Recently, Large Language Models (LLMs) based Web Agents have shown significant potential in web understanding and interaction tasks. However, their personalization ability and user experience remain limited by the ambiguity and dynamic nature of user intent, struggling to model diverse user interests and track intent changes over time. To address these challenges, this paper proposes Orion, a novel personalized Web Agent. Orion adopts a global-micro profiling mechanism to balance users' long-term stable preferences and scenario-based needs, and introduces context-aware interest retrieval to enhance personalization. Additionally, we design adaptive profile tracking and proactive disambiguation mechanisms to effectively address the continuous evolution of user intent in multi-turn interactions. Orion is optimized through end-to-end online reinforcement learning, improving personalized reasoning and decision-making ability in real interactive scenarios. Experiments demonstrate that Orion significantly outperforms state-of-the-art baselines in personalized understanding and task efficiency.

QUIC adapts well to complex network situations due to mechanisms such as 0/1-RTT handshake and fast retransmission. It has now become a new star in the era of IoT. However, a phenomenon reveals the security risks of QUIC. Studies indicate that the internet is exposed to an average of four QUIC flood attacks per hour. The efficiency-oriented features of QUIC introduce vulnerabilities, making it particularly susceptible to attacks. In IoT scenarios, protocol security often depends on the design of the protocol itself and the middlewares. However, QUIC's design does not prioritize security as its highest concern and due to the ossification of middleboxes, the server-side defense is the only option. Therefore, we propose the QShield framework to seek breakthroughs from an engineering perspective. Based on the SDN principles, QShield consists of three parts. At the application layer, QUIC applications can utilize this library to implement strategy development and enable data sharing. A user-space library operates as the control layer, facilitating real-time bidirectional data transfers between the kernel and user space via a suite of APIs. In the data layer, QShield core blocks attack packets at the lowest layer of the Linux network protocol stack using eBPF technology. QShield effectively resists client-side attacks, and experimental results show that QShield can reduce the server's CPU usage for processing attack packets by nearly 50%, thereby essentially restoring normal Queries Per Second and bandwidth, reducing the bandwidth amplification by about 68% on the specific QUIC implementation.

In the AIOps realm, precise system state forecasting is essential, particularly within microservices architectures, where may have dynamic deployments, varied call paths, and cascading effects complicate spatio-temporal relationships. Existing time series forecasting methods, which emphasize temporal patterns, fall short in capturing the critical spatial dimensions. Spatio-temporal graph methods, while useful, often overlook temporal trends and the length of forecast horizons. Furthermore, existing research about microservices tends to undervalue the role of network metrics and topological structures in reflecting system dynamics. This paper presents STMformer, a novel model designed for microservices state forecasting, adept at managing multi-node and multivariate time series based on diverse spatio-temporal relationships. It harnesses dynamic network connections and topological insights to model complex spatio-temporal interactions and incorporates a PatchCrossAttention module for global cascading effect analysis. Based on a microservices-based dataset we collect with our developed tool, we demonstrated that STMformer outperformed existing methods, reducing MAE by 8.6% and MSE by 2.2% in forecasting tasks. The source code is available at https://github.com/xuyifeiiie/STMformer.

Cross-modal hashing techniques provide an effective method for large-scale cross-modal search due to their ability to handle multiple data types and their efficient storage and computation performance. To achieve excellent performance, deep supervised cross-modal hashing methods require extensive training data from various classes. However, when new classes emerge in the database, existing cross-modal hashing methods typically need to retrain the image and text encoders and regenerate hash codes for all data, which is impractical for large-scale retrieval systems. In this paper, we introduce an innovative cross-modal incremental hashing framework called Deep Incremental Cross-Modal Hashing Network (DICMHN), which can learn hash codes incrementally. The DICMHN framework is capable of directly learning the hash codes of newly emerging images and texts while maintaining the integrity of existing hash codes. Moreover, this framework ensures the accuracy of query results by modeling the correlation between query images and matching texts, as well as between query texts and matching images, while preserving the distinctions between images and texts. Extensive experiments conducted on multiple cross-modal benchmark datasets demonstrate that our proposed DICMHN framework significantly reduces training time and outperforms existing state-of-the-art methods.

Currently, time series prediction in microservice systems suffers from inaccurate forecasts due to the complex interdependencies and highly dynamic workload characteristics. Traditional small-scale models struggle to understand the temporal patterns embedded within multi-dimensional metrics, leading to suboptimal performance. The advent of large language models (LLMs) offers a promising solution, as their powerful representation learning capabilities can effectively capture these complex temporal patterns. In this study, we propose a novel approach tailored for multi-dimensional time series forecasting in microservice environments. Our method leverages specialized embedding techniques that combine dynamic receptive field convolution and adaptive attention masks to capture temporal dependencies and feature relationships across multiple nodes. Additionally, we fine-tune a pre-trained LLaMA model to enhance its applicability for time series forecasting within microservice contexts. Experimental results demonstrate that our approach achieves higher prediction accuracy compared to baseline methods in different datasets. This research's achievements in time series forecasting provide new insights for downstream tasks such as resource allocation and fault prediction.

