Abstract Multi-Layer Perceptrons are widely used for Distributed Denial-of-Service detection due to their high accuracy in distinguishing malicious from benign traffic. However, their vulnerability to adversarial perturbations, subtle input modifications that evade detection, remains largely unexplored which poses significant risks for real-world deployment. This study evaluates the susceptibility of a state-of-the-art Multi-Layer Perceptron model (Sharif et al. in IEEE Access 11:51810–51819, 2023), with a baseline accuracy of 99.1%, trained on the CICIDS2017 and CICDDoS2019 benchmarks. We demonstrate that minimal, protocol-compliant perturbations (e.g., shuffling Flow IAT Mean) reduce accuracy from 99.1 to 1.5%—exposing critical operational risks in deployed systems. Unlike prior gradient-based attacks, our method requires no internal model knowledge, enabling practical exploitation by low-resource adversaries. We explore three attack strategies: perturbing malicious samples to induce false negatives (accuracy drops to 64.5%), perturbing benign samples to amplify false positives (accuracy drops to 36.2%), and perturbing both classes simultaneously (accuracy drops to 1.5%). We further reveal that adversarial retraining only partially mitigates risks (93.4% recovery), demanding continuous defense adaptation. These findings highlight the critical need to assess adversarial risks alongside traditional performance metrics in DDoS detection systems.

Convolutional neural networks (CNNs) are widely used in machine learning (ML) applications such as image processing. CNN requires heavy computations to provide significant accuracy for many ML tasks. Therefore, the efficient implementations of CNNs to improve performance using limited resources without accuracy reduction is a challenge for ML systems. One of the architectures for the efficient execution of CNNs is the array-based accelerator, that consists of an array of similar processing elements (PEs). The array accelerators are popular as high-performance architecture using the features of parallel computing and data reuse. These accelerators are optimized for a set of CNN layers, not for individual layers. Using the same accelerator dimension size to compute all CNN layers with varying shapes and sizes leads to the resource underutilization problem. We propose a flexible and scalable architecture for array-based accelerator that increases resource utilization by resizing PEs to better match the different shapes of CNN layers. The low-cost partial reconfiguration improves resource utilization and performance, resulting in a 23.2% reduction in computational times of GoogLeNet compared to the state-of-the-art accelerators. The proposed architecture decreases the on-chip memory access rate by 26.5% with no accuracy loss.

This article represents an on-line time-predictable distributed hardware scheduler solution, suitable for