In recent years, edge computing has undergone significant growth, but ensuring anonymity, efficiency, and auditability in service utilization remains challenging. This paper proposes HACEC, an efficient and auditable anonymous access control scheme for edge computing. HACEC utilizes a dual-token mechanism to achieve anonymity and efficient service utilization. It allows users to access services using temporary identities, without exposing their real identities. We integrate the Trusted Execution Environment (TEE) and threshold cryptography into this mechanism to prevent several attacks. This mechanism not only protects users' identity privacy but also avoids reliance on an always-online cloud, thereby addressing the issue of a single point of failure. Additionally, HACEC proposes an auditable Multi-Authority Attribute-Based Encryption (MABE) scheme and a hierarchical audit mechanism to achieve efficiency and security in audit. The system separates the audit process into data audit and identity tracing. Data audit would not expose users' identities and is performed efficiently through the MABE scheme. Once malicious behaviors are detected, identity tracing can be performed in a threshold manner to retrieve the identities. As a result, HACEC achieves a trade-off between efficiency, security, and auditability. We provide a comprehensive security analysis and performance evaluation to demonstrate the security and efficiency of HACEC.

Traffic analysis plays a pivotal role in network management. However, despite the prevalence of encryption, attackers are still able to deduce privacy elements such as user behavior and OS identification through advanced learning-based methods that exploit side-channel features. Existing defense strategies, which manipulate feature distribution to evade traffic analyzers, are often hampered by the need for impractical decoder deployment across all routes in symmetric framework methods. Moreover, reversing feature distribution modifications to real-time traffic, especially through dummy packet crafting or padding, is a complex task. In response to these challenges, we propose Veil, a novel and practical defender designed to protect live connections against encrypted network traffic analyzers. Leveraging an asymmetric deployment structure, Veil is capable of reconstructing live streams at the packet-block level, thereby allowing for seamless deployment on any connection node while enforcing transmission constraints. By employing a traffic-customized DQN framework, Veil not only reverses statistical feature perturbations back to the traffic space but also directs the distribution towards a target class. Extensive experiments conducted on real-world datasets validate the efficacy of Veil in efficiently evading analyzers in both targeted and untargeted modes, outperforming existing defense mechanisms. Notably, Veil addresses the key issues of impractical decoder deployment and complex real-time traffic manipulation, offering a more viable solution for network traffic privacy protection. The source code is publicly available at https://github.com/SecTeamPolaris/Veil, facilitating further research and application in the field of network security.

In the academic discourse of network management, the identification of unauthorized access and the profiling of mobile devices through network access detection are of paramount importance. The prevalent endpoint-based detection methods, which necessitate the deployment of monitoring software, are fraught with challenges that impede their scalability and applicability across diverse operating systems, often due to prohibitive costs. To surmount these obstacles, we propose NetGuard, a pioneering system that passively discerns network access patterns from gateway-level traffic. Grounded in the innovative Domain Name Forest (dnForest) fingerprinting, NetGuard refines device-specific access patterns through a two-stage distillation algorithm, enhancing the distinctiveness of each device’s digital signature. This refined methodology enables efficient and real-time detection of network access, as evidenced by our experiments in real-world settings. To advance scholarly investigation, we have meticulously compiled the NetCess2023 dataset, encompassing a broad spectrum of mobile devices, and made it publicly available alongside NetGuard prototype at https://github.com/SecTeamPolaris/NetGuard.

Traffic analysis is integral to network management. Despite encryption, attackers can deduce privacy elements such as user behavior and OS identification using advanced learning-based methods that exploit side-channel features. Existing defenses manipulate feature distribution to evade traffic analyzers, but symmetric framework methods require impractical decoder deployment across all routes. Moreover, reversing feature distribution modifications to real-time traffic is complex, especially through dummy packet crafting or padding. To address these issues, we propose Mirage, a practical, asymmetrically deployable live connection defender against encrypted network traffic analyzers. Mirage reconstructs live streams at the packetblock level, allowing deployment on any connection node to enforce transmission constraints. Utilizing a traffic-customized DQN framework, Mirage reverses statistical feature perturbations to traffic space while directing distribution towards a target class. Experiments on real-world datasets show Mirage efficiently evades analyzers in both targeted and untargeted modes, outperforming existing defenses. Code of Mirage is available at11https://github.com/SecTeamPolaris/Mirage.

Identifying malicious traffic is crucial for safeguarding internal networks from privacy breaches.Intrusion Detection Systems (IDS) traditionally rely on inefficient and outdated rule-sets, necessitating a shift towards AI-driven, learning-based algorithms for enhanced detection capabilities.Despite their promise, AI-integrated IDS face deployment challenges due to complex, opaque decision-making processes that can lead to latency and an increased risk of false positives.This paper presents the Explainable AI-based Intrusion Detection System (XAI-IDS), addressing the limitations of both rule-based and AI-driven IDS by integrating interpretable deep learning models.XAI-IDS employs tree regularization to transform complex models into efficient, transparent decision trees, facilitating real-time detection with improved accuracy and explainability.Experiments on two benchmark datasets demonstrate XAI-IDS's superior performance, offering a scalable solution to the challenge of identifying malicious traffic with reduced risk of false positives.

The payment channel is a prominent solution to scale the throughput of decentralized blockchain ledgers. It reduces the load on-chain by enabling off-chain micropayments without exhausting blockchain resources. However, the balance of a channel could become depleted due to payments going in one direction, making subsequent payments in that direction impossible. Several solutions have been proposed in recent years to address this issue. Nevertheless, ensuring both privacy and efficiency while maintaining applicability to edge nodes remains a challenging task. In this paper, we present PCRECHARGE, a solution to revive a depleted payment channel. Its key idea is to recharge the channel by conducting an on-chain payment and a reverse off-chain payment. The main challenge of this solution is to ensure that both payments must be performed atomically. To address this challenge, we conceive a pay-or-refund mechanism and integrate it into PCRECHARGE. It introduces another two transactions pay and refund , enabling an honest party to publish one of them to get his coins back. The most prominent feature of this mechanism lies in its independence from specific scripting and its avoidance of costly cryptographic tools, making it suitable for wide deployment. We provide comprehensive analyses and experimental evaluations to demonstrate the security and high efficiency of PCRECHARGE. Compared to reconstructing a channel, our approach reduces the transaction size by 66% in the honest case and addresses the limitations of current solutions, particularly their poor application to edge nodes.