, such as blockchain, 3-D printing, and big data. Then, the applications of SM to industries are illustrated. The SM has broad application prospects in the high-end customized, distributed manufacturing, and other intelligent manufacturing. Finally, the challenges and future trends are discussed.

To tackle with advanced persistent threats against industrial control system, Siemens has developed S7CommPlus- TLS, a new version of the encrypted protocol challenging traditional DPI-based anomaly detection methods. However, the communication mode of industrial control system leads to the overlapping of periodic traffic and sensitive behavior traffic, and thus makes mainstream encrypted traffic classification methods exhibit a poor performance in S7CommPlus-TLS protocol. Therefore, we design a multiple clustering framework called MCFM, which can automatically extract sensitive behavior of S7CommPlus-TLS from network traffic. The first-clustering is used as a pre-processing model to separate and remove periodic traffic from overlapping flows according to the communication mode of industrial control system. Besides, we employ the second- clustering as a generator to extract the fingerprint of sensitive behaviors. Our comprehensive experiments on the simulation dataset covering six sensitive behaviors indicate that MCFM achieves an excellent performance, and outperforms present cutting-edge methods. To the best of our knowledge, this is the first work analyzing industrial control system from the perspective of encrypted traffic analysis.

In recent years, phishing scams have become the most serious type of crime involved in Ethereum, the second-largest blockchain platform. The existing phishing scams detection technology on Ethereum mostly uses traditional machine learning or network representation learning to mine the key information from the transaction network to identify phishing addresses. However, these methods adopt the last transaction record or even completely ignore these records, and only manual-designed features are taken for the node representation. In this paper, we propose a Temporal Transaction Aggregation Graph Network (TTAGN) to enhance phishing scams detection performance on Ethereum. Specifically, in the temporal edges representation module, we model the temporal relationship of historical transaction records between nodes to construct the edge representation of the Ethereum transaction network. Moreover, the edge representations around the node are aggregated to fuse topological interactive relationships into its representation, also named as trading features, in the edge2node module. We further combine trading features with common statistical and structural features obtained by graph neural networks to identify phishing addresses. Evaluated on real-world Ethereum phishing scams datasets, our TTAGN (92.8% AUC, and 81.6% F1-score) outperforms the state-of-the-art methods, and the effectiveness of temporal edges representation and edge2node module is also demonstrated.

Encrypted traffic classification requires discriminative and robust traffic representation captured from content-invisible and imbalanced traffic data for accurate classification, which is challenging but indispensable to achieve network security and network management. The major limitation of existing solutions is that they highly rely on the deep features, which are overly dependent on data size and hard to generalize on unseen data. How to leverage the open-domain unlabeled traffic data to learn representation with strong generalization ability remains a key challenge. In this paper, we propose a new traffic representation model called Encrypted Traffic Bidirectional Encoder Representations from Transformer (ET-BERT), which pre-trains deep contextualized datagram-level representation from large-scale unlabeled data. The pre-trained model can be fine-tuned on a small number of task-specific labeled data and achieves state-of-the-art performance across five encrypted traffic classification tasks, remarkably pushing the F1 of ISCX-VPN-Service to 98.9% (5.2%↑), Cross-Platform (Android) to 92.5% (5.4%↑), CSTNET-TLS 1.3 to 97.4% (10.0%↑). Notably, we provide explanation of the empirically powerful pre-training model by analyzing the randomness of ciphers. It gives us insights in understanding the boundary of classification ability over encrypted traffic. The code is available at: https://github.com/linwhitehat/ET-BERT.

As an essential component of Internet of Things, GPS-enabled devices record tremendous digital traces, which provide a great convenience for understanding human mobility. How to discover transportation modes efficiently from such valuable sources has come into the spotlight. In this article, the transportation mode detection is treated as a dense classification task, and a similarity entropy-based encoder-decoder (SEED) model is proposed. We first design an encoder-decoder backbone for end-to-end mode detection. Then, a semi-supervised learning module based on similarity entropy is proposed to exploit numerous unlabeled data. Specifically, we stack several convolutional layers as an encoder to capture hierarchical features from fixed-length trajectories, and then adopt transposed convolutional layers as a decoder. For a semi-supervised module, inspired by entropy regularization, we use the${K}$-Means algorithm to cluster prototype vectors from the encoder’s predictions. We then fine-tune the encoder by sharpening the similarity distribution between unlabeled predictions and prototypes, aiming to make the former close to one prototype only while staying away from others. A majority-voting post-processing method is used to alleviate jitter impact when inferring. The Experimental results show that SEED significantly outperforms segmentation-then-inference methods. Furthermore, the similarity entropy-based module can improve the generalization performance of the model, and the metrics such as intersection over union can be increased by 5% over baselines. All of these verify the superiority of our method.

Any successful change in an organization requires an appropriate change management method and a process for involved staff and department to accept the change and become engaged in order to achieve its success. It is even more important and difficult to adopt a novel change management method to bring multiple organizations across the business value chain into the change implementation. This research does not focused on change management within a single organization but rather emphasizes a change management method, including an appropriate change framework, well-defined critical success factors (CSFs), and related tools for implementing change in multiple organizations. This article introduces one kind of change management method to support a process change through global value chain (GVC) in multiple organizations, and the method is used in a case study to achieve a successful change. In order to succeed in optimizing GVC performance, this research applies the proposed change management method to the case GVC, to support technical change by obtaining the staff’s full commitment and engagement. The achieved results from the case study prove that successful change comes not only through technical solutions implemented in the problem process throughout the GVC but also through strong support and engagement from all organizations and involved staff. The proposed change management method not only helped the case GVC to implement change successfully but also can help the relevant multiple organizations to improve the GVC performance and add value by optimizing their problem process.

Accurate and timely traffic flow prediction is crucial for intelligent transportation systems (ITS). Recent advances in graph-based neural networks have achieved promising prediction results. However, some challenges remain, especially regarding graph construction and the time complexity of models. In this paper, we propose a multi-stream feature fusion approach to extract and integrate rich features from traffic data and leverage a data-driven adjacent matrix instead of the distance-based matrix to construct graphs. We calculate the Spearman rank correlation coefficient between monitor stations to obtain the initial adjacent matrix and fine-tune it while training. As to the model, we construct a multi-stream feature fusion block (MFFB) module, which includes a three-channel network and the soft-attention mechanism. The three-channel networks are graph convolutional neural network (GCN), gated recurrent unit (GRU) and fully connected neural network (FNN), which are used to extract spatial, temporal and other features, respectively. The soft-attention mechanism is utilized to integrate the obtained features. The MFFB modules are stacked, and a fully connected layer and a convolutional layer are used to make predictions. We conduct experiments on two real-world traffic prediction tasks and verify that our proposed approach outperforms the state-of-the-art methods within an acceptable time complexity.

With the widespread application of mobile phones, it has become possible to study human mobility and travel behaviors based on cellular network data. Contrary to call detail records, the data is triggered by mobile cellular signaling and can provide fine-grained information about users’ daily routines. However, it does not explicitly provide semantic details about traveling traces, e.g., trip purposes. In this paper, we propose a methodological framework to handle large-scale cellular network data and discover the underlying trip purposes in an unsupervised way. We first devise heuristic rules to identify home/work purposes. Then, a flexible latent Dirichlet allocation (LDA) model is presented to discover the activities for remaining trips, in which each trip is depicted by four attributes, i.e. arrival time, age group, stay duration, and the point of interest tag for the destination. Experimental results show that the proposed method can identify diverse trip purposes by explaining their structures over trip attributes and outperform baselines in terms of log-likelihood and perplexity. We also analyze the difference between the automatically discovered trip purposes and those estimated from household census, and the analyzed results demonstrate the feasibility of our proposed method.

