Deep Packet Inspection (DPI) faces significant bottlenecks in regular expression (regex) matching due to escalating rule complexity and traffic volume. Existing FPGA-based solutions inefficiently process all packets through every automaton, incurring substantial resource overhead. This article proposes OD-REM, an on-demand regex matching architecture for FPGAs that dramatically improves efficiency. In addition to this novel architecture, OD-REM also introduces three innovations: (1) A Counter-Enabled Fast Reconfigurable Automaton (cFRA) compresses regex states by 97.5% via counting semantics, eliminating state explosion for bounded repetitions; (2) A Ring Queue (RQ) scheduler dynamically dispatches packets only to automata relevant to their candidate rules (identified via pre-filtering); (3) A modular pipeline for per-packet, on-chip run-time reconfiguration. Implemented on a Xilinx VU9P FPGA with 32 parallel cFRAs, OD-REM achieves 41.18 Gbps throughput—roughly 3× to 40× higher than the similar works while still performing a full reconfiguration on every packet. It reduces packet latency by 3.73 µs versus sliding-window scheduling. Integrated with Pigasus, OD-REM offloads complex rules, accelerating Hyperscan software matching by up to 37×. This work demonstrates FPGA-centric regex matching as a scalable, high-throughput solution for modern DPI systems.

Holographic-type communication brings an immersive tele-holography experience by delivering holographic contents to users. As the direct representation of holographic contents, hologram videos are naturally three-dimensional representation, which consist of a huge volume of data. Advanced multi-connectivity (MC) millimeter-wave (mmWave) networks are now available to transmit hologram videos by providing the necessary bandwidth. However, the existing link selection schemes in MC-based mmWave networks neglect the source content characteristics of hologram videos and the coordination among the parameters of different protocol layers in each link, leading to sub-optimal streaming performance. To address this issue, we propose a cross-layer-optimized link selection scheme for hologram video streaming over mmWave networks. This scheme optimizes link selection by jointly adjusting the video coding bitrate, the modulation and channel coding schemes (MCS), and link power allocation to minimize the end-to-end hologram distortion while guaranteeing the synchronization and quality balance between real and imaginary components of the hologram. Results show that the proposed scheme can effectively improve the hologram video streaming performance in terms of PSNR by 1.2 dB to$\mathbf{6. 4 d B}$against the non-cross-layer scheme.

Machine learning and deep learning methods have been widely used in network intrusion detection, most of which are supervised intrusion detection methods, which need to train a lot of marked data. However, in some cases, a small amount of exception data is hidden in a large amount of exception data, making methods that require a large amount of the same markup data to learn features invalid. In order to solve this problem, this paper proposes an innovative method of small sample network intrusion detection. The innovation point is that network data is modeled as graph structure to effectively mine the correlation features between data samples, and by comparing the distance similarity, the triplet network structure is used to detect anomalies. The triplet network is composed of triplet graph convolutional neural network which shares the same parameters and is trained by providing triplet samples to the network. Experiments on network traffic datasets CSE-CIC-IDS2018 and UNSW-NB15 as well as system status monitoring datasets verify the effectiveness of the proposed method in network intrusion detection of small samples.

As an important part of intrusion detection, feature selection plays a significant role in improving the performance of intrusion detection. Krill herd (KH) algorithm is an efficient swarm intelligence algorithm with excellent performance in data mining. To solve the problem of low efficiency and high false positive rate in intrusion detection caused by increasing high-dimensional data, an improved krill swarm algorithm based on linear nearest neighbor lasso step (LNNLS-KH) is proposed for feature selection of network intrusion detection. The number of selected features and classification accuracy are introduced into fitness evaluation function of LNNLS-KH algorithm, and the physical diffusion motion of the krill individuals is transformed by a nonlinear method. Meanwhile, the linear nearest neighbor lasso step optimization is performed on the updated krill herd position in order to derive the global optimal solution. Experiments show that the LNNLS-KH algorithm retains 7 features in NSL-KDD dataset and 10.2 features in CICIDS2017 dataset on average, which effectively eliminates redundant features while ensuring high detection accuracy. Compared with the CMPSO, ACO, KH, and IKH algorithms, it reduces features by 44%, 42.86%, 34.88%, and 24.32% in NSL-KDD dataset, and 57.85%, 52.34%, 27.14%, and 25% in CICIDS2017 dataset, respectively. The classification accuracy increased by 10.03% and 5.39%, and the detection rate increased by 8.63% and 5.45%. Time of intrusion detection decreased by 12.41% and 4.03% on average. Furthermore, LNNLS-KH algorithm quickly jumps out of the local optimal solution and shows good performance in the optimal fitness iteration curve, convergence speed, and false positive rate of detection.

When traditional machine learning methods are applied to network intrusion detection, they need to rely on expert knowledge to extract feature vectors in advance, which incurs lack of flexibility and versatility. Recently, deep learning methods have shown superior performance compared with traditional machine learning methods. Deep learning methods can learn the raw data directly, but they are faced with expensive computing cost. To solve this problem, a preprocessing method based on multipacket input unit and compression is proposed, which takes m data packets as the input unit to maximize the retention of information and greatly compresses the raw traffic to shorten the data learning and training time. In our proposed method, the CNN network structure is optimized and the weights of some convolution layers are assigned directly by using the Gabor filter. Experimental results on the benchmark data set show that compared with the existing models, the proposed method improves the detection accuracy by 2.49% and reduces the training time by 62.1%. In addition, the experiments show that the proposed compression method has obvious advantages in detection accuracy and computational efficiency compared with the existing compression methods.

In network virtualization, virtual network embedding is mostly static, which maps each virtual link onto a single predictable path, thus offering a significant advantage for adversaries to eavesdrop or intercept a certain virtual network. However, existing works on multipath embedding just focus on performance and survivability, instead of maximizing the routing unpredictability to avoid link attacks. In this paper, we present a mutable virtual network embedding framework which maps each virtual link onto a set of substrate links with a game-theoretic optimal stochastic routing policy. Firstly, we model the virtual network embedding in the context of stochastic routing with its effectiveness quantified by game theory. Then, in node mapping algorithm, we define a security capacity matrix to evaluate substrate nodes, thus overcoming two disadvantages of existing resource capacity metric. In link mapping algorithm, we work out the optimal stochastic routing policies with satisfying capacity, delay and cycle-free constraints. The simulation results indicate that our framework can significantly improve the probability that packets are not attacked, with little expense of request acceptance ratio and average routing hops.