DDoS attacks have become one of the most severe cybersecurity threats, especially in application-layer attacks. With the emergence of Programmable Data Planes (PDPs), it has become possible to maintain line-rate throughput while achieving high detection rates, making them crucial in addressing DDoS challenges. However, due to the complexity of DDoS attacks, detection remains resource-intensive and overall network defense effectiveness is limited. This limitation becomes particularly pronounced in clustered environments, where coordinated defense is essential. This paper presents SISTAR, an innovative framework for efficient DDoS detection and mitigation using PDP. SISTAR integrates an improved Decision Tree - Constrained Threshold Segmentation (DT-CTS) model to achieve high detection accuracy while minimizing hardware resource usage. Through distributed deployment across multiple switches, SISTAR enhances network resilience by enabling rapid detection and coordinated response to DDoS attacks. We implement a prototype of SISTAR and evaluate its performance in a realistic testbed, the experimental results show that SISTAR surpasses existing models in terms of detection accuracy and resource efficiency. When combined with its alert pushback mechanism, SISTAR can effectively reduce network resource consumption caused by DDoS attacks.

Malicious traffic detection is a critical means to detect network attacks, and plays an essential role in ensuring network security. However, most existing methods only focus on single feature or statistical feature, failing to comprehensively learn traffic information. Moreover, feature extraction remains superficial, resulting in a lack of important details. Thus, this paper proposes a novel malicious traffic detection method, named “DeepBytes”, which consists of original traffic vectorization, feature extraction and fusion, and classification. The original traffic vectorization converts the traffic into vectors. In the feature extraction and fusion phase, we first use the proposed CB-ResNet network to extract deep byte feature, then effectively fuse flow, packet, and byte-level features through the proposed multi-attention algorithm. The traffic classification identifies whether the traffic is malicious and determines its specific type. Extensive experimental results on the ISCXIDS2012 and CICIDS2017 datasets indicate that the detection performance and false alarm of our proposed method achieve 99.96% and 0.01 %, outperforming the state-of-the-art methods. The results also demonstrate that our method has excellent generalization capability and can accurately detect unknown attacks.

High-speed USB is prominently used in electronic devices, such as computers and mass storage devices, where sensitive data may be stored. There are risks of information leakage by conducted compromising emanations during data transmission with high-speed USB devices. Therefore, it is of great significance to research and analyze the security issues of high-speed USB for maintaining information security. However, little research is done on conducted compromising emanations of high-speed USB. In this paper, we propose a method to attack high-speed USB devices by conducted compromising emanations through USB hubs. First, we construct a USB hub-based attack model for high-speed USB devices. Then, we design a filtering mechanism with Kaiser filter to preprocess the collected leakage signal to obtain a cleaner leakage signal. Finally, by decoding and reconstructing the processed signal, the attack on the high-speed USB device is realized. Extensive experiments show that the method proposed in this paper can successfully attack high-speed USB devices, achieving a Bit-level Accuracy of 99.69% and a Character-level Accuracy of 98.04%. This demonstrates that our attack method is effective and verifies the existence of information leakage risk from high-speed USB devices through conducted compromising emanations in USB Hubs.