Identifying intrusions from massive logs has long been a great challenge. To address this issue, this paper proposes Pontus, a novel host-based intrusion detection method via accurate provenance clustering, efficient graph serialization and classification with minimum provenance loss. Pontus first utilizes a novel multi-round label propagation algorithm (MLPA) based on overlapping community discovery to cluster the behavior instances that constitute user behavior accurately. In this way, Pontus can analyze behavior instances to extract behavior features effectively while reducing the analysis workload. Then, Pontus enables efficient graph serialization via neighbor node aggregation to convert the behavior instance into vectors while maximizing the retention of provenance information. Finally, Pontus uses a hybrid method that combines the convolutional autoencoder with Bisecting Kmeans clustering to accurately extract the provenance features of behavior instances to identify host-based intrusions. The experimental results show that compared with the state-of-the-art methods, Pontus’s accuracy increases by an average of 0.243, and F1-score increases by an average of 0.201, with small runtime overheads.

Social media platforms serve as central hubs for content dissemination, opinion expression, and public engagement across diverse modalities. Accurately predicting the popularity of social media videos enables valuable applications in content recommendation, trend detection, and audience engagement. In this paper, we present Multimodal Video Predictor (MVP), our winning solution to the Video Track of the SMP Challenge 2025. MVP constructs expressive post representations by integrating deep video features extracted from pretrained models with user metadata and contextual information. The framework applies systematic preprocessing techniques, including log-transformations and outlier removal, to improve model robustness. A gradient-boosted regression model is trained to capture complex patterns across modalities. Our approach ranked first in the official evaluation of the Video Track, demonstrating its effectiveness and reliability for multimodal video popularity prediction on social platforms. The source code is available at https://github.com/yllhwa/SMPDVideo.

Abstract As modern attack methods become more concealed and complex, obtaining many labeled samples in big data streams is difficult. Active learning has long been used to achieve better intrusion detection performance by using only a small number of training samples. Intrusion behaviors can be described by provenance graphs that record the dependency relationships between intrusion processes and the infected files. It is a challenge to develop active learning strategies that consider defining and selecting the most valuable provenance and ensure that the strategy for querying provenance is efficient. We present Angus, an active learning framework for provenance-based intrusion detection. We propose two novel active learning strategies: the most similar graph query strategy and the maximum difference query strategy. They either select samples to update the training set according to similarities of provenance graphs or preferentially select samples with low redundancy and large differences from the current training set. Besides, we also improve the above query strategies by using the parallel query to reduce detection time overheads. The experiments on various real-world applications demonstrate their performance and efficiency.

It is essential to utilize a large number of I/O workloads to analyze commodity system performance or simulate scientific phenomena in high-performance scientific computing. I/O traces are often unavailable at scale due to trace storage overhead, privacy concerns, and the performance impact of trace instrumentation. We study how to generate sufficiently representative I/O workloads using Generative Adversarial Networks (GANs). The best GAN architecture can generate I/O workloads with maximum mean discrepancy (MMD) as low as 0.015-0.05, which implies the synthetic I/O workloads have successfully learned the potential distribution of real I/O traces. We demonstrate that the performance similarity between the original I/O trace and the generated I/O workload through trace replay can be 90.36%-97.32%.

Identifying intrusion from massive and multi-source logs accurately and in real-time presents challenges for today's users. This article presents Paradise, a real-time, generalized, and distributed provenance-based intrusion detection method. Paradise introduces a novel extract strategy to prune and extract process feature vectors from provenance dependencies at the system log level, and it stores them in high-efficiency memory databases. Using this strategy, Paradise does not depend on the specific operating system type or provenance collection framework. Provenance-based dependencies are calculated independently during the detection phase, thus, Paradise can negotiate all detection results from multiple detectors without extra communication overhead between detectors. Paradise also employs an efficient load-balanced distribution scheme that enhances the Kafka architecture to efficiently distribute provenance graph feature vectors to the detectors. The experimental results demonstrate that our method has a high detection accuracy with a low time overhead.

