Efficient adversarial attack methods are critical for assessing the robustness of computer vision models.In this paper, we reconstruct the optimization objective for generating adversarial examples as "maximizing the difference between the non-true labels' probability upper bound and the true label's probability," and propose a gradient-based attack method termed Sequential Difference Maximization (SDM).SDM establishes a three-layer optimization framework of "cycle-stage-step." The processes between cycles and between iterative steps are respectively identical, while optimization stages differ in terms of loss functions: in the initial stage, the negative probability of the true label is used as the loss function to compress the solution space; in subsequent stages, we introduce the Directional Probability Difference Ratio (DPDR) loss function to gradually increase the non-true labels' probability upper bound by compressing the irrelevant labels' probabilities.Experiments demonstrate that compared with previous SOTA methods, SDM not only exhibits stronger attack performance but also achieves higher attack cost-effectiveness.Additionally, SDM can be combined with adversarial training methods to enhance their defensive effects.The code is available at https://github.com/X-L-Liu/SDM.

Modern decentralized deep learning methods for network intrusion detection in Software-Defined Networking (SDN)-enabled Industrial Internet of Things (IIoT) environments encounter significant challenges, particularly for IIoT data heterogeneity and privacy leakage. To this end, we propose a novel framework for network intrusion detection, dubbed SFLNID, that improves Federated Learning (FL) to ensure both efficient training and privacy preservation in SDN-enabled IIoT. Specifically, we firstly design joint optimization mechanism for unbalanced and non-IID data, which introduces a Focal loss as the loss function, and leverages the Wasserstein distance between global and local models as the regularization term. In addition, we improve adaptive differential privacy with dynamic gradient clipping techniques, adjusting the clip-threshold based on Holt exponential smoothing to achieve privacy protection during the local model training. Moreover, we develop a customized CNN-GRU model tailored for FL-based network intrusion detection to make a tradeoff between model accuracy and overheads. Theoretical analysis confirms the convergence and privacy guarantees of SFLNID. Extensive experiments, conducted on well-known IIoT datasets including ToN-IoT, RT-IoT and Edge-IIoT, demonstrate that SFLNID outperforms the state-of-the-art methods in terms of detection accuracy, communication overhead, and cooperative privacy preservation.

Neural networks are vulnerable to meticulously crafted adversarial examples, resulting in high-confidence misclassifications in image classification tasks. Due to their stealthiness and difficulty in detection, black-box transfer attacks have become a significant focus of defense. In this article, we propose a purification defense based on probabilistic scheduling algorithm of pre-trained models (ProbSched-PTM) to counter diverse transfer attacks. We first quantify the differences among various models based on their output scores and verify the linear negative correlation between adversarial transferability and model difference. Subsequently, guided by the model difference probability, we integrate the negative momentum probability as a regularization factor to construct ProbSched-PTM. It selects the most appropriate substitute model from multiple pre-trained models to generate strong-transferability adversarial examples for training the purification model, which enables the purification model to effectively eliminate diverse adversarial perturbations. The ProbSched-PTM-based purification defense provides robust defense against unseen adversarial attacks from different substitute models. In a black-box attack scenario, utilizing ResNet-34 as the target model, our approach achieves average defense rates of over 94.8% on CIFAR-10 and over 71.2% on Mini-ImageNet, demonstrating state-of-the-art performance.

Due to the high mobility of unmanned aerial vehicles (UAVs), the network topology may change frequently, making persistent connectivity and fault tolerance difficult. Deep reinforcement learning (DRL) offers the opportunity to make proper actions in a large decision space, which could be utilized for the complicated topology control of flying ad-hoc networks. However, how to train and deploy the DRL algorithms on resource-limited and hardware-constrained UAVs to ensure network connectivity and fault tolerance still faces huge challenges. In this work, a topology control method based on positional movement and DRL is proposed, which is suitable for topology construction and topology adjustment. First, a centroid-guided target-driven method is designed to transform arbitrary graphs into 2-connected graphs by connecting each node with its two designated target nodes in a specific order. Then, a topology control method based on the centroid-guided target-driven method and soft actor-critic (CGTD-SAC) is proposed. CGTD-SAC trains agents to keep connectivity with two target agents and keep a safe distance from surrounding agents. CGTD-SAC generates 2-connected topologies in a distributed manner. CGTD-SAC is a tiny algorithm with low computational complexity and less communication overhead. Finally, experiments demonstrate that CGTD-SAC has an excellent ability to obtain network topologies with 2-connectivity, suitable link length, and appropriate number of links.

