Authentication and Key Agreement (AKA) are essential for UAV networks operating in open and hostile environments, as they assist in preventing common threats such as impersonation and replay attacks. However, traditional protocols often rely on a centralized server for key and identity management, creating risks of key leakage and a single point of failure. To address these issues, we propose a blockchain-based decentralized authentication mechanism that remains effective even under partial node compromise. Our design adopts Physical Unclonable Functions (PUFs) in place of key-based authentication to mitigate key leakage risk. To mitigate machine learning (ML) attacks inherent in existing PUF-based protocols, we design a lightweight Encrypted Randomized Challenge-Response Pair (ERCRP) structure, which incorporates external randomness to obfuscate underlying PUF mapping. Meanwhile, to address CRP leakage in prior centralized schemes, we combine Shamir's Secret Sharing and blockchain for secure CRP management. Specially, we introduce a decoupled design that separates interaction-intensive secret reconstruction process from blockchain consensus to ensure high efficiency. Finally, we develop a lightweight commitment-based management mechanism to prevent unauthorized CRP consumption and reuse from malicious authentication attempts. Additionally, the protocol provides UAV identity untraceability via dynamic identity updates. Comprehensive formal and informal security analyses, together with comparative performance evaluations, demonstrate the protocol's strong security guarantees and practical efficiency.

Network asset auditing constitutes a systematic assessment of organizational IT infrastructures, encompassing comprehensive identification of active hosts, operating systems, and service configurations. This foundational process plays a pivotal role in discovering and managing potential vulnerabilities that adversaries may exploit. While various existing network scanning tools (e.g., Nmap, Masscan, ZMap) provide elementary auditing capabilities, their efficacy is fundamentally constrained in detecting devices/services concealed behind Network Address Translation (NAT) gateways. To address this critical limitation, we propose DMIF (Detection framework based on Multiple Inherent Fingerprints), which introduces two methodological innovations: (1) a frequency domain analytical approach for extracting inherent traffic characteristics, and (2) an adaptive multi-fingerprint aggregation mechanism. Our DMIF builds upon the key observation that different hosts and different operating systems exhibit distinctive traffic fingerprints stemming from their hardware architectures and protocol implementations. The framework’s feature extraction module employs spectral analysis to capture these device-specific patterns, while the fingerprint aggregation module dynamically optimizes weight assignments across multiple fingerprint dimensions through machine learning techniques. We evaluate DMIF in two scenarios and consider the effects of network fluctuations and user behaviors. Experimental results demonstrate that DMIF’s detection F1 score exceeds 0.91 for a wide range of device types, including personal computers, mobile phones, and IoT devices.

Malicious traffic detection is an important technique for network management, assisting network administrators in identifying malicious hosts and activities. With the growing proportion of encrypted traffic, recent studies incorporate Machine Learning (ML) and Deep Learning (DL) methods. These methods can achieve effective classification but rely heavily on large-scale and high-quality datasets. Due to the coarse-grained traffic collection at the level of hosts or switches in existing datasets, the introduction of noisy traffic degrades the performance of malicious traffic detection models. In this paper, to tackle the efficacy challenge caused by noisy traffic, we propose a traffic dataset purification framework named PureFlow. Specifically, PureFlow adopts an unsupervised clustering algorithm to categorize the collected traffic based on their sources, and thus overcome the feature confusion caused by mixing noisy traffic from different sources. With a set of autoencoders based on reconstruction loss, PureFlow can distinguish the feature differences between noisy and valid traffic. We conduct extensive experiments on public datasets. The results show that PureFlow can effectively filter noisy traffic and significantly enhance the performance of several malicious traffic detection models without additional modifications, achieving average accuracy and F1-score improvements of 5.58% and 0.056, respectively.

In recent years, most botnets have utilized Domain Generation Algorithms (DGAs) to dynamically generate domains to establish communication with Command and Control (C&C) servers, enabling malicious activities. However, recent research mainly proposes methods based on labeled DGA domain datasets that already yield high detection rates, but cannot be applied directly to realistic network environments. In this paper, we propose a novel hybrid threshold-behavior analysis system that examines and processes network traffic in several layers to detect DGA domains precisely. Our system incorporates a multi-level filtering approach that dramatically increases the precision of domain identification. At the system’s center lies its innovative hybrid threshold-behavior analysis framework, which employs a cascaded filtering process to enhance malicious domain identification while efficiently preserving computational resources. To address the issue of separating highly random DGA domains from their legitimate ones, we utilize adaptive thresholding combined with contextual analysis of domain query patterns to enable stealthy DGA domain detection. We test on realistic network traffic datasets to verify the performance of our system. The experiments show that our system has a 97.88% recall rate for labeled DGA domains and can correctly identify a huge number of previously unlabeled DGA domains, demonstrating its effectiveness and feasibility.