Lanes play a very critical and important role in maintaining the orderly operation of road traffic. Therefore, the automatic lane detection is very important and has significant potential value. Combining the existing lane detection methods based on deep learning, this paper proposes a new lane detection model, Bi-Lanenet, to solve the problems that still exist in the current methods, aiming to overcome the disadvantages in these methods and improve the practicality of the lane detection algorithm. For the task of lane detection, this paper improves the segmentation accuracy and improves the traditional lanenet model while ensuring that the network model is lighter weight and more robust. Then, we propose a new bilateral lane recognition network based on semantic segmentation and details, and use the random sample consensus (RANSAC) method to optimize the post-processing process. We conduct experiments on the TuSimple and CULane datasets and prove that the method can detect lanes in the image efficiently with 110 frame-per-second (FPS) and accurately at 97.08%.

The emergence of containers dramatically simplifies and facilitates the development and deployment of applications. More and more enterprises deploy their applications on the container cloud platform. For cloud service providers, an effective container workload prediction method is a must to achieve efficient utilization of cloud resources. However, the existing methods are either rarely based on container load characteristics or cannot make accurate real-time predictions. In this paper, we propose a Docker container workload proactive prediction method using a hybrid model combining triple exponential smoothing and long short-term memory (LSTM), which not only can capture both short-term and long-term dependencies in container resource time series but also smooth the container resource utilization data. In order to improve the prediction accuracy of the hybrid model, those two single models are combined using the mean absolute percentage error (MAPE) method. Besides, we design a real-time Docker workload prediction system for the hybrid model. Our experiments show that the mean absolute percentage error of the hybrid model is decreased by an average of 3.24%, 12.18%, 13.42%, 43.45%, and 50.69% compared with the LSTM, the triple exponential smoothing, ES-ARIMA, Bayesian Ridge Regression and BiLSTM with an acceptable time and computational cost overhead.

In mobile crowd sensing, the mobile terminal integrates a variety of widely distributed sensing devices and communication ports. Sensing devices and communication ports can collect and share all kinds of perception data. However, inherent contradictions exist among perceived ability, communication port, and moving rule while collecting real-time and accurate sensing information. This article mainly focused on recruited and selected mobile nodes and assigned sensing tasks to improve the quality of sensing information. The optimization of the implementation stage of the sensing task is beyond the scope of this study. This article proposes a utility-based sensing task decomposition and subcontract algorithm, which is a method of sensing data acquisition that establishes direct collaboration between mobile nodes. A mobility model based on Markov chain is established to forecast the spatial distribution of sensing nodes. A utility function is designed to estimate the sensing task execution capacity of sensing nodes based on spatial distribution and tempo-spatial coverage of the collected data. The sensing tasks are then decomposed and subcontracted to neighboring nodes according to the utilities of the neighboring nodes to the decomposed sensing tasks. This method improves the quality of sensing data in terms of sensing data coverage and finished ratio of sensing task.

It is increasingly important and a big challenge to detect intrusion behavior variants in today's world. Previous host-based intrusion detection methods typically explore the sequence of system calls or unix shell commands to detect the intrusion behavior. This article abstracts the detection of intrusion behavior variants as the comparison between different sequences when the sequence order or length transforms. To overcome the impact of sequence transformation on the detection accuracy, we propose P-Gaussian, a provenance-based Gaussian distribution detection scheme which comprises two key design features: (1) it utilizes provenance to describe and identify intrusion behavior variants, and eliminates the impact of sequence order transformation on the detection accuracy. (2) it adopts Gaussian distribution principle to accurately compute the similarity between intrusion behavior and its variant, and eliminates the impact of intrusion behavior sequence length increase on the detection accuracy. To improve the detection performance, P-Gaussian employs a Redis memory database with multiple Redis instances and multiple threads to enable the parallelism of provenance processing in multi-core environments. It also classifies hot and cold provenance to provide high-efficient long-term forensic analysis. Experimental results on widely-used real world applications demonstrate the performance and efficiency of our system.

