Graph prompt learning (GPL) serves as a crucial framework for mitigating the knowledge transfer by reconciling the substantial mismatch between pre-training models and downstream tasks. However, prevalent GPL paradigm fail to accommodate graph data affected by privacy-induced noise. Specifically, 1) GPL typically relies on the stability of original graph structures for the design of effective prompt templates; 2) the construction of prompts lacks explicit guidance to suppress noise introduced by privacy perturbations; 3) prompt optimization on single disturbed graphs can easily lead to overfitting to noise patterns. To address these issues, we propose a novel privacy-aware graph prompt learning (PAGPL) scheme, which alleviates spurious clues caused by privacy noise injection. Initially, an adaptive structure-wise Bayesian estimation is applied to reconstruct the privacy-perturbed graphs. Subsequently, to suppress the impact of residual perturbation, a noise-resilient prompt generation is employed to filter unreliable structural and signals. Ultimately, we incorporate a multi-view-based progressive privacy consistency to promote the robustness of prompts against the semantic misalignment while improving the task-specific consistency. The experimental results reveal that our scheme outperforms state-of-the-art (SOTA) GPL approaches with a 10%–60% improvement in accuracy under various real-world privacy-perturbed scenarios.

Large language model (LLM)-driven agents are designed to handle a wide range of tasks autonomously. As tasks become increasingly composite, the integration of multiple agents into a graph-structured system offers a promising solution. Recent advances mainly architect the communication order among agents into a specified directed acyclic graph, from which a one-by-one execution can be determined by topological sort. However, sequential architectures restrict the diversity of the information flow, hinder parallel computation, and exhibit vulnerabilities to potential backdoor threats. To overcome underlying shortcomings of sequential structures, we propose a node-wise multi-agent scheme, named message passing agent system (MPAS). Specifically, to parallelize the communication across agents, we extend the message propagation mechanism in graph representation learning to multi-agent scenarios and introduce our individual-epistemic message propagation. To further enhance expressiveness and robustness, we investigate three self-driven message aggregators. To achieve desired working flows, collaborative connections can be optimized without constraints. The experimental results reveal that compared to state-of-the-art sequential designs, MPAS could architect more advanced algorithms in 93.8% of the evaluations, reduce the average communication time from 84.6 seconds to 14.2 seconds per round on AQuA, and improve resilience against backdoor misinformation injection in 94.4% tests.

Abstract Tor employs multi-layer encryption and three-hop circuits to provide low-latency anonymity. While indispensable for privacy, these same properties can also be misused to conceal illicit activity. This dual-use nature makes effective de‑anonymization essential under appropriate, policy-bounded oversight, so that harmful behavior can be uncovered without undermining legitimate use. Yet de‑anonymization is not free: taking nodes offline and deploying honeypots consumes significant resources, increases exposure, and risks degrading network availability. Prior work faces two limitations: (i) it decouples the choice of which node to target from which method to apply, overlooking their strong coupling; and (ii) it often evaluates effectiveness with narrow, single-effect proxies, neglecting collateral network impact and operational cost. To support better de‑anonymization, we model joint node–technique selection as a tri-objective problem balancing attack gain ( AP ), attack impact ( AI ), and attack cost( AC ). For each feasible node–method pair we compute these three metrics, extract the Pareto set, prune with $$\epsilon$$ ϵ -constraints, and select a preference-aware compromise with VIKOR. In a Docker-orchestrated testbed, this Pareto-first pipeline achieves about $$+50\%$$ + 50 % higher attack gain and roughly $$-29\%$$ - 29 % lower attack Impact and attack cost compared with random selection.

The proliferation of Internet of Things (IoT) devices has profoundly transformed various industries. However, with the continual emergence of new IoT device types, their extensive heterogeneity and weak security have posed significant challenges for network management and security. Despite existing research excelling at classifying IoT traffic, they have yet to consider incremental updates and timely identification, which are critical for early device management and security in IoT networks. As a solution, we present EAPN, a novel and evolvable IoT device identification model that supports adapting to new IoT devices with limited traffic. EAPN extracts traffic features from only a few dozen packets and resorts to a metric-learning-based triplet network to capture accurate, discriminative behavioral representations among IoT devices. Then, inspired by Few-Shot Incremental Learning (FSIL), EAPN further considers advancing incremental model updates based on the relationship between traffic features of new and existing IoT devices. Extensive evaluations demonstrate that EAPN not only surpasses state-of-the-art adaptive IoT device-type identification methods but also achieves over 90% accuracy under almost all incremental conditions, maintaining satisfactory performance even after multiple updates.

Over-the-top (OTT) applications mainly communicate through HTTPS, the most famous encryption protocol family on the Internet. The classification of HTTPS encrypted traffic can effectively obtain fine-grained OTT application information for network management and cyber security. As the most expressive feature, the side-channel length sequence is widely used by current research, especially the packet length sequence. However, these attempts ignored interferences from protocol piecewise decoupling and encryption covering, leading to poor performance. Based on the application layer feature engineering theory, we proposed a new metric called Application Data Unit (ADU) length to eliminate the interferences. However, ADU length cannot be obtained directly from packets as the TLS encryption protocol covers the entire application layer, which contains an intrusive and variable HTTP header. Hence, we designed a Length-Correction Multiple Regression Neural Network (LCMRNN) algorithm to restore the real ADU length sequences accurately. Exhaustive experiments in two scenarios of the real CERNET network show that no matter the HTTP-1.1 or HTTP2.0 protocol, the LC-MRNN model can achieve significantly accurate ADU length restoration. In classification, with the assistance of the LS-LSTM classifier, our method outperforms the state-of-the-art methods with about 4.2% improvement in F1-score (93.52%).

Encrypted traffic analysis is crucial for cyberspace security. Self-supervised learning shows great promise to enhance traffic analysis with the pre-trained traffic encoder, which is constructed using large-scale, readily available unlabeled traffic data. However, existing approaches struggle to handle the increasingly prevalent encrypted traffic, as their generative reconstruction tasks cannot process encrypted content. To this end, we propose TACO, a robust and flexible encrypted traffic analysis system based on flow semantics learning. Specifically, we first design several feasible traffic data augmentation strategies to prepare flow semantics knowledge from the unlabeled traffic. Then, our traffic encoder with a traffic partition module learns the semantics knowledge based on the contrastive pre-training paradigm. It serves as a traffic foundation encoder that can comprehend flow semantics and extract effective semantic representations. Finally, we fine-tune the traffic encoder to leverage flow semantics for various downstream encrypted traffic analysis tasks. The experimental results illustrate that TACO outperforms the optimal baseline by 7.5% in average F1 score on four traffic classification datasets and achieves an improvement of at least 11.62% in average F1 score on the three transfer tasks, while indicating superior efficiency. We will release the source code as well as the experiment data upon publication to foster future research.

Machine learning (ML) has gained significant adoption in Android malware detection to address the escalating threats posed by the rapid proliferation of malware attacks. However, recent studies have revealed the inherent vulnerabilities of ML-based detection systems to evasion attacks. While efforts have been made to address this critical issue, many of the existing defensive methods encounter challenges such as lower effectiveness or reduced generalization capabilities. In this paper, we introduce MalPurifier, a novel adversarial purification framework specifically engineered for Android malware detection. Specifically, MalPurifier integrates three key innovations: a diversified adversarial perturbation mechanism for robustness and generalizability, a protective noise injection strategy for benign data integrity, and a Denoising AutoEncoder (DAE) with a dual-objective loss for accurate purification and classification. Extensive experiments on two large-scale datasets demonstrate that MalPurifier significantly outperforms state-of-the-art defenses. It robustly defends against a comprehensive set of 37 perturbation-based evasion attacks, consistently achieving robust accuracies above 90.91%. As a lightweight, model-agnostic, and plug-and-play module, MalPurifier offers a practical and effective solution to bolster the security of ML-based Android malware detectors.

Website fingerprinting (WF) attacks are employed to identify websites that utilize Tor encryption. Although State-Of-The-Art (SOTA) WF attacks demonstrate strong performance in single-tab scenarios, they face challenges in multi-tab scenarios. Many multi-tab WF attacks rely solely on direction sequence or process directional and temporal sequence separately. They ignore the coupling between directional and temporal features, which reflects distinct resource-loading processes for different websites. To address the limitations of existing approaches, this paper proposes a new multi-tab WF attack, STMWF. It leverages spatial-temporal sequence analysis and jointly models Inter Arrival Time (IAT) with the direction sequence. STMWF utilizes an SE-attention-based feature extractor to derive features from various website resources within the spatial-temporal sequence. It then employs correlation self-attention to integrate these resource features into their respective websites, ultimately constructing distinct fingerprints for each site. Additionally, the method incorporates correlation denoising to suppress noise in the website fingerprints, thereby enhancing the discriminability of the extracted features. We collected single-tab traces to synthesize a dataset with controlled overlap ratios. We also captured real-world multi-tab traffic with varying tab-opening intervals, evaluating performance under authentic conditions. The experimental results indicate that STMWF significantly outperforms the SOTA multi-tab attacks in both dynamic and static settings. Specifically, it achieves an average F1-score improvement of approximately 14.87% under static conditions and 34.81% under dynamic conditions compared to the SOTA multi-tab WF attack, ARES. Furthermore, STMWF exhibits greater robustness against WF defenses than SOTA attacks and consistently surpasses them across varying overlapping scenarios.

Website fingerprinting (WF) attacks identify Torencrypted websites but struggle with cross-domain scenarios due to traffic distribution shifts. The existing few-shot WF attacks address the cross-domain problem with excessive auxiliary data, significantly reducing deployment efficiency. This work proposes UDA-WF, a data-efficient few-shot WF with Unsupervised Domain Adaptation (UDA). UDA-WF first pre-trains the feature extractor with limited auxiliary data in the source website domain. Then, it extracts the invariant feature space by computing the intersection of the source and target feature spaces through the unsupervised domain adaptation with the softmatch mechanism. Finally, UDA-WF fine-tunes the feature extractor and a single-layer perceptron to extract the discriminative unique feature space of the target website domain. We evaluate UDA-WF on our WF dataset collected over multiple months. UDA-WF significantly overcomes the cross-domain problem while reducing auxiliary data requirements by 95% and pre-training bootstrap time by 99% compared to the State-Of-The-Art (SOTA) methods. UDA-WF achieves an accuracy of 97.37% under the 20-shot setting in the closed-world scenario and outperforms SOTA methods. To further demonstrate the model’s adaptability to diverse real-world requirements, we validate it on the DF and Wang datasets, achieving accuracies exceeding 92% and 94%, respectively. Moreover, the results show that our UDA-WF is more resilient to concept drift and robust to WF defense.

Industrial Internet of Things (IIoT) faces increasing security risks with wide applications. Compared with the Internet, the IIoT has a broader attack surface and unique structural characteristics, posing difficulties in directly transferring the previous vulnerability analysis techniques. This paper proposes a triple-stage vulnerability analysis framework (TS-VulA) for IIoT via attack graphs combining ModernBERT and multi-layer heterogeneous networks, which includes three stages. In the first stage, the SentenceBERT based on ModernBERT and IIoT disruption losses are combined to conduct a single-node vulnerability assessment from the aspects of likelihood and criticality of vulnerability exploitation. In the second stage, an IIoT device importance calculation based on multi-layer heterogeneous network theory is proposed, which can acquire the inherent relationships among various IIoT devices. Stage 3 extends attack graph rules for IIoT, then computes node priorities by integrating vulnerability assessment and device importance, which can guide the mitigation strategy. Extensive experiments demonstrate that the proposed vulnerability assessment method achieves an average accuracy and average precision of 87.86% and 87.33%, both exceeding the existing methods. Simulated case studies illustrate that the proposed TS-VulA outperforms the prevailing vulnerability analysis methods.

With the continuous advancement of transportation systems, leveraging Vehicular Crowdsensing (VCS) for data collection and analysis within digital cities has become a promising paradigm. Most existing research focuses on improving task completion rates using location information but often overlooks the impact of drivers’ rational decision-making processes. To address this issue, we propose novel task scheduling and incentive mechanisms grounded in two distinct rational decision-making models. Specifically, drivers are categorized as Individual Rationality and Bounded Rationality based on their sensitivity to utility and cost. For drivers with Individual Rationality, who only accept tasks that ensure non-negative utility, we formulate the maximum weighted subset coverage problem (MWSC-Problem). On the other hand, for drivers exhibiting Bounded Rationality, who accept tasks with a certain probability influenced by their sensing utility and cost, we introduce the maximum probability task coverage problem (MPTC-Problem). The driver recruitment problem in both scenarios is proven to be NP-hard. For each case, we design customized scheduling and incentive algorithms to optimize both the platform’s task completion rate and cost efficiency. Meanwhile, the performance bounds and computational complexity of the proposed algorithms are theoretically analyzed. By extensive simulations on a real-world taxi dataset, the effectiveness of our strategies is validated.

Consortium blockchains enable secure economic applications through privacy-preserving architectures and efficient processing. Growing cross-chain demands require value-exchange mechanisms, yet expose privacy risks during external interactions. Encrypting cross-chain information is necessary, requiring third-party verification of relations within the encrypted content. Existing privacy-preserving cross-chain research for consortium chains struggles to balance transaction efficiency, transaction validity verification, and complex trust assumptions for relays. We present VeCroToken, an efficient, verifiable, and privacy-preserving cross-chain model for consortium blockchains. VeCroToken introduces a dual-balance mechanism and designs four types of cross-chain zero-knowledge transactions based on zk-SNARKs. These transactions encrypt two types of balances and transaction amounts, effectively protecting participant privacy. The encrypted cross-chain data and zero-knowledge proof credentials are stored on participants’ consortium blockchains and the relay chain. Relay nodes and third parties can validate transaction proofs with public parameters, preserving privacy while ensuring compliance and validity. We give a security analysis in the UC framework that proves verifiability and balance safety. We also provide a privacy analysis establishing the amount, balance, and fund-correlation privacy. We implement a prototype on Hyperledger Fabric. Our experimental results show that VeCroToken has a lower overall zero-knowledge proof overhead than the state-of-the-art models and performs well in transaction performance.

This paper introduces an innovative blind flow watermarking framework on the basis of Invertible Neural Network (INN) called IFW, which aims to solve the problem of suboptimal encoder-decoder coupling in existing end-to-end watermarking architectures. The framework tightly couples the encoder and decoder to achieve highly consistent feature mapping using the same parameters, thus effectively avoiding redundant feature embedding. In addition, this paper adopts the INN to implement watermarking, which supports forward encoding and backward decoding, and the watermark extraction is completely dependent on the embedding algorithm without the need for the original network flow. This feature enables both the embedding and the blind extraction of watermarks simultaneously. Extensive experiments demonstrate that the proposed IFW method achieves a watermark extraction accuracy exceeding 96.6% and maintains a stable K-S test p-value above 0.85 in both simulated and real-world Tor traffic environments. These results indicate a clear advantage over mainstream baselines, highlighting the methods ability to jointly ensure robustness and invisibility, as well as its strong potential for real-world deployment.

Traffic classification is crucial for network management and security. Recently, deep learning-based methods have demonstrated good performance in traffic classification. However, they primarily capture features from raw packet bytes, overlooking the significance of inter-packet correlations within flows from a global perspective. Additionally, effectively handling both packet-length and temporal information, while extracting the structural relationships from a graph into the model, remains a challenge for enhancing the performance of traffic prediction. In this paper, we propose DigTraffic, a novel dual-channel interactive graph transformer to address these limitations. DigTraffic employs a message-level graph-structured flow representation combined with message-aware structural aggregation. To learn intrinsic flow representations, DigTraffic constructs traffic interaction graphs, by incorporating three well-designed heterogeneous types of edges to capture client-server interactions. After that, we separately encode lengthy and temporal flow sequences using a dual-channel network and fuse these modalities within a Transformer architecture. Furthermore, DigTraffic introduces a message-aware Graph Transformer that leverages both node embeddings and edge spatial relations to capture complex graph structures and rich structural information. Experimental results demonstrate that our method significantly outperforms the state-of-the-art methods on four real-world traffic datasets.