In the modern supply chain system, large-scale transportation tasks require the collaborative work of multiple vehicles to be completed on time. Over the past few decades, multi-vehicle route planning was mainly implemented by heuristic algorithms. However, these algorithms face the dilemma of long computation time. In recent years, some machine learning-based methods are also proposed for vehicle route planning, but the existing algorithms can hardly solve multi-vehicle time-sensitive problems. To overcome this problem, we propose a novel multi-agent reinforcement learning model, which optimizes the route length and the vehicle’s arrival time simultaneously. The model is based on the encoder-decoder framework. The encoder mines the relationship between the customer nodes in the problem, and the decoder generates the route of each vehicle iteratively. Specially, we design multiple route recorders to extract the route history information of vehicles and realize the communication between them. In the inferring phase, the model could immediately generate routes for all vehicles in a new instance. To further improve the performance of the model, we devise a multi-sampling strategy and obtain the balance boundary between computation time and performance improvement. In addition, we propose a simulation-based vehicle configuration method to select the optimal number of vehicles in real applications. For validation, we conduct a series of experiments on problems with different customer amounts and various vehicle numbers. The results show that the proposed model outperforms other typical algorithms in both performance and calculation time.

The number of vehicles is rapidly increasing. An effective control strategy for Hybrid Electric Vehicles (HEVs) is important. In this paper, we present a two-level control strategy that combines the Adaptive-Equivalent Consumption Minimization Strategy (A-ECMS) and the Adaptive Dynamic Programming (ADP). At the lower level, the A-ECMS is used to convert the consumed charge into Equivalent Fuel Consumption (EFC) for every sample moment, and a PI controller is used to adjust the values of the equivalent factor of the A-ECMS. At the upper level, the ADP is used to find the minimum of EFC corresponding to equivalent factor for every sample moment, and it maintains the State of Charge (SOC) of battery to charge and discharge smoothly in a high-efficiency field for the HEV. As by the ADP, we look into the future and then we can have a better estimate for the equivalent factor than the ordinary A-ECMS. In this way, we can save energy as well as calculate instantaneous parameters for the control strategy. Compared with a typical rule-based control strategy, the proposed control method saves EFC up to 10.3% and the stability of the SOC is increased by more than 60%, tested on benchmarks.

Website fingerprinting attacks on Tor pose an security issue in anonymity privacy, in which attackers can identify websites visited by victims through passively capturing and analyzing encrypted packet traces. Although related works have been studied over a long period, most of them focus on single-tab packet traces which only contain one page tab’s data. However, users often open multiple page tabs successively when browsing the web, and multi-tab packet traces generated will corrupt common single-tab attacks. Existing multi-tab attacks still depend on an elaborate feature engineering, besides, they fail to exploit the overlapping area which contains the mixed data of two adjacent page tabs, thus suffering from the information lost or confusion. In this paper, we propose a Block Attention Profiling Model named BAPM as a new multi-tab attacking model. Specifically, BAPM fully utilizes the whole multi-tab packet trace including the overlapping area to avoid information lost. It generates a tab-aware representation from direction sequences and performs the block division to separate mixed page tabs as clearly as possible, thus relieving the information confusion. Then the attention-based profiling is used to group blocks belonging to the same page tab and finally multiple websites are simultaneously identified under a global view. We compare BAPM with state of the art multi-tab attacks, and BAPM outperforms comparison methods even with larger overlapping area. The effectiveness of model design is also validated through ablation, sensitivity and generalization analysis.

With the full encryption of network traffic, traffic classification schemes based on machine learning emerge in endlessly. Class imbalance, as a widely-studied challenge in machine learning, has not attracted enough attention in traffic classification researches. The uneven distribution hidden in the real-world traffic will cause performance degradation of the existing schemes. In existing methods, data pre-sampling is easy to introduce noise or lose massive information; the cost matrix of cost-sensitive methods is difficult to design; feature selection methods will filter out lots of “redundant” features and cause unsatisfactory results. In this paper, we propose an effective end-to-end framework for imbalanced traffic classification which avoids the above weaknesses, called DeepFE. We adopt deep neural networks for feature extraction, and model features from the perspective of channels. It can learn class-sensitive feature representation, which is quite helpful to distinguish the minority traffic classes. Moreover, DeepFE can be applied to various tasks because of its unlimited input format, i.e., both the raw bytes and the packet length sequence can be used. We conducted experiments on the public dataset ISCXVPN2016 and a realworld traffic dataset covering 27 applications. The results show that DeepFE achieves excellent results, significantly alleviating the performance degradation caused by imbalance, and surpasses several state-of-the-art methods.

As the mainstream in network traffic classification (NTC), machine learning (ML) based methods suffer performance degradation due to the imbalance distribution of Internet traffic. Data augmentation methods including the traditional oversampling techniques and the Generative Adversarial Network (GAN) based generation methods are most commonly used to counter the imbalance problem in NTC. However, the former is prone to overfitting and introducing noise. The latter overcomes the above weaknesses, but the quality of the generated traffic samples is difficult to judge. Besides, these methods all divide the imbalanced traffic classification problem into two subproblems, which cannot guarantee the global optimality. In this paper, we propose a GAN based Traffic Augmentation (TA-GAN) for imbalanced traffic classification. TA-GAN is an end-to-end framework that integrates the generation of the minority traffic samples with the training of the target classifier. We design the feedback mechanism to better guide the direction of the sample generation and simultaneously indicate the quality of the synthesized samples. Moreover, the existing deep learning-based NTC methods can be easily adapted to imbalance scenarios with TA-GAN. Comprehensive experiments on the public ISCXVPN2016 dataset demonstrate that TA-GAN effectively mitigates the influence of traffic imbalance (a maximum 14.64% improvement to the minority class'$F_{1}$score) and outperforms the state-of-the-art methods.

As the tool for launching cyber attacks, the ever-increasing malware variants pose a significant threat to the interconnected network community. The detection methods based on conventional machine learning techniques require lots of samples for training. However, in real-world scenarios, such as in the early stage of novel attacks appearance, only a small number of malicious samples can be obtained. Applying data-intensive traditional methods in the above scenarios will cause serious overfitting problems. Therefore, there is a need for few-shot detection. In his paper, we propose UMVD-FSL, a framework based on few-shot learning to detect unseen malware variants with a small set of data. We start with network traffic data generated by malware variants and benign applications and then convert them to grayscale images. The prototype-based few-shot learning model takes the grayscale images as the input and utilizes meta-training to generalize the meta-learner for adapting new tasks. When a new sample appears, the model performs classification by computing distances to prototype representation of each class. We evaluate different methods through a series of comparative experiments. Our method has the best performance on all subtasks. The experimental results indicate that our method is universal and robust in detecting malware variants from the same network environment and different network environments. The above points prove that our method can accomplish the task of few-shot unseen malware variants detection.

Global IPv6 scanning has always been a challenge for researchers because of the limited network speed and computational power. Target generation algorithms are recently proposed to overcome the problem for Internet assessments by predicting a candidate set to scan. However, IPv6 custom address configuration emerges diverse addressing patterns discouraging algorithmic inference. Widespread IPv6 alias could also mislead the algorithm to discover aliased regions rather than valid host targets. In this paper, we introduce 6GAN, a novel architecture built with Generative Adversarial Net (GAN) and reinforcement learning for multi-pattern target generation. 6GAN forces multiple generators to train with a multi-class discriminator and an alias detector to generate non-aliased active targets with different addressing pattern types. The rewards from the discriminator and the alias detector help supervise the address sequence decision-making process. After adversarial training, 6GAN's generators could keep a strong imitating ability for each pattern and 6GAN's discriminator obtains outstanding pattern discrimination ability with a 0.966 accuracy. Experiments indicate that our work outperformed the state-of-the-art target generation algorithms by reaching a higher-quality candidate set.

Tor is a popular anonymous social network. However, it is also concerned by censors or other malicious attackers. A large body of work examines Tor’s susceptibility to flow correlation attacks. Moreover, the existing methods to defend against such attacks have two inherent drawbacks. One is they will bring high delay to the system, the other is they lack of theoretical basis to prove their effectiveness.This paper conducts the first experimental study of how to effectively defeat flow correlation attacks on Tor. We propose a new universal perturbation generation algorithm, a defense to achieve the goal of flawing flow correlation attacks by apply tiny perturbations to the traffic. Our approach uses adversarial sample technique to incorporate Tor traffic constraints and avoid the two drawbacks mentioned above. We evaluate it over five typical flow correlation attacks. Our results show the effectiveness and high transferability of the generated perturbations. For instance, by applying a perturbation with a tiny variance of only 10ms, the TP of original flow correlation attack is reduced from 82% to 60% and the surrogate attack decreases from 71% to 52%.