As the Internet’s complexity and information volume surge, the need for efficient web automation becomes critical. Traditional web agents struggle with redundant web content, which disrupts their understanding of the environment. They also face inefficiencies in multi-task scenarios due to handcrafted exemplars and encounter error accumulation in long-horizon tasks, exacerbated by web-specific complexities like nested structures and interactive elements. To address these issues, we introduce WebSurfer, a novel web agent designed to filter, learn, and adapt in complex environments. WebSurfer refines task-oriented states for clearer observations and employs an exemplar retrieval and ordering strategy to enhance LLMs’ understanding and adaptability to current tasks. Notably,WebSurfer features a novel web-wise insight feedback mechanism that enables continuous adaptation and strategy refinement. Evaluations demonstrate that WebSurfer outperforms state-of-the-art (SOTA) methods on realistic tasks, achieving higher accuracy and enhancing longterm adaptability.

Large Language Models (LLMs) have demonstrated remarkable performance across various domains, showcasing significant potential for long-term time series forecasting (LTSF), and consequently attracting substantial research interest. In LTSF, temporal decomposition has been widely adopted in existing models, including both Transformer-based and linear models, to enhance predictive capabilities. However, our experiments indicate that a simplistic integration of these decomposition methods into LLMs can lead to overfitting, even though they are effective in traditional models. In this paper, we propose PaSTS, a novel framework designed to integrate decomposition methods into LLMs through a specialized temporal synthesis layer, thereby improving predictive accuracy and mitigating overfitting of LLMs in LTSF tasks. Empirical evaluation of our framework provides evidence supporting the effective integration of LLMs with temporal decomposition techniques. Furthermore, applying our synthesis method to the decomposed series in several traditional models that employ seasonal-trend decomposition demonstrates its adaptability.

Knowledge Distillation, an effective model compression technique, transfers knowledge from a large teacher model to a smaller student model, reducing computational costs while maintaining model performance. In large-scale retrieval tasks, maintaining the consistency of retrieval result rankings is crucial. However, traditional distillation methods focus on aligning the feature vectors extracted by the student model with those of the teacher model, which often fails to preserve ranking consistency in complex retrieval tasks. To address this issue, we propose a reinforcement learning-based multi-teacher knowledge distillation framework to optimize ranking consistency. By incorporating reinforcement learning strategies, the framework dynamically selects and adjusts the weights of multiple teacher models, enabling the student model to better learn from different teachers and accurately maintain retrieval rankings. Experimental results demonstrate that the proposed method significantly improves ranking consistency and retrieval performance on several benchmark datasets.

Relational Triple Extraction (RTE) focuses on extracting triples from sentences, a crucial task in the automatic construction of knowledge graphs. Large Language Models (LLMs) have the ability to automatically extract triples from text through appropriate instructions or fine-tuning. However, due to the bias between LLMs training data and inference data, the previous LLM-based triple extraction method ignores many potentially valuable knowledge and lacks noise filtering, which greatly limits the capability of RTE model. To address these challenges, we propose Candidate Prompt Enhancement and Noise Filtering Relational Triple Extraction Framework Based on Large Language Models (CNRel), which combines small pre-trained language model and LLMs. Specifically, we first utilize a candidate entity pair extraction and filtering block, based on a small pre-trained language model, to extract and refine all possible entity pairs in the text, ensuring the capture of as much valuable information as possible Then, a fine-tuned LLMs such as LLaMA is then used to predict the relationship between the candidate entity pairs and extract as many triples as possible. Finally, Noise Filter block filter the extracted triples through LLMs, and remove the wrong triples, which greatly improve the precision of the RTE model. Experiments on several public datasets show that CNRel achieves state-of-the-art among all previous mainstream relational triple extraction methods, and we conduct a widely ablation experiments to reveal the contribution of each component to the overall performance.

The widespread use of encryption protocols and increasing privacy demands have significantly increased encrypted traffic, creating new challenges for network monitoring and threat detection. Current methods struggle with diverse scenarios and distinguish between subtle traffic patterns within webpages of the same application. To address these challenges, we introduce ANT-ET, an end-to-end multimodal framework designed for fine-grained encrypted webpage traffic fingerprinting. ANT-ET leverages a transformer to model payload semantics and constructs a traffic interaction graph to capture both temporal and spatial characteristics of packet interactions. Additionally, ANT-ET incorporates a gradient reversal layer to improve generalization by facilitating domain-invariant feature learning across related webpages. Experimental results demonstrate ANT-ET’s superior performance compared to various baseline models, which were evaluated using a proprietary encrypted webpage traffic dataset and three public datasets. Ablation studies confirm the effectiveness of different framework components, while sensitivity and complexity analyses further validate ANT-ET’s robustness and flexibility.

