Log anomaly detection plays a pivotal role in ensuring system stability and security, particularly in largescale environments characterized by the generation of log data at exceptionally high volumes and velocities. Conventional approaches often struggle to effectively filter log information and fully leverage temporal dynamics, resulting in challenges such as information loss, semantic drift, and heightened computational overhead. To overcome these limitations, we present QYXLAD, an innovative log anomaly detection framework. QYXLAD enhances log representation accuracy by seamlessly integrating temporal and semantic information. It introduces a MPMM(Multi-level Progressive Masking Mechanism)-based Feature Fusion designed to capture temporal dependencies and semantic features across diverse pattern combinations, thereby significantly improving the sensitivity and precision of anomaly detection. Furthermore, QYXLAD utilizes a Mamba-based classifier for anomaly identification. Comprehensive theoretical analysis and empirical evaluations demonstrate that QYXLAD achieves state-of-the-art performance on multiple public log datasets, surpassing existing methods in key metrics such as precision, recall, and F1-score. These results underscore the framework’s efficacy and superiority in addressing log anomaly detection challenges.

DHCP is widely deployed in WLANs to automatically assign IP addresses to WiFi devices when users connect to the WLANs. However, frequent user mobility brings big challenges to the DHCP performance. Recently proposed IP configuration (e.g., IP lease time, size of IP address pool) decisions on DHCP are based on traditional models to study user mobility patterns which lead to poor DHCP performance since the online time of individuals varies due to their personal pReferences and the number of crowds differs spatially and temporally. In this paper, we propose PredHCP, a predictive configuration framework on DHCP to improve the DHCP performance. Specifically, PredHCP utilizes an attention-based recurrent neural network (ARNN) to learn sequential patterns of individual mobility and accurately predicts user online time to ensure the effective IP lease time configuration. Meanwhile, PredHCP introduces a spatio-temporal graph neural network (STGNN) to learn both spatial and temporal dependencies of crowd migration and accurately predict crowd size in each area to ensure effective IP pool configuration. We conduct comprehensive experiments on real network traces for a month to evaluate the performance of PredHCP. Experimental results show that PredHCP can accurately predict user mobility patterns by achieving lower prediction errors. By accurately modeling mobility patterns, PredHCP makes effective IP configuration to ensure high DHCP performance. Large-scale simulation results show that PredHCP can save up to 69% IP addresses and the IP efficiency is 41% which outperforms existing methods by 6%.

Datagram transport layer security (DTLS) protocol is widely used in Internet of Things (IoT) for providing security services. The computational overhead makes it hard to implement DTLS on resource-constrained IoT devices. The two significant costly computations in the DTLS handshake are the Diffie-Hellman (DH) key exchange and the certificate verification. A simplified handshake protocol of DTLS (DTLShps) is proposed to reduce the computational overhead of the IoT devices for a general scenario of end-to-end communications based on software-defined networking (SDN). First, a controller is utilized to generate a symmetric key dynamically, then encrypt and distribute this key to two communicating IoT devices. Second, the certificate verification is shifted from the IoT device to the more powerful controller. Third, the controller replaces the DTLS server to make a cookie exchange with the DTLS client. Furthermore, the BAN logic and the tool Scyther are used to validate the security of our scheme. The performance evaluation shows that not only the computational overhead and the energy consumption in the IoT devices are effectively decreased but also the overall duration of the whole handshake is reduced.

Data leakage prevention (DLP) uses a series of techniques to detect and prevent the sensitive data leakage caused by insider threat. Current detection methods either fail to achieve high accuracy toward transformed data or fail to reduce computational complexity. To ensure high detection accuracy and reduce computational complexity, we propose a Weighted Context Graph Model (WCGM) in this paper. The main goal of WCGM is three folds. First, the weighted context graph is proposed to build the contextual relation of data, based on which sub-graph matching method is used to calculate similarity features between tested data and pre-defined template. Second, machine learning algorithms are used to classify the tested data based on the similarity features of its context graphs. Third, privacy- preserving graph masking method is proposed to protect the data privacy of data holders. Extensive simulation results show that the proposed WCGM is able to achieve significant enhancement in terms of running time and accuracy.

A possible approach to address the ossification of the Internet is to set up multiple virtual networks on top of a single shared physical substrate, and each virtual network can be customized to some specific purposes. However, the current realization of virtualized infrastructure, more specifically, the IaaS cloud and network testbed, suffer from the limited programmability or high cost. To overcome these drawbacks, we propose SDViNet, a solution combining the network virtualization concept applied in IaaS cloud and SDN (Software Defined Network)-based networking testbed. It aims to achieve flexible programmable virtual network abstraction, extend the system at scale and underlying technology easily, and utilize the existing cloud platforms and commercial devices at low-cost. SDViNet is comprised of a centralized server, a set of distributed agents and a central OpenFlow controller, which communicates with the underlying packet delivery fabric. Our prototype implementation and case study show that it is feasible to provide a programmable virtual network in the IaaS cloud, while utilizing the virtualized infrastructure in an extensible and lost-cost way.