Graph-structured data contains a lot of sensitive information about individuals. In order to protect users’ privacy, many anonymization mechanisms for graph-structured data are proposed. However, one common drawback of these mechanisms is that they only consider to hide the local characteristics, such as the degree of nodes or their neighbors. They lack the consideration for the nodes’ attribute features and the features of potential global graph structure, which leads to the failure of these mechanisms to provide sufficient security.To address this shortcoming, we propose RecGraph, a framework for graph recovery attack based on variational graph autoencoders. We use RecGraph to perform graph recovery attack on three real social network datasets, and compare it with five existing baselines, to prove the effectiveness of our method. We also evaluate the privacy wastage after performing the graph recovery attack using RecGraph to demonstrate the serious security risks faced by the existing graph anonymization mechanisms.

With the proliferation of encrypted traffic, machine learning (ML) based network traffic classification (NTC) has become the mainstream method. However, most studies ignored two issues. On the one hand, Internet traffic presents a natural uneven distribution. On the other hand, machine learning algorithms generally aim to achieve the highest overall accuracy without considering class imbalance. This leads to severe performance degradation of existing ML-based NTC schemes when facing imbalanced scenarios. In this paper, we design a novel Generative Adversarial Network (GAN) architecture to generate traffic samples, in which the addition of the classifier and the pretraining module makes the generation process more stable and effective. We propose an end-to-end framework for imbalanced traffic classification, named ITCGAN, which can generate traffic samples for minority classes to adaptively rebalance the original traffic and simultaneously train the optimal classifier. We evaluate its effectiveness on the public ISCXVPN2016 dataset based on the global metrics and individual metrics. The results show that our method performs well in imbalanced NTC tasks, fully alleviating the performance degradation (a 10.27-percentage-point improvement to the precision of the most minority class). Meanwhile, it surpasses five state-of-the-art oversampling methods.

With the rapid development of the Internet, network traffic is growing explosively. It brings great challenges to the traditional traffic identification technology using full traffic analysis, which requires more resources to achieve the collection and analysis of full traffic. And, handling the raw traffic may lead to the compromise of user privacy. NetFlow has good compatibility with the existing routing or switching devices, can aggregate network traffic information, support traffic sampling, reduce the invasion of user privacy, and can effectively deal with the challenges. However, as NetFlow is usually output after traffic sampling to ensure the performance of network devices and only contains session-level statistical information, existing NetFlow research mostly focuses on the binary classification problems (e.g., specific anomaly traffic detection), and less exploration has been conducted on traffic multi-classification problems. And NetFlow is even less involved in the currently popular field of encrypted traffic classification. In this paper, we focus on how to perform encrypted traffic multi-classification research based on sampled NetFlow records and propose a multi-classification method based on the multi-source extension of sampled NetFlow records. To improve the distinguishability and applicability of the sampled NetFlow records, we extend and enrich the records with full consideration of the head or payload information in traffic data, including TTL values, Cipher Suites, etc. For different application scenarios, the methods based on head information extension and payload information extension are proposed, respectively. Through comprehensive experiments, the results show that the proposed method is more applicable and effective than the method based on a single N etFlow record in dealing with multi-classification problems in different encryption application scenarios.

With the widespread use of tunnel technology, the volume of encrypted tunnel traffic rises sharply, which brings a new challenge to traditional encrypted traffic identification. A number of real-world application scenarios, including Quality of Service and intrusion detection, have put forward new re-quirements for identifying numerous tunnels, applications, and fine-grained behavior. However, previous studies and datasets on encrypted tunnel traffic identification fail to meet these requirements due to their low dataset coverage and coarse label granularity. These weaknesses further affect the extracted features based on these datasets, making them unable to adequately characterize encrypted tunnel traffic. In this paper, we refine the previous tunnel traffic identification granularity from prevalent application identification to behavior identification, and propose LFETT2021, a large-scale fine-grained encrypted tunnel traffic dataset. Our dataset expands the coverage to two operating system platforms, five tunnels, 23 applications, and 76 behaviors. Furthermore, we propose a set of Time-Packet-Related features to better characterize encrypted tunnel traffic. Our comprehensive experiments on LFETT2021 and Time-Packet-Related features show the best average precision of 85% and recall of 88% in 3 different granularity identification scenarios.

Certificates play a key role in TLS, which is by far the most widely used security protocol for protecting network traffic. Studies have shown that inappropriate usage of certificates may incur security and privacy risks, most of which are focused on the server-side certificates. However, with the rapid development of the Internet of Things that interconnects countless nodes over the world, as well as the Zero Trust philosophy that stresses authentication of every entity, the adoption of client certificates could be a lot more vital. According to our observation, many practical problems and security risks still exist in the deployment and use of client certificates. In this paper, we present a passive measurement of over 24 million client certificates, collected by a framework deployed on the CSTNET, one of the major academic backbone networks in China. By performing a comprehensive analysis of the large scale real-world data, we give a big picture of the client certificates usage in current network, and disclose implementation flaws of these certificates which may possibly harm transport layer security and user privacy. As many as 342,699 defective client certificates are unearthed, which is an important reminder that never should we neglect the correct use of certificates on the client side.

Agent-based simulation is a useful approach for the analysis of dynamic population evolution. In this field, the existing models mostly treat the migration behavior as a result of utility maximization, which partially ignores the endogenous mechanisms of human decision making. To simulate such a process, this article proposes a new cognitive architecture called the two-layered integrated decision cycle (TiDEC) which characterizes the individual's decision-making process. Different from the previous ones, the new hybrid architecture incorporates deep neural networks for its perception and implicit knowledge learning. The proposed model is applied in China and U.S. population evolution. To the best of our knowledge, this is the first time that the cognitive computation is used in such a field. Computational experiments using the actual census data indicate that the cognitive model, compared with the traditional utility maximization methods, cannot only reconstruct the historical demographic features but also achieve better prediction of future evolutionary dynamics.

Pedestrian trajectory prediction is vital for transportation systems. Generally we can divide pedestrian behavior modeling into two categories, i.e., knowledge-driven and data-driven. The former might bring expert bias, and it sometimes generates unrealistic pedestrian movement due to unnecessary repulsive forces. The latter approach is popular nowadays but most existing neural networks, including fully connected long short-term memory (LSTM) networks, use a 1D vector to model their input and state. The shortcoming is that these works cannot learn spatial information about pedestrians, especially in a dense crowd. To tackle this, we propose to use tensors to represent essential environment features of pedestrians. Accordingly, a convolutional LSTM is designed and deepened to predict spatiotemporal trajectory sequences. As the tensor and convolution can learn better spatiotemporal interactions among pedestrians and environments, experimental results show that the proposed network can estimate more realistic trajectories for a dense crowd in evacuation and counterflow.

As network services continuously evolving, accurately classifying traffic is important for network operators to optimize QoS and customize policy. Network service uses non-standard ports and protocol obfuscation causing damage to the accurate port-based and payload-based traffic classification. However, Deep Packet Inspection (DPI) technique, which combines the payload-based method and port-based method, is still adopted by practitioners from the academic and industrial community. In this paper, we investigate the DPI classification result on a large network to estimate the impact of two factors. We qualify the popularity of non-standard port among different protocols. By endpoint filtering, we discover a large proportion of non-standard ports are opened temporally. We show there still is strong association between P2P protocols and camouflaged protocol. In particular, using both host and label association between endpoints, we find camouflaged protocols exhibit an abnormal port span that is different with the original protocol and are similar to the port span of P2P protocols.

