Specific emitter identification (SEI) separates the radio frequency fingerprint (RFF) from signals, which is of great significance in solving Internet of Things (IoT) security problems. However, the scarcity of high-quality, diverse, and labeled data in real-world scenarios limits the application of SEI. Under such conditions, the SEI is referred to as few-shot SEI (FS-SEI). To surmount this challenge, we propose a diffusion model-based data augmentation method capable of generating a substantial volume of diverse, high-quality data. Specifically, we develop a multi-scale convolutional block attention module denoising diffusion probabilistic model (MSCBAM-DDPM), which enhances feature capture capabilities, laying the foundation for the generation of diverse data. Furthermore, we propose an adaptive two-stage multi-domain loss function that guides the model to learn the characteristics of the original data and further derive other similar features, thereby achieving the goal of generating diverse and high-quality data. Finally, we theoretically derive the feasibility of the proposed loss function and further demonstrate the excellent diversity and quality of the data generated by our method, as well as its considerable gain for FS-SEI, through extensive experiments on real-world signal datasets.

Code reuse attacks exploiting memory disclosure vulnerabilities can bypass all deployed mitigations. One promising defense against this class of attacks is to enable execute-only memory (XOM) protection on top of fine-grained address space layout randomization (ASLR). However, recent works implementing XOM, despite their efficacy, only protect programs that have been (re)built with new compiler support, leaving commercial-off-the-shelf (COTS) binaries and source-unavailable programs unprotected. We present the design and implementation of NORAX, a practical system that retrofits XOM into stripped COTS binaries on AArch64 platforms. Unlike previous techniques, NORAX requires neither source code nor debugging symbols. NORAX statically transforms existing binaries so that during runtime their code sections can be loaded into XOM memory pages with embedded data relocated and data references properly updated. NORAX allows transformed binaries to leverage the new hardware-based XOM support—a feature widely available on AArch64 platforms (e.g., recent mobile devices) yet virtually unused due to the incompatibility of existing binaries. Furthermore, NORAX is designed to co-exist with other COTS binary hardening techniques, such as in-place randomization (IPR). We apply NORAX to the commonly used Android system binaries running on SAMSUNG Galaxy S6 and LG Nexus 5X devices. The results show that NORAX on average slows down the execution of transformed binaries by 1.18% and increases their memory footprint by 2.21%, suggesting NORAX is practical for real-world adoption.

Lack of energy proportionality in server systems results in significant waste of energy when operating at low utilization, a common scenario in today's data centers. We propose DIMMer, an approach to eliminate the idle power consumption of unused system components, motivated by two key observations. First, even in their lowest-power states, the power consumption of server components remains significant. Second, unused components can be powered off entirely without sacrificing server availability. We demonstrate that unused memory capacity can be powered off, eliminating the energy waste of self-refresh for unallocated memory, while still allowing for all capacity to be available on a moment's notice. Similarly, only one CPU socket must remain powered on, allowing unused CPUs and attached memory to be powered off entirely. The DIMMer vision can improve energy proportionality and achieve energy savings. Using a Google cluster trace as well as in-house experiments, we estimate up to 50% savings on DRAM and 18.8% on CPU background energy. At $0.10/kWh, this corresponds to 0.6% of total data center cost.

An essential goal of Virtual Machine Introspection (VMI) is assuring security policy enforcement and overall functionality in the presence of an untrustworthy OS. A fundamental obstacle to this goal is the difficulty in accurately extracting semantic meaning from the hypervisor's hardware level view of a guest OS, called the semantic gap. Over the twelve years since the semantic gap was identified, immense progress has been made in developing powerful VMI tools. Unfortunately, much of this progress has been made at the cost of reintroducing trust into the guest OS, often in direct contradiction to the underlying threat model motivating the introspection. Although this choice is reasonable in some contexts and has facilitated progress, the ultimate goal of reducing the trusted computing base of software systems is best served by a fresh look at the VMI design space. This paper organizes previous work based on the essential design considerations when building a VMI system, and then explains how these design choices dictate the trust model and security properties of the overall system. The paper then observes portions of the VMI design space which have been under-explored, as well as potential adaptations of existing techniques to bridge the semantic gap without trusting the guest OS. Overall, this paper aims to create an essential checkpoint in the broader quest for meaningful trust in virtualized environments through VM introspection.