With the continuous evolution of web application attack techniques, attackers have widely adopted fuzzing-based penetration testing. However, traditional rule-based feature-matching detection mechanisms and machine learning-based detection systems face challenges including ineffective malicious traffic with local mutations, complex and time-consuming model training, and excessive server load. This paper introduces Fuzzydetect, a novel detection framework for identifying malicious HTTP fuzzing traffic. It applies a sliding window mechanism to segment network traffic and uses fuzzy hashing to capture similarity patterns in consecutive packets and compute similarity scores, utilizing Support Vector Machine (SVM) to distinguish malicious activity from benign traffic. We conduct comprehensive experiments using mainstream datasets to evaluate our system with existing solutions. Experimental results demonstrate that the proposed system achieves a True Positive Rate of 99.64%, accuracy of 98.2%, and F1-score of 0.9867, with a faster processing speed that satisfies real-time detection requirements.

Network probing serves as a potent technique in network security protection, enabling the effective identification of dangerous devices and potential threats. This paper focuses on network probing against Network Address Translation (NAT) hidden networks, especially for campus or public networks. However, it is noted that the traditional active probing techniques usually need to inject probes into the network, posing a challenge in public network scenarios. Moreover, current passive techniques cannot achieve high accuracy, low computational resources, and real-time requirements simultaneously. To this end, we design a host probing system named Hostprober for NAT networks based on Network Time Protocol (NTP) traffic analysis. Leveraging the widely used and featured NTP traffic, the Hostprober can identify the NTP traffic fingerprints by normalizing polling intervals and dynamically adjusting the time window. Based on the captured fingerprints, the Hostprober can reorganize the NTP traffic into traffic sets corresponding to different hosts, and match the NTP traffic to the models to achieve the purpose of host detection and network probing. Furthermore, we evaluate our proposed internal network probing method in both a controlled virtual environment and a real network environment, comparing it with other baselines. The evaluation results show that our approach demonstrates good accuracy and outperforms other comparison methods.

Multi-factor authentication (MFA) has become an essential method for enhancing security in authentication procedures by leveraging multi-dimensional authentication anchors, such as Biometrics-Based Authentication and One-time Password (OTP). However, MFA usually triggers for each login attempt and significantly impacts user usability. To this end, Risk-Based Authentication (RBA) is developed to achieve a better balance between user usability and security by dynamically checking the user authentication information. Opposite to the previous RBA designs that leverage static rules, this paper introduces Dynamic User Behavior Authentication (DUBA), an enhanced RBA design proposed to further improve both security and user experience. Our design uses probabilistic statistical methods to evaluate and score user behaviors. In this, authentication procedures can be dynamically adjusted in response to real-time user patterns and potential threats. Besides, DUBA introduces the weight adjust scheme that can efficiently defend against malicious behavior while improving usability, utilizing multi-dimensional behavioral data, such as login frequency, device information, and geographic location. We implement DUBA and evaluate its effectiveness by integrating it into the actual Single Sign-On (SSO) system in use on our campus. The results show that DUBA significantly reduces false positives and strengthens defenses against identity impersonation attacks.

The rapid growth of blockchain-based decentralized applications (DApps) highlights blockchain's potential to enhance application security. However, expensive on-chain data storage limits the deployment of DApps with large datasets. Additionally, DApp development tools, such as Ethereum smart contracts, lack support for complex queries, further hindering dataintensive DApps. To address the challenges of expensive storage and inability of complex queries, we propose ContractDB, a framework that integrates external verifiable databases (VDBs) with blockchain DApps. ContractDB offloads data storage and processing to VDBs, thereby reducing on-chain storage costs and enhancing data handling capabilities. Existing VDBs incur high verification costs and lack support for public verifiable update. In this paper, we propose a novel VDB design using authenticated dictionaries and authenticated set operations to reduce verification cost and enable verifiable updates. Performance evaluations show that ContractDB can verify the results of 6-condition conjunction (with mixed equivalent and range) queries on a 220-line data table within 2.4 million gas cost, with potential for optimization. For comparison, storing those data in contracts requires over 36 billion gas and still cannot support range or multi-condition queries. Therefore, the proposed ContractDB makes it feasible to support DApps with large datasets.