Microservice architectures have become mainstream for cloud-native applications, and distributed tracing is widely used to ensure system observability. Trace is essentially an aggregated data with multimodal attributes (e.g., performance metric, invocation log, and topology relationships). Existing methods typically do not adequately consider the complex correlations and interactions between the different modalities of trace, whereas fusing multimodal data into a unified analysis provide the possibility to improve performance. On the other hand, most of the existing methods are trained in an unsupervised manner and cannot utilize historical data. Therefore, this article proposes a trace anomaly detection method using graph-based semi-supervised learning, TraceGSAD. It extracts features of trace from multiple modalities and train an improved message-passing neural network to fuse features for unified modeling and generate a graph-level representation. The end-to-end deep anomaly detection model trained in an semi-supervised manner, using only a small amount of labeled data to achieve superior performance. The evaluation on the microservice benchmarks show that TraceGSAD achieves a high precision, outperforming state-of-the-art trace anomaly detection approaches. It also demonstrates the effectiveness of multimodal fusion analysis as well as the use of empirical data in semi-supervised learning that can significantly improve anomaly detection performance.

The evolution of cloud computing and microservices is gradually supplanting traditional network deployment schemes within data centers. As applications deploy substantial computing resources in data centers, a fierce competition for network services ensues, marked by stringent quality requirements. Simultaneously, safeguarding the time sensitivity of the main flow becomes imperative. However, prevailing container network solutions primarily ensure service quality through scheduling and orchestration, neglecting the influence of computing resources on network service quality under intense resource competition. Consequently, our focus revolves around exploring the preservation of time-sensitive attributes of primary service network links, aiming to enhance the service quality of container networks in highly competitive computing resource environments. This paper introduces a novel container network solution designed to meet the quality of service requirements for time-sensitive data in container networks. Implemented on the Kubernetes platform, this solution establishes an underlay network structure based on Cilium for transmitting network packets requiring performance guarantees and exhibiting time sensitivity. Utilizing eBPF programs with adjusted CPU affinity for packet forwarding, the solution records packets necessitating quality of service guarantees. Network service quality is ensured through algorithms such as Multiqueue Priority, Earliest TxTime First, Enhancements for Scheduled Traffic, etc. The network packets requiring performance guarantees and time sensitivity refer to the TSN (Time-Sensitive Networking) standard. To assess the solution’s effectiveness, we deployed Kubernetes on two directly connected physical servers. Measurements were conducted in scenarios of both idle and highly competitive computing resources, evaluating bandwidth, latency, and jitter of container access packets across different hosts. The results confirm a noteworthy enhancement in container network service quality under highly competitive computing resource environments.

After trading the hardware cost and deployment complexity of inter-microservice communication architecture, the data plane of service mesh has gradually changed from sidecar mode to sidecarless mode. In sidecarless mode, the traffic of microservices need to be processed by zero-trust tunnel, so that the confidentiality, integrity and authentication of application data can be achieved. Thus, the efficiency of zero trust tunnel has a great impact on the performance of inter-microservices communication. However, current zero trust tunnel schemes require additional data transmission and processing, resulting in serious performance degradation. Thus, in this paper, we propose an efficient zero-trust tunnel which is called EZTunnel. Based on a programmable kernel, EZTunnel can execute L4 traffic management and security policies during system calls, thereby improving the communication performance between microservices. Through experiments under different traffic characteristic, we show that EZTunnel can achieve better inter-microservice request response delay, flow completion time and communication bandwidth than current zero-trust tunnel.

In recent years, the integration of Large Language Models (LLMs) with graph neural networks (GNNs) has opened new avenues in handling Text-Attributed Graphs (TAGs). This paper presents a novel approach leveraging LLMs for tackling TAG node classification problems, focusing on text augmentation and structural information enhancement through neighbor information integration. Our method employs a supervised fine-tuning process for LLMs with generated structure-ware rationales that involve structural information from TAGs. Through a combination of structure-aware rationale generation and alignment training, we enhance the learning and integration of graph structural information. We demonstrate the effectiveness of our approach across multiple datasets, showcasing improvements in node classification accuracy. Our contributions include the development of a self-guided approach to generate high-quality rationale text and the fine-tuning of a text embedding model for enhanced graph information understanding, ultimately feeding enriched features into a GNN for final node classification.

