The remote desktop is widely used in enterprise environments. To improve its security, Zero Trust is generally introduced to replace the traditional perimeter-based model with dynamic trust evaluation and continuous verification. However, for the remote desktop system, where access chain topology can be abstracted as a graph consists of users, terminals, VMs and connections between them, classical dynamic trust evaluation approaches rely simply on users’ features collected from user-terminal interactions. They ignore features from remained parts of graph, such as terminal itself (as access medium) and status of virtual machines (as access target). Recent graph neural network (GNN) models are dedicated to fusing features from multiple sources in graph structure; however, they are often designed for low-heterogeneity domains and are thus not well suited to the heterogeneous interactions in remote desktop access. To address these challenges, we propose a heterogeneous graph neural network (HGNN) framework for trust evaluation in remote desktop systems. In particular, we model users, terminals, and virtual machines as distinct node types and represent their interactions as a heterogeneous graph, upon which we apply HGNN to aggregating multi-type relational information. This enables comprehensive and adaptive trust estimation tailored to the characteristics of remote desktop environments. Experiments on real-world datasets demonstrate that our method consistently outperforms baselines in terms of accuracy, precision, recall, and F1-score in the trust-level prediction task, confirming the effectiveness of heterogeneous graph modeling and neural-based aggregation in improving trust evaluation performance.

Mobile edge computing (MEC), extending computing services from cloud to edge, is recognized as one of key pillars to facilitate real-time services and tackle backhaul bottleneck. However, it is not economically efficient to attach intensive security appliances to every MEC node to defend application-level DDoS attacks and ensure the availability of services. Thus, we explore the elasticity of security defense among MEC nodes by proposing a COoperative DEfense (CODE) framework for MEC, referred to asCODE4MEC. CODE4MEC aims to adapt to traffic changes by coordinating container-carried defensive resources among cooperative MEC nodes in an automatic way. Towards this aim, we propose four control plane functions to enable a life-cycle management for CODE4MEC, namely, CODE triggering, scheduling, coordination and releasing. However, an effective CODE4MEC requires non-trivial algorithmic schemes, in particular for CODE scheduling and coordination functions. We thus design an online combinatorial auction mechanism for real-time CODE scheduling, and prove a tighter performance bound relative to prior arts. As for CODE coordination, a flow-based traffic and context information coordination scheme is proposed to enable classical defense schemes to work properly and efficiently. Finally, using a combination of real testbed and simulation evaluations, we validate the effectiveness of CODE4MEC.

The cooperative Mobile Edge Computing (MEC) caching, where caches are distributed in 5G edge to cooperatively bring popular contents closer to mobile users, is concocted with high expectation on improving users' quality of experience. However, the system may suffer severely from the pollution attack. By frequently requesting unpopular contents, the adversaries in the pollution attack can break the patterns of content popularity. As a result, the cooperative content placement decision making, which relies on the popularity pattern, will be misguided to store unpopular contents instead of popular ones. In this paper, we explore the behaviors and threats of pollution attack in cooperative MEC caching. Starting with single-inject pollution where adversaries concentrate the attack on a single cache, we study the behaviors and diffusion features from both statistical experiments and theoretical analysis. Results show that the unpopular contents can fill into caches within 2 hops from attackers, and caches within 3 hops suffer from severe damage. Meanwhile, we also derive the upper boundary of the attack damage and present a boundary analysis. Furthermore, in multiple-inject pollution where the adversaries launch multiple single-inject pollution simultaneously, we evaluate the threat when attackers intelligently organize the attacks. It is found that the adversaries can cause 44% severer damage and cover 45% more area after intelligently organizing the attacks. Our work in this paper provides a fundamental basis for countermeasures designing.