Malicious traffic detection has gained increasing importance in network security research due to its potential for detecting network attacks in real time. Currently, malicious traffic detection methods primarily rely on either a single feature or a single model architecture. This limitation often leads to high false positive rates when deployed in complex open environments and constrains their capability to handle diverse types of malicious traffic effectively. To address these challenges, in this paper, we propose a novel hybrid model that leverages feature fusion and attention mechanisms to enhance the accuracy of malicious traffic detection. Specifically, we first employ both Decision Tree (DT) and Random Forest (RF) models to extract traffic features. Their predictions are then fused using a stacking method to enrich the feature representation. Subsequently, a Multilayer Perceptron (MLP) is introduced as the meta-learner, with a self-attention mechanism incorporated into its hidden layer to dynamically optimize feature weight allocation, thereby enabling the model to focus more accurately on key traffic features. Extensive experiments were conducted using the CICIDS2017 and CICIDS2018 datasets. The experimental results demonstrate that our proposed model, which combines feature fusion and attention mechanisms, achieves significantly superior detection performance compared to traditional singlemodel approaches, particularly in terms of precision, recall, and F1-score.

Entanglement distribution between distant quantum nodes plays an important role in quantum networks. However, due to the unique properties of quantum mechanics and hardware limitations, entanglement resources in quantum networks are scarce. Quantum links that fail to meet request demands become bottleneck links, significantly hindering remote entanglement distribution in multi-request scenarios. In this paper, we propose an entanglement routing scheme called SwappingBoost that can effectively reduce resource consumption along entanglement distribution paths, alleviating the negative impact of bottleneck links. SwappingBoost first employs a decreasing resource reservation method to compensate for resource losses caused by failed entanglement swapping, freeing up pre-reserved resources on downstream links to accommodate other paths and requests. Besides, SwappingBoost introduces a path-priority-based rounding algorithm that achieves integer-level resource allocation while ensuring balanced resource allocation. Extensive simulation results demonstrate that SwappingBoost can effectively reduce the load of bottleneck links, enhancing network throughput while maintaining fairness among multiple requests.

A Link Flooding Attack (LFA) is a type of link-aimed Distributed Denial of Service (DDoS) attack that can overwhelm the Internet critical links to cut off connections with lots of low-rate, seemingly benign traffic. To defend against such threats, a promising solution involves mitigating the attack through load balancing. However, adaptive attacks employ two effective means to circumvent existing load balancing strategies. The first is the frequent changing of targets, known as rolling attacks. Rolling attacks exploit the delay between attack detection feedback and the mitigation of load balancing, depleting the defender’s resources. The second is the strategical selection of target links to create the worst-case scenario for load balancing algorithms. To address these challenges, we propose LinkDam. Specifically, LinkDam adopts a proactive approach by tracking and predicting potential victim links, providing defense against all targets of rolling attacks. Subsequently, we introduce a robust load balancing strategy to prevent the exploitation of selected link combinations. Additionally, LinkDam introduces a partial deployment approach, demanding a mere 40% of nodes be programmable (i.e., SDN nodes) while maintaining an acceptable 10% performance reduction from the maximum achievable. The experimental results indicate that LinkDam surpasses an 80% accuracy threshold, and exhibits a 57% higher tolerance to attack budgets compared to state-of-the-art solutions.

Link-flooding attacks (LFAs) pose a significant challenge to Internet availability by attacking critical network links with high volumes of seemingly legitimate traffic. In response, researchers have developed network topology obfuscation (NTO) to safeguard critical links. However, state-of-the-art NTO defenses are coarse-grained, leading to less efficient security and usability. In addition, once under attack, NTO schemes cannot identify the attacker’s bot and launch counter-defensive measures. To address these issues, this paper introduces SpiderNet, which employs advanced obfuscation techniques to secure critical links while using strategically created honeypot links for effective bot identification. When adversaries probe the network, SpiderNet captures their probing behavior and deliberately feeds back misinformation about honeypot links. By analyzing the attack patterns directed at these decoy targets, SpiderNet correlates them with adversarial probing activities to effectively identify the bots. Our experiments demonstrate that SpiderNet is more robust than state-of-the-art NTO schemes in terms of security and usability, while also being capable of identifying LFA bots.

Quantum networks, which work by establishing entanglement between distant quantum end nodes (known as end-to-end entanglement distribution), are the promising infrastructure for quantum applications. However, the inherent loss in quantum channels and quantum decoherence contribute to the scarcity of entanglement resources in quantum networks. Consequently, there is an inevitable gap between available entanglement resources and requests’ demands, significantly hindering concurrent end-to-end entanglement distributions. In this paper, we present NarrowGap, an end-to-end entanglement distribution design that can alleviate the negative impact of entanglement resource scarcity on the request service capability of quantum networks. At the heart of NarrowGap, the resource transfer scheme (RTS) is designed to transfer idle entanglement resources to boost the bottlenecks’ capacities based on the unique feature of entanglement swapping, thus narrowing the gap between available entanglement resources and requests’ demands for end-to-end entanglements. Besides, NarrowGap presents a resource allocation scheme (RAS) to guarantee fairness, considering both the success probability of end-to-end entanglement distribution and each request’s demand, to address resource competition in bottlenecks. Extensive simulations demonstrate that NarrowGap outperforms three representative schemes and can achieve more than twice the performance improvement in request service rate.

