While existing far memory and disaggregated memory solutions provide a foundation for addressing limitations of single-node memory capacity and inefficient resource allocation in data centers, they predominantly focus on host memory, overlooking the critical demands of GPU-centric workloads. A key bottleneck in scaling GPU memory is the lack of connectivity and interoperability between GPUs, which is exacerbated by their heterogeneity. To bridge this gap, this paper proposes UHM, a unified data transferring and memory pooling scheme for heterogeneous GPU memories. UHM establishes the communication channels between heterogeneous GPU/host memories and leverages double data buffers for pipelined and reliable transfer. Furthermore, UHM unifies both local and remote memories to build a memory pool. The pooling scheme effectively integrates local and remote resources, performs efficient caching management in local memory, and optimizes memory block management for remote memory resources. Evaluation on a heterogeneous GPU cluster demonstrates that UHM significantly reduces the data transfer latency (up to 87.2%), improves the cache hit ratio, reduces runtime memory allocation latency (up to 94.7%), while enhancing the overall memory utilization (24.7%).

System logs provide valuable information for intrusion detection and forensic analysis. To counter cyber attacks, enterprises widely deploy monitoring software and record fine-grained system events within the operating system through system logs. However, system logs can pile up in large quantities as the complex nature of modern computer systems and the covert nature of cyber attacks. Storing system logs efficiently is an important and challenging task. Lossless compression techniques provide an intuitive idea of reducing the size of system logs. Recently, researchers have applied Deep Neural Networks (DNNs) in designing compression strategies, achieving remarkable outcomes. Unfortunately, general-purpose lossless compression methods fail to achieve effective compression due to their inadequate extraction of structural redundancy from system logs. Certain methods opt to add a few preprocessing steps before log compression to enhance compression efficiency. Nevertheless, their RNN-based models face challenges in efficiently utilizing GPU resources and can not handle parallel computation. Therefore, their methods still demand a significant compression time. In this paper, we propose TurboLog, a novel transformer-based compression method specifically designed for system logs. To address the above deficiencies, TurboLog initiates by executing a series of preprocessing steps to reduce the structural redundancy and numerical redundancy within raw logs. Subsequently, Tur-boLog uses a transformer-based probability estimator to model log data in parallel. Finally, TurboLog combines the probability estimation of log data with arithmetic coding to accomplish log compression. We use a large public dataset to evaluate TurboLog. The results show that TurboLog can achieve the highest compression ratio of 65.25×. Furthermore, compared to the state-of-the-art method, TurboLog decreases compression time by 75% while concurrently enhancing the compression ratio by 20%. In conclusion, TurboLog achieves much better space savings than existing methods and points an optional direction for future research.

The detection and analysis of Advanced Persistent Threats (APTs) are pivotal for contemporary network security. Provenance graphs, constructed from audit logs, offer a wealth of contextual information to identify and analyze threats and are popular in APT detection field. However, existing approaches frequently fall short in offering explanatory capabilities for their detection results, placing an additional burden on security analysts. Confronted with coarse-grained detection outcomes, analysts must delve into provenance graphs or audit logs to precisely pinpoint attack entities and events, which can significantly delay the response to threats. In this paper, we propose ProDE, a novel approach that enhances APT detection by providing interpretable results using an encoder-decoder architecture. ProDE initiates the detection process by comparing the encoded representations of the true graph and the predicted graph. Upon detecting abnormalities, the encoder-decoder model is able to decode the encodings into provenance graphs, thereby revealing inconsistencies between the decoded graph and real graph that serve as interpretable results. We evaluate ProDE on two widely used datasets, while taking into account the detection performance, the result shows ProDE can provided the more detailed detection results which provide the interpretation for analysts compared with existing approaches.

Advanced Persistent Threats (APTs) are low-and-slow attack patterns and difficult to detect due to their strong concealment. Recently, provenance-based method demonstrates promising prospect in APT detection. However, existing approaches suffer from following several limitations. First, rule-based models heavily rely on domain-specific knowledges and sophisticated matching mechanism from rules to system logs. Second, current anomaly-based techniques require attack-free data to train model and hard to acquire fine-grained detection results to locate attack events. An important reason for undermining the detection capacity of model is the notorious dependency explosion problem and data imbalance problem. Both of problems make the vector representations of benign events and attack events similar, therefore, the model can not differentiate them well. In this paper, we propose DeepDist, which can enhance the entity vector representation by contrastive learning. In this way, we force the projection of benign and attack entities into different feature regions to improve the detection ability of the model. Then we correlate these detected entities to constitute attack events. During our evaluation against thirteen real APT attack scenarios of two datasets, DeepDist shows the detection results with high accuracy.