The Transport Layer Security (TLS) protocol has been widely used in software-defined perimeter (SDP) to establish secure, encrypted connections between distributed SDP components. To improve communication efficiency of its handshake protocol, the latest TLS standard (i.e., TLS 1.3) introduces a zero round-trip-time (0-RTT) handshake. However, traditional 0-RTT handshake protocols lack a forward secure key exchange scheme, so encrypted data that have already been transmitted could be potentially leaked to attackers after the pre-shared key (PSK) is compromised. To achieve secure TLS handshake with minimal communication cost, several forward secure 0-RTT key exchange schemes based on puncturable encryption were proposed. However, they are not applicable to real world SDP environments, because they either need to pre-store a large number of secret keys in the host onboard phase, or require a large number of complex cryptography operations (e.g., bilinear-pairing) in the access phase. Therefore, to avoid high computational overhead while still maintaining communication efficiency and forward security, a novel 0-RTT key exchange scheme based on efficient puncturable key encapsulation mechanism is proposed in this paper. Experimental results show that, with reasonable (and configurable) memory consumption, the latency performance of the proposed scheme is about 30% better than FFDHE3072, which is a practical 1-RTT key exchange scheme in TLS 1.3.

As Large Language Models (LLMs) continue to enhance their capabilities in multi-agent collaborative applications, the unpredictability of the generative content risks has intensified. Particularly in ongoing interaction scenarios with users, it remains unclear whether there is generative content risk drift over time. In this context, "drift risk" refers to the trend of progressively intensified content risk that emerges during sustained adversarial interactions among LLM agents. Additionally, the high cost associated with constructing complex adversarial environments for agents impedes the transferability of current assessment methods for LLMs to multi-agent adversarial scenarios. In this paper, we introduce a low-cost and lightweight framework for assessing content risk drift of LLMs, named CRDA. This framework, bypassing the need for constructing complex adversarial environments, offers a method that integrates roles and responses memory to guide automatically multi-round adversarial interactions among LLM agents, that is, multiple agents as avatars of a single LLM. In this approach, LLM agents enable the analysis of content risk drift of this LLM. Moreover, we explore the impact of restricted roles and the unsafe content with negative viewpoints in responses memory on the content risk drift of LLMs. Considering the rapid advancement of Chinese LLM capabilities, this study selects real adversarial topics in Chinese and assesses content risk drift of five representative Chinese LLMs. The research finds that these LLMs exhibit significant content risk drift even after a certain safety alignment, showing an initial increase followed by a gradual decrease. As the adversarial process progresses, under restricted roles, agents more effectively breach the model's safety alignment, leading to content risk drift of the LLM. The content drift risk assessment can be quantified specifically by measuring the deterioration rate at which LLM agents deteriorate from positive to negative and analyzing the underlying trends during the automatically multi-round adversarial interactions. In restricted and general roles adversarial interactions, all agents of five Chinese LLMs exhibit an overall average increase of 31.5% and 16.38% in the cumulative deterioration rate respectively by the 10th round, compared to the baseline no-roles adversarial interactions. Finally, we hope that the framework and findings presented in this paper will offer valuable insights for research on safety alignment in LLM agents during adversarial processes.

Microservice has become the mainstream paradigm for developing cloud-native applications, but the intricate interdependencies between microservices and the vast amount of heterogeneous observable data (i.e. metrics, logs and traces) pose challenges for rapid troubleshooting. Several anomaly detection and root cause localization approaches that integrate multi-source data have been proposed. However, they are plagued with issues such as scarcity of high-quality data and insufficient model generalization. This is particularly evident when domain-specific models are trained from scratch for specific tasks. Recently, Large Language Models (LLMs) have shown outstanding capabilities in time series analysis, due to multi-source data generated by distributed microservices exhibit intrinsic spatio-temporal characteristics. In view of this, we propose LLM4MST, an LLM-empowered microservice troubleshooting model. We first unify and represent multi-source data by extracting service invocation graphs, and model dependencies between microservices by using a message-passing based graph neural network to generate graph-level sequences. The graph-level representation is then aligned with the LLM, and the LLM is fine-tuned to capture complex spatio-temporal patterns, generating a global vector that represents the state of microservice system within a timeslot. LLM4MST achieves accurate anomaly detection and root cause localization by jointly training the end-to-end model. Experiments on real datasets show that LLM4MST exhibits excellent performance in both full-sample and few-shot scenarios, demonstrating the powerful ability of LLMs in cross-domain knowledge transfer and few-shot learning.

Cloud computing and microservices are increasingly supplanting traditional network deployment strategies within data centers due to their inherent flexibility in infrastructure management and rapid scalability. Nevertheless, current approaches often fall short in addressing quality of service (QoS) for virtual networks, especially under conditions of intense resource competition. This shortfall prevents the fulfillment of critical services’ requirements for low latency and predictability. To mitigate this challenge, we propose a cloud-native network service architecture designed to deliver consistently low latency and predictable packet arrival times. This architecture dynamically coordinates and reserves computational resources even during high contention periods, thereby maintaining container network QoS and ensuring the stable availability of microservice applications under extreme conditions. We validated the effectiveness of our proposed solution by deploying multiple container nodes across two directly connected servers and establishing a Kubernetes cluster. By launching a large volume of tasks within a constrained time frame, we assessed the container network’s load, latency, and jitter during peak usage periods. Our results indicate that, although our solution exhibits marginally reduced performance compared to the open-source Kubernetes network plugin under low-load conditions, it significantly outperforms the plugin under high-load scenarios. Specifically, when host CPU usage surpasses 90% and memory usage exceeds 80%, the open-source plugin experiences notable packet loss and long-tail latency distributions. In contrast, our solution demonstrates an 84% reduction in jitter compared to the open-source CNI.