Noise is a major issue influencing quantitative analysis in diffusion MRI. The effects of noise can be reduced by repeated acquisitions, but this leads to long acquisition times that can be unrealistic in clinical settings. For this reason, post-acquisition denoising methods have been widely used to improve SNR. Among existing methods, non-local means (NLM) has been shown to produce good image quality with edge preservation. However, currently the application of NLM to diffusion MRI has been mostly focused on the spatial space (i.e., the x -space), despite the fact that diffusion data live in a combined space consisting of the x -space and the q -space (i.e., the space of wavevectors). In this paper, we propose to extend NLM to both x -space and q -space. We show how patch-matching, as required in NLM, can be performed concurrently in x - q space with the help of azimuthal equidistant projection and rotation invariant features. Extensive experiments on both synthetic and real data confirm that the proposed x - q space NLM (XQ-NLM) outperforms the classic NLM. These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

This article demonstrates how to use multiple channels to improve communication performance in Wireless Sensor Networks (WSNs). We first investigate multichannel realities in WSNs through intensive empirical experiments with Micaz motes. Our study shows that current multichannel protocols are not suitable for WSNs because of the small number of available channels and unavoidable time errors found in real networks. With these observations, we propose a novel tree-based, multichannel scheme for data collection applications, which allocates channels to disjoint trees and exploits parallel transmissions among trees. In order to minimize interference within trees, we define a new channel assignment problem that is proven NP-complete. Then, we propose a greedy channel allocation algorithm that outperforms other schemes in dense networks with a small number of channels. We implement our protocol, called the Tree-based, Multichannel Protocol (TMCP), in a real testbed. To adjust to networks with link quality heterogeneity, an extension of TMCP is also proposed. Through both simulation and real experiments, we show that TMCP can significantly improve network throughput and reduce packet losses. More important, evaluation results show that TMCP better accommodates multichannel realities found in WSNs than other multichannel protocols.

Many applications in wireless sensor networks require communication performance that is both consistent and of high quality. Unfortunately, performance of current network protocols can vary significantly because of various interferences and environmental changes. Current protocols estimate link quality based on the reception of probe packets over a short time period. This method is neither efficient nor accurate enough to capture the dramatic variations of link quality. Therefore, we propose a link metric called competence that characterizes links over a longer period of time. We combine competence with current short-term estimations in routing algorithm designs. To further improve network performance, we have designed a distributed route maintenance framework based on feedback control solutions. This framework allows every link along an end-to-end (E2E) path to adjust its link protocol parameters, such as transmission power and number of retransmissions, to ensure specified E2E reliability and latency under dynamic link qualities. Our solutions are evaluated in both extensive simulations and real system experiments. In real system evaluations with 48 T-Motes, our overall solution improves E2E packet delivery ratio over existing solutions by up to 40% while reducing transmission energy consumption by up to 22%. Importantly, our solution also achieves more stable and better transient performance than current approaches.

As wireless devices and sensors are increasingly deployed on people, researchers have begun to focus on wireless body-area networks. Applications of wireless body sensor networks include healthcare, entertainment, and personal assistance, in which sensors collect physiological and activity data from people and their environments. In these body sensor networks, quality of service is needed to provide reliable data communication over prioritized data streams. This article proposes BodyQoS, the first running QoS system demonstrated on an emulated body sensor network. BodyQoS adopts an asymmetric architecture, in which most processing is done on a resource-rich aggregator, minimizing the load on resource-limited sensor nodes. A virtual MAC is developed in BodyQoS to make it radio-agnostic, allowing a BodyQoS to schedule wireless resources without knowing the implementation details of the underlying MAC protocols. Another unique property of BodyQoS is its ability to provide adaptive resource scheduling. When the effective bandwidth of the channel degrades due to RF interference or body fading effect, BodyQoS adaptively schedules remaining bandwidth to meet QoS requirements. We have implemented BodyQoS in NesC on top of TinyOS, and evaluated its performance on MicaZ devices. Our system performance study shows that BodyQoS delivers significantly improved performance over conventional solutions in combating channel impairment.