To prevent serious privacy leakage from website fingerprinting (WF) attacks, many traditional or adversarial WF defenses have been released. However, traditional WF defenses such as Walkie-Talkie (W-T) still generate patterns that might be captured by the deep learning (DL) based WF attacks, which are not effective. Adversarial perturbation based WF defenses better confuse WF attacks, but their requirements for the entire original traffic trace and perturbating any points including historical packets or cells of the network traffic are not practical. To deal with the effectiveness and practicality issues of existing defenses, we proposed a novel WF defense in this paper, called PST. Given a few past bursts of a trace as input, PST Predicts subsequent fuzzy bursts with a neural network, then Searches small but effective adversarial perturbation directions based on observed and predicted bursts, and finally Transfers the perturbation directions to the remaining bursts. Our experimental results over a public closed-world dataset demonstrate that PST can successfully break the network traffic pattern and achieve a high evasion rate of 87.6%, beating W-T by more than 31.59% at the same bandwidth overhead, with only observing 10 transferred bursts. Moreover, our defense adapts to WF attacks dynamically, which could be retrained or updated.

3D face reconstruction from a single 2D facial image is a challenging and concerned problem. Recent methods based on CNN typically aim to learn parameters of 3D Morphable Model (3DMM) from 2D images to render face alignment and 3D face reconstruction. Most algorithms are designed for faces with small, medium yaw angles, which is extremely challenging to align faces in large poses. At the same time, they are not efficient usually. The main challenge is that it takes time to determine the parameters accurately. In order to address this challenge with the goal of improving performance, this paper proposes a novel and efficient end-to-end framework. We design an efficient and lightweight network model combined with Depthwise Separable Convolution and Muti-scale Representation, Lightweight Attention Mechanism, named Mobile-FRNet. Simultaneously, different loss functions are used to constrain and optimize 3DMM parameters and 3D vertices during training to improve the performance of the network. Meanwhile, extensive experiments on the challenging datasets show that our method significantly improves the accuracy of face alignment and 3D face reconstruction. Model parameters and complexity of our method are also improved greatly.

Machine learning (ML) is widely applied to network traffic classification (NTC), which is an essential component for network management and security. While the imbalance distribution exhibiting in real-world network traffic degrades the classifier's performance and leads to prediction bias towards majority classes, which is always ignored by exiting ML-based NTC studies. Some researches have proposed solutions such as resampling for imbalanced traffic classification. However, most methods don't take traffic characteristics into account and consume much time, resulting in unsatisfactory results. In this paper, we analyze the imbalanced traffic data and propose the focal loss based adaptive gradient boosting framework (FLAGB) for imbalanced traffic classification. FLAGB can automatically adapt to NTC tasks with different imbalance levels and overcome imbalance without the prior knowledge of data distribution. Our comprehensive experiments on two network traffic datasets covering binary and multiple classes prove that FLAGB outperforms the state-of-the-art methods. Its low time consumption during training also makes it an excellent choice for highly imbalanced traffic classification.

Recent research shows that website fingerprinting (WF) is a growing threat to privacy-sensitive web users, especially when using machine learning techniques such as deep learning or machine learning (DL / ML) to attack website fingerprint, reducing the effectiveness of the previous defense strategies. The reason is that the features targeted by the previous defense countermeasures are manually extracted, the range of it can’t be large enough to cover the range of features automatically extracted by DL / ML-based attacks. This paper proposes a black box defense countermeasure based on decision boundary confusion. Instead of manually extracting features, it uses the classification results of the classifier to determine the decision boundary of the classifier then automatically find the adversarial traffic that may cause the classifier to be confused. At the same time, to solve the retraining problem caused by adversarial traffic, we also utilize Monte Carlo estimation to modify adversarial traffic, to confuse decision boundary, improve the retraining resistance of adversarial traffic. Therefore, it is difficult for the classifier to form a stable and effective decision boundary after training the adversarial traffic. Results shows that our method gets a average defense success rate of 78.2% when facing the baseline WF Attacks, outperforming existing SOTA method Walkie-Talkie’s 63.6% average defense success rate. At the same time, our method improves the ability of the adversarial traffic to resist retrain, increased the retrain defense success rate from 12% to 78.2% under 31% overhead.

As an essential task for network management and security, network traffic classification has attracted increasing attention in recent years. Traditional traffic classification methods achieve certain success in identifying specific application traffic but fail with un-predefined unknown classes. Existing unknown traffic discovery methods commonly pick out some unlabeled testing data as part of training data to train the classification models, which is not in line with the real-world open environments. In this paper, we propose a novel scheme named SEEN to achieve unknown traffic detection in network traffic classification. There are three crucial phases in the SEEN: unknown discovery, unknown clustering, and system update. In the first step, using a metric-based approach with siamese network, SEEN identifies unknown traffic as well as accurately classifies the traffic generated by pre-defined application classes. After discovery, unknown traffic is automatically clustered into more fine-grained categories in the unknown clustering step. In the system update step, inspired by low-shot learning, SEEN allows new classes to be added or unnecessary known classes to be deleted quickly without retraining from the sketch, which can complement the system’s knowledge. Experimental results exhibit that SEEN can achieve outstanding performances both on known and unknown traffic identification on two open real-world datasets, and the proposed scheme can address the problem of unknown traffic effectively.

Flow correlation is a common approach to break the anonymity of anonymous communication. However, unpredictable network noise caused by multiple factors in open Internet raises the bar for existing correlation methods. Traditional methods comparing statistical distance of data flows and deep learning methods such as convolutional neural network behave worse because network noise changes traffic shape. In this paper, we design a pre-processing model called ResTor to perform the noise reduction before actually correlating entering and exiting flows. ResTor treats the byte accumulation sequences smoothed at fixed intervals as fitting targets, and takes advantage of the stacked auto-encoder architecture to remove noise in two phases. Experiment results show that the exiting Tor flows processed by ResTor are closer to their corresponding entering flows, thus the correlation task can be finished effectively even using traditional correlation ways: cosine distance and other statistical metrics assisted by ResTor achieve less computational overhead and higher correlation accuracy on Tor compared to the state-of-the-art method of DeepCorr, especially when traffic is obfuscated.

Website Fingerprinting (WF) attack is an side-channel attack which aims at encrypted web traffic. WF attackers recognize encrypted website traffic through constructing fingerprinting for each website using the flow-based features extracted from encrypted traffic. WF defense typically aims at modifying the features of the encrypted websites. However, those countermeasures either cause high overhead or fail to counter the subsequent WF attacks. Especially, the newest WF attacks, which are based on deep neural network, is able to classify the defended traffic by directly learning from the labeled defended traffic. In this paper, we propose an novel defense through making use of the trick that machine learning models are vulnerable to adversarial exmaples. We design WF-GAN, a GAN with an additional WF classifier component, to generate adversarial examples for WF classifiers through adversarial learning. As the website set is divided into source and target website, WF-GAN are trained to map websites features from source set to adversarial examples and make adversarial examples more similar to the website features in the target set. The experimental result shows that WF-GAN achieves 90% success rate with at most 15% overhead for untargeted defense, which outperforms previous defense. In addition, adversarial examples based defense support targeted defense, which is not support by traditional defense. The result shows that WF-GAN achieves over 90% targeted defense success rate when the target websites set is twice as many as the source website set.

Malicious events pose a significant threat to the current increasingly interconnected Internet community. Detection based on features of network traffic and machine learning algorithms is a common approach to identify malicious events. The performance of approaches is associated with the used features and algorithms. In this paper, we propose MalFinder, an ensemble learning-based framework for malicious traffic detection. Considering the trend of network traffic encryption and the complexity of decrypting traffic, we utilize statistical features and sequence features to describe network traffic. We extend the dimensions of these two types of features to enhance their capability for representing traffic data. Feature importance analysis and contrast experiments illustrate the effectiveness of our new features. Among our selected classifiers suitable for malicious traffic detection, boosting-based classifiers XGBoost and LightGBM can reduce bias, and bagging-based classifier Random Forest can reduce variance. Stacking, which is the integration method of the classification results used in our framework, can improve the generalization ability of the method. MalFinder can achieve 96.58% F-measure and 95.44% accuracy in the malicious traffic detection task on a real-world dataset, whose results are better than those of comparison methods. In terms of unseen malicious traffic discovery, MalFinder still provides good performance with 93.46% F-measure and 91.04% accuracy, which even surpasses the results in the task of known malicious traffic detection of other comparative methods. With consideration of the scarcity of public data sets used for malicious traffic detection, we have exposed our self-built dataset for more extensive researches.