Abstract In wireless sensor networks, one of the primary requirements is that sensor data acquired from the physical world can be interchanged with all interested collaborative entities in a secure, reliable manner. Because of highly unpredictable nature of the environments caused by malicious attacks or potential threats, minimizing transmission cost between source and sink nodes with jointly considering the security of the whole network is a critical issue. This paper considers two optimization problems of deriving the minimum cost paths from multiple source nodes to the sink node under the guaranteed level of the vulnerability. The link or node vulnerability is defined as a metric, which characterizes the degree of link or node sharing among paths. With the defined link vulnerability, the link vulnerability‐constrained minimum cost paths problem is first formulated, and two polynomial‐time algorithms are developed for deriving the optimal paths. For the node‐vulnerability‐constrained minimum cost paths problem, we adopt the network conversion and then achieve the optimal solution with previous proposed algorithms. The necessary condition for solution existence, the optimality of the proposed algorithms, and the related properties of tree network are further theoretically analyzed. Extensive simulations show the significant performance improvements achieved by our proposed algorithms.Copyright © 2014 John Wiley & Sons, Ltd.

In this paper, we propose TCP-FNC (TCP with fast network coding), which is designed to reduce the decoding delay for TCP with network coding. TCP-FNC retains the framework of TCP/NC and includes two schemes to meet the demand of online network coding. First, we develop a feedback based scheme named FCWL, which can efficiently reduce the waiting delay and work well with both RTT-based and loss-based TCP variants. Second, we propose an optimized progressive decoding algorithm named EFU for Gaussian-Jordan elimination, which can further reduce the computation delay from O(n2) to O(n). Evaluation results indicate that our TCP-FNC can achieve shorter decoding delay than TCP/NC and VON without trading off its goodput performance. We verify that TCP-FNC can reduce the decoding delay by 33% on average.

TCP suffers from low throughput and high latency because of its expensive timeout based loss recovery mechanism in data center networks (DCNs). In this paper, we propose TCP with Adaptive Complementary Coding (TCP-ACC) to effectively address these problems. Without revising existing TCP congestion control, we first design a light-weight complementary coding scheme to avoid TCP timeout which will result in higher throughput and lower latency. In our scheme, the redundancy setting is adaptive to the real-time packet loss rate. Then we introduce Lyapunov optimization framework to find the optimal number of redundant coding packets for TCP-ACC, and we also prove that TCP-ACC can reduce the flow timeout probability close to that of the optimal complementary coding solution. Extensive NS2 simulations show that, compared with other three solutions for TCP's problems in DCNs, TCP-ACC can reduce the flow completion time by 45% and improve the flow throughput by 40% on average.

In this paper, we propose CGM-PS, a partial-decentralized, un-starving, work-conservative, and preemptive coflow scheduling scheme to shorten the Coflow Completion Time (CCT) for TCP flows in data center networks (DCNs). In CGMPS, we propose both inter- and intra- coflow scheduling policies. In inter-coflow scheduling, we present P-SEBF, which adopts a connected-graph model based novel concept Partialcoflow, to achieve approximate SEBF scheduling in a partial-decentralized manner. In intra-coflow scheduling, we present FP-MDFS to give flow-level priorities and appropriate rates to TCP flows for finishing the coflows as quick as possible without wasting network capacities in a decentralized manner. Trace-based simulation results show that, among existing coflow scheduling schemes, CGM-PS can achieve the minimal CCTs both on average and in the 90th percentile. In brief, CGM-PS only brings about similar scheduling overhead with the decentralized schemes, while it can achieve the CCT performance even better than the near optimal centralized scheme.

Information-Centric Networking (ICN) is a new emerging concept, in which the principal paradigm shifts from the traditional end-to-end connection to the information-centric communication model. In ICN, information unit, such as content or service, is distributed in different sites or data centers to provide large-scale services. A common supporting approach for scalable service provisioning is deploying multiple replica servers throughout the network. Accordingly, an efficient and flexible scheme is needed to direct distributed requests to an appropriate replica server. In this paper, we first propose an incrementally deployable ICN architecture based on edge/core separation. And then, a practical anycast-based service provisioning scheme is presented with joint considerations of both servers contexts and the underlying network conditions. Extensive experiments have been performed to evaluate the proposed scheme. Experiment results show that efficient context-aware distributed service provisioning can be achieved.