With the widespread use of smartphones and the rapid growth in mobile users worldwide, Location-Based Services (LBS) have become indispensable in daily life. The utilization of such services inevitably results in the generation of a considerable quantity of geolocation data. Most of these data have been encrypted to safeguard user privacy. However, the risk of side-channel information leakage still exists. In order to reveal the vulnerabilities in geolocation privacy, we propose a novel attack method, ETLA, leveraging encrypted LBS traffic analysis techniques. Specifically, we design a feature extraction algorithm, TPFC, to accurately restore the application-layer LBS transmission patterns and construct highly recognizable location combined features. Finally, we conduct extensive experiments based on real traffic datasets, and the results show that the average attack accuracy of ETLA reaches 97.68%. Additionally, we validate the application agnosticism, temporal stability and anti-interference capability of the model, further emphasizing the threat posed by the attack in real-world application scenarios.

Malware increasingly targets current Internet of Things (IoT) devices, causing significant economic losses. Accurate and early detection of malware is essential for defense. Existing IoT malware detection methods primarily analyze interactive traffic between compromised devices and C&C servers. Such detection needs to be performed while IoT devices are undergoing attacks, which still exposes IoT devices to danger. By analyzing real-world DNS traffic generated by IoT devices, we uncover that the DNS behavior patterns of benign IoT devices and malwareinfected devices differ. Therefore, this work proposes a method to accurately and early detect IoT malware via DNS traffic analysis with deep learning before attacks are launched, referred to as IoTMD-2D. IoTMD-2D first extracts a comprehensive set of DNS traffic features of IoT devices that effectively characterize DNS traffic behavioral patterns. Then, it integrates an attention-based LSTM to capture hidden relationships within domain names and a 1D-CNN to explore hidden patterns in DNS behavior-level features for generating feature representations that discriminate DNS traffic of benign IoT devices and malware-infected devices. Finally, IoTMD-2D accurately detects IoT malware based on the generated feature representation. Our experimental study on public IoT datasets demonstrates that our IoTMD-2D achieves an accuracy of 97.63 % in detecting IoT malware at an early stage via DNS traffic analysis.

As network line rates continue to escalate, sketch-based methods have become increasingly pivotal tools in network measurement. Traditional sketch-based measurements are performed in fixed windows, which leads to truncation of network traffic and results in issues of underreporting. Recently, some studies have introduced the sliding window model into sketch-based measurements, providing a promising solution to this problem. However, these methods require the deployment of multiple sketch instances on a network equipment, consuming substantial memory resources. In addition, they necessitate complex data collection operations to achieve high accuracy. In this paper, we propose a novel network measurement framework, namely Round Sketch, which minimizes memory usage by incorporating an indicator into each counter and simplifies the data collection process by providing an efficient collection-and-set operation. Furthermore, Round Sketch is generic and can be applied to a wide range of existing sketches. We have implemented Round Sketch on FPGA platform and conducted comprehensive evaluations based on various measurement tasks. The results indicate that Round Sketch achieves comparable accuracy to state-of-the-art solutions while occupying only half of the memory space.

Intelligent traffic analysis, serving as a core enabler of QoS (Quality of Service) policies, plays a pivotal role in finegrained resource scheduling and mission-critical performance assurance. While SmartNIC-based data plane offloading effectively alleviates host processing burdens, existing solutions lack a unified traffic management capability, restricting them to packet-level classification or inference model acceleration. This paper proposes FlowAccel, an end-to-end hardware architecture for line-rate intelligent network traffic analysis in FPGA-based SmartNICs. FlowAccel constructs a hierarchical memory structure for real-time updates of flow state and per-flow packet length sequence. Its feature extraction pipeline enables parallel computation of traffic fingerprint features and incorporates a dedicated XGBoost acceleration engine for hardware-optimized model inference. Implemented on the Alveo U50, our prototype demonstrates a$1.08 \mu ~\mathrm{s}$median inference latency under 100 Gbps network traffic. Compared with a single-logical-core DPDK software implementation, FlowAccel achieves a$54 \times$latency reduction and$180 \times$throughput improvement. In terms of accuracy, FlowAccel attains Macro-F1 scores of$89.0 \%, 86.3 \%$, and 92.4 % across three public datasets, significantly outperforming existing single-port 100 Gbps hardware offloading approaches.

State machines are essential for enhancing protocol analysis to identify vulnerabilities. However, inferring state machines from network protocol implementations is challenging due to complex code syntax and semantics. Traditional dynamic analysis methods often miss critical state transitions due to limited coverage, while static analysis faces path explosion issues. To overcome these challenges, we introduce a novel state machine inference approach utilizing Large Language Models (LLMs), named ProtocolGPT. This method employs retrieval augmented generation technology to enhance a pre-trained model with specific knowledge from protocol implementations. Through effective prompt engineering, we accurately identify and infer state machines. To the best of our knowledge, our approach represents the first state machine inference that leverages the source code of protocol implementations. Our evaluation of six protocol implementations shows that our method achieves a precision of over 90 %, outperforming the baselines by more than 30 %. Furthermore, integrating our approach with protocol fuzzing improves coverage by more than 20 % and uncovers two 0-day vulnerabilities compared to baseline methods.

Network traffic classification is essential for network management and security. In recent years, deep learning (DL) algorithms have emerged as essential tools for classifying complex traffic. However, they rely heavily on high-quality labeled training data. In practice, traffic data is often noisy due to human error or inaccurate automated labeling, which could render classification unreliable and lead to severe consequences. Although some studies have alleviated the label noise issue in specific scenarios, they are difficult to generalize to general traffic classification tasks due to the inherent semantic complexity of traffic data. In this paper, we propose FlowRefiner, a robust and general traffic classification framework against label noise. FlowRefiner consists of three core components: a traffic semantics-driven noise detector, a confidence-guided label correction mechanism, and a cross-granularity robust classifier. First, the noise detector utilizes traffic semantics extracted from a pre-trained encoder to identify mislabeled flows. Next, the confidence-guided label correction module fine-tunes a label predictor to correct noisy labels and construct refined flows. Finally, the cross-granularity robust classifier learns generalized patterns of both flow-level and packet-level, improving classification robustness against noisy labels. We evaluate our method on four traffic datasets with various classification scenarios across varying noise ratios. Experimental results demonstrate that FlowRefiner mitigates the impact of label noise and consistently outperforms state-of-the-art baselines by a large margin. The code is available at https://github.com/NSSL-SJTU/FlowRefiner.

Early classification of encrypted traffic is crucial for time-sensitive tasks such as intrusion detection and cyberspace situation awareness. Dissimilar flows can be distinguished with a small number of packets, while similar flows require more packets. The existing early classification methods use the same number of packets to classify all flows, which leads to many flows cannot be classified early. In this paper, we propose a method to classify TLS flows by concatenation of multiple models. For flows that fail to be classified, a larger number of packets are used to classify them in the subsequent models in turn until they are successfully classified. Compared with existing methods that rely on unstable features such as time series, the proposed method can accurately classify flows by features that are easy to extract and maintain stable values. Experiments show that the proposed framework has the highest classification efficiency and accuracy compared with three baseline methods, including a state-of-the-art early classification method.

Tor is widely used to facilitate anonymous web communication, but it remains vulnerable to Website Fingerprinting (WF) attacks. Although deep learning-based WF attacks have shown promising results, they typically rely on large-scale labeled data and assume consistent conditions between training and deployment. These assumptions limit their practical applicability in real-world scenarios, where data scarcity and domain shifts are common. To address these challenges, recent research has focused on Cross-Domain Few-Shot Website Fingerprinting (CDFSWF), a more realistic yet challenging setting. Existing efforts mainly leverage data augmentation or feature alignment techniques. While data augmentation can mitigate sample scarcity, it often fails to capture true distributional variability. In contrast, many feature alignment WF methods overlook the semantic structure of class relationships, reducing their effectiveness in the target domain. In this paper, we propose CoDA, a novel method designed to improve cross-domain robustness in CDFSWF. CoDA integrates supervised contrastive pre-training, hierarchical flow attention, and prototype-based classification to effectively model semantic traffic structures under domain shifts. Furthermore, a Dual Confidence Alignment (DCA) strategy is introduced during fine-tuning to adaptively align semantic structures. Extensive experiments across various cross-domain scenarios show that CoDA consistently outperforms state-of-the-art baselines in both closed-world and open-world settings.

Machine learning (ML) models for Android malware detection face escalating threats from adversarial query attacks, which iteratively perturb malware samples guided solely by model outputs. Existing stateful defenses primarily detect such attacks by analyzing query similarities or distribution anomalies. However, these methods are less effective in the malware domain, where discrete feature spaces and strict functional constraints combine with their reliance on only a single similarity or distribution metric, making it difficult to capture the varied patterns of query-based attacks. In this paper, we introduce MalShield, a stateful defense model that monitors the query stream through an adaptive sliding window, which adjusts its span according to the incoming query rate to preserve relevant context and enable real-time computation of multiple anomaly indicators. We design multiple complementary anomaly indicators, such as similarity decay and feature growth, to capture both temporal patterns and deviations in feature space, enabling more sensitive detection of query attacks. The K-of-N voting rule alerts only when enough indicators agree, cutting false positives and adapting to varied query attacks, thus providing robust, interpretable defense without changing the classifier. Experiments on Androzoo and Drebin datasets, against eight black-box query attacks, show MalShield achieves more than 96% reduction in evasion rates, surpassing existing stateful defenses and at best outperforms existing defense models by 100%.

Slow HTTP DoS (SHD) is a novel DoS attack that exploits HTTP/HTTPS. SHD often operates at the application layer with encryption and has long packet intervals due to its slow transmission rate, making it more concealed and difficult to detect. Therefore, traditional detection methods for high-speed DDoS are ineffective against SHD. Meanwhile, Existing SHD detection approaches need many generic features or complex models, thus becoming less interpretable and more resource-intensive to meet real-time demands in high-speed networks. Moreover, most methods rely on bidirectional traffic, neglecting the prevalent issue of asymmetric routing in high-speed networks. To overcome these shortcomings, this paper proposes IEA-DMS, an Interpretable feature-driven, Efficient and Accurate Detection Method for Slow HTTP DoS in high-speed networks. We first analyze SHD mechanisms and construct a representative feature set based on its traffic characteristics to perform effectively under sampling and asymmetric routing. Then, to fast and accurately record the features, we employ Slow HTTP DoS Sketch and provide a detailed error analysis and suggest appropriate parameters. Experiments using public datasets show that the proposed features are efficient and interpretable. Even with numerous unidirectional flows and a 1/64 sampling rate , IEA-DMS detects SHD accurately within 2 min with low memory usage. Besides, IEA-DMS’s processing performance reaches 13.1 Mpps and can continuously process more than 100 days of traffic without clearing memory.

Abstract People conveniently share and watch videos through Instant Messaging(IM) software, which is likely to reveal their preferences. Identifying IM video content can enable attackers to snoop on user privacy. Existing methods identify videos based on the features embodied in the DASH stream. However, IM software does not transmit video using DASH. IM software uses various transmission protocols or even private protocols for video transmission, which poses a challenge for video content identification. In this paper, we propose a video content identification framework for IM software, which obtains video content by extracting unique and stable features of videos as transmission fingerprints and matching them in a video fingerprint database. We evaluate the method on two popular IM software. The experimental results show that our method has an accuracy of 98.05% and 99.49% for ciphertext videos transmitted over GQUIC protocol and HTTPS protocol, respectively, and even reaches 100% identification accuracy for plaintext videos. Furthermore, the experimental results outperform the existing methods.

Abstract Network flow fingerprinting technology extends the number of embedded bits based on watermarking, thereby conveying additional information about the marked traffic, such as the traffic origin or the identity of the marking entity. However, existing fingerprinting/watermarking techniques follow the same embedding pattern under various levels of network noise, which hinders adaptation to high-noise environments and increases the risk of information loss. Therefore, this paper introduces the concept of embedding strength and proposes a network flow fingerprinting method with adaptive embedding strength. The embedding strength is adaptive for different network flows and can be freely adjusted. To achieve this, we design a two-stage training framework to generate fingerprint delays. In the first stage, we use an autoencoder architecture to obtain the optimal embedding for the fingerprint. In the second stage, we introduce a new component-the Adaptor-to produce a minimized embedding strength that eliminates redundant embeddings from the previous stage, thus balancing robustness and invisibility. Experimental results show that, after two stages of training, our scheme achieves an extraction rate of 98.33% and a bit error rate of 0.83%. Furthermore, in high-noise environments, our scheme can adjust the embedding strength to improve the extraction rate from 60.83 to over 90%.

A compiler converts smart contract source code into bytecode, ensuring behavior consistency between them. However, as compiler is also a program, it may contain bugs that disrupt this consistency, known as Compiler-Introduced Bugs (CIBs). Of the latest 4,857 verified smart contracts coded in Solidity, approximately 58% still use compilers that contain at least one CIB. These CIBs can be exploited by attackers to bypass security checks or inject malicious data, leading to significant security issues, which becomes even more serious for smart contracts in blockchain as they cannot be modified after being deployed. To this end, this paper proposes sBugChecker, to the best of our knowledge, the first systematic framework designed to automatically and effectively detect CIBs for smart contracts coded in Solidity. sBugChecker can be readily extended with the rule customization suite we propose based on domain specific language. Additionally, it employs two static analytical methods, i.e., pattern matching, and symbolic execution, to identify CIBs’ triggering conditions and confirm their impacts, broadening its detection scope and improving its detection efficiency. To evaluate sBugChecker’s performance, we construct a CIB mutated smart contract dataset, which is the first publicly-available one for this study. According to the evaluation based on this dataset, sBugChecker performs exceptionally well, with detection precision, recall, and F-measure on average achieving 96.6%, 95.5% and 96.0%, respectively. Moreover, sBugChecker has been applied to successfully discover real-world deployed smart contracts capable of triggering CIBs.

Recently intrusion detection technology has been deployed in the Industrial Internet of Things (IIoT), which is an efficacious approach to enhancing security. However, identifying previously unseen and unknown attacks, referred to as the open-set problem, has become increasingly difficult due to the openness of IoT architecture and the continuous evolution of attack patterns. Moreover, existing open-set intrusion detection solutions are challenging to be applied directly to IIoT because of their unique characteristics, such as limited computational and storage capabilities, long detection times, and the inability to continuously learn. In this paper, we propose an efficient, lightweight, and dynamic open-set intrusion detection scheme for IIoT. It consists of three stages: the known attack classification stage focuses on extracting features from known data to efficiently classify normal data and known attacks; the unknown attack recognition stage analyzes the distribution of reconstruction errors to effectively distinguish between known data and unknown attacks; and the dynamic update detection stage introduces a lightweight detection architecture for unknown attacks detection, significantly reducing the computational overhead and storage requirements of IIoT devices. Simultaneously, it learns from and updates with newly detected unknown attacks to further optimize detection capabilities. We conduct experiments on four widely used datasets to evaluate the performance of open-set intrusion detection for IIoT. The experimental results delineate the superiority of our proposed method over four state-of-the-art approaches in open-set intrusion detection. Meanwhile, our proposed lightweight model updating method significantly reduces detection time by over 65% and memory overhead by over 80% compared to retraining methods, while achieving an average detection accuracy of 96%.