Graph anomaly detection aims to identify graph components, e.g., nodes and edges, that deviate significantly from normal distribution. However, we observe that there exist two challenges that degrade the detection performance, i.e., over-smoothing and over-fitting. First, as anomalies are only a small percentage of the entire dataset, the neighboring nodes of anomalous nodes are mostly normal. As a result, after aggregating multi-hops of neighboring nodes, the representations of anomalies are more similar to normal nodes, making them less distinguishable and causing the over-smoothing problem. Second, over-fitting arises from the lack of labels, caused by the high cost of labeling real-world data. In consequence, the supervision information could be insufficient, leading to model over-fitting. To deal with these two challenges, we propose a framework, named CL-GAD, that leverages cross-layer representations for graph anomaly detection. By utilizing information from different hops of neighboring nodes, we could capture the cross-layer information of anomalies, which is distinct from normal nodes, to solve the over-smoothing aggregation problem. To deal with the over-fitting problem, we introduce an alignment training design that enables the utilization of the vast amount of unlabeled data during training. We conduct extensive experiments on real-world datasets to evaluate our framework, and the results demonstrate its superiority over state-of-the-art baselines.

Knowledge Graph Completion (KGC) aims to enrich and complete the knowledge graph by discovering missing information from existing fact triples. However, existing KGC methods often overlook the utilization of structured knowledge within the knowledge base. In this paper, we propose a novel Large Language Models-based Knowledge Graph Completion framework, called SIKGC, which builds the structural information prompt to assist the knowledge graph completion tasks. Specifically, we arrange the triples in the knowledge graph as the sequences of text. By fusing the descriptions of entities, relations and their structural information as task-aware prompts, we input such prompts into large language models and regard the responses as prediction tasks. The experimental results on various public datasets show that the proposed method outperforms all baseline methods for the three knowledge completion tasks and attains state-of-the-art in triple classification. We also demonstrate that fine-tuning the smaller large language models (e.g., Baichuan2-13B, LLaMA2-13B, ChatGLM3-6B) with relevant data markedly enhances their KGC capabilities and significantly outperforms GPT-4.

The rapid rise of social networks has led to a proliferation of fake news, especially those with images. The combination of images and text may confuse users and cause even more negative impact. Exisiting methods for fake news detection either require expert knowledge or large amounts of labeled data. In addition, these methods fails to clarify which part of the multimodal information is misleading or why. In this paper, we present a simple yet efficient Chain-of-thought Prompting method for Multimodal Fake News Detection (CP-FEND). It first finds the closest demonstration samples of the news posts to be detected by a KNN-based approach. Afterwards, we design a logical prompt method including Examination, Inference and Determination stages to guide Large Language Model (LLM) to automatically construct reasoning processes for the authenticity of the samples. Finally, LLM are prompted to derive the authenticity of multimodal news with the guidance of samples and Chain-of-Thought reasoning. A reflective verification is performed to further improve the detection performance through comprehensive evaluation of the original responses. Extentsive experiments on two public datasets have demonstrated the superiority of our method over existing methods.

Existing studies for rumor detection rely heavily on a large number of labeled data to operate in a fully-supervised manner. However, manual data annotation in realistic cases is very expensive and time-consuming. In this paper, we propose a novel self-supervised Relation-Event based Contrastive Learning (RECL) framework for rumor detection to address the above issue. Specifically, we present both the relation-level and event-level augmentation strategies to generate contrastive samples, which capture both the semantics revealed by repost relations and the structural features of rumor events. Moreover, contrastive learning tasks are devised to generate informative graph representations by utilizing self-supervision signals of unlabeled data. Extensive experimental results on real-world datasets demonstrate the effectiveness of our model, especially with limited labeled data.

Few-shot Named Entity Recognition (NER) aims to recognize unseen name entities based on a tiny support set that consists of seen name entities and labels, which is obviously different from traditional supervised NER methods. Contrastive learning has become a popular solution for few-shot NER, which improves the robustness of NER to handle unlabeled entities by learning a similarity metric to measure the semantic similarity between test samples and entity labels. However, existing contrastive learning based NER methods individually learn the word embedding in source and target domains, ignoring connections between entities with the same label and limiting the effectiveness of contrast learning. In this paper, we propose a novel few-shot NER framework that jointly models different domain texts and optimizes a generalized objective of differentiating between words in all stages. The proposed model builds the cross-domain attention layer to enhance the feature representations of words and transfer the entity similarity information from the source domain to the target domain. This significantly reduces the divergence between entities with same label. Experimental results on the largest Few-shot NER dataset show that CDANER significantly outperforms all baseline methods, which verifies the effectiveness and robustness of the proposed model.