Cloud computing is one of the most significant latest efforts in the field of information technology, which may change the way how information services are provisioned. In a Cloud environment, different types of resources need to be virtualized as a collection of Cloud services using virtualization technology. End-users in the Cloud are usually provided with customized Cloud services that involve not only different kinds of computing services but also the networks interconnecting those computing services. Therefore, a set of Cloud computing services and the networking services should be modeled as a composite customized Cloud service. In this paper, we present an improved model for Cloud service provisioning based on our previous Network-Cloud proposal, and propose a procedure with several QoS-aware service selection algorithms for composing different services offered by a Cloud. Our analysis with numerical experiments show that the presented algorithms can select services appropriately that deal with different requirements of service provisioning.

Finding a path that satisfies multiple Quality-of-Service (QoS) requirements is vital to the deployment of current emerged services. However, existing QoS routing algorithms are not very efficient and effective at finding such path. Moreover, few works focus on two or more QoS constraints. In this paper, we propose an effective fully polynomial approximation scheme (FPAS) for multiconstrainted path optimal problem based on the technique of auxiliary graph construction. By employing the nonlinear definition of the path constraint and limited iteration of the FPAS itself, our FPAS can not only achieve the complexity reduction but generate a preferable path as well. We further analyze the Markov properties of the entire network and obtain some key parameters to reflect the routing characteristic. We experiment with different scale of random networks and compare our FPAS against previous well known studies. Our results show that FPAS can find path with lower complexity and better quality.

Recently, the significantly increased IPv6 address length has posed a greater challenge on wire-speed router for packet classification (PC). Most conventional IPv4-based PC algorithms are no longer suitable for IPv6 PC. The performance and capacity of many IPv6 algorithms and classification devices depend upon properties of the IPv6 classifiers. However, there are no publicly available IPv6 real classifiers due to the security and confidentiality reasons. Besides, since IPv6 implementation is still in the initial phase, IPv6 real classifiers at present are too small to depict the feature. Thus, researchers who work on IPv6 PC can only generate synthesized classifiers by ad hoc methods. In response to this problem, we present ClassBenchv6, a suite of tools for benchmarking IPv6 PC algorithms and devices. In this paper, we analyze the intrinsic relationship among the major characteristics of real classifiers and the associated IPv4/IPv6 RFC documents. Based on the analysis, we predict the high-level characteristics for IPv6 classifiers. Our ClassBenchv6 can generate different kinds of classifiers applied to different fields and be used to estimate newly proposed IPv6 PC algorithms comprehensively. It is simple, easy to configure and scalable for further IPv6 deployment. While we have already found ClassBenchv6 to be very useful in our own research, we seek to eliminate the significant access barriers to realistic test vectors and initiate a broader discussion to guide the refinement of the tools. ClassBenchv6 is publicly available at: http://code.google.eom/p/classbenchv6/.

Internet migration from IPv4 to IPv6 has introduced more challenge to IP address lookup problem. Nowadays, some existing address lookup algorithms work well for IPv4 addresses, however, few of them can scale well to IPv6 both in lookup and update speed. As IPv6 uses 128-bit addresses, schemes whose lookup time grows with address length become less attractive. In this paper, a novel level based IPv6 routing lookup algorithm, called level-based routing lookup (LRL) algorithm, is proposed. This proposed algorithm is specially designed based on the extensive research on the characteristics of IPv6 prefix length distribution, which is composed of four levels. Different structures are used for different levels. Intensive experiments have been done to evaluate the algorithm. The results show that the new algorithm excels in following aspects: good support of IPv6, extremely excellent fast lookup speed, stable memory consumption and competitive update speed.

Recently, the significantly increased IPv6 address length has posed a greater challenge on wire-speed router for IP lookup. As a result, even the most efficient IPv4 lookup scheme can not meet the demand in IPv6. In this paper, we make a thorough observation on the characteristic of IPv4/IPv6 routing table and propose a novel division technique for routing table, with which the traditional LPM (longest prefix matching) problem can be changed to an exact matching one for majority prefixes. Based on this technique, we propose a DBH (dynamic binary hash) scheme for dynamic IPv6 routing lookup, which achieves O(log W) (W stands for the address length) lookup performance. Key feature of the new scheme is its ability to have a performance guarantee of 7 hash probes in the worst cast of IPv6 routing lookup, meanwhile it can support incremental update. This makes it more attractive in reality. The performance evaluation has shown that the newly proposed scheme can achieve an average lookup memory access number of 2.7 for current IPv6 lookup. It is below 35% of best existing dynamic algorithm. Besides, the memory cost by the data structure itself is extremely small and the average update memory access number is very few.

Next generation internet protocol, IPv6, has attracted growing attention and has been deploying worldwide. With 128-bit address, IPv6 provides an extremely large address space and poses a great challenge to the routing table lookup algorithms. Today's efficient IPv4 routing table lookup schemes can hardly be competent for IPv6. In this paper, we propose a multi-stage IPv6 routing table lookup algorithm based on a sufficient study on the characteristics of the IPv6 address structure, the IPv6 address allocation policies, and the real world IPv6 backbone BGP routing tables. The proposed algorithm combines the binary tree, the segment table, and the route bucket other than adopting single technique as previous schemes do. Compared with previous algorithms, the proposed algorithm performs faster, occupies less memory, scales better, and supports incremental update.