With the explosive development of mobile devices, mobile crowdsensing (MCS) has emerged as a promising approach for large-scale sensing data collection. In the research of MCS, blockchain technology has been widely adopted to decentralize the traditional mobile crowdsensing and tackle the problem of single point of failure. Incentive mechanisms are devised to boost participation with fairness and truthfulness. However, to better determine the incentive strategy, participants’ privacy can be disclosed on top of the blockchain and obtained by adversaries during the transmission and execution of user data, leading to serious security issues. In this paper, we propose a two-stage incentive scheme with efficiency, robustness and privacy preservation considered based on the combination of blockchain technology and Trusted Execution Environment (TEE). Detailedly, we design two kinds of smart contracts, where on-chain public contracts support the procedure of general crowdsensing interactions, and off-chain private ones enabled by TEE complete the privacy-preserving computations, including an online incentive mechanism for worker recruitment decisions and a truth discovery algorithm for data aggregation. Recovery mechanism and hash check mechanism are introduced to avoid TEE provider failures and TEE providers’ attacks, respectively. Our scheme is proved to be theoretically secure in terms of private information protection, worker participation anonymity, and data aggregation privacy. Experimental results also verify the feasibility and superiority of our incentive scheme.

Encrypted traffic on anonymizing networks is still at risk of being exposed to the Website Fingerprinting (WF) attack. This attack can seriously threaten the online privacy of users of anonymity networks such as Tor. While deep-learning-based WF attacks achieve high accuracy in controlled experimental settings, they cannot continuously learn after deployment. In real-world environments, new websites are constantly emerging, requiring attackers to expand their monitoring scope continuously. This necessitates attack models capable of continuous learning and expanding classification capabilities. In this paper, we explore how attackers can leverage incremental class learning techniques to continuously learn new classes while retaining the ability to distinguish old ones. This approach mitigates the catastrophic forgetting problem in dynamic, open-world scenarios. We introduce a new WF attack, Class Incremental Fingerprinting (CIF), which employs a scalable architecture enabling Class Incremental Learning (CIL) with limited resources. We evaluate this attack in various scenarios, such as learning 100, 200, and 500 monitored website classes across 5 and 10 incremental tasks, achieving an average accuracy of 97.8% and above. Additionally, we assess the CIF attack’s effectiveness in open-world multi-classification scenarios and test it in few-shot settings using the proposed data augmentation method, Mixtam, achieving an average task accuracy of 87.6% and above with only 30 samples per class.

Edge computing (EC) and container technology have been widely used to increase the flexibility of computing resources and meet the real-time requirements for delay-sensitive applications. However, it has been shown that edge clouds suffer from distributed denial-of-service (DDoS) attacks, especially low-rate DDoS (LDDoS) attacks, which can be stealthily crafted to evade detection. Unfortunately, the existing techniques cannot provide effective protection, and the amplifying resource consumption and service delay incurred by defense greatly diminish the efficiency of the security system. To tackle these problems, this paper exploits Moving Target Defense (MTD) techniques and deep reinforcement learning (DRL) for mitigating the impact of LDDoS attacks in a resource-efficient way by effectively partially invalidating, avoiding, and tolerating malicious traffic that improves the Web services’ security and quality with lower overhead. We first design several lightweight MTD mechanisms by utilizing the built-in functionalities of container-based applications. To further optimize resource utilization, we formulate the interaction between attacks and MTD deployment as a Markov decision process (MDP), and adopt a deep Q-network (DQN) algorithm to achieve the best trade-off between effectiveness and overhead. The simulations prove the effectiveness of the proposed approach in LDDoS mitigation, with a significant improvement of up to 31.7% in security and 26.95% in service quality when compared with other practical strategies, and the experimental results also demonstrate that our method exhibits the lowest response time per request of 276.66 ms and the lowest webpage load time of 1.413 s with only 2.44% additional memory usage in comparison with previous works in the high workload scenario.

Various Traffic Classification (TC) technologies have been developed to de-anonymize anonymous tools, such as Tor, the most popular communication anonymous system. Although current TC methods boast high performance in closed-world scenarios, they frequently encounter challenges when dealing with the low base rate of anonymous traffic in the real open world, a phenomenon referred to as the base rate fallacy. In this paper, we introduce HPETC, an anonymous traffic classification system tailored for real-world scenarios, with a focus on achieving high precision, even in the presence of extremely low rates of anonymous traffic within expansive network environments. HPETC comprises an online classifier that efficiently filters anonymous traffic with minimal resource requirements, alongside an offline classifier responsible for extracting detailed information to support fine-grained classification. In response to the base rate fallacy, we introduce three Enhanced Techniques to enhance the performance of the classifiers within HPETC. Experimental findings illustrate that HPETC markedly diminishes resource consumption and greatly enhances the actual precision in comparison to state-of-the-art methods. Remarkably, in scenarios characterized by an extremely low rate of anonymous traffic (non-Tor/Tor$=$1000), our HPETC demonstrates an actual precision improvement that exceeds eightfold when benchmarked against commonly utilized models, specifically the Random Forest (RF) and Convolutional Neural Network (CNN) models.

Many malicious attacks are launched through encrypted traffic from unknown proprietary network protocols. Timely identification of such malicious unknown encrypted traffic is essential for the defense. However, it is challenging to acquire labels for unknown protocols in the context of encrypted traffic. Due to the lack of prior knowledge, unsupervised learning is adopted to cluster unknown encrypted traffic. The existing unsupervised encrypted traffic clustering methods do not customize feature extraction and representation of unknown encrypted traffic, resulting in imperfect clustering results. This work innovatively proposes BiFR-SSL to accurately cluster unknown encrypted traffic without prior knowledge. BiFRSSL extracts features of each unknown encrypted bidirectional network flow based on the lengths, arrival time, and directions of packets within the flow to construct a Bidirectional Flowpic Representation (BiFR). Subsequently, it exploits Self-Supervised Learning (SSL) to pre-train a feature extractor that produces feature representations from BiFRs, guaranteeing the closeness of encrypted traffic flows from the same protocol in the representation space. Finally, it clusters unknown encrypted traffic based on their feature representations generated by the pre-trained feature extractor. Our experimental studies demonstrate that BiFR-SSL can effectively cluster encrypted traffic of unknown protocols and outperforms state-of-the-art methods.

In an era of rapidly increasing network speeds and expanding infrastructures, the demand for real-time and accurate network measurement tasks by network management has progressively heightened. Among these tasks, heavy flow detection has received sustained attention due to its broad application in areas such as traffic scheduling and congestion control. Concurrently, as a growing number of network services are deployed to the data plane, the already scarce resources of the data plane face even stricter constraints in multi-task scenarios. Hence, this paper proposes a heavy flow detection method aimed at resource-constrained scenarios, implementing a lightweight and hardware-software integrated real-time heavy flow detection on a data plane based on FPGA programmable switches. By designing an accurate flow table utilizing FPGA resource characteristics and optimizing the implementation of the sketch algorithm in hardware, our method significantly reduces the resource overhead of the data plane while conducting real-time detection of large network flows. Tests conducted with different real network traffic and a 4×10Gbps programmable network card have demonstrated that, with minimal hardware resources and minimal interference with network forwarding services, the real-time heavy flow detection precision of our method can reach more than 97%.

As a modern ensemble technique, Deep Forest (DF) employs a cascading structure to construct deep models, providing stronger representational power compared to traditional decision forests. However, its greedy multi-layer learning procedure is prone to overfitting, limiting model effectiveness and generalizability. This paper presents AugDF, an optimized Deep Forest featuring learnable, layerwise data augmentation policy schedules. Specifically, We introduce the Cut Mix for Tabular data (CMT) augmentation technique to mitigate overfitting and develop a population-based search algorithm to tailor augmentation intensity for each layer. Additionally, we propose to incorporate outputs from intermediate layers into a checkpoint ensemble for more stable performance. Experimental results show that AugDF sets new state-of-the-art (SOTA) benchmarks in various tabular classification tasks, outperforming shallow tree ensembles, deep forests, deep neural network, and AutoML competitors. The learned policies also transfer effectively to Deep Forest variants, underscoring its potential for enhancing non-differentiable deep learning modules in tabular signal processing.

Hidden services (HS) allow users to experience anonymity, but they also provide shelter for criminal activities. The widespread attention towards deanonymizing HS has brought website fingerprinting attack (WFA) into the spotlight, which is considered highly promising. However, most HS websites are designed simply and have high similarity in resource structures, making it difficult to represent the HS access traffic well, and existing work often directly applies traffic representation methods in the field of web research, resulting in poor effects of the model. Besides, features of HS access traffic are closely related to the resource access sequence of websites. Current studies build models based on convolutional neural network (CNN), ignoring the global correlation of HS access traffic parts. To address the short-comings, we have proposed an efficient WFA to deanonymize HS, and named it NuanceTracker. The contribution of our work lies in three points. Firstly, a burst-based HS fingerprint generation algorithm is proposed to describe the sequence of HS access traffic. Secondly, we propose NuanceTracker, which is designed by introducing multi-scale global attention (MGA) into a basic CNN model for global information extraction. Finally, comparison experiments are conducted in closed-world and open-world scenarios. Our NuanceTracker has proven to outperform three state-of-the-art WFA methods.

Open Source Proxy Software (OSPS) provides privacy protection for users accessing the Internet by constructing a private anonymizing network. However, there is a growing concern about whether OSPS can actually prevent privacy leaks as it claims. Researchers have attempted to use AI-based techniques to identify OSPS, but there are two shortcomings in the current studies. First, there is no complete public dataset to support the identification tasks for different requirements. The existing datasets do not cover the most commonly used OSPS tools and their typical configurations. Second, with the introduction of deep learning techniques, the models continue to become complex, resulting in significant computational overhead. Using early flows for identification may make the model lighter, but result in weaker representations and lower classification performance. To address the above shortcomings, we have carried out pioneering work on OSPS traffic identification through early flows. First, we collect the access traffic of three OSPS tools and create a dataset with 8 protocol configurations. Second, we present an innovative Dual-View Identification (DVI) method for OSPS traffic. By considering both static and dynamic views, DVI effectively characterizes early flows and achieves accurate classification through feature fusion. In the static view, spatial distribution features are extracted by representing the early flows as a grayscale picture. In the dynamic view, spatial features and temporal correlations are represented using a flow with multiple packets, similar to a video with multiple frames. Comparative experiments show that DVI achieves over 90% accuracy and F1 scores in all three tasks, which greatly improves its ability to identify different protocol configurations and access sites. Besides, DVI outperforms 5 state-of-the-art methods and achieves low parameters and FLOPS through early flows.

To protect user privacy, video traffic is usually encrypted during transmission. Some research has been con-ducted to implement video identification attacks by analyzing the features of video traffic. However, short video platforms use hybrid transmission modes and a preloading mechanism to improve user experience. These new characteristics make video identification attacks targeted at long videos not appliable to short videos. In this paper, we proposed a method for extracting and correcting the hybrid fingerprints of application layer video resources, and designed an SVP-DOHMM matching method for video identification. Our method can identify each video for scenarios with hybrid transmission modes and preloading mechanism. We implemented our method on the dataset con-taining more than 100,000 video fingerprints of a short video platform. The experimental results show that the accuracy can reach 98.16% by sniffing the traffic for only 10 seconds in the closed world and can identify videos with 97.64 % accuracy in the open world.

With the rapid rise of video services, Internet Service Providers (ISPs) need to better monitor the Quality of Experience (QoE). Video resolution is a crucial factor affecting QoE. However, with the widespread use of QUIC based on UDP for video transmission, existing resolution identification methods based on the TCP header information cannot extract information from the UDP header. Moreover, in recent years, video platforms have begun to send video segments using random combinations to avoid side-channel attacks, leading to the failure of existing machine learning-based methods. To address this problem, we propose a method to identify the video resolution from QUIC traffic. The method takes the length of the video segment sequence as fingerprints, uses the features of QUIC to accurately extract and correct the length of the video segment sequence from the encrypted video stream, and then uses a combinatorial matching method to identify the corresponding video segment, thus accurately identifying the resolution of the video segment. Experimental results using YouTube videos show that the accuracy of this method for video resolution identification is more than 97%, and the average identification time is 0.13 seconds. Using this method, ISPs can accurately identify the resolution of videos transmitted via QUIC in real-time, which provides a basis for monitoring users' QoE.

With the rapid evolution of deep learning (DL), its integration in encrypted traffic classification (ETC) can automatically extract key features from raw traffic data, enhancing classification performance. So far, researchers have proposed many DL-based models for ETC. However, the complexity and dynamism of network applications lead to the diversification of ETC tasks. Current models, mostly tailored for single tasks, overlook real-world multi-tasking needs of network devices. Deploying task-specific complex models concurrently on resource-limited devices is impractical. In response to the increasing number of tasks, researchers have introduced multi-task learning frameworks for ETC, demonstrating its potential as a promising technical approach. However, current research overlooks the interference between tasks, resulting in flawed models when it comes to sharing parameters, setting learning rates, and determining loss values. Aiming at these deficiencies, we propose $\mathcal{M}$-ETC, a multi-task ETC method reducing inter-task interference. The innovation of $\mathcal{M}$-ETC lies in two aspects. Firstly, we design a hierarchical multi-task learning model (HMLM) to provide effective features for each task and prevent the impact of invalid features. Secondly, we propose a learning rate balancing strategy (LRB) for modules and a dynamic weight average strategy (DWA) for tasks’ loss values. During model training, LRB prevents overfitting and underfitting of tasks, while DWA prevents bias towards tasks with large loss values. To validate $\mathcal{M}$-ETC, we carry out comparative experiments using four encrypted traffic datasets. The experimental results show that the classification performance of $\mathcal{M}$-ETC on multiple tasks exceeds those of five state-of-the-art methods.

Tor has provided hidden services (HS) and protected the anonymity of the Web server with hidden service directory servers. Some criminals use hidden services to engage in illegal activities, such as anonymous transactions, pirated distribution, hacking, etc. In order to protect the security of cyberspace, hidden service traffic needs to be deanonymized. Artificial intelligence-based methods have become the most promising, but there are still two shortcomings in current research work. First, some of them mainly uses the size and direction sequence of the data packet as the input to complete the recognition, without mining the features of network traffic from many views. Second, they extract information from different view, but just concatenate them together instead of fuse them densely. Therefore, in this paper we propose a Tor hidden service traffic identification method with multi views named TriViewNet. TriViewNet extracts information from three different views, local flow, TLS layer, and TCP layer for identification ad fuses them with Tri-attention module. By comparing with state-of-the-art models, the results show that our TriViewNet outperforms in the recognition of Tor HS traffic.

The technology for AI-based encrypted traffic classification (ETC) is advancing rapidly. However, many current studies are conducted in closed network environments where traffic is classified into pre-determined classes. In the actual network environment, new traffic is constantly emerging, making anomaly detection of unknown traffic a pressing issue. The current research attempts different approaches for unknown traffic identification (UTI) from the perspective of model construction, including UTI based on n-classification, UTI based on multiple 2-classifiction, and UTI baed on (n+1)-classification. The above three approaches mentioned are prone to misclassification and have low accuracy due to issues with threshold setting, poor generalization of binary classifiers, and low credibility of generated samples. Researchers have used contrastive learning (CL) for UTI because of its strengths in feature representation. However, there are two shortcomings in the current studies. First, the feature representation of a single view cannot fully capture different classes of traffic features. Second, the existing CL schemes distinguish whether they belong to the same category by constructing pairs of positive and negative samples, but they are still unable to distinguish between known classes and unknown classes in the feature space, resulting in low accuracy. To address the above shortcomings, we propose UTI-MCL, an unknown traffic identification method using multi-view contrastive learning. Firstly, in terms of feature expression, we extract the packet length sequence and the packet byte sequence respectively to learn a more comprehensive feature representation. Secondly, in terms of model construction, we introduce an anchor and compare the distance with both positive and negative samples to help the model better separate different classes in the feature space, enhancing feature distinction. Furthermore, the distance between samples is optimized through the adaptive weights triplet loss function to balance samples from different classes. A series of experiments have proved the effectiveness of UTI-MCL. Even with unknown traffic accounting for 60%, the Fβ-Score can still exceed 94%.