Online reviews play a significant role in purchase decisions of consumers by providing feedback information from buyers of products. In order to mislead consumers, opinion spammers are hired to write fake reviews to promote or demote specific products for illegitimate benefits. Existing methods for spam review detection mainly focused on designing manual features, which highly rely on expert knowledge. Although recent works utilized deep learning methods to automatically learn the semantics of reviews through the inherent user-review-product strong relation, they fail to capture the weak relations between reviews at the content, sentiment and temporal levels, which provides various semantic information to expose fake reviews. Moreover, the imbalanced class distribution in spam detection issues makes this work even more challenging. To address the above problems, we propose a novel Weak-Strong Unified Network (WSUN) for opinion spam detection. Multi-level weak relation graphs are constructed to reveal the abnormal behavioral patterns of spammers, which aggregates the semantics of strong relations by graph convolutional networks and extracts comprehensive review representation by utilizing relation-level attention mechanism. In addition, a graph-based over-sampling method is devised to mitigate the impact of imbalanced class distribution. Extensive experimental results on real-world datasets show that our model is more effective than the state-of-the-art methods.

In recent years, the concept of Zero Trust Networks (ZTN) has been proposed to overcome unrealistic security assumptions, e.g., what lies in private networks (such as data centers) is always trusted and safe. In ZTN, no device or user is assumed to be secure, instead all connections have to be authenticated and authorized before being established. Software Defined Perimeter (SDP) is one of the most promising solution for ZTN, where the gateway allows clients to access services only after receiving legitimate Single Packet Authorization (SPA) data. However, existing SDP solutions either (1) need to decouple the SPA from the connection request, resulting in redundant communication processes and impersonation attacks; or (2) need to copy the SPA data to the user space from sniffers, causing the packets to enter the protocol stack repeatedly. Due to the large number of short-lived streams in the data center, inefficiency and insecurity of the SPA process lead to severe connection delays and network attacks (e.g., DDoS). To this end, we propose an eBPF-based Dynamic Perimeter (EDP) to enhance the security and performance of SDP. By using EDP, authentication data can be efficiently embedded into every packet and checked before entering the receiver's protocol stack. Experimental results show that the connection delay of EDP is 80% less than that of the existing state-of-the-art solutions.

Social relations are closely related to each of us and are a crucial part of society. Recognizing the social relationships of people in pictures can improve AI’s understanding of human behavior, thereby facilitating collaborative interactions between computers and humans. Previous work only focused on a single picture, so too little information can be obtained. In this paper, we proposed Picture Reasoning Model(PRM) to achieve relationship classification, which innovatively uses the self-attention method to learn the association between relationships. The association between relationships is at the social level, thus using it to assist relationship recognition can get rid of the problem of insufficient information in a single picture. In addition, the model also adopts a two-stream approach, extracting both characters and global features for getting multiple perspectives information. We conduct extensive experiments on two benchmark datasets PIPA and PISC. Experimental results show that our model has improved the accuracy metric of the datasets compared with SOTA. On the PIPA dataset, the accuracy increases from 64.4% to 65.6%, and on the PISC dataset, the mAP raises from 72.7% to 73.2%, which validates the effectiveness of our proposals.

The Digital Twin Network (DTN) is a key enabling technology for efficient and intelligent network management in modern communication networks. Learning dynamic net-work behaviors at the flow granularity is a core element for realizing DTN with accurate network modelling. However, it is challenging due to the complexity of network architectures and the proliferation of emerging network applications. In this paper, we devise a Packet-Action Sequence Model to represent all possible packets behaviors in a unified way. Besides, we propose a novel and effective algorithm to assess whether the behavior pattern is time dependent or independent by using the temporal characteristics of packets in a network flow, so as to learn the key factors of packets that contribute to network behaviors. Based on two typical scenarios, i.e., packet caching and routing, the experimental results verify that the proposed algorithm can identify network behavior patterns and learn key factors affecting the behaviors with over 99 % accuracy.

Due to the ever-increasing complexity of modern communication networks, network operators are making tremendous efforts on achieving objectives for the network to meet the diversified requirements of many real-world applications. However, network operators are repeatedly taking a lot of time on some common tasks shared by different networks. In order to reduce repetitive human efforts on network management, advanced machine learning paradigms, such as deep reinforcement learning, has received numerous attention in the networking community. Nevertheless, it encounters great difficulty in transferring learned policies to new environments, resulting in new model training and testing for each changed environment setting. To tackle this important issue, in this paper we propose a new framework that is the first of its kind to enable an agent to have transferable knowledge for network management, specifically, for network path selection tasks. Through this framework, an agent can efficiently learn and express the transferable network knowledge for achieving task objectives. Extensive experimental results show that the learned knowledge through the proposed framework can realize some common objectives of path selection tasks across different network environments. In addition, the knowledge learned from one network task can significantly improve the learning performance of another similar but different task.