In order to protect user privacy or guarantee free access to the Internet, the network covert channel has become a hot research topic. It refers to an information channel in which the messages are covertly transmitted under the network environment. In recent years, many new construction schemes of network covert channels are proposed. But at the same time, network covert channel has also received the attention of censors, leading to many attacks. The network covert channel refers to an information channel in which the messages are covertly transmitted under the network environment. Many users exploit the network covert channel to protect privacy or guarantee free access to the Internet. Previous construction schemes of the network covert channel are based on information steganography, which can be divided into CTCs and CSCs. In recent years, there are some covert channels constructed by changing the transmission network architecture. On the other side, some research work promises that the characteristics of emerging network may better fit the construction of the network covert channel. In addition, the covert channel can also be constructed by changing the transmission network architecture. The proxy and anonymity communication technology implement this construction scheme. In this paper, we divide the key technologies for constructing network covert channels into two aspects: communication content level (based on information steganography) and transmission network level (based on proxy and anonymity communication technology). We give an comprehensively summary about covert channels at each level. We also introduce work for the three new types of network covert channels (covert channels based on streaming media, covert channels based on blockchain, and covert channels based on IPv6). In addition, we present the attacks against the network covert channel, including elimination, limitation, and detection. Finally, the challenge and future research trend in this field are discussed.

IoT-driven intelligent transportation systems (ITS) have great potential and capacity to make transportation systems efficient, safe, smart, reliable, and sustainable. The IoT provides the access and driving forces of seamlessly integrating transportation systems from the physical world to the virtual counterparts in the cyber world. In this paper, we present visions and works on integrating the artificial intelligent transportation systems and the real intelligent transportation systems to create and enhance “intelligence” of IoT-enabled ITS. With the increasing ubiquitous and deep sensing capacity of IoT-enabled ITS, we can quickly create artificial transportation systems equivalent to physical transportation systems in computers, and thus have parallel intelligent transportation systems, i.e. the real intelligent transportation systems and artificial intelligent transportation systems. The evolution process of transportation system is studied in the view of the parallel world. We can use a large number of long-term iterative simulation to predict and analyze the expected results of operations. Thus, truly effective and smart ITS can be planned, designed, built, operated and used. The foundation of the parallel intelligent transportation systems is based on the ACP theory, which is composed of artificial societies, computational experiments, and parallel execution. We also present some case studies to demonstrate the effectiveness of parallel transportation systems.

With the development of encryption protocol, such as Secure Sockets Layer (SSL) and Transport Layer Security (TLS), the traditional fingerprinting approaches based on packet content and special field are difficult to fingerprint the websites. Therefore, recent research imported machine learning algorithms to deal with this problem, and various features are extracted for the machine learning algorithms. However, previous approaches of fingerprinting encrypted websites are based on HTTP/1.1, which are not applicable to the widely used HTTP/2. In addition, most of the work only fingerprints the home page of each website, but in fact, users also visit other web pages of the website. To solve the feature compatibility problem, we propose to use the local request and response sequence (LRRS) as features. LRRS can represent the patterns of the encrypted Internet traffic not only based on HTTP/1.1 but also based on HTTP/2 using local packet sequences. In order to fingerprint different web pages in the same website, we import Deep Forest to extract fine-grained features. It utilizes a convolution structure to make full use of LRRS sequential features and multi-layer structure to enhance the ability of feature representation. The experimental results show the proposed algorithm has achieved the best overall performance on four datasets. Especially on the bidirectional encrypted traffic dataset with HTTP/2, the proposed approach achieved 55% higher of f1 score than the state-of-the-art method KFP with Random Forest.

Home surveillance cameras have been widely used in recent years, however, what comes next is the increasing events of users' privacy disclosure. Most cameras use video compression technologies such as H.26X and MPEG to reduce the stream size during transmission on the purpose to transfer higher definition(HD) video with limited bandwidth. Although traffic is encrypted, these video differential encoding techniques can cause traffic patterns to change as users' behavior changes. Therefore, it is very meaningful to mine user privacy behavior hidden behind the surveillance traffic based on traffic statistical features. In this paper, we collected a large amount of surveillance video traffic, including 9 kinds of daily life behaviors, such as watching TV, switching door, sweeping the floor, etc. According to frequency distribution sequences of packet length, probability transition matrix of packet length and other statistical features, we used a variety of models to classify users' daily life behaviors. The results show that the random forest classifier and the AlexNet classifier can achieve a macro-averaging F1-score of 97.23% and 97.89% respectively. The performance of our approach reveals that the users' daily routine can be accurately constructed only through video traffic, which is a potentially huge security issue for the users. Moreover, this work has important reference value for camera manufacturers to improve user privacy protection.

The choice of model orientation is a very important issue in Additive Manufacturing (AM). In this paper, the model orientation problem is formulated as a multi-objective optimization problem, aiming at minimizing the building time, the surface quality, and the supporting area. Then we convert the problem into a single-objective optimization in the linear-weighted way. After that, the Genetic Algorithm (GA) is used to solve the optimization problem and the process of GA is parallelized and implemented on GPU. Experimental results show that when dealing with complex models in AM, compared with CPU only implementation, the GPU based GA can speed up the process by about 50 times, which helps to significantly reduce the optimization time and ensure the quality of solutions. The GPU based parallel methods we proposed can help to reduce the execution time and improve the efficiency greatly, making the processes more efficient.

With more attention paid to user privacy and communication security, the volume of encrypted traffic rises sharply, which brings a huge challenge to traditional rule-based traffic classification methods. Combining machine learning algorithms and manual-design features has become the mainstream methods to solve this problem. However, these features depend on professional experience heavily, which needs lots of human effort. And these methods divide the encrypted traffic classification problem into piece-wise sub-problems, which could not guarantee the optimal solution. In this paper, we apply the recurrent neural network to the encrypted traffic classification problem and propose the Flow Sequence Network (FS-Net). The FS-Net is an end-to-end classification model that learns representative features from the raw flows, and then classifies them in a unified framework. Moreover, we adopt a multi-layer encoder-decoder structure which can mine the potential sequential characteristics of flows deeply, and import the reconstruction mechanism which can enhance the effectiveness of features. Our comprehensive experiments on the real-world dataset covering 18 applications indicate that FS-Net achieves an excellent performance (99.14% TPR, 0.05% FPR and 0.9906 FTF) and outperforms the state-of-the-art methods.

Since the lack of IPv6 network development, China is currently accelerating IPv6 deployment. In this scenario, traffic and network structure show a huge shift. However, due to the long-term prosperity, we are ignorant of the problems behind such outbreak of traffic and performance improvement events in accelerating deployment. IPv6 development in some regions will still face similar challenges in the future. To contribute to solving this problem, in this paper, we produce a new measurement framework and implement a 5-month passive measurement on the IPv6 network during the accelerating deployment in China. We combine 6 global-scale datasets to form the normal status of IPv6 network, which is against to the accelerating status formed by the passive traffic. Moreover, we compare with the traffic during World IPv6 Day 2011 and Launch 2012 to discuss the common nature of accelerating deployment. Finally, the results indicate that the IPv6 accelerating deployment is often accompanied by an unbalanced network status. It exposes unresolved security issues including the challenge of user privacy and inappropriate access methods. According to the investigation, we point the future IPv6 development after accelerating deployment.

More and more security vulnerabilities are closely related to operating system (OS) information, but how to accurately identify OS versions on a real-world dynamic network in encrypted traffic is still a challenge. In this paper, we propose a comprehensive passive OS identification method based on encrypted traffic. It takes advantage of several features in TLS headers and TCP/IP headers. Moreover, we also consider flow statistic features for each session. We collect a large dataset of more than 2 million samples to evaluate the performance of our approach. According to the experimental results, the performance of the proposed method is preferable to the traditional method.