Leveraging the advanced capabilities of Deep Neural Networks (DNNs), attackers can precisely detect users' online activities through traffic monitoring, nullifying the efficacy of current encrypted communication tools/protocols and progressively resulting in privacy leakage. Several defensive methods against DNN-based traffic monitoring (DTM) have been proposed; however, these methods often rely excessively on prior knowledge and incur inevitable additional bandwidth overhead (BWO). Moreover, they frequently generate invalid packets that violate network transmission constraints. To address these drawbacks, in this paper, we propose BYTEFLIPPING, a byte-space grey-box defensive method, which perturbs vulnerable bytes in the transport layer payload to generate adversarial sample packets. We design a Payload Byte Vulnerability Ranking algorithm to pinpoint the most vulnerable bytes and based on this generate adversarial packets to defend DTM. Extensive experiments reveal that ByteFLIPPING performs well in protecting against three DTM methods across two benchmark datasets, significantly decreasing the accuracy of the state-of-the-art ET-BERT by 94%. Compared to baseline defensive methods, BYTEFLIPPING incurs no extra BWO, offers more dependable packet validity, and boasts greater feasibility.

Domain Generation Algorithms (DGAs) are essential for creating numerous domain names automatically, commonly used to make malicious domains more stealthy and persistent online. To counteract DGAs, deep learning-based detection methods have been proposed, significantly reducing the effectiveness of traditional DGAs. However, due to inherent vulnerabilities in deep learning models, these detection methods are susceptible to adversarial attacks. Existing adversarial DGAs focus on character-based detection methods but overlook word-based structures, leading to weak performance against advanced word-based detection methods like graph neural networks. In this paper, we propose an innovative adversarial method and name it Word-Character DGA (WCDGA). The main idea is to create domain names by combining high-frequency words with common prefixes and suffixes found in reputable domains. This process utilizes a bidirectional encoder (BERT) and implements character transformations based on edit distance. We evaluate WCDGA against established character-based DGA detection methods (LSTM.MI, MIT, NYU) and the latest word-based method DGGCN. The results demonstrate that WCDGA out-performs existing adversarial DGAs in its evasion capabilities, successfully bypassing multiple detection methods simultaneously. Index Terms—Domain generation algorithm, Anti-detection, Dictionary generation, Character transformation

With the widespread adoption of the Internet and the continuous evolution of digital media technologies, video stream has increasingly become a dominant part of overall Internet traffic. The spread of harmful videos in social networks makes it important to collect evidence and regulate them. With the growth of Internet video stream, identifying video titles in VPN encapsulated environments has become increasingly challenging, as Virtual Private Networks (VPNs) encapsulate already encrypted video stream. To address this challenge, we extract stable video segments features from VPN encapsulated traffic based on DASH and HLS protocols, and then use these features to train hybrid CNN-LSTM models for accurate video title identification. Furthermore, the method filters background traffic and leverages unidirectional flow characteristics to handle asymmetric routing in real networks. Experimental results show that this approach achieves high accuracy, surpassing existing methods and demonstrates robustness when handling VPN encapsulated video streams, even under interference from background traffic and complex routing environments.

The proliferation of illegal information and criminal activities on anonymous networks has driven the demand for effective deanonymization attacks against Tor, which emerging learning algorithms have successfully achieved through flow correlation techniques. However, the feasibility of developing flow correlation methods specifically for Tor onion services remains an open challenge. In this paper, we propose TOScorr, an effective deep learning-based flow correlation attack that enables high-precision deanonymization of onion service sessions. To accommodate the high variability of onion service traffic, TOScorr uses aggregated features of flow pairs as robust inputs and employs a novel encoding module with Transformer self-attention mechanisms added to capture information embedded in both local and global contexts. Experimental results show that TOScorr is more scalable and practically effective in correlating onion services compared to previous methods.

Distributed Denial of Service (DDoS) attacks threaten cloud servers by flooding redundant requests, leading to system resource exhaustion and legitimate service shutdown. Existing DDoS attack mitigation mechanisms mainly rely on resource expansion, which may result in unexpected resource over-provisioning and accordingly increase cloud system costs. To effectively mitigate DDoS attacks without consuming extra resources, the main challenges lie in the compromisesbetween incoming requests and available cloud resources. This paper proposes a resource-aware DDoS attack mitigation framework named RAM, where the mechanism of feedback in control theory is employed to adaptively adjust the interaction between incoming requests and available cloud resources. Specifically, two indicators including request confidence level and maximum cloud workload are designed. In terms of these two indicators, the incoming requests will be classified using proportional-integral-derivative (PID) feedback control-based classification scheme with request determination adaptation. The incoming requests can be subsequently processed according to their confidence levels as well as the workload and available resources of cloud servers, which achieves an effective resource-aware mitigation of DDoS attacks. Extensive experiments have been conducted to verify the effectiveness of RAM, which demonstrate that the proposed RAM can improve the request classification performance and guarantee the quality of service.

Mobile crowdsensing (MCS) is an efficient approach for large-scale sensing data collection by leveraging the mobility and capability of mobile devices. To avoid the weaknesses of traditional centralized crowdsensing systems, blockchain has been introduced to secure the process of MCS. This paper studies a location-aware scenario, where privacy of users are protected in a blockchain- based MCS system, and formulates an optimization problem to maximize the coverage given a budget based on reverse auction. An incentive mechanism named MMCB is further proposed and implemented as smart contracts in blockchain to solve the problem. We demonstrate that the mechanism achieves a set of desirable properties, including computation efficiency, individual rationality, truthfulness, budget feasibility, approximation, and privacy preservation. To protect the identity privacy of workers and obtain anonymity, a linkable ring signature is employed in smart contracts. In addition, a Pedersen commitment is utilized for protecting workers’ bid profile and the submitted sensing data is encrypted and only accessible to the requester. We implement a prototype system based on the Hyperledger Fabric platform, and the evaluation results show that our privacy-preserving incentive mechanism architecture improves 36.2% coverage and reduces 53.1% payment with better security level compared to the state-of-the-art schemes.

Machine learning (ML) has been widely adopted for Android malware detection to deal with serious threats brought by explosive malware attacks. However, it has been recently proven that ML-based detection systems exhibit inherent vulnerabilities to evasion attacks, which inject adversarial perturbations into a malicious app to hide its malicious behaviors and evade detection. To date, researchers have not found effective solutions for this critical problem. Although there are some similar works in the image classification field, most of those ideas cannot be borrowed due to the significant differences between images and Android apps. In this paper, we exploit Moving Target Defense (MTD) to continually change the attack surface of the protected detector and create uncertainty on the attacker side. We thus propose a novel Android malware detection framework named MTDroid, which fully leverages a seamless blend of dynamicity, diversity, and heterogeneity to mitigate the impact of evasion attacks. To this end, we develop a dynamic model pool to decrease the exposure time of a single classifier, by building and rebuilding multiple heterogeneous models with distinct data. We then generate diversified variant models to provide defensive measures against various attacks, and further improve robustness through ensemble learning. Specifically, we propose a two-stage selection algorithm to optimize the ensemble learning process, and design a hybrid update strategy to refresh the framework dynamically. The experimental results show that MTDroid significantly enhances the robustness against a wide range of attacks and outperforms the state-of-the-art methods upon three popular practical datasets.

Encrypted Traffic Classification (ETC) can provide necessary information support for network management and security. The state-of-the-art ETC methods take a single flow as the unit and only use sequence features based on in-flow relationships. In an actual network, one-time access to an application will generate multiple flows. Taking a single flow as the classification unit will produce many repeated and potentially erroneous results, which dramatically reduces the classification efficiency and prevents the results from being used for effective network management and security. In this paper, we propose a multi-flow ETC method. Since multiple flows generated by an application cannot be directly bound in a complex multi-application scenario, we first cluster the encrypted traffic to acquire flow bunches through the proposed Time Sequential Hierarchical Clustering with Sliding Windows (TSHC-SW) algorithm. Then, based on the flow bunches, we propose five different multi-flow classification schemas that can realize multi-flow classification effectively with model-independent. Open-world experiments show that our method is versatile in that it can pursue classification accuracy, speed, or sample covering rate, respectively, according to the actual demand and network environment constraints. In flow clustering, we achieve 95% adjusted Rand Index and 98% purity. In the multi-flow classification, we have over 99% F1-score, 79% prediction time saving, and 5% sample covering rate increasing, which is far superior to the state-of-the-art single-flow methods.

Virtual Private Network (VPN) technology can bypass censorship and access geographically locked services. Some harmful information may be hidden in VPN traffic and circumvent the surveillance systems, bringing a significant challenge to network security. Considering the increasing richness of service types in VPN traffic, identifying traffic service facilitates further targeting harmful VPN traffic. Therefore, VPN traffic service identification is critical in network management. The existing identification methods use complete traffic for analysis. However, massive data analysis in high-speed networks consumes enormous resources, limiting the real-time processing of traffic identification. This paper proposes a real-time VPN traffic service identification method named RT-CBCH. We construct features that are still available after sampling and design a fast traffic processing structure based on Counting Bloom Filter and Chained Hash Table (CBCH). Experimental results validate the real-time capability, stability and accuracy of our method. At the sampling ratio of 1/256, it takes only 23.63 seconds to process the mixed traffic of 900-second traffic generated on a 10 Gbps link and our collected V2Ray traffic, which is increasingly common in VPN traffic. Under different sampling ratios, the identification results remain respectable, with an overall accuracy of about 90% for application service and over 99% for V2Ray proxy service. Furthermore, comparisons with similar work illustrate the high accuracy and low resource consumption of RT-CBCH. Experimental results show that our method can stably implement real-time VPN traffic service identification from sampled data in high-speed networks.

With the rapid development of Internet of Things (loT) technology, there is explosive growth in the number of loT devices. Meanwhile, the low security and network heterogeneity of loT networks have brought new challenges to implementing network management and security strategies in smart homes and small offices. Early and accurate loT device-type identification is the first step towards the security management of loT networks. The existing machine learning-based and deep learning-based models for loT traffic classification have achieved decent results. However, most of these methods rely on a long-term window to collect loT device traffic for identification, resulting in limited real-time performance. This work proposes 10T-GFCN, an early and accurate loT device-type identification model with global attention mechanism. 10T-GFCN first constructs a multi-feature sequence for each device from a small packet window. Then 10T-GFCN resorts to the global attention mechanism to efficiently mine temporal information and feature relationships and obtain an updated embedding of each multi-feature sequence. Finally, a fully convolutional neural network is trained based on the updated embeddings of traffic features to identify loT device types. Our experimental study suggests that 10T-GFCN can efficiently capture distinguishable representations for packet-level features of loT traffic and outperforms state-of-the-art loT identification methods. It achieves an average accuracy of 98.88 % with a window size of 75 packets (the traffic of about three minutes) on the UNSW dataset.

Website fingerprinting (WF) attack enables an eavesdropper to spy on users' browsing activity for malicious purposes, which poses a critical threat to Internet users' privacy. Prior research mainly focuses on attack performance in local area networks. Meanwhile, with the upgrade of network infrastruc-ture, a notable transition to high-speed connectivity in real-world network nodes has emerged. While in high-speed networks, there has been a mismatch between the overall traffic in transmission and the upper limit of the attacker's processing capabilities. Prior attacks based on full-traffic collection will face a sharp increase in resource overhead and a decrease in attack efficiency. In response to the emerging challenges, we first apply sampling techniques to WF attack to reduce the amount of data that needs to be processed. In addition, we devise an effective attack model with good performance on sampled traffic. Evaluations indicate that our attack model achieves 94.9 % accuracy in 1/8 packet sampling scenario and 98% accuracy in non-sampling scenario, outperforming the state-of-the-art in both cases. The compatibility in packet sampling environments helps extend the WF attack from the laboratory setting targeting at a few users to real-world high-speed networks capable of massive surveillance. The code of this paper is publicly available at https://github.com/code-flyerISAPWF.

The sensitivity of network traffic data has led to the scarcity of public traffic datasets, hindering the development of data-driven research in this field. Researchers proposed publishing synthetic network traffic instead of the original dataset. However, existing traffic synthesis methods are inadequate in data utility and seldom consider privacy protection. For this reason, we propose NFlowGAN for high-utility privacy-preserving network flow synthesis. We introduce spectral normalization in the network structure to improve training stability, thus improving the data utility. In addition, we add a Gaussian noise layer to the discriminator of NFlowGAN to provide higher privacy guarantees for the synthesized flow. The experimental evaluation results on the Darknet2020 dataset demonstrate that our proposed NFlowGAN achieves a significant improvement in data utility with privacy preservation compared to the two baselines. The synthesized high-utility dataset can be widely shared for research and educational purposes.

In recent years, the good revenue generated by cryptocurrency mining has attracted a lot of people to participate in it. It has also caught the attention of hackers, and cryptojacking attacks are becoming more common. Detecting cryptomining behavior can effectively reduce the lost caused by cryptojacking attacks. Existing host-based cryptomining detection methods can protect only end devices and violate users' privacy. Besides, network-based solutions can not better handle anti-reconnaissance means of encrypted proxy. To bridge this gap, we propose a cryptomining traffic detection model based on K-S Test(CMD-KST). Our traffic analysis study confirms that the feature distributions of cryptomining traffic over an encrypted proxy are still stable and unique. CMD-KST compares the feature distributions of a network flow segment with that of cryptomining traffic over the encrypted proxy to complete the detection task. CMD-KST is easily deployable and can detect cryptomining traffic at the entrance of the managed network. Our experimental results demonstrate that CMD-KST achieves a recall of 98.84% without generating false positives and takes only 6 minutes of analyzing mining traffic to complete the detection. CMD-KST is faster than other network-based cryptomining traffic detection methods and achieves a higher precision. Furthermore, the adversarial evaluation shows that it is challenging for the attackers to counteract our detection.

Darknet is described as an individual encrypted part of the Internet that can only be accessed with specific anonymity tools. Achieving accurate classification of darknet traffic is crucial for identifying anonymous network applications and combating cybercrimes. Machine learning-based and deep learning-based classifiers have achieved decent results in darknet traffic classification. However, these methods can not learn global and distinctive darknet flow embedding representations, resulting in limited classification performance. To tackle these issues, we propose Dark-DKGC, a novel darknet traffic classification method based on Knowledge Graph (KG) with Dynamic Knowledge Graph (DKG) embedding learning. Dark-DKGC first constructs Darknet Traffic Dynamic Knowledge Graph (Dark-DKG). Then Dark-DKGC utilizes the DKG embedding method to effectively learn the embedding representations of all flows. Finally, machine learning-based classifiers are trained based on the embedding representations of flows to identify darknet traffic. Our experimental studies suggest that Dark-DKGC can effectively capture distinguishable embedding representations for darknet flows. In multiclass classification scenario, its average accuracy is about 7%-13% higher than state-of-the-art methods and 1% higher than the static KG embedding-based classifier. Besides, compared to the static KG embedding method, Dark-DKGC takes advantage of its online embedding learning to improve test efficiency significantly. Moreover, the visualization of Dark-DKG allows a certain degree of interpretability for the classification results.