Packet collision causes packet loss and wastes resources in wireless networks. It becomes even worse in dense WSNs, due to burst-traffic and congestion around sinks. In this paper, we propose a novel protocol to recover collided packets. Our experiments on a testbed reveal that collisions between long packets and short packets cause a partial error pattern on collided packets, which can be used for efficient recovery. We give a theoretical analysis that demonstrates that combining such collision recovery with CSMA protocols achieves a significant performance improvement. Then, we design ACR, an Active Collision Recovery protocol, which actively converts most potential collisions into LS-collisions, and then applies a lightweight FEC scheme to recover collided packets with such partial error patterns. We implement ACR on a Tmote testbed, and compare its performance with other packet recovery schemes. Results show that ACR significantly reduces the number of retransmissions, and achieves around 25% improvement on transmission efficiency over other schemes.

Continuous and reliable operation of WSNs is notoriously difficult to guarantee due to hardware degradation and environmental changes. In this paper, we propose and demonstrate a methodology for run-time assurance (RTA), in which we validate at run time that a WSN will function correctly, despite any changes to the operating conditions since it was originally designed and deployed. We use program analysis and compiler techniques to facilitate automated testing of a WSN at run time. As a proof of concept, we implemented a framework for designing and automatically testing WSN applications. We evaluate our implementation on a network of 21 TelosB nodes, and compare performance with an existing network health monitoring solution. Our results indicate that in addition to providing the application-level verification function, RTA misses 75% fewer system failures, produces 70% fewer maintenance dispatches, and incurs 33% less messaging overhead than network health monitoring.

Multifrequency media access control has been well understood in general wireless ad hoc networks, while in wireless sensor networks, researchers still focus on single frequency solutions. In wireless sensor networks, each device is typically equipped with a single radio transceiver and applications adopt much smaller packet sizes compared to those in general wireless ad hoc networks. Hence, the multifrequency MAC protocols proposed for general wireless ad hoc networks are not suitable for wireless sensor network applications, which we further demonstrate through our simulation experiments. In this article, we propose MMSN, which takes advantage of multifrequency availability while, at the same time, takes into consideration the restrictions of wireless sensor networks. In MMSN, four frequency assignment options are provided to meet different application requirements. A scalable media access is designed with efficient broadcast support. Also, an optimal nonuniform back-off algorithm is derived and its lightweight approximation is implemented in MMSN, which significantly reduces congestion in the time synchronized media access design. Through extensive experiments, MMSN exhibits the prominent ability to utilize parallel transmissions among neighboring nodes. When multiple physical frequencies are available, it also achieves increased energy efficiency, demonstrating the ability to work against radio interference and the tolerance to a wide range of measured time synchronization errors.

Mobile sensors are widely deployed in Wireless Sensor Networks (WSNs) to satisfy emerging application requirements. Specifically, processing location dependent queries in mobile WSNs is still a challenging problem due to sensor mobility. We present an Event-based Location Dependent Query (ELDQ) model that continuously aggregate data in specific areas around mobile sensors of interests to provide event-based location dependent data services to the users. ELDQs generalize several typical query types and are important in many applications. However, existing approaches are incapable of efficiently answering ELDQs. In this paper, we propose a set of techniques to process ELDQs while optimizing system performance. Cost analysis and simulation results indicate that our techniques greatly reduce the cost of processing ELDQs while achieving relatively high accuracy and short response time.