Malicious domain is a vital component of various cyber attacks. Recent techniques detect malicious domains by building classifiers based on domain character features which may be easily evaded by attackers. In this paper, we propose a malicious domain detection approach based on domain relationship features, PDNS features, and domain character features. The key insight is that malicious domains deploy on IP that is loosely regulated and the domains on such IP have similar network characteristics including domain relationships, resolution characteristics, and network behaviors. We find that the relationship of malicious domains is different from that of benign domains. Take this into account, we build meaningful associations among domains and extract the domains relationship features by a modified graph embedding algorithm from Passive DNS data. Besides, we mine more features from PDNS which have not been mentioned in previous work. These PDNS features can enhance the effectiveness of the classifier. Finally, we combine domain character features, PDNS features and relationship features as the feature set. We evaluate the performance of our model on a real-world dataset from DNS servers. We achieve excellent performance by applying several classifiers based on domain character features, PDNS features and relationship features with an accuracy of 94.0%, a recall of 94.3% and a precision of 93.8% in the challenging scenario where domains deploy on the same IP and malicious domains share similar character features with benign domains. We also compare our method with two state-of-the-art detection approaches and find that our approach outperforms those SOTA approaches. Based on the comparison results, we point out that our way to construct a domain relationship graph can effectively mine the domain association features and the features combined with PDNS features and domain character features can effectively identify malicious domains which are similar to benign domains.

Remote desktop enables users to remotely access their computers via the Internet, which is widely used as a basic tool in areas such as remote work, remote assistance and remote administration. However, existing remote desktop is designed to work in the mode of updating user's real-time command and remote screen's state interactively for a better user experience, such working mode may cause serious side-channel information leakage problem in spite of encryption of the traffic, as revealed in this paper. We carry out an experimental research to assess the side-channel information leakage of six most popular remote desktop softwares in Windows 10 & 7 platforms: Anydesk, ConnectWise, MicroRDS, RealVNC, Teamviewer, and Zoho Assist. With the help of machine learning techniques including logistic regression, support vector machine, gradient boosting decision tree, random forest as well as statistic features of flow burst, we observe that an adversary can excellently uncover (top at 99.26% TPR, 0.57% FPR, 97.17% F1-score) 5 rough kinds of daily activities covering editing documents, reading documents, surfing webs, watching videos and installing softwares and even worse precisely classify 4 fine activities predefined as editing documents with Microsoft Office Word and the other three edit tools with high true positive rate and low false positive rate. Our results prove the fact for remote desktop traffic encryption mechanism is nothing sufficient to prevent side-channel information leakage and both users and providers of remote desktop should pay more attention to such serious privacy leakage problem.

Welcome to the fifth issue of the IEEE Transactions on Computational Social Systems (TCSS) this year. Seventeen regular articles and a brief discussion on social manufacturing (SM) are presented here. In addition, a special issue on “Human-Centric Cyber Social Computing” is included.We would like to take the opportunity to thank the Guest Editors for their time and effort devoted to the special issue.

As a typical cyber-physical system, 3D printing has developed very fast in recent years. There is a strong demand for mass customization, such as printing dental crowns. However, the accuracy of the 3D printed objects is low compared with traditional methods. The main reason is that the model to be printed is arbitrary and usually the quantity is small. The deformation is affected by the shape of the object and there is a lack of a universal method for the error compensation. It is neither easy nor economical to perform the compensation manually. In this paper, we present a framework for the automatic error compensation. We obtain the shape by technologies such as 3D scanning. And we use the "3D deep learning" method to train a deep neural network. For a specific task, such as dental crown printing, the network can learn the function of deformation when a large amount of data is used for training. To the best of our knowledge, this is the first application of the deep neural network to the error compensation in 3D printing. And we propose the "inverse function network" to compensate for the error. We use four types of deformations of the dental crowns to verify the performance of the neural network: 1) translation; 2) scaling up; 3) scaling down; and 4) rotation. The convolutional AutoEncoder structure is employed for the end-to-end learning. The experiments show that the network can predict and compensate for the error well. By introducing the new method, we can improve the accuracy with little need for increasing the hardware cost.

Image based eye detection and gaze estimation have a wide range of potential applications, such as medical treatment, biometrics recognition, human-computer interaction. Though a large number of researchers have attempted to solve the two problems, they still exist some challenges due to the variation in appearance and lack of annotated images. In addition, most related work perform eye detection first, followed by gaze estimation via appearance learning. In this paper, we propose a unified framework to execute the gaze estimation and the eye detection simultaneously by learning the cascade regression models from appearance around the eye related key points. Intuitively, there is coupled relationship among location of eye center, shape of eye related key points, appearance representation and gaze information. To incorporate these information, at each cascade level, we first learn a model to map the shape and appearance around current eye related key points to the three dimension gaze update. Then, with the help of estimated gaze, we further learn a regression model to map the gaze, shape and appearance information to eye location update. By leveraging the power of cascade learning, the proposed method can alternatively optimize the two tasks of eye detection and gaze estimation. The experiments are conducted on benchmarks of GI4E and MPIIGaze. Experimental results show that our proposed method can achieve preferable results in gaze estimation and outperform the state-of-the-art methods in eye detection.

With the popular use of SSL/TLS, more and more web applications, such as online banking, e-mail, and ecommerce, turn to secured channels for communication, which rely on X.509 certificate for authentication. Generally, every certificate has a theoretical validity period when it is issued. However, the used period in practice is often different from the theoretical validity, namely, before or after the validity, for a long or short time. If a certificate is expired, it is easily to be exploited by cyber-attackers, leading to web users' personal information at risk. To explore the security flaws of the SSL/TLS certificate, we conduct a large-scale measurement study of X.509 certificate life cycle from the view of leaf certificates. Based on a passive data set collected over one year, we investigate the certificate validity period in a fine-grained manner, and uncover that the actual usage of the certificates are not satisfactory. Meanwhile, we discover several security-related issues that may leave the web communication at risk. The recommendations are summarized to ensure the long-term security for certificate use in practice. We believe that the work will be beneficial to web security and improve the certificate utilization in the future.

Encrypted traffic classficiation has become an emergent and challenging task for network monitoring and management. Traditional classification methods for encrypted traffic rely on complex statistical characteristic construction and in-depth packet resolution, which produce huge loads. In this paper, we develop Length-aware FFT (LaFFT) fingerprinting to identify different encrypted application traffic with packet length sequences. We apply FFT to packet length sequences to generate the frequency domain vectors as LaFFT features. We verify the distinguishability of LaFFT fingerprinting by data analysis. Furthermore, the linear inseparability and the front superiority of LaFFT fingerprinting are demonstrated by comprehensive experiments. In the real-world dataset, the LaFFT fingerprinting with random forest classifier can achieve 96.8% TPR, 0.32% FPR and 0.959 FFT, which significantly outperform the state-of-the-art methods.

With the explosion of network applications, network anomaly detection and security management face a big challenge, of which the first and a fundamental step is traffic classification. However, for the sake of user privacy, encrypted communication protocols, e.g. the SSL/TLS protocol, are extensively used, which results in the ineffectiveness of traditional rule-based classification methods. Existing methods cannot have a satisfactory accuracy of encrypted traffic classification because of insufficient distinguishable characteristics. In this paper, we propose the Multi-attribute Markov Probability Fingerprints (MaMPF), for encrypted traffic classification. The key idea behind MaMPF is to consider multi-attributes, which includes a critical feature, namely “length block sequence” that captures the time-series packet lengths effectively using power-law distributions and relative occurrence probabilities of all considered applications. Based on the message type and length block sequences, Markov models are trained and the probabilities of all the applications are concatenated as the fingerprints for classification. MaMPF achieves 96.4% TPR and 0.2% FPR performance on a real-world dataset from campus network (including 950,000+ encrypted traffic flows and covering 18 applications), and outperforms the state-of-the-art methods.