Phishing deceives users' trust through subtle URL and HTML disguises, stealing sensitive data or spreading malicious viruses. Phishing detection from URLs has been the focus of research in recent years, which balances the performance and time compared to list-based and content-based approaches. The approaches using neural networks to extract semantic information from URLs to detect phishing websites can avoid feature engineering. However, the features' plausibility cannot be verified. Heuristic features designed artificially can reflect URL differences more reasonably, but the current features lack diversity and have poor generalization in the real web environment. In this paper, we propose a phishing detection model combining heuristic features and machine learning, which extracts features from URL components and linguistics perspectives, leading to lightweight and feature diversity. Three datasets with significant differences are used to verify the model's generalizability. Eventually, the average accuracy of the three datasets reaches 98.68%, and the average precision, recall, and F1-score are all above 98%, which shows good generalizability and outperforms the baselines.

Covert communication technology serves as a crucial tool for safeguarding not only the content of communication but also the identities of the parties involved. In this regard, blockchain emerges as a promising solution due to its decentralized nature, flood propagation of data, and inherent anonymity features. This makes blockchain an ideal candidate for covert communication channels, effectively addressing the weaknesses associated with traditional covert communication methods susceptible to detection, tracing, and interruption. However, the current efforts encounter obstacles like limited practicality, constrained channel capacity, and insufficient concealment capabilities, impeding their broad adoption in real-world scenarios. To address these issues, we propose DarkTrans, a blockchain-based covert communication scheme consisting of an address binary tree and a novel embedding mechanism. The address binary tree as a dynamic label method enables rapid recognition of specific transactions by the recipient, rendering detection by third parties challenging. The embedding mechanism encodes secret messages into transaction values for transmission to augment channel capacity, which can be practically realized within an Ethereum private blockchain. Our experiments with three aspects demonstrate that, compared with the existing scheme, DarkTrans achieves a low embedding time and a high channel capacity. Additionally, Kolmogorov-Smirnov test and sample entropy analysis are conducted to validate the robust concealment of this scheme.

Smartphones and mobile Internet development have promoted the rise of short video applications. Douyin, the most popular short video application in China, has very complex in-app functions. Due to users’ need for privacy protection, encryption protocols are widely used. But it also makes it difficult to supervise malicious user behaviors. The encrypted traffic of Douyin user behaviors has the characteristics of a small sample and instantaneity. It is easy to be covered by the huge background traffic, which brings challenges to the research of Douyin user behavior identification. To solve this problem, we first proposed an automated method for labeling encrypted traffic of Douyin user behaviors based on multistage packet filtration technology, which can improve labeling efficiency and sample purity. Secondly, we propose a multi-layer identification method to identify Douyin user behaviors. Specifically, we first analyze the global and local characteristics of Douyin traffic to identify user behavior flows. Then, the user behavior flow is segmented into packet subsequences based on the local burstiness of the user behavior traffic. Finally, we extract the features of subsequences to identify Douyin user behaviors. The results can achieve an average of 0.980 precision, 0.966 recall, and 0.971 f1-score.

With the popularity of the Internet and the rapid development of software technology, the classification and analysis of encrypted traffic has become crucial. Due to the complexity of network environments and private encryption protocols, traffic data in the open world usually exhibit high statistical heterogeneity. Thus, traditional traffic classification methods trained by single dataset will encounter difficulties of misclassification. This paper proposed a hypemetwork-based personalized federated learning framework for encrypted traffic classification (ETC). In this framework, hypernetworks on the server side can generate layer-granularity weights for model aggregation. Clients can not only focus on improving the effect on local datasets but also aggregate models from other clients more appropriately guided by hypernetworks. Experimental evaluations are conducted on real-world encrypted traffic datasets under different heterogeneous scenarios. The results show that our framework gains a 2-8% improvement over the state-of-the-art methods on ETC tasks.

The privacy protection capabilities of open source proxy software (OSPS) while browsing the Internet have sparked great interest from both industry and academia, bringing forth pressing security concerns. Currently, using artificial intelligence for traffic identification is the most promising direction. Due to the wide variety and rich configuration of OSPS, it is not feasible to train models for all tasks and deploy them on the same network device. It is a novel idea to improve efficiency by leveraging multi-task learning. However, the related studies still have three shortcomings. First, improving the performance of the main task through auxiliary tasks does not apply to equally important OSPS identification tasks. Second, the model’s ability to characterize traffic is weak, resulting in performance gaps between different tasks. Finally, the influence of task difficulty on convergence speed is ignored, which is easy to cause overfitting and underfitting. Aiming at the shortcomings, we propose Cerberus, an OSPS traffic identification scheme based on multi-task learning. The main contributions of our work can be summarized in three aspects. Firstly, a high-quality dataset is constructed through traffic collection, and three OSPS traffic identification tasks are defined on it. Secondly, an identification model is designed by optimizing the ability to characterize traffic and balancing the convergence speed of multiple tasks. Finally, Cerberus is verified through comparative experiments. Its classification performance is better than both single-task and multi-task solutions. Besides, Cerberus runs fast and consumes few resources, making it suitable for deployment on network devices.

As a new self-developed protocol of V2Ray, mKCP disguises users’ network access as communication of four network applications by forging application layer headers to evade traffic-based detection. The emergence of mKCP has received widespread attention. Whether mKCP can provide secure network access that protects user privacy is the focus. Traditional methods cannot identify mKCP camouflage traffic, but machine learning (ML)-based traffic identification is considered a promising direction. Unlike the previous network traffic classification, mKCP camouflage traffic identification introduces new challenges. First, existing work has neither published any dataset containing mKCP camouflage traffic nor designed specific traffic features. Second, no researchers have optimized the identification scheme for deployment on network devices. Aiming at the shortcomings, we propose SharpEye, an ML-based mKCP camouflage traffic identification scheme. The novelty of our work lies in three points. Firstly, a complete dataset containing mKCP camouflage traffic is constructed through long-term traffic collection. Secondly, by analyzing the communication patterns of mKCP traffic, a feature set mFS is designed to improve identification accuracy. Finally, a two-stage feature selection method mGBFS is proposed to improve the operation efficiency. The experimental results show that mFS can enhance the performance of classifiers in identifying mKCP camouflage traffic, and mGBFS reduces the running time and overhead while ensuring high accuracy. Therefore, SharpEye achieves accurate and efficient mKCP camouflage traffic identification.

The prevailing of malware variants in ubiquitous Internet of Things (IoT) devices causes enormous losses. Accurate and timely identification of malware variant traffic at an IoT edge gateway can effectively reduce the loss. TransNet, the state-of-the-art technology for malware variant traffic detection, considers only global domain adaptation and ignores the alignment of distributions between different subdomains, which fails to capture the fine-grained information of classification targets. Besides, TransNet converges very slowly, which may use up precious resources in IoT devices. This article proposes a deep subdomain adaptation network with attention mechanism (DSAN-AT) to accurately and efficiently identify malware variant traffic at an IoT edge gateway. DSAN-AT utilizes local maximum mean discrepancy (LMMD) to align the traffic feature distributions of subdomains in the source and target domains. It also exploits channel and spatial attention mechanisms to accelerate learning traffic features between different subdomains to save precious computing resources at the IoT edge gateway. Our experimental study demonstrates that DSAN-AT achieves an average accuracy of 97.15% (96.37% for TransNet) and converges fast without using a large target domain training data set. DSAN-AT has strong practicality for identifying malware variant traffic at an edge IoT gateway.

With the wide application of Internet of Things (IoT) devices in the power grids, the sophisticated feedback on their operating status is of great significance for improving efficiency and reducing accidents. For exquisite management of the resilient intelligent IoT with flexible increase and decrease of devices and heterogeneous operating systems, this article proposes an adaptive measurement method “MRAM,” which can snapshot the multidimensional resource view (MRV) of all devices in the jurisdiction. Extensible gateway platform based on CPU, field-programmable gate array, and cloud computing is applied in MRAM, which liberates the local resources of monitored IoT devices. MRAM improves the long short-term memory algorithm called ELSTM. ELSTM can accommodate the current IoT devices’ state for detecting the mutation of MRV. The newly collected resources determined by ELSTM whether MRAM enters an abnormal state to drive the adaptive measurement state machine. According to the state machine which endeavors that the MRV is updated timely, MRAM adjusts the measurement granularity in real time. Simulations and experiments have tested the convergence time and occupied bandwidth of MRAM deployed in power grids. These evaluations confirmed MRAM’s practicality and robustness, as well as the MRV is genuine management data for the upper layer power grids applications. A real environment is built to test the performance of this method as well. MRAM has high measurement accuracy and the precision of mutation detection is 98.41%. It converges the update MRV of second level under the condition of IoT devices and the cloud’s low consumption of memory and CPU utilization.

Botnets extensively leverage Domain Generation Algorithms (DGAs) to establish reliable communication channels between bots and Command and Control (C&C) servers. Numerous character-level DGA classifiers have been extensively studied to detect and classify domain names generated by DGAs. Meanwhile, a series of adversarial domain generation algorithms have been proposed to evade DGA classifiers. Although the existing domain name generation algorithms have progressed against DGA classifier, their anti-detection abilities are still weak. This paper proposes a Bidirectional Long Short-Term Memory (BiLSTM) network-based adversarial DGA with high anti-detection ability, referred to as ReplaceDGA. ReplaceDGA requires no knowledge of the targeted DGA classifiers. It first builds a prediction model for benign domain names using the BiLSTM network to model the semantic relationship hidden within benign domain names and then replaces two characters of each input benign domain name based on the prediction model to maximize the similarity between the benign and generated domain names. Our experimental results validate that ReplaceDGA successfully evades various character-level DGA classifiers even after they are retrained by domain names generated by ReplaceDGA and outperforms the state-of-the-art adversarial DGAs in anti-detection ability, repetition rate, and collision rate. Our study of ReplaceDGA promotes the urgent need for developing more comprehensive and robust DGA classifiers that consider other factors besides character-level information of domain names.

Early and accurate detection of network intrusions is crucial to ensure network security and stability. Existing network intrusion detection methods mainly use conventional machine learning or deep learning technology to classify intrusions based on the statistical features of network flows. The feature extraction relies on expert experience and cannot be performed until the end of network flows, which delays intrusion detection. The existing graph-based intrusion detection methods require global network traffic to construct communication graphs, which is complex and time-consuming. Besides, the existing deep learning-based and graph-based intrusion detection methods resort to massive training samples. This paper proposes Graph2vec+RF, an early and accurate network intrusion detection method based on graph embedding technology. We construct a flow graph from the initial several interactive packets for each bidirectional network flow instead, adopt graph embedding technology, graph2vec, to learn the vector representation of the flow graph and classify the graph vectors with Random Forest (RF). Graph2vec+RF automatically extracts flow graph features using subgraph structures and relies on only a small number of the initial interactive packets per bidirectional network flow without requiring massive training samples to achieve early and accurate network intrusion detection. Our experimental results on the CICIDS2017 and CICIDS2018 datasets show that our proposed Graph2vec+RF outperforms the state-of-the-art methods in terms of accuracy, recall, precision, and F1-score.

The foundation of network management is to timely, accurately, and flexibly monitor the status of a managed network. Recently, In-band Network Telemetry (INT) has presented its unique capabilities in acquiring the insights of a network and thus has been adopted in many production networks. However, less attention was put on the potential threats on INT (e.g., the man-in-the-middle attacks, Trojan horse injection) that may falsify network measurements resulting in catastrophic consequences. In this paper, we propose a secure INT architecture calledSINTthat can effectively mitigate INT vulnerabilities and can be implemented using ’chiplet’ based multi-modal network processors (MNP). SINT adopts blockchain technology into INT, in which a network status snapshot acquired via INT is viewed as a block and added into a network telemetry blockchain to prevent arbitrary access and malicious modification. To minimize the intrusiveness of the INT and blockchain operations, SINT is designed to be a lightweight protocol and uses improved RAFT consensus mechanisms to reduce its network and computing overhead. The design of the chiplet MNP system makes SINT highly flexible and adaptive to facilitate INT convergence and related blockchain updates. In the SINT architecture, INT tasks and blockchain operations are dispatched to different chips to achieve an optimal trade-off among measurement accuracy, security requirements, and computing resource on the data plane. Experiments and simulations show that SINT can alleviate most cyberattacks on INT and retain 97% of bandwidth utilization for other users’ normal traffic in a complex scenario with 500 nodes. Furthermore, SINT converges the INT results quickly and accurately with minor overhead compared to that of the state-of-art INT methods.

Live Web streaming occupies a large proportion of network traffic, and various live streaming platforms use HTTP-FLV protocol to transmit streaming. The content-aware strategy that includes frame-skipping and frame-dropping mechanisms before client decoding is essential in providing high-quality live video services to improve QoE. Therefore, frame type identification is necessary for content-aware strategy and traffic engineering. The current studies focus on keyframe identification under single datasets. However, they failed to consider the actual scenarios where there are various types of live Web streaming with user interactions and only identify keyframes. After studying, we found a type of frame in normal video frames that contain image parameters for subsequent frames, which can also cause a stall if they are dropped or skipped during frame processing, and this type of frame is called a reference frame. To effectively identify keyframes and reference frames, we propose the TDS-KRFI, which extracts lightweight and effective streaming features from the encrypted traffic of live Web streaming. Then we use a two-layer double similarity measure to construct the spatio-temporal structure of dynamic data units and use the DGCNN model to identify frame types. In evaluation, we use various datasets with 6,532,890 frames containing user interactions under different webcasting platforms to conduct extensive experiments. It can achieve 99.9% (average 98.96%) accuracy in keyframe identification and 95.7% in all types of frames (keyframes, reference frames, and other frames) within 9.6% of the transmission time, demonstrating the robustness and effectiveness of our approach and outperforming the state-of-the-art research so far.

Distributed Denial of Service (DDoS) attacks have posed severe threats to the Internet. Although researchers have proposed many DDoS detection schemes, there are still some challenging issues. Traditional per-flow-based DDoS methods are impractical for massive amounts of high-speed network traffic due to the huge resource consumption. In addition, existing methods are not designed to take into account the widespread asymmetric routing in high-speed networks, resulting in false positives when these methods are deployed on the Internet. Furthermore, existing methods can not achieve a good trade-off between detection accuracy and granularity when detecting hybrid DDoS attacks. This paper proposes an Accurate, Fast, and Fine-grained Detection Scheme (AF-FDS) for DDoS attacks in high-speed networks with asymmetric routing. We select features based on the characteristics of DDoS attacks and design a data structure Double Composite Structure Sketch (DCSS). DCSS can achieve fast recording and extraction of the selected features from the sampled traffic. Experimental results using real-world traces in a 10Gbps network with asymmetric routing show that AF-FDS can detect nine types of DDoS attacks at a fine-grained level within 15 seconds with over 98.0% precision and recall, even at a sampling rate of 1/1024. Furthermore, the comparison with several state-of-the-art methods illustrates that AF-FDS can detect DDoS attacks with a lower false positive rate (FPR) and shorter alarm time in asymmetric routing scenarios.