XCP is one of the most commonly used protocols in modern congestion control implementations. XCP can provide the available transmission rate to applications. It is well known fact that one of the issues of XCP is that the time-delay of its traditional implementation (TR-XCP) is twice the time-delay of its flow model. This leads to unstable behaviors when controlling the congestion in networks with heterogeneous propagation delays. This paper proposes an improvement of TR-XCP called the stable XCP (ST-XCP). ST-XCP decreases the control interval of XCP implementations and brings the behavior of the congestion control system back to the stability region. It is demonstrated in this paper, theoretically and through simulations, that ST-XCP outperforms TR-XCP as far as the queue size is concerned, and that it is also stable even while controlling the congestion in networks with heterogeneous propagation delays.

Services such as multimedia, VoIP, video-conferencing, social networking and others impose new requirements on providers and constraints on network designers. Fair Queueing algorithms like CSFQ or Stochastic Fair BLUE have been used to improve the quality of the packet transmission. Such mechanisms usually supervise the bandwidth consumption per-flow and become helpless in the presence of P2P traffic. In quest for high quality transmission, multimedia applications are designed to use more and more P2P paradigms. As P2P traffic is also exposed to congestion, few works address congestion control in mixed traditional IP (for short called IP traffic) and P2P traffic. In this paper, we propose a model flow for the mixture of the two and present a principle and a method based on per-subscriber flow control, for congestion control. An architecture based on the Token-Based Traffic Control for P2P applications is introduced. The token resource consumed by each subscriber is counted and controls for both core and edge routers are generated in the case of IP and P2P traffic. The traffic is measured at core routers and the measurement data is conveyed to edge routers. They label the Token-Level on incoming packets according to the congestion index, and police the total input token of each P2P subscriber. Simulations results and the analysis of the impact on the performance of this approach on some P2P experiments are given.

Differentiated services (DiffServ) define the per-hop-behavior (PHB) to enable scalable network designs with QoS support for multiple classes. MPLS traffic engineering (MPLS TE) enables resource reservation, fault-tolerance, and optimization of network resources. From the implementation point of view, the QoS is provided on the forwarding plane while the reservation and admission control happen on the control plane. There is no communication between the two modules to guarantee the bandwidth for the end to end tunnels. Furthermore, the video traffic has a variable-bit-rate (VBR), so the effective bandwidth is required for satisfying the real QoS. This paper will propose a novel framework to provide an integrated QoS provisioning, where packet loss probability is guaranteed for the video traffic. The design and implementation prototype is based on Hyperchip PBR 1280 core router system.

QoS control and guarantees for IP/MPLS VPN services are increasingly important for network service providers. The dynamic control of QoS parameters is still an open issue. A control theory based packet loss control system is proposed to dynamic maintain the preset packet loss probability targets for instantiated VPN services in the core network, where the transducer and the dynamic packet loss model have been studied in the previous studies, respectively. However, the identified linear model contains time-varying and norm-bounded uncertain parameters. This paper will extend the previous research to design a robust and optimal controller for the complete QoS control system. Specially, a Linear Matrix Inequality (LMI) approach for designing the robust and optimal Proportional- Integral (PI) controller is studied. By adopting the LMI expression, a symmetric positive definite matrix P with guaranteed overall system's quadratic stability is determined. The matrix P finally infers the robust PI controller parameters. A number of experiments are devised on the live NCIT*net network to evaluate the performance of the controller.

Provisioning QoS enabled MPLS VPN services is increasingly important for network service providers. A series of studies investigate the application of control theoretic frameworks to measure and control the QoS parameters, especially the packet loss probability. The plant model is one of the key issues to be solved in the control system. This paper will try to identify the dynamic model of packet loss probability using the system identification methods, where the traffic rates are inputs and packet loss probability is the output. The experiments are designed on the live NCIT*net2. The numeric results are evaluated to verify the effectiveness of the algorithm.

When provisioning the quantitative QoS based VPN services over packet switched networks, parameters such as packet loss, delay and delay jitter, besides the required bandwidth, have to be guaranteed. While the bandwidth is easier to guarantee during the lifetime of a VPN service, maintaining a value of the loss parameter below a preset value presents serious difficulties. Thus one of the main issues to be solved is to estimate the packet loss parameter effectively and accurately. Linking the stochastic characteristics of the traffic process to the loss probability has been examined as a solution under various contexts. Based on the large deviation theory (LDT), two types of asymptotic loss estimators have been studied extensively: the large buffer asymptotic and the large number of source asymptotic. This paper explores the application of the above estimators to the core links which aggregates lots of VPN services. To reduce the computational complexity, aggregate traffic approximation estimator is employed instead on the latter of the study. Firstly, the two practical estimators are derived based on LDT and Gaussian traffic model. Then their performances are evaluated in the live MPLS VPN network. Conclusion and suggestion for future research are formulated at the end of this paper.