This paper is to discuss the state, trend, and frontiers of development of cyber-physical-social systems (CPSSs) in China. The demand for developing CPSS is discussed in detail, followed by the Artificial societies, Computational experiments, Parallel execution (ACP) approach for CPSS and knowledge automation. The development of ACP based on CPSS in transportation, energy, information, Internet of Things, and Internet of Minds (IoM) is discussed to demonstrate the cutting-edge applications in CPSS. Finally, the blockchainized IoM technology and the concepts of parallel society are described. This paper will contribute to the transition from the current social construct to a futuristic intelligent society.

Deep learning methods have been actively researched for cross-modal retrieval, with the softmax cross-entropy loss commonly applied for supervised learning. However, the softmax cross-entropy loss is known to result in large intra-class variances, which is not not very suited for cross-modal matching. In this paper, a deep architecture called Deep Semantic Embedding (DSE) is proposed, which is trained in an end-to-end manner for image-text cross-modal retrieval. With images and texts mapped to a feature embedding space, class labels are used to guide the embedding learning, so that the embedding space has a semantic meaning common for both images and texts. This way, the difference between different modalities is eliminated. Under this framework, the center loss is introduced beyond the commonly used softmax cross-entropy loss to achieve both inter-class separation and intra-class compactness. Besides, a distance based softmax cross-entropy loss is proposed to jointly consider the softmax cross-entropy and center losses in fully gradient based learning. Experiments have been done on three popular image-text cross-modal retrieval databases, showing that the proposed algorithms have achieved the best overall performances.

Content delivery network (CDN) has been playing an important role in accelerating users' visit speed, bring good experience for popular web sites around the world. It has become a common security enhance service for CDN providers to offer HTTPS support to tenants. When several tenants are deployed to share a same IP address due to resource efficiency and cost, CDN providers should make comprehensive settings to ensure that all tenants' sites work correctly on users' requests. Otherwise, issues can take place such as denial of service (DOS) and privacy leakage, causing very bad user experience to users as well as potential economic loss for tenants, especially under the situation of hybrid deployment of HTTP and HTTPS. We examine the deployments of typical multi-tenant CDN providers by active measurement and find that CDN providers, namely Akaimai and ChinaCenter, have configuration problems which can result in DOS by certificate name mismatch error. Several advices are given to help to mitigate the issue. We believe that our study is meaningful for improving the security and the robustness of CDN.

With the widespread use of SSL, many issues have been exposed as well. Forged certificates used for MITM attacks or proxies can make SSL encryption useless easily, leading to privacy disclosure and property loss of careless victims. In this paper, we implement a large scale of passive measurement of SSL/TLS and analyze the forged certificates in the wild comprehensively. We measured SSL/TLS connection for 16 months on two large research networks, which provided a total of 100 Gbps bandwidth. We gathered nearly 135 million leaf certificates and studied the forged ones. Our findings reveal main reasons of signing forged certificates, and show the preference of them. Finally, we find out several suspicious servers that might be used for MITM.

Background traffic of web applications refers to the traffic not generated directly due to user activities (e.g. user behavior profiling) that is usually useful to the application providers, but not the users. A recent study indicated that background traffic, contributing 51.8% bandwidth, has exceeded user-generated traffic. Accurate identification of background traffic can help network managers to optimize network resource allocation and avoid network congestion. However, identification of background traffic is not easy and the solution must be robust enough for all applications. In this paper, we propose the first method that can self-learn background traffic rules from unlabeled data and automatically identify online background traffic. The accuracy of the extracted rules is 90.51%. When applying our method in a real enterprise network, the false positive rate (FPR) is only 3% showing that our method is accurate and effective. Our method is derived from a critical observation that the background traffic exhibits a periodic behavior (referred as autonomous periodic interaction (AuPI)). Technically, we propose two indexes, Time Regularity Factor (TRF) and Time Interval Factor (TIF), to capture this AuPI pattern from unlabeled communication traffic. As a side contribution, we created a public benchmark dataset of 45 hot applications with 97,000+ background traffic flows that can be used by researchers to further investigate background traffic.

Malware is one of the most severe security threats on the Internet. A key challenge for attackers is to install their malware programs on as many victim machines as possible. HTTP protocol, being the most popular protocol and occupying a significant portion of network traffic, is an obvious target for attackers to exploit for malware distribution. Advanced attackers would even hide the malicious executable program behind a benign file such as text, image. The existence of malware becomes harder to detect and the distribution channels become more evasive (i.e., not clear to identify). However, the exploited and hidden behavior often leads to an inconsistency between the actual content type and the declared content type. In this paper, we conduct a detailed study on a seven-month traffic of content type inconsistency executable program downloaded from an ISP of CSTNET (China Science and Technology Network). We found that 99.78% (891/893) of PE (portable executable) files declared to be images are malicious and 100% of PE files declared to be text with typical file extensions, “.pdf”, “.doc”, “.css” are malware. So, content type inconsistency can be used to detect evasive network attacks as well as effectively discover unknown malware from the traffic.

With the development of Internet techniques, such as the Secure Sockets Layer and Transport Layer Security encryption protocol, the traditional internet traffic classification approaches based on port, IP and packet content is difficult to identify the traffic flows. Therefore, many researches imported Machine Learning algorithm to deal with the problem, and the statistical features are extracted for the machine learning algorithms. However, the features are often constructed of various features in different spaces, such as the port ID, packets number, one-hot encodings and statistical properties. The traditional machine learning algorithms usually use Euclidean metric for the distance computing, which is unable to make the best use of the artificial features with various Internet traffic flow attributes. Considering this, the paper proposed to utilize Metric Learning algorithms to learn the adaptive distance metric for the multiple features. As a result, the proposed algorithm can take better advantage of the artificial features and make full use of the characteristics. Finally, the evaluation is conducted on the encrypted web sites traffic database with the comparison of several state-of-the-art algorithms, and experimental results show that the proposed algorithm has achieved the best performance with 8% higher of accuracy than Decision Tree which is the second best algorithm.

Abstract We present an efficient and stable framework, called Unified Intersection Resolver (UIR), for cloth simulation systems where not only impending collisions but also pre‐existing penetrations often arise. These two types of collisions are handled in a unified manner, by detecting edge‐face intersections first and then forming penetration stencils to be resolved iteratively. A stencil is a quadruple of vertices and it reveals either a vertex‐face or an edge‐edge collision event happened. Each quadruple also implicitly defines a collision normal, through which the four stencil vertices can be relocated, so that the corresponding edge‐face intersection disappear. We deduce three different ways, i.e., from predefined surface orientation, from history data and from global intersection analysis, to determine the collision normals of these stencils robustly. Multiple stencils that constitute a penetration region are processed simultaneously to eliminate penetrations. Cloth trapped in pinched environmental objects can be handled easily within our framework. We highlight its robustness by a number of challenging experiments involving collisions.

Summary In recent years, more and more intrusion detection systems and firewalls have been used to detect and block malicious applications or unknown protocols in order to enhance the security of systems. Therefore, some malicious applications begin to shape themselves as common ones to escape malicious protocol detection. Being an important protocol for many Internet services, hypertext transfer protocol (HTTP) is responsible for nearly 10% of the traffic volume on the Internet. Therefore, many malicious applications pretend their traffic to be HTTP protocol to go into hiding their malicious behaviors. In the paper, we study the problem of discovering these abnormal behaviors in HTTP protocol traffic. We find that the characteristics of many abnormal behaviors are performed in the header fields of their shaping HTTP such as Tor and malicious web crawlers, and the information of HTTP header fields of HTTP traffic generated by normal application is also discussed. And then, a method based on the measurement of HTTP header fields proposed three patterns that make them specific to detect abnormal behaviors of shaping HTTP protocol. The experimental results indicate that the proposed method is effective for abnormal behaviors by shaping to be HTTP on large‐scale traffic of one Internet service provider. The experimental results also show that the proposed method could be extended to large‐scale and high‐speed network environment for detecting abnormal behaviors of shaping HTTP protocol. Copyright © 2016 John Wiley & Sons, Ltd.