Packet loss is common in networks, which leads to network quality of service degradation. Packet loss is an essential and concerning symptom when the quality of service is degraded. Therefore, real-time passive packet loss detection is conducive to estimating network services. Existing passive packet loss detection methods mainly study the packet loss for TCP using header information from full traffic. However, it cannot infer packet loss status for UDP due to its limited header information and is too costly to perform full acquisition in real networks. To address these problems, we propose a framework called LossDetection based on packet sampling and Feature-Sketch to detect packet loss in real time for both TCP and UDP. The result shows that our methodology can detect packet loss with an accuracy of 98%-100% at a sampling rate of 1/16. Furthermore, our extensive evaluation demonstrates that LossDetection is easy to implement in a software router and achieves low memory and detection latency while providing real-time information about packet loss.

With the inevitable dominance of video traffic on the Internet, Internet service providers (ISP) are striving to deliver video streaming with high quality. Video resolution, as a direct reflection of video quality, is a key factor of the video quality of experience (QoE). Since the displayed information of video cannot be observed by ISPs, ISPs can only measure the video resolution from traffic. However, with HTTP/2 being gradually adopted in video services, the multiplexing feature of HTTP/2 allows audio and video chunks to be mixed during transmission, making existing monitoring approaches unusable. In this article, we propose a method called H2CI to monitor resolution for adaptive encrypted video traffic under HTTP/2. We consider the size of the mixed data for identification. Specifically, H2CI consists of a length restoration method to extract restored fingerprints and a fingerprint-matching method for fine-grained resolution identification. The experimental results show that H2CI can achieve more than 98% accuracy for fine-grained resolution identification. Our method can be effectively applied to infer the adaptation behavior of encrypted video streaming and monitor the QoE of video services under HTTP/2.

Service classification of high-speed network traffic is critical for Internet Service Providers (ISPs) to ensure network Quality of Service (QoS). As high-speed network transmission accelerates, ISPs can only obtain unlabeled and sampled traffic from high-speed networks, making supervised learning methods difficult to apply. Some existing methods use unsupervised learning to classify services to reduce the need for labeled data. However, when these methods are applied, fluctuations in the feature vector lead to a certain percentage of the same class of services being grouped into different clusters. We proposes a practical method for classifying traffic services in high-speed networks. Specifically, we propose a method called Two-Stage Clustering (TSC), which automatically implements merging clusters of the same service. Validation experiments on publicly available datasets show that our classifier achieves an accuracy of 90.07% and a recall of 91.81% even with a sampling rate of 1:64, which is higher than the classification methods that also use unsupervised learning.

As the scale of Distributed Denial of Service (DDoS) flooding attacks has increased significantly, many detection methods have applied sketch data structures to compress the IP traffic for storage saving. However, due to the large IP address space, these methods need to flush the sketch frequently to reduce the hash collisions. Besides, few of them can be applied to detect attacks in the high-speed network where sampling is usually adopted. This paper proposes a hierarchical system named HDS for efficient and continuous DDoS flooding attack detection in high-speed networks. Rather than directly processing the IP traffic, HDS uses sketches to track sampled traffic at different levels of aggregation: interface level, area level, and host level. Then traffic classifiers are trained for each level for attack detection. The main advantage of our approach is that each detection level only tracks a small set of traffic, which can identify the attack victim fastly and hardly causes hash collisions. Experimental results on the real-world 10Gbps network traffic datasets show that HDS can effectively detect various DDoS flooding attacks with high accuracy and identify the victim within an average of 10s when the sampling rate exceeds 1/2048.

Attackers often use Tor to launch cyberattacks and conduct illegal transactions, threatening cyberspace's security and people's daily lives. Existing methods for malware traffic detection on Tor can be classified as rule-based and network-based, both of which apply machine learning extensively. Tor malware traffic detection systems are often deployed in open network environments. Their machine learning systems are the first to be attacked by adversarial samples. To ensure that Tor is not abused, this paper proposes an Adversarial Learning-based Tor Malware Traffic Detection model, AL-TMTD. We generate realistic attack samples that can evade detection and use these samples to produce an augmented training set for producing hardened detectors. In such a way, we obtain a more resilient Tor malware traffic detection model that achieves adversarial robustness. We validate our proposal through an extensive experimental campaign that considers multiple machine learning algorithms and shadow models. We simulate the adversary to construct functionally approximate shadow models through black-box model extraction and generate adversarial samples to validate the adversarial robustness of our proposed AL-TMTD model. Our experimental results demonstrate that the average accuracy of AL-TMTD after the adversarial retraining is as high as 0.995 in detecting adversarial samples, which is 0.314 without the adversarial retraining, a significant improvement.

Affected by the COVID-19 pandemic, teleworking is becoming more popular, with the exposed attack surface of the internal network expanding. Once outsiders personate accounts or insiders conduct illegal operations, the data security in teleworking with traditional border protection will be broken. Therefore, it is necessary to implement fine-grained and dynamic access control to protect data from malicious access. Attribute-based access control (ABAC) is ideal, where authorization is performed through attributes and rules. On this basis, risk assessment, context awareness, and machine learning are supplemented for dynamic access control. However, these methods have their limitations due to the requirement of sufficient prior knowledge and massive label-classified data. Moreover, it is challenging to obtain the samples of attack behaviors, and the attack behaviors may change frequently to evade detection. In contrast, the normal behaviors are relatively stable except for the update of network services. We propose a dynamic access control model, ABAC-IntroVAE, to address the above issues. ABAC-IntroVAE judges users' requests through rule matching and behavior analysis based on the attributes of the requests. It first filters out requests against the rules by rule matching. Then, the introspective variational autoencoder (IntroVAE) is used for behavior analysis to realize dynamic access decisions. Requests classified as normal can be authorized for access. ABAC-IntroVAE only needs samples of normal requests for training, avoiding the difficult task of collecting massive and frequently changing samples of attack requests. Meanwhile, the IntroVAE model is updated through continual learning to adapt to new-style normal behaviors due to the update of network services. Our experiment study suggests that our proposed ABAC-IntroVAE can effectively perform dynamic access control. It achieves an accuracy of 97.2% in abnormal detection and maintains an accuracy of over 97% through continual learning, despite the addition of new-style user behavior patterns.

With more attention paid to communication security and user privacy, there has been a dramatic rise in private protocols, which brings great challenges to traditional protocol identification. The increasingly complex design of private pro-tocols has led to the loss of effectiveness of features used for traditional identification. Besides, some features are redundant and also lose sight of the particularity of private protocols, which could not be guaranteed to be the optimal identification solution. In this paper, we propose a method to obtain the Sequence Sta-tistical Fingerprint(Seq-SF) which is proprietary for each private protocol and can be used for identifying private protocols from promiscuous traffic. We extend statistical features associated with protocol transmission to make the sequence feature be integrated into it. Then, we adopt a feature selection algorithm based on mutual information ranking, which can evaluate the pertinence between features and protocols to guarantee the effectiveness and optimality of Seq-SF. The results of experiments on the real-world dataset covering 13 private protocols indicate that Seq-SF achieves an ideal performance(99.41% accuracy, 97.56% precision, 95.18% recall, and 0.20% FPR on average) and has good robustness.

Port scanning is an extensively used technique by attackers to probe for vulnerabilities in network systems. Since fast port scans can be effectively detected by many existing methods, some advanced attackers perform slow port scans in order not to be suspected. A highly stealthy slow scan can last for dozens of days, which brings significant challenges to current intrusion detection approaches. Besides, the existing port scan detection methods are all based on full traffic. They are not suitable for high-speed networks because of huge computational and storage resource consumption. According to the protocol characteristics and the connection patterns of port scans, we construct a traffic feature set that can not only distinguish the specific scan types, but also remain effective for the sampled traffic. Furthermore, we customize a data structure Scan Detection Sketch (SDS) for feature extraction. Experimental results using public datasets show that our method can detect slow port scans in a 10Gbps high-speed network with high accuracy and acceptable memory consumption. And the proposed method works well even for slow port scans lasting more than 60 days.

Virtual Private Network (VPN) can bypass censorship and access services that are geographically locked. Therefore, VPN traffic identification has become an urgent problem in traffic classification. The existing VPN traffic identification methods use complete traffic for analysis. However, massive data analysis in high-speed networks consumes many resources, limiting the real-time processing of traffic identification. The management of high-speed networks is mainly based on sampled traffic. As VPN traffic accounts for a relatively low proportion, it is particularly challenging to identify VPN traffic from sampled data. This paper proposes a real-time identification method for VPN traffic from sampled data in high-speed networks. In our method, we construct features that are still available after sampling and design a fast traffic processing structure based on Counting Bloom Filter and Chained Hash Table (CBCH). To validate the usability of our method, we use 900 seconds of traffic generated on a 10 Gbps link as background traffic, mixed with V2Ray traffic, which is increasingly common in VPN traffic. With the VPN traffic proportion of 0.03%, it takes only 50.79 seconds to complete the processing at the sampling ratio of 1/256. This time is significantly less than the traffic generation time. For the effective flows extracted from sampled backbone traffic, the identification results are maintained at a high level with 97% precision, 93% recall, and 95% F1 score. In addition, our method can achieve fine-grained VPN traffic identification of different V2Ray tools.

DDoS attacks are usually accompanied by IP spoofing, but the availability of existing DDoS defense systems for high-speed networks decreases when facing DDoS attacks with IP spoofing. Although IP traceback technologies are proposed to focus on IP spoofing in DDoS attacks, there are problems in practical application such as the need to change existing protocols and extensive infrastructure support. To defend against DDoS attacks under IP spoofing in high-speed networks, we propose a novel DDoS defense system, IM-Shield. IM-Shield uses the address pair consisting of the upper router interface MAC address and the destination IP address for DDoS attack detection. IM-Shield implements fine-grained defense against DDoS attacks under IP spoofing by filtering the address pairs of attack traffic without requiring protocol and infrastructure extensions to be applied on the Internet. Detection experiments using the public dataset show that in a 10Gbps high-speed network, the detection precision of IM-Shield for DDoS attacks under IP spoofing is higher than 99.9%; and defense experiments simulating real-time processing in a 10Gbps high-speed network show that IM-Shield can effectively defend against DDoS attacks under IP spoofing.

Domain Generation Algorithms (DGAs) are widely applied in diversified malicious attack patterns such as botnets. Attacks utilize DGAs to dynamically create pseudorandom domains to evade security detection and successfully connect bots with Command and Controls (C&C) servers. The detection of Algorithmically Generated Domains (AGDs) plays an essential role in network attack detection. Most of the existing DGA detectors are machine learning or deep learning-based methods. However, these DGA detectors perform relatively poorly with insufficient training samples, such as small-scale DGA families and emerging DGA variants. Besides, machine learning-based detectors require sophisticated and time-consuming artificial feature extraction, and attackers can circumvent the extracted features. This paper focuses on accurately detecting DGAs based on siamese network with insufficient training samples. Our proposed DGA detection method is referred to as DGAD-SN. DGAD-SN first introduces contrastive learning and adopts the siamese network framework to construct the feature extractor, which excavates the implicit relationship information between characters in the domain name strings using limited training samples. Then machine learning-based DGA classifiers are trained based on the extracted neural feature vectors of domain names to identify AGDs. Our experimental studies suggest that DGAD-SN can efficiently extract distinguishable neural feature vectors for domain names and outperforms state-of-the-art DGA detectors in identifying small-scale DGA families or emerging DGA variants. Its average accuracy is 10%−15% higher than conventional machine learning-based detection methods and about 1%−2% higher than deep learning-based detection methods using limited training samples.

The globalization of the economy and the increase in network bandwidth have contributed significantly to the development and popularity of real-time communication (RTC) social applications. RTC media streams, such as video meetings and calls, require more network resources and real-time performance than other services. In order to meet the requirements of RTC application providers to offer a higher level of service to their subscribers, Internet Service Providers (ISPs) need to identify the application to which the RTC media stream belongs. There are already some studies on traffic identification. However, the extant work is not yet able to distinguish the corresponding applications from the same type of media streams in real time. In addition, most of the work is not validated with actual data containing massive background traffic. Hence, we propose a real-time application identification method for meeting and calling RTC media streams in social networks. By analyzing the encrypted traffic, the method extracts features from the unit-time traffic aggregation without using payload and related information fields. The generated feature sequences are fed to our lightweight model. Our proposed method does not depend on initial packets or whole flows, and only an arbitrary 3-second traffic block is needed to achieve over 99% accuracy. Moreover, experiments using high-speed network traffic reflect that our approach can identify corresponding applications from RTC media streams in real time. Besides, comparisons with similar work show that this method requires only 1/160th of the memory and 1/10th of the processing time.

Network traffic classification is the basis for network management, Quality of Service and intrusion detection. As the number of Internet applications increases, the variety of unknown protocols grows, posing a significant challenge to network traffic classification. Traditional rule-based traffic classification methods are currently limited by the rise of dynamic ports and encryption protocols. Statistical methods using statistical features have good recognition of protocols with public formats. However, there is no public protocol format for unknown protocols, making it challenging to extract useful features. This paper proposes a practical Probability Statistics and Cluster Merging (PSCM) method to automatically extract encrypted unknown protocol features and map the clustering results to the actual protocols. Experimental results on real-world network traffic show that the method achieves an accuracy of 99.28% and performs well in the sampling scenarios.

Due to the heterogeneity, fragmentation, and lack of visibility, Internet of Things has become the new target for attacks. Therefore, it is necessary for Internet Service Providers to identify IoT devices to prevent attacks and protect the entire network in time. In this paper, we propose an IoT device identification approach based on lightweight deep learning models using a single feature. Specifically, we analyze the traffic pattern specific to IoT devices and use one feature to characterize this pattern, reducing the time consumption. Moreover, we select multiple time scales to extract this feature for different IoT devices, achieving an accurate characterization and improving the accuracy. Furthermore, we use unidirectional flows as analysis objects, suitable for backbone networks. The evaluation results on real-world datasets show that our approach achieves an accuracy of over 99%, with one-seventeenth of the time consumption of the state-of-the-art approach, realizing the lightweight and real-time requirements.

Identifying mobile applications from network traffic is important for Internet service providers (ISPs) to manage their networks at a fine-grained level. However, the rise of public services has led to a gradual increase in service coupling among applications, making it more difficult to identify applications. Existing methods produce classification ambiguities when identifying highly coupled mobile applications, resulting in low application identification accuracy. In this paper, we propose a service-based method to quickly identify highly service coupling applications after the applications are launched. It can accurately identify highly coupled mobile applications based on the features of the services accessed by the applications. Experiments on a real network traffic dataset of highly coupled mobile applications verify that our method can identify applications within 25s after the mobile applications are launched, and the identification accuracy is over 99%.

Due to its efficiency, low overhead, and high scalability, consortium blockchain has been deeply applied in various fields of society. Order financing is one of the scenarios of applying consortium blockchain. Since data on the consortium blockchain is available to the blockchain members, information of a financing order written directly to the blockchain will leak the commercial privacy of the purchaser and supplier. Therefore, the financing order data should be encrypted when published as a transaction on the consortium blockchain. However, the investor needs to verify the financing order data on a consortium blockchain before loaning money to the supplier. It is tricky to efficiently satisfy the verifiability of encrypted financing order data on the consortium blockchain. This work proposes VmppOrder, a verifiable model for privacy-preserving financing orders on a consortium blockchain based on zero-knowledge Succinct Non-interactive ARguments of Knowledge (zk-SNARKs). By the supplier publishing zero-knowledge proofs generated from the financing order, the investor can verify the encrypted financing order published on the consortium blockchain without decrypting it. We elaborate on the specific construction of VmppOrder and analyze the security of the constructed circuit with zero-knowledge proof. We implement a prototype of the model on Hyperledger Fabric based on Libsnark and conduct comprehensive experiments to evaluate its performance. Our experimental results validate the efficiency of the proposed model. Its order proof generation takes about 6.31 seconds, the order verification takes only 2.58 milliseconds, and the transaction processing speed is about 660 transactions per second on a moderately equipped machine.