Many applications in wireless sensor networks require communication performance that is both consistent and high quality. Unfortunately, performance of current network protocols can vary significantly because of various interferences and environmental changes. Current protocols estimate link quality based on the reception of probe packets over a short time period. This method is neither efficient nor accurate enough to capture the dramatic variations of link quality. Therefore, we propose a link metric called competence that characterizes links over a longer period of time. We combine competence with current short term estimations in routing algorithm designs. To further improve network performance we have designed a distributed route maintenance framework based on feedback control solutions. In real system evaluations with 48 T-Motes, our overall solution improves end-to-end packet delivery ratio over existing solutions by up to 40%, while reducing energy consumption by up to 22%. Importantly, our solution also achieves more stable and better transient performance than current approaches.

The current rapid development and deployment of wireless sensor networks (WSNs) and their application in mission critical systems are exacerbating the need for high confidence WSNs. Achieving high confidence WSNs will require new assurance technologies. Most current solutions deal with faults and reliability and not with application level semantics and associated assurances. We propose the use of a novel WSN design and assurance mechanism, run time assurance (RTA), to guarantee that important application-level requirements are met in mission critical applications.

In this paper, we advocate asymmetric function placement as one of guiding principles to architect sensor network systems. We demonstrate its generic applicability and effectiveness by applying this principle to three typical sensor network technologies, namely, localization (Spotlight), sensing (uSense) and communication (mNets). These technologies have very dissimilar features, representing a wide spectrum of system design requirements. We have invested significant effort to design, implement and evaluate our techniques on TinyOS/Mote testbeds. The results from several running systems indicate that asymmetric function placement is a powerful guiding principle to achieveefficiencyandhigh-performancesimultaneously in wireless sensor networks. At the end, we exam the system features that discourage the use of asymmetric function placement and approaches to address them.

This paper demonstrates how to use multiple channels to improve communication performance in Wireless Sensor Networks (WSNs). We first investigate multi-channel realities in WSNs through intensive empirical experiments with Micaz motes. Our study shows that current multi-channel protocols are not suitable for WSNs, because of the small number of available channels and unavoidable time errors found in real networks. With these observations, we propose a novel tree-based multichannel scheme for data collection applications, which allocates channels to disjoint trees and exploits parallel transmissions among trees. In order to minimize interference within trees, we define a new channel assignment problem which is proven NP- complete. Then we propose a greedy channel allocation algorithm which outperforms other schemes in dense networks with a small number of channels.We implement our protocol, called TMCP, in a real testbed. Through both simulation and real experiments, we show that TMCP can significantly improve network throughput and reduce packet losses. More importantly, evaluation results show that TMCP better accommodates multi-channel realities found in WSNs than other multi-channel protocols.

Extensive empirical results reveal that interference can cause link qualities to change quickly and dramatically. For such highly dynamic links, the short term link quality estimations widely used in existing protocols require frequent measurements and may not be accurate. As a result, when these links are selected, end-to-end communication quality varies significantly. Also, route changes occur frequently, introducing traffic oscillation and excessive overhead in network protocols. To achieve good and stable network performance, it is not enough to use short term link estimation. It is essential to characterize a link's capacity to perform well at a desired level in the presence of interference and environmental changes. Therefore, we propose a performance metric called competence. We have incorporated the competence metric into routing algorithm designs. We have also designed and implemented a maintenance framework that stabilizes performance at both link and network layers. This framework allocates the desired performance level among multiple links along an active route by using an end-to-end feedback loop, and enforces the performance level of each link through adaptive transmission power control and retransmission control. In real system evaluations with 48 TMotes, our solution outperforms previous protocols significantly and achieves end-to-end stable performance for more than 99% of the time over 24 hours.

Environmental wireless sensor network (EWSN) systems are deployed in potentially harsh and remote environments where inevitable node and communication failures must be tolerated. LUSTER---Light Under Shrub Thicket for Environmental Research---is a system that meets the challenges of EWSNs using a hierarchical architecture that includes distributed reliable storage, delay-tolerant networking, and deployment time validation techniques.