Nowadays, Quantum Key Distribution (QKD) has garnered widespread attention due to its ability to provide symmetric secret keys with information-theoretic security in point-to-point communication. Additionally, key relay technology has been introduced to complete end-to-end key distribution between remote parties by consuming keys in the intermediate links. The routing problem of selecting paths for key relay technology becomes crucial as it directly impacts the network's performance. In this paper, we focus on addressing the routing problem for a specific scenario to serve applications with real-time requirements. Real-time is a critical necessity for supporting various applications, such as video chatting and calling. To satisfy real-time requirements and achieve Quality of Service (QoS) provision to guarantee the completion time, we introduce a distributed routing protocol called Distributed Routing Protocol Based on Key Reservation (Q-RoKR). It reserves keys in advance along the selected path, thereby satisfying real-time requirements. We also propose a priority-awareness mechanism to address resource competition and make efficient use of keys in links. Extensive experiments demonstrate that our protocol effectively meets the real-time requirements and significantly improves throughput. Furthermore, our key efficiency approaches the optimal bound when compared to other comparison schemes.

Remote entanglement distribution in an efficient and reliable manner, especially in the context of a large-scale quantum network with multiple requests, remains an unsolved challenge. The key difficulties lie in achieving spontaneous and precise control over the entanglement distribution procedure, as multiple nodes need to reach a consensus on how to perform it. From the network aspect, allocating link-layer entangled pairs as resources to achieve high efficiency is also challenging. To address these issues, we propose a decentralized Reliable Entanglement Distribution Protocol (REDP) for large-scale networks. The protocol operates in a Forward-Backward Propagation (FBP) manner, where consensus is reached hop-by-hop and disseminated to all nodes on the path. We further use probabilistic analysis and quasi-static modeling to seek the fairness and efficiency of the network based on the above transmission model. Accordingly, we introduce a Source Window Strategy (SWS) and an Entanglement Allocation Strategy (EAS) to assign sending windows and allocate resources for multiple requests, ensuring a high level of fairness and efficiency from a network perspective. Through systematic simulations involving both classical and quantum communication protocols, we demonstrate that REDP outperforms existing approaches in terms of fairness, throughput, and fidelity performance.

The quantum network that allows users to communicate in a quantum way will be available in the foreseeable future. The network capable of distributing Bell state entangled pairs faces many challenges due to entanglement decoherence and limited network performance, especially when the network scale is enormous. Many entanglement distribution protocols have been proposed so far, and most of them are in a centralized and synchronized manner, which may be infeasible in large-scale networks. As such, in this paper, we propose a full spontaneous version of quantum networks in which the quantum nodes autonomously manage multiple entanglement distribution requests. However, one major issue is that quantum nodes have little knowledge about the network, especially the congestion (e.g., some nodes may have no usable quantum memories). We present a routing algorithm to adaptive evaluate the congestion on the neighbor nodes to avoid potential congestion. We use SimQN, the new network layer simulation platform built by our research team, to evaluate our proposed design. The result demonstrates that it can adapt to changes in network resources and reduce the drop rate that eventually leads to a higher entanglement distribution rate but remains fair for multiple requests to use the network resources fairly and achieve a more balanced throughput.

Bluetooth is a short-range wireless communication technology widely used by billions of personal computing, IoT, peripheral, and wearable devices. Bluetooth devices exchange commands and data, such as keyboard/mouse inputs, audio, and files, through a secure communication channel that is established through a pairing process. Due to the sensitivity of those commands and data, security mechanisms, such as encryption, authentication, and authorization, have been developed and adopted in the standards. Nevertheless, vulnerabilities continue to be discovered.

Remote entanglement distribution plays a crucial role in large-scale quantum networks, and the key enabler for entanglement distribution is quantum routers (or repeaters) that can extend the entanglement transmission distance. However, the performance of quantum routers is far from perfect yet. Amongst the causes, the limited quantum memories in quantum routers largely affect the rate and efficiency of entanglement distribution. To overcome this challenge, this paper presents a new modeling for the maximization of entanglement distribution rate (EDR) on a memory-limited path, which is then transformed into entanglement generation and swapping sub-problems. We propose a greedy algorithm for short-distance entanglement generation so that the quantum memories can be efficiently used. As for the entanglement swapping sub-problem, we model it using an Entanglement Graph (EG), whose solution is yet found to be at least NP-complete. In light of it, we propose a heuristic algorithm by dividing the original EG into several sub-problems, each of which can be solved using dynamic programming (DP) in polynomial time. By conducting simulations, the results show that our proposed scheme can achieve a high EDR, and the developed algorithm has a polynomial-time upper bound and reasonable average runtime complexity.