Internet of Things (IoT) has been ubiquitous in both industrial and living areas, but also known for its weak security. Being as the first defense line against various cyberattacks, authentication is even more critical to IoT applications. Moreover, there has been a growing demand for cross-domain collaboration, leading to an increasing need for cross-domain authentication. Recently, certificate-based authentication schemes have been extensively studied. However, many of these schemes are not efficient in computation, storage, and communication, which are highly required in IoT. In this paper, we propose a lightweight authentication scheme based on consortium blockchain and design a cryptocurrency-like digital token to build trust. Furthermore, trust lifecycle management is performed by manipulating the amount of tokens. The comprehensive analysis and evaluation demonstrate that the proposed scheme is resistant to various common attacks and more efficient than competitor schemes in terms of storage, communication, and authentication cost.

Nowadays, a large number of intelligent devices involved in the industrial Internet of Things (IIoT) environment lead to unprecedented challenges in security. Due to limited resources with weak security protection, the IIoT devices can be easily compromised to launch distributed denial-of-service (DDoS) attacks, resulting in catastrophic results. Although there are many DDoS mitigations of traditional static schemes, the proactive defense method to resist attacks has not been well studied. Furthermore, existing proactive schemes ignored the delay-sensitive characteristic of applications under the IIoT environments. To address these issues, we first adopt two kinds of moving target defense (MTD) techniques that dynamically control the admission of devices and migrate service replicas to isolate attackers on limited edge clouds and mitigate DDoS attacks early near its source. Then, we formulate a multistage optimization problem of MTD mechanisms deployment and model it as constrained Markov decision processes in order to maximize the available resources of the system under the limitations of the IIoT environments. Besides, we present an MTD optimal strategy algorithm to solve decision problems in a cost-effective manner. In this article, the proposed algorithm can achieve an optimal admission allocation by means of attackers gathering within the same service where the service migration decisions are assisted by means of value iteration. The experimental results verify that the proposed algorithm, compared with existing strategies, can effectively mitigate DDoS attacks with acceptable degradation of the quality of service.

As more and more network applications have adopted encryption for user privacy, it poses a great challenge to identify increasing types of encrypted traffic. Recent methods mainly focus on leveraging machine learning or deep learning to improve the effectiveness of classification, and achieve good results in their experiments. However, most methods are developed for a limited number of traffic types on a close-world dataset, lacking the ability to transfer knowledge learned from available labeled data of known classes to the identification of unknown classes, of which the data is unseen during training. In this paper, we propose a novel attribute-based zero-shot learning (ZSL) framework for encrypted traffic classification, with both fine granularity for general classification and good scalability for identifying unknown classes. The framework is based on our defined attribute semantic space, consisting of two components: i) a feature-attribute embedding model to learn the mapping between flow features and attributes from seen classes. We use Temporal Convolution Network (TCN) for flow feature embedding and Simple Recurrent Units (SRU) for attribute embedding, with attention mechanisms introduced in both models for interpretability. ii) a GAN-based feature generation model FAE-G that leverages the trained FAE model to improve the generalization of the classifier for unseen classes. For generalized ZSL (GZSL) tasks, we introduce gradient-based rejection to classify both seen and unseen classes in a two-step way. The experimental results demonstrate that our method shows excellent performance in fine-grained classification, and also achieves presentable results in the identification of unknown classes.

Bitcoin and other digital cryptocurrencies have de-veloped rapidly in recent years. To reduce hardware and power costs, many criminals use the botnet to infect other hosts to mine cryptocurrency for themselves, which has led to the proliferation of mining botnets and is referred to as cryptojacking. At present, the mechanisms specific to cryptojacking detection include host-based, Deep Packet Inspection (DPI) based, and dynamic network characteristics based. Host-based detection requires detection installation and running at each host, and the other two are heavyweight. Besides, DPI-based detection is a breach of privacy and loses efficacy if encountering encrypted traffic. This paper de-signs a lightweight cryptojacking traffic detection method based on network behavior features for an ISP, without referring to the payload of network traffic. We set up an environment to collect cryptojacking traffic and conduct a cryptojacking traffic study to obtain its discriminative network traffic features extracted from only the first four packets in a flow. Our experimental study suggests that the machine learning classifier, random forest, based on the extracted discriminative network traffic features can accurately and efficiently detect cryptojacking traffic.

The existing DDoS attack detection methods based on a single monitoring point only consider symmetric routing scenarios, which may not be practical. Such schemes will produce high false positives when facing the asymmetric routing scenarios. Besides, few of them are applicable in high-speed networks. The paper designs a DDoS detection scheme customized for high-speed networks and takes asymmetric routing scenarios into account. Systematic sampling is applied to high-speed incoming traffic, and a proposed Double Composite Structure Sketch (DCSS) is utilized for fast recording and extraction of features based on the characteristics of DDoS attacks in both symmetric and asymmetric routing scenarios. Then classifiers are trained for online DDoS detection. Our experimental results using the public dataset show that in a 10Gbps network with asymmetric routing, our approach can accurately detect UDP Flood and SYN Flood attacks within 20 seconds when the sampling rate is set to 1/2048.

Backbone network is the core part of the Internet. Due to the high transmission speed of traffic in the backbone network, Quality of Service (QoS) monitoring of services in the backbone network becomes a highly important and challenging issue. Traffic classification is the basis of QoS monitoring. The existing traffic classification is based on full traffic, which is impractical in high-speed backbone network traffic. This paper presents a method to classify the sampled traffic and gives an example of its application in QoS monitoring. Specifically, we design the Multiple Counter Sketch (MC Sketch) to quickly extract features from the sampled data stream in a backbone, propose the Batch Classifier based on Agglomerative Clustering (BCAC) for unsupervised clustering of traffic, and combine with the supervised machine learning method to train the labeled data in the clustering results to get the classification model. The experimental results of sampled traffic collected on a 10Gbps link show that even when the sampling ratio is 1:1024, the accuracy of our classification model reaches 96.3%. When different block sizes are set, the average clustering time of BCAC is only about one-third of the traditional agglomerative classifier. Moreover, we give an example of applying our traffic classification method to monitor the QoS, and the results show that our method can efficiently and accurately monitor the QoS dynamics of backbone network traffic.

With the increasing and extensive use of intelligent Internet of things (IoT) devices, its operational aspect in the network has become a significant dependent data for network QoS management and scheduling. For the resilient intelligent IoT cluster with flexible increase and decrease of devices and heterogeneous operating systems, this paper proposes an adaptive measurement method MRAM, which can snapshot the multidimensional QoS resources view (MRV) of the IoT devices in cluster. MRAM uses the measurement offloading architecture based on extensible gateway platform and cloud computing to liberate the local resources of monitored IoT devices. Based on the improved LSTM algorithm, the MRV’s mutations detection method ELSTM is designed. Newly collected QoS resource can be judged whether mutations have occurred and adaptive measurement state machine is enabled by ELSTM. According to the state machine which ensures that the MRV is updated timely and reflected the current status of the cluster, MRAM adjusts the measurement granularity in real time. This method provides a high time efficiency global profile for the upper QoS services and reduces the impact of measurement on the IoT devices. A real environment is built to test the performance of this method. MRAM has high measurement accuracy and the precision of mutations detection is 98.29%. It converges the update MRV of second level under the condition of IoT devices’ low consumption of storage and CPU utilization.

Selfish node detection offers an effective means to mitigate the routing performance degradation caused by selfish behaviors in opportunistic Networks (OppNets), but leads to the extra network overload and computation cost. Most existing effort in the literature focuses on exploring the detection methods based on the traffic analysis or the cooperation among nodes. In this paper, we investigate the state transition of nodes in the message dissemination without detection. Specifically, the Ordinary Differential Equation (ODE) is constructed to approximatively model the periodic detection with complete detection requirements. Then we obtain the optimal solution of the selfish node detection by the Pontryagin’s maximum principle, and mathematically deduce the right detection time during the message lifetime. The model soundness is verified statistically and the analysis accuracy is evaluated via extensive simulations. The experiments also show that our solution can achieve the tradeoff between the reward and the detection cost.

Blockchain is well known for its storage consistency, decentralization and tamper-proof, but the privacy disclosure and difficulty in auditing discourage the innovative application of blockchain technology. As compared to public blockchain and private blockchain, consortium blockchain is widely used across different industries and use cases due to its privacy-preserving ability, auditability and high transaction rate. However, the present co-audit of privacy-preserving data on consortium blockchain is inefficient. Private data is usually encrypted by a session key before being published on a consortium blockchain for privacy preservation. The session key is shared with transaction parties and auditors for their access. For decentralizing auditorial power, multiple auditors on the consortium blockchain jointly undertake the responsibility of auditing. The distribution of the session key to an auditor requires individually encrypting the session key with the public key of the auditor. The transaction initiator needs to be online when each auditor asks for the session key, and one encryption of the session key for each auditor consumes resources. This work proposes GAChain and applies group key agreement technology to efficiently co-audit privacy-preserving data on consortium blockchain. Multiple auditors on the consortium blockchain form a group and utilize the blockchain to generate a shared group encryption key and their respective group decryption keys. The session key is encrypted only once by the group encryption key and stored on the consortium blockchain together with the encrypted private data. Auditors then obtain the encrypted session key from the chain and decrypt it with their respective group decryption key for co-auditing. The group key generation is involved only when the group forms or group membership changes, which happens very infrequently on the consortium blockchain. We implement the prototype of GAChain based on Hyperledger Fabric framework. Our experimental studies demonstrate that GAChain improves the co-audit efficiency of transactions containing private data on Fabric, and its incurred overhead is moderate.

Website fingerprinting (WF) is a traffic analysis technique that enables attacker passively inspecting user’s traffic to infer which website the user is accessing, especially sensitive sites, has been proven effective in laboratory open-world environment experiment. Several WF claim a high performance, but implicitly assume that clients only visit web pages, which fundamentally limits its practicability. We want to investigate their usefulness in open-real-world. We proposed a two-stage scheme and realized a high performance of Tor traffic identification and website fingerprinting attack on the access network and core gateway, which is a more realistic application scenario. Then we analyzed the classification performance of using statistical features and packet sequence features on the access network and core network. We can conclude that our method works fine on both networks, but improving performance on core gateway is difficult.

Existing intrusion detection models trained by machine learning all need reliable datasets. However, the update of the public dataset is basically long after the occurrence of the new attack, which makes the update speed of the intrusion detection model relatively slow. In this paper,we proposed a Never-Ending learning framework for intrusion detection. In this framework, the neural network model can constantly absorb the knowledge of the public/private datasets using multi-task learning and transfer learning. Meanwhile, the framework also drew on the idea of serendipitous learning, updating the model by isolating the suspected traffic from the device under attack and classifying it as a new attack category. In order to protect the privacy of users and private datasets, this paper improves various training methods of continuous learning based on the idea of federated learning. As a result, users’ data will not be transmitted directly, so as to protect users’ privacy.

DDoS attacks have emerged as one of the most serious network security threats in 5G, IoT, multi-cloud, and other emerging technology scenarios. The bandwidth of DDoS attacks is increasing in the new scenario, but the current network structure and security devices are inflexible. We propose a DDoS protection method based on SDN multi-dimensional scheduling method and DDoS scrubbing policy, which not only plans the scheduling path, but also blocks and redirects different kinds of attack traffic that used dynamic residual bandwidth of links, the number of flow entries in OpenFlow switches, and scheduling path length. To flexibly protect against DDoS attacks, this method combines scheduling and protection means. The experimental results indicate that the scheduling is effective. The scheduling, path produced by this method outperforms ECMP and KSP approaches in throughput, packet loss rate, and jitter, and it can block L3/L4 attack traffic and redirect L7 attack traffic.

With the great changes in network scale and network topology, the difficulty of DDoS attack detection increases significantly. Most of the methods proposed in the past rarely considered the real-time, adaptive ability, and other practical issues in the real-world network attack detection environment. In this paper, we proposed a real-time adaptive DDoS attack detection method RT-SAD, based on the response to the external network when attacked. We designed a feature extraction method based on sketch and an adaptive updating algorithm, which makes the method suitable for the high-speed network environment. Experiment results show that our method can detect DDoS attacks using sampled Netflowunder high-speed network environment, with good real-time performance, low resource consumption, and high detection accuracy.

Blackhole detection in the opportunistic networks offers an effective means to mitigate the routing performance degradation but faces many challenges from corrupted nodes due to their collusion behaviors. Most existing effort in the literature focuses on the blackhole feature extraction from the message exchange. However, the decay effect of features and the forged features from the corrupted node, which acts as the rational node in performing message exchange, degrade the performance of the detection. In this article, we investigate the evidence construction, i.e., the direct and indirect evidence with the statistical parameters in message exchange. Specifically, we construct behavior classifiers to distinguish the blackhole behaviors from rational ones and design the collusion filtering strategy to improve the detection accuracy by separating corrupted nodes from rational ones, laying a behavior identification foundation. The contact evidence-driven blackhole detection (CEBD) based on machine learning is proposed to improve the routing performance. The soundness of the proposed scheme is verified statistically and the detection accuracy is evaluated based on random waypoint model (RWP) trace and Shanghai taxi trace. Extensive simulations show that our scheme outperforms the benchmarks, including SDBG, Li, and MDS, in terms of the delivery ratio in various scenarios.

The Internet of Things (IoT) is becoming truly ubiquitous in every domain of human lives, and a large number of objects can be connected and enabled to communicate with cloud servers at any time. However, complex connections and vulnerabilities of IoT devices introduce inevitable security threats, in which distributed denial-of-service (DDoS) attacks usually incur catastrophic results. Unfortunately, the existing DDoS mitigation methods cannot provide effective protection. Moreover, the amplifying complexity and increasing delay incurred by defense greatly affect the stability of IoT networks. To tackle these problems, we present a novel framework that can proactively adapt the attack surface of IoT networks, dynamically optimize defense strategies, and rapidly deploy the corresponding defense mechanisms. In particular, we establish hybrid proactive defense mechanisms combining Moving Target Defense (MTD) techniques with cyber deception to spread camouflage information to confuse attackers. Based on these mechanisms, we introduce a defender-led signaling game model to formalize defense scenarios and depict the interactions between the defender and the attacker. Besides, we present an optimal algorithm to solve decision problems and optimize defense implementation in a cost-effective manner. Our extensive experiments demonstrate that the proposed approach can effectively mitigate DDoS attacks and maintain a high level of performance in IoT networks with acceptable overhead.

Two intrinsic features of Named Data Networking(NDN), in-network caching and multipath communication, offer the potential for fast and reliable big data transmissions via multisource content delivery. Network coding has recently been utilized to achieve efficient multisource content delivery in NDN. On the other hand, request pipelining is essential for efficient multisource content delivery in network coding enabled NDN. However, it is a challenge to simultaneously support network coding and request pipelining in NDN in a cost-effective way. To address this problem, we propose NCP-NDN, a network coding and request pipelining enabled named data networking architecture. NCP-NDN supports reasonably efficient Interest aggregation when enabling request pipelining without undermining the privacy of content retrieval by extending each Interest with a session and generation oriented requester identifier. Besides, NCP-NDN provides consumers with linearly independent blocks while request pipelining is enabled by combining rank-based matching, one forwarding of each block for per requester and face, and recoding the matching cached blocks before replying an Interest. Our experimental studies illustrate that NCP-NDN improves the performance of content delivery and reduces the overhead of big data transmissions as compared to the existing schemes.