Virtual network embedding (VNE) that instantiates virtualized networks on a substrate infrastructure, is one of the key research problems for network virtualization. Most existing VNE approaches, however, focus on the current virtual network request (VNR) and treat all VNRs equally, which disregard the long-term impact and waste many resources on the process of embedding infeasible VNRs (i.e., VNRs that cannot be embedded completely). To address these problems, a proactive virtual network embedding algorithm based on hierarchical reinforcement learning, VNE-HRL, is proposed in this paper. Within our framework, the VNE task is performed by a two-level agent that considers both the long-term impact of a VNR and the short-term effect of an embedding action. For each processing, a high-level agent aims to select a currently feasible VNR with the maximum long-term reward from a window-based batch, and a low-level agent is assigned to embed the selected VNR on a substrate infrastructure by performing a series of embedding actions. Extensive simulation results indicate that our algorithm best performance on most metrics compared with existing state-of-the-art solutions, with up to 9.92% and 33.03% improvement on acceptance ratio and average revenue.

In this paper, we focus on protecting the facial privacy for people under the surveillance scenarios, by changing some visual appearances of the faces while keeping them recognizable by the current face recognition systems. This is a challenging problem because we need to retain the most important structures of the captured facial images, while modify the salient facial regions to protect personal privacy. To address this problem, we introduce a novel individual face protection model, which can camouflage the face appearance from the perspective of human visual perception and preserve the identity features of faces used for face authentication. To that end, we develop an encoder-decoder network architecture which can separately disentangle the facial feature representation into an appearance code and an identification code. Specifically, we first randomly divide the input face image into two groups, the source and target sets, where the identity and appearance codes can be correspondingly extracted. Then, we recombine the identity and appearance codes to synthesize a new face, which has the same identity as the source subject. Finally, the synthesized faces are employed to replace the original face to protect the individual privacy. Note that our model is end-to-end with a multi-task loss function, which can better preserve the identity and stabilize the training process. Experiments conducted on Cross-Age Celebrity dataset demonstrate the effectiveness of our model and validate our superiority in terms of visual quality and scalability.

Virtual network embedding arranges virtual network services onto substrate network components. The performance of embedding algorithms determines the effectiveness and efficiency of a virtualized network, making it a critical part of the network virtualization technology. To achieve better performance, the algorithm needs to automatically detect the network status which is complicated and changes in a time-varying manner, and to dynamically provide solutions that can best fit the current network status. However, most existing algorithms fail to provide automatic embedding solutions in an acceptable running time. In this paper, we combine deep reinforcement learning with a novel neural network structure based on graph convolutional networks, and propose a new and efficient algorithm for automatic virtual network embedding. In addition, a parallel reinforcement learning framework is used in training along with a newly-designed multi-objective reward function, which has proven beneficial to the proposed algorithm for automatic embedding of virtual networks. Extensive simulation results under different scenarios show that our algorithm achieves best performance on most metrics compared with the existing state-of-the-art solutions, with upto 39.6% and 70.6% improvement on acceptance ratio and average revenue, respectively. Moreover, the results also demonstrate that the proposed solution possesses good robustness.

Flow watermarking is a promising active traffic tracking technology. It helps to establish the correspondence between the sender and the receiver, by embedding watermarks into packets with certain features of active interference traffic. Existing watermarking technologies have several drawbacks, such as the vulnerability to multi-flow attacks, low robustness and invisibility. This paper proposes a new traffic tracking technique based on hidden Markov model, called Hidden Markov State-based Flow Watermarking (HMSFW). HMSFW divides the observation range, i.e., inter-packet time, as Markov states and uses the State Transition Probability Mean (STPM) as the watermark carrier. It then adjusts the STPM of a given time interval according to historical traffic characteristics. The proposed HMSFW not only improves the robustness of embedded watermarks, but also effectively enhances their invisibility. The feasibility and invisibility of HMSFW are validated via extensive experimental results.