In this paper, we propose a resilient control plane based on endogenous security for Software-Defined Networking (SDN) named SDN-ESRC to prevent vulnerability backdoor attacks. SDN-ESRC uses a set of heterogeneous controllers (e.g., RYU, OpenDayLight, ONOS) to compose the control plane and dynamically and adaptively selects several heterogeneous controller instances from the controller set to detect and correct the malicious control messages. The design of SDN-ESRC faces two challenges: (1) increasing network update delay due to multi-controller comparison and (2) maintaining high controllable security. To address the first challenge, SDN-ESRC adopts the master modification mode to reduce the network update delay and identify malicious control messages. To address the second challenge, SDN-ESRC introduces the comparison modification mode to ensure high availability in real time. We propose an evaluation model for SDN-ESRC and theoretically analyze the SDN-ESRC’s endogenous security performance under three typical backdoor attack scenarios. We implement SDN-ESRC in a prototype system and conduct simulations and experiments. The results show that SDN-ESRC can improve the backdoor damage attack security up to 98.3%, the backdoor random attack security up to 99.99%, and the backdoor coordinated attack security up to 82% at the cost of increasing network update delay less than 8.3%.

In SDN, the controller is the core and is responsible for processing all flow requests of the network switches. However, due to the sudden occurrence and unbalanced distribution of flows in the network, it is likely that some controllers suffer workload that is far heavier than their load capacity, which leads to the failure of the controller and further leads to the paralysis of the entire network. To solve this problem, we propose a dynamic flow redirection scheme (DFR) to prevent network crash. We describe the phenomenon of controller failure caused by numerous flow requests. The flow redirection is formalized as a multi-objective optimization problem and constrained by flow table and bandwidth. We prove that the problem is NP-hard. We solve this problem with the dynamic flow redirection approach (DFR). First, state detection module detects whether the current flow requests will exceed the controller load. The Flow Redirection Assignment Module then computes the redirect path for the redundant flow request. Finally, Rule Dispense issues the flow rules to the corresponding switches. Simulation results show that DFR reduces network latency and reduces the overload probability of controllers by at least 3 times.

In 5G networks with SDN architecture, the traffic explosion and the rising of diverse service requirements lead to many challenges for 5G core networks on flexibility and scalability. In order to achieve high-speed forwarding of traffic and diversified transmission requirements in the 5G era, combined with SDN and Segment Routing, we propose a scalable flow forwarding scheme called Segment Routing based on Path Aggregation and Rule sharing (PARS-SR) to solve SDN switch flow table resource shortage problem. Traditional OpenFlow-based or MPLS-based flow forwarding scheme may lead to performance degradation due to flow-table overflowed or heavy MPLS label load incurred. PARS-SR exploits SDN, Segment Routing and intelligent path encoding algorithm to achieve a trade-off between flow table resource and MPLS label load. The proposed PARS-SR can learn the flow path information online to implement path aggregation and rule sharing by aggregating a large number of flows into a small number of flow entries based on the coincidence degree of the flow path. To find the optimal flow path aggregation scheme, we present an intelligent encoding algorithm to maximize the overall cost saving. The simulation results show that PARS-SR can effectively reduce both the number of flow entries and the MPLS label load of the packet.

Multi-controller is a promising control plane solution for the large-scale Software-Defined Networks (SDN). Some existing works (e.g., OpenFlow 1.2) propose to use backup controllers named slave controllers to achieve fault- tolerance in the control plane. In this paper, we identify the unreasonable slave controller assignment could cause the controller chain failure and eventually crash the entire network. We consider some important factors for designing fault-tolerant control plane and formulating Slave Controller Assignment (SCA) problem. SCA is an NP-complete problem, and we solve it with Adaptive Slave Controller Assignment (ASCA) scheme, which adaptively assigns slave controller according to load variance difference. The numerical results validate the efficiency of ASCA.