Bus rapid transit (BRT) has been proved to be an effective tool to improve mass transit services. However, BRT's adaptive operations like management and scheduling under different scenarios are too complicated to implement using traditional methods. The ACP approach, which is based on holism and complex system theory and consists of artificial systems (A), computational experiments (C) and parallel execution (P), offers an efficient new method to cope with these complex systems, including BRT. In this paper, the parallel transportation management and control system for BRT (PTMS-BRT) is presented, which is designed and implemented using the ACP approach. PTMS-BRT integrates such functions as BRT's monitoring, warning, forecasting, incident management, and real-time scheduling, to provide its operations smoother, safer, more efficient, and reliable. It has been piloted successfully in Guangzhou BRT to demonstrate it as another successful example of parallel transportation systems.

The subway's daily management and control are too complicated to be handled by using traditional methods. Based on the artificial systems, computational experiments, and parallel execution (ACP) approach, the Parallel Transportation Management and Control System for Subways (PTMS -Subway) is proposed. First, the dynamic status perception and management platform for subways (SPMP-Subway) is constructed, and artificial subway systems (ASS) are designed and constructed, and then they are validated by the real-time data from SPMP-Subway. Then, the design content and construction process of computational experiments platform are performed. Finally, through the interactions of parallel execution system between actual subway and its ASS, a set of practical management and control algorithms can be validated and improved. PTMS-Subway can implement those advanced functions, such as real-time monitoring, warning, forecasting, scheduling optimization, incidence management, and so on, to improve its reliability, efficiency, safety, and service level. SPMP-Subway and PTMS-Subway have been piloted in Subway Lines 1 and 2 in Suzhou, China, and achieved the expected results and benefits successfully.

Low-rank matrix recovery (MR) has been widely used in data analysis and dimensionality reduction. As a direct heuristic to MR, convex relaxation is usually degraded by the repeated calling of singular value decomposition (SVD), especially in large-scale applications. In this paper, we propose a novel Riemannian optimization method (ROAM) for MR problem by exploiting the Riemannian geometry of the searching space. In particular, ROAM utilizes an efficient subspace tracking schema that automatically detects the unknown rank to identify the preferable geometry space. Moreover, a gradient-based optimization algorithm is proposed to obtain the latent low-rank component, which avoids the expensive full dimension of SVD. More significantly, ROAM algorithm is proved to converge under mild assumptions, which also verifies the effectiveness of ROAM. Extensive empirical results demonstrate the improved accuracy and efficiency of ROAM over convex-relaxation approaches.

Advancements in complexity, complex systems, and the intelligence sciences, particularly smart city technologies, have shown great potential in aiding to ease traffic congestion. The overall approach and the main ideas in building smart transportation for smart cities, particularly ACP (artificial system, computational experiment, and parallel execution)-based parallel transportation management and control systems (PTMS), are presented. PTMS can be expanded to the new generation of intelligent transportation systems. The main components of the proposed architecture include social signal and social traffic, ITS clouds and services, agent-based traffic control, and transportation knowledge automation. Some technical details of these components are discussed. Finally, one case study is introduced, and the effectiveness is analyzed.

Network traffic classification is of great importance for fine-grained network management and network security. However, with the rapid development of new network applications in recent years, traffic that cannot be identified by classifiers accounts for an increasing ratio, which brings a great challenge for network operators. Most of the unknown traffic is usually generated by only a few or some certain kinds of applications. We call this kind of traffic as the elephant traffic. It is generally recognized that traffic sharing the same server IP and server port is generated by the same application. In this paper, we say that they are belonging to the same service. Therefore, we propose a novel method, in which service-based statistical features are used for cluster analysis, to classify these elephant traffic. Preliminary results on a real network traffic dataset show that our method is able to automatically identify similar unknown applications. We believe that classifying unknown traffic in service perspective is a promising direction.

Field data are important for convenient daily travel of urban residents, reducing traffic congestion and accidents, pursuing a low-carbon environment-friendly sustainable development strategy, and meeting the extra peak traffic demand of large sporting events or large business activities, etc. To meet the field data demand during the 2010 Asian (Para) Games held in Guangzhou, China, based on the novel Artificial systems, Computational experiments, and Parallel execution (ACP) approach, the Parallel Traffic Management System (PtMS) was developed. It successfully helps to achieve smoothness, safety, efficiency, and reliability of public transport management during the two games, supports public traffic management and decision making, and helps enhance the public traffic management level from experience-based policy formulation and manual implementation to scientific computing-based policy formulation and implementation. The PtMS represents another new milestone in solving the management difficulty of real-world complex systems.

Ramp metering is an effective tool for traffic management on freeway networks. In this paper, we apply iterative learning control (ILC) to address ramp metering in a macroscopic-level freeway environment. By formulating the original ramp metering problem as an output regulating and disturbance rejection problem, ILC has been applied to control the traffic response. The learning mechanism is further combined with Asservissement Linéaire d'Entrée Autoroutière (ALINEA) in a complementary manner to achieve the desired control performance. The ILC-based ramp metering strategy and the modified modularized ramp metering approach based on ILC and ALINEA in the presence of input constraints are also analyzed to highlight the advantages and the robustness of the proposed methods. Extensive simulations are given to verify the effectiveness of the proposed approaches.

This paper mainly researches enterprise information integration. Firstly, middleware types are discussed. Then, information integration platform is discussed. Next, a kind of middleware solution for enterprise information integration is proposed where an information integration environment is firstly built. Additional middleware-tier is then placed on top of the existing middleware-tier, the connection between the integrated middleware and the agent service unit is done with thick adapters, and the message broker middleware is placed on top middleware. The last part is about some analysis and conclusions.

Push/pull production mode and correspondent production plan and schedule strategies are mainly discussed. Firstly, we discuss about push/pull production mode used in CIMS, where push/pull combined control strategy is put forward, push/pull production mode is compared with MRPII and JIT. Secondly, production plan and schedule strategy of push/pull production mode is put forward, where its basic framework and overall architecture are given out, push/pull combined control method for main production plan is discussed. At the end of the paper, some conclusions are drawn out.

This paper initially researches Virtual Pulp & Paper Enterprise (VPPE). After the introduction, several conceptions are defined, virtual enterprise (VIE) is proved to be important to agile market competition, VE's unique challenges and opportunities are given out, VE's main issues are listed, a number of processes supporting the formation of VE are analyzed. Then, main research objectives, main transactions are given out. Next, to create new business model for pulp & paper industry, we initially analyze and create several potential solutions: 1. ERP solution. 2. Internet solution. 3. VPPE solutions. One solution to new customer ship is also created. At last, some conclusion are drawn out.

A delay dependent stability criterion for uncertain delay neural network is developed. A sufficient condition for the asymptotically robust stability of neural networks is proposed. The criterion includes the information on the size of time delay. In this criterion, a maximum admission delay value is estimated. The checking for robust stability of uncertain delay neural networks by our result can be carried out simply. Our result is less conservative than previously known criterion.

In this paper, the problem of robust decentralized stabilization for large-scale stochastic interval dynamical systems with time delays is investigated. First, with special transformation, the systems convert to equivalent form, which is apt to analysis. Then, some sufficient conditions for robust stability of the system are given. Furthermore, the design laws for robust decentralized stabilization controller are proposed in terms of linear matrix inequalities (LMIs). Analyses for the cases of time invariant delays and time varying delays are presented respectively.

This paper studies the problem of L/sub 2/ almost disturbance decoupling with global asymptotic stability for a class of strict feedback nonlinear system with time delays. A new recursive design method is proposed. Based on backstepping design method, it can conclude that there exists a robust control that solves the almost disturbance attenuation problem for nonlinear system with time delay.

Existing supply chains (SCs) have some disadvantages. In the paper, a kind of agile supply chain (ASC) is created and discussed. First, ASC is defined and analyzed. Then the judge criterion, qualified ASC and technology is given. Next, the basic functions of ASC are created and listed. Several key technologies of ASC are put forward and discussed, where the information integration for ASC management and fast system reorganization are two key issues. Finally, conclusions are drawn out and further research work is given out.