Summary Although IPv6 has been standardized more than 15 years ago, its deployment is still very limited. China has been strongly pushing IPv6, especially due to its limited IPv4 address space. In this paper, we describe measurements from a large Chinese academic network, serving a significant population of IPv6 hosts. We show that despite its expected strength, China is struggling as much as the western world to increase the share of IPv6 traffic. To understand the reasons behind this, we examine the IPv6 applicative ecosystem. We observe a significant IPv6 traffic growth over the past 3 years, with P2P file transfers responsible for more than 80% of the IPv6 traffic, compared with only 15% for IPv4 traffic. Checking the top websites for IPv6 explains the dominance of P2P, with popular P2P trackers appearing systematically among the top visited sites, followed by Chinese popular services (e.g., Tencent), as well as surprisingly popular third‐party analytics including Google. Finally, we compare the throughput of IPv6 and IPv4 flows. We find that a larger share of IPv4 flows get a high‐throughput compared with IPv6 flows, despite IPv6 traffic not being rate limited. We explain this through the limited amount of HTTP traffic in IPv6 and the presence of Web caches in IPv4. Our findings highlight the main issue in IPv6 adoption, that is, the lack of commercial content, which biases the geographic pattern and flow throughput of IPv6 traffic. Copyright © 2014 John Wiley & Sons, Ltd.

TCP suffers from low throughput and high latency because of its expensive timeout based loss recovery mechanism in data center networks (DCNs). In this paper, we propose TCP with Adaptive Complementary Coding (TCP-ACC) to effectively address these problems. Without revising existing TCP congestion control, we first design a light-weight complementary coding scheme to avoid TCP timeout which will result in higher throughput and lower latency. In our scheme, the redundancy setting is adaptive to the real-time packet loss rate. Then we introduce Lyapunov optimization framework to find the optimal number of redundant coding packets for TCP-ACC, and we also prove that TCP-ACC can reduce the flow timeout probability close to that of the optimal complementary coding solution. Extensive NS2 simulations show that, compared with other three solutions for TCP's problems in DCNs, TCP-ACC can reduce the flow completion time by 45% and improve the flow throughput by 40% on average.

In this paper, we propose CGM-PS, a partial-decentralized, un-starving, work-conservative, and preemptive coflow scheduling scheme to shorten the Coflow Completion Time (CCT) for TCP flows in data center networks (DCNs). In CGMPS, we propose both inter- and intra- coflow scheduling policies. In inter-coflow scheduling, we present P-SEBF, which adopts a connected-graph model based novel concept Partialcoflow, to achieve approximate SEBF scheduling in a partial-decentralized manner. In intra-coflow scheduling, we present FP-MDFS to give flow-level priorities and appropriate rates to TCP flows for finishing the coflows as quick as possible without wasting network capacities in a decentralized manner. Trace-based simulation results show that, among existing coflow scheduling schemes, CGM-PS can achieve the minimal CCTs both on average and in the 90th percentile. In brief, CGM-PS only brings about similar scheduling overhead with the decentralized schemes, while it can achieve the CCT performance even better than the near optimal centralized scheme.

Summary OpenFlow has become the key standard and technology for software defined networking, which has been widely adopted in various environments. However, the global deployment of OpenFlow encountered several issues, such as the increasing number of fields and complex structure of flow entries, making the size of flow table in OpenFlow switches explosively grows, which results in hardware implementation difficulty. To this end, this paper presents the modelling on the minimisation for storage space of flow table and proposes a Heuristic Storage space Optimisation algorithm for Flow Table (H‐SOFT) to solve this optimisation problem. The H‐SOFT algorithm degrades the complex and high‐dimensional fields of a flow table into multiple flow tables with simple and low‐dimensional fields based on the coexistence and conflict relationships among fields to release the unused storage space due to blank fields. Extensive simulation experiments demonstrate that the H‐SOFT algorithm can effectively reduce the storage space of flow table. In particular, with frequent updates on flow entries, the storage space compression rate of flow table is stable and can achieve at ~70%. Moreover, in comparison with the optimal solution, the H‐SOFT algorithm can achieve the similar compression rate with much lower execution time. Copyright © 2014 John Wiley & Sons, Ltd.

Mobile IPv6 suffers various limitations, e.g., lack of business model and management of enormous and discrete home agents, preventing it from being deployed in large-scale commercial environments. Recently, the identification/locator (ID/Locator) split architecture has demonstrated its significant predominance in next generation mobile networks. With the aim of pushing the global deployment of mobility support over IPv6, this study makes an effort to design and evaluate an operational mobility model over IPv6 (OMIPv6) based on ID/Locator split architecture. Instead of the home agents adopted in the standard MIPv6, a cloud mobility management center is employed to be responsible for maintaining the identification and locations of mobile hosts, as well as providing the name resolution services to the mobile hosts. Moreover, this paper develops an analytical model considering all possible costs required for the operation of OMIPv6.

The routing scalability and IP address exhaustion are two significant issues the current Internet faces. The "locator/identifier (Loc/ID) split" has become a well recognized design principle for future Internet architectures that make Internet routing more scalable. In this paper, a novel Loc/ID split routing and addressing architecture called IPv4+6 is proposed. It not only solves the routing scalability problem but also expands the IP address space. It is easy to deploy, which only needs to make simple changes on DNS and gateway router.