In-network caching and multipath forwarding are prominent features of Named Data Networking (NDN). Network coding enabled NDN (NC-NDN) coordinates the in-network caching and multipath forwarding to improve content delivery performance. However, the existing NC-NDN lacks the considerations on the incorporation with caching schemes. It basically adopts the caching scheme of Caching Everything Everywhere (CEE) leading to cache redundancy and unnecessary and frequent cache replacement. On the other hand, the existing caching schemes for native NDN do not make use of the characteristic of network coded Data packets. To address these problems, this paper proposes a demand and responsiveness-based caching strategy specific to NC-NDN to enable cost-effective caching for network coded Data packets. In our proposed caching strategy, the caching decision at a caching node takes into account three factors, its present demand on the network coded Data packets of the requested generation of content, its distance to the original content provider, and its potential responsiveness to the future requests for the same generation based on the number of network coded Data packets locally cached and that would return for the requested generation. It commits to cache network coded Data packets of a generation of content at more valuable nodes along the transmission path. Our experimental studies show that the proposed caching strategy offers high-performance content delivery and reduces the caching overhead as compared to the existing strategies.

Encryption of network traffic has become an inevitable trend. As an important link to Internet encrypted traffic analysis, encrypted traffic service classification can provide support for the coarse-grained network service traffic management and security supervision. But traditional DPI method cannot be effectively applied in an encrypted traffic environment, and the existing methods based on machine learning have two problems in feature selection. One is the complex feature classification over costing problem, the other is the TLS-1.2 suited method is no longer applicable to TLS-1.3 handshake encryption. To solve these problems, in this paper, we consider the differences among encryption network protocol stacks and propose a method of encrypted traffic service classification combining with capsule neural network in a multi-protocol environment by using multi-PDU lengths as the features, making full use of Markov property between PDU length sequences and being suitable to TLS1.3 environment. The feature makes our method much faster than others in feature extraction. Our control experiments on ISCX VPN-nonVPN dataset show that our method achieves a satisfactory performance (0.9860 Pr, 0.9856 Rc, 0.9855 F1), which is superior to the state-of-the-art methods.

Duty-cycling techniques have been widely adopted to save energy for energy-constrained wireless sensor networks, while they also cause the sleep latency issue, especially in a multihop linear sensor network (LSN). So the duty-cycling and pipelined-forwarding (DCPF) techniques have been proposed to alleviate this issue. However, most of existing DCPF protocols have no effective scheme to handle the contention and interference among those proximately-located nodes which maintain the same sleep-wakeup schedule. As a result, the network performance degrades with low energy efficiency and high packet delivery latency, particularly when experiencing a heavy traffic load. To this end, this paper proposes an enhanced pipelined data collection (EPDC) MAC protocol for LSN. In EPDC, three algorithms are proposed to guarantee that those nodes located within the interference range of each other have mutually staggered sleep-wakeup schedules, so that the contention and interference among them can be eliminated. The extensive OP-NET simulations show that EPDC significantly outperforms an existing DCPF protocol in terms of packet delivery ratio, network throughput, packet delivery latency, and energy efficiency.

The authentication protocol is commonly served as the first defense line against various attacks in vehicular ad hoc networks (VANETs). Conventional schemes usually employ public key infrastructure or cryptography-based algorithms, which suffer from high computational and storage cost. In this paper, we propose a privacy-preserving authentication scheme for VANETs based on consortium blockchain. The authenticity of a vehicle or a road-side unit is represented by its transaction capability on blockchain instead of a certificate or a cryptographic key. In support of that, we design a novel data structure based on the unspent transaction output (UTXO) combined with a set of online operations, including issue, transfer, query and revocation. Thus, the authentication between two entities is accomplished by on-chain verification and corresponding communications. We conduct a set of security and privacy analysis as well as implementing a prototype on the Hyperledger Fabric platform, to evaluate the effectiveness and the efficiency of the proposed scheme.

Intelligent Fault localization for SDN becomes one of the most critical but difficult tasks. This paper proposes a new approach called Policy-Aware In-band Network Telemetry (PAINT) to tackle SDN fault localization. In the PAINT system, network operators define and deploy network services using a high-level Service Provisioning Language (SPL). Then, PAINT automatically parses the service policy to infer the causal relationship between service related network components and (end-to-end) service-level observable symptoms. Based on the causality model, PAINT deploys monitoring instruments for the symptoms. PAINT utilizes a dynamically created Symptom-Fault-Telemetry model to incorporate In-band Network Telemetry (INT) actions systematically into the fault reasoning process to improve the efficiency and accuracy of fault localization for SDN. PAINT has been extensively evaluated in a simulation environment for its accuracy and scalability with very positive results.

Named Data Networking (NDN) intrinsically supports in-network caching and multipath forwarding. The two salient features offer the potential to simultaneously transmit content segments that comprise the requested content from original content publishers and in-network caches. However, due to the complexity of maintaining the reachability information of off-path cached content at the fine-grained packet level of granularity, the multipath forwarding and off-path cached copies are significantly underutilized in NDN so far. Network coding enabled NDN, referred to as NC-NDN, was proposed to effectively utilize multiple on-path routes to transmit content, but off-path cached copies are still unexploited. This work enhances NC-NDN with an On-demand Off-path Cache Exploration based Multipath Forwarding strategy, dubbed as O2CEMF, to take full advantage of the multipath forwarding to efficiently utilize off-path cached content. In O2CEMF, each network node reactively explores the reachability information of nearby off-path cached content when consumers begin to request a generation of content, and maintains the reachability at the coarse-grained generation level of granularity instead. Then the consumers simultaneously retrieve content from the original content publisher(s) and the explored capable off-path caches. Our experimental studies validate that this strategy improves the content delivery performance efficiently as compared to that in the present NC-NDN.

Radio frequency identification (RFID) technology has rich applications in cyber-physical systems, such as warehouse management and supply chain control. Often in practice, tags are attached to objects belonging to different groups, which may be different product types/manufacturers in a warehouse or different book categories in a library. As RFID technology evolves from single-group to multiple-group systems, there arise several interesting problems. One of them is to identify the popular groups, whose numbers of tags are above a pre-defined threshold. Another is to estimate arbitrary moments of the group size distribution, such as sum, variance, and entropy for the sizes of all groups. In this paper, we consider a new problem which is to estimate all these statistical metrics simultaneously in a time-efficient manner without collecting any tag IDs. We solve this problem by a protocol named generic moment estimator (GME), which allows the tradeoff between estimation accuracy and time cost. According to the results of our theoretical analysis and simulation studies, this GME protocol is several times or even orders of magnitude more efficient than a baseline protocol that takes a random sample of tag groups to estimate each group size.

Radio-frequency identification (RFID) technology has been widely adopted in various industries and people's daily lives. This paper studies a fundamental function of spatial-temporal joint cardinality estimation in distributed RFID systems. It allows a user to make queries over multiple tag sets that are present at different locations and times in a distributed tagged system. It estimates the joint cardinalities of those tag sets with bounded error. This function has many potential applications for tracking product flows in large warehouses and distributed logistics networks. The prior art is either limited to jointly analyzing only two tag sets or is designed for a relative accuracy model, which may cause unbounded time cost. Addressing these limitations, we propose a novel design of the joint cardinality estimation function with two major components. The first component is to record snapshots of the tag sets in a system at different locations and periodically, in a time-efficient way. The second component is to develop accurate estimators that extract the joint cardinalities of chosen tag sets based on their snapshots, with a bounded error that can be set arbitrarily small. We formally analyze the bias and variance of the estimators, and we develop a method for setting their optimal system parameters. The simulation results show that, under predefined accuracy requirements, our new solution reduces time cost by multiple folds when compared with the existing work.

Sampling is highly demanded in software defined networking (SDN) by the need to control the consumption of network measurement resources and by the need of detailed measurements from applications and service providers. Open-Flow, as the standard control protocol between SDN controller and switches, is not equipped with traffic sampling function. In this paper, we proposes a software defined sampling measurement scheme via an adoptable extension to OpenFlow called eOpenFlow. In the data plane of SDN switch, the sampling action OFPAT_OUTPUT_SAMPLING is added to sample user defined specific traffic flows. We present two different sampling rules, which are based on multi-level flow table and group-based table mechanisms, respectively. In SDN control plane, collected network samples are analyzed to realize various measurement functions. eOpenFlow has been implemented, and further evaluated via carefully designed experiments in order to verify its different sampling functions.

Fault localization is a core element in SDN networkmanagement. Many SDN fault reasoning and verificationtechniques assist operators focus on either analyzing the controlplane configuration or checking the data plane network behavior. These solutions are limited in that they cannot correlate networksymptoms between the control and the data planes, and areharder to generalize across protocols since they have to modelcomplex configuration languages and dynamic protocol behavior. This paper proposes a new approach called Service OrientedVerification Integrated Reasoning (SOVIR) to tackle SDN faultreasoning. In the SOVIR system, a network user can request oneor multiple network services via a high level Service ProvisioningLanguage (SPL). SOVIR automatically parses each provisionedservice and presents it as a logical Service View, which consistsof a pair of logical end nodes, a service specification, and alist of required network functions (e.g., load balancer). Afterprovisioned in an SDN network, SOVIR queries the controllerabout the network topology and flow rules from all SDN switches. Based on the flow rules and the configuration of end nodesand network function nodes, SOVIR maps the Service View toan Implementation View, in which all the logical componentsin the Service View are mapped to the actual system componentsalong with the actual network topology. SOVIR usesan extended Symptom-Fault-Verification model to incorporatevarious verification techniques systematically into fault reasoningprocess to localize the faults in SDN. SOVIR has been evaluatedin a simulation environment for its accuracy and efficiency. The evaluation shows that with SOVIR, both performance andaccuracy of fault reasoning in the simulated SDN networks canbe greatly improved by taking properly selected verification toolson specific network entities.

Abstract Modern botnets such as Zeus and Conficker commonly utilize a technique called domain fluxing or a domain generation algorithm to generate a large number of pseudo‐random domain names (PDNs) dynamically for botnet operators to control their bots. These botnets are becoming one of the most serious threats to Internet security on a global scale. How to prevent their destructive action is one of the most pressing issues of today. In this paper, we focus on detecting domain‐flux botnets within the monitored network based on Domain Name System (DNS) traffic features. This method passively captures all DNS traffic from the gateway of a monitored network and then extracts key features to identify PDN. Based on examining and analyzing a large number of legitimate domains as well as PDN generated by botnets, we have discovered that there is a discernible bias in the rules for constructing domain names. Therefore, we introduce a methodology that analyzes DNS traffic to extract the length and the expected value, which can distinguish between a domain name generated by humans or bots. In order to evaluate the effectiveness of the proposed approach, various machine learning algorithms are applied to train predictive models for our detection system. This proposed scheme is implemented and tested in a real local area network. The experimental results show that our proposed method achieves the highest detective efficiency for decision tree algorithms (J48) with an average overall accuracy of up to 92.3% and a false positive rate of 4.8%. Copyright © 2016 John Wiley & Sons, Ltd.

As a distinctive feature of Information Centric Networking (ICN), in-network caching plays a fundamental role on system performance. The line-speed requirement of in-network caching invalidates the employ of complex collaborative caching schemes. The cache management of in-network caching includes three components - cache placement, cache replacement and cache location. Coupling the three pieces would make more efficient use of in-network caches, but existing in-network caching schemes consider only one or two of the three pieces. This work enhances in-network caching with a low complexity cache placement scheme that takes into account content popularity, hop reduction gains, cache space contention and replacement penalty and couples with cache replacement and location, here dubbed PRL (coupling cache Placement, Replacement and Location). PRL keeps data chunks that are more popular and farther away to fetch at an en-route router with less cache space contention. And PRL locates cached copies so as to serve a higher proportion of requests from in-network caches. Our preliminary simulation results suggest that PRL increases cache hit ratio and reduces the average hop count traversed by users' requests and the caching operations at routers as compared to existing representative innetwork caching schemes.

A flow is active during a measurement period if it sends at least one packet. It is essential to control resource consumption in network monitoring by traffic sampling, so most high-end routers provide sampling network traffic function. The number of original flow is an important metrics to many network applications such as congestion control and network security. In this paper, we present a EUF algorithm that can accurately infer the number of original flow from the sampled packet traffic. Using the EUF algorithm, the number of unsampled flows can be estimated by an iteration method based on random sampling, and then the number of original flows can be precisely estimated according to both the number of the sampled flows and the unsampled flow. The EUF algorithm is also compared with the EM algorithm using multiple traffic traces collected from a Tier-1 ISP backbone networks. The result shows that the EUF algorithm is superior to EM and can provide highly accurate estimation on the number of the original flow.

Currently, researchers study the traffic difference of various Internet applications, and analyze the impacts on network performance and quality of service, mainly through network measuring, to explore the unknown behaviors performed by this huge complex nonlinear system. Passive measurement can get the measurement data which most truly reflect network behavior, so it is widely used in the network measurement. However, in the high-speed network, it is difficult to measure, process, storage and analyze the measured massive data. Under the background of passive measurement for the large-scale high-speed network, this paper focuses on measurement, collation, storage and analysis of the massive data, which was closely related to the measurement and behavior analysis. This paper will design and implement a Trace Measurement and Analysis System for the Multi-links CERNET Backbone (TMASM), and it would test TMASM using a JSERNET trace. In this paper, first, we design and implement TMASM, then discuss the features of the data captured by Watcher measurement subsystem. We study the strategy of processing the parallel links packet data collected from Jiangsu Province border multi-links of CERNET backbone. The Architecture of TMASM supports scalability in order to expand the analysis functions only through a simple approach. Finally, TMASM is tested, and a Trace collected from Jiangsu Province border channel of CERNET is analyzed using TMASM.

Overlay networks have emerged as a powerful and flexible platform for developing new disruptive network applications. The attractive characteristics of overlay networks such as planetary-scale distributions, user-level flexibility (e.g., overlay routing) and manageability bring to overlay fault diagnosis new challenges, which include inaccessible underlying network information, incomplete and inaccurate network status observations; dynamic symptom-fault causality relationships, and multi-layer complexity. To address these challenges, we propose a distributed user-level Belief Revision based overlay fault diagnosis technique called EUDiag. EUDiag can passively use observed overlay symptoms as reported by overlay monitoring agents to correlate and diagnose faults, and select the least-costly appropriate probing actions whenever necessary to enhance the passive fault reasoning results. EUDiag adapts to the changes in highly dynamic overlay networks by incrementally revising user beliefs based on new observed overlay symptoms. EUDiag can diagnose faults without relying on underlying network fault probabilistic quantifications (e.g. prior fault probability).Simulations and experimental studies show that EUDiag can efficiently (e.g. low latency) and accurately localize root causes of overlay faults/problems, even when the observed symptoms are incomplete.

In a distributed network, a great number of network applications, such as measurements of one-way delay, can be performed by measuring accurately synchronized clocks from different network computers. Due to the difference of frequency and time between different clocks, these clocks are not synchronized, so in one-way delay measurements between two computers there exists a relative time offset. S.B. Moon et al. (see Proc. INET 2000) and V. Paxson (see PhD Dissertation, U.C. Berkeley, 1997; Proc. ACM SIGMETRICS, p.11-21, 1998) directly analyze one-way delay measurements to remove measurement error. In our approach, the frequency and time information between computers' clocks is exchanged, and a relative clock model between two computer clocks can be established; based on the relative clock model, the measured delay timestamp is corrected, and so the one-way delay measurement is also corrected indirectly. Two groups of measured data in a local area network, and one group of one-way delay between Southeast University in China and AMS in Switzerland are analyzed to verify the relative clock model. The result shows that the relative clock model can describe the relative relationship between different computer clocks, and correct the measured error of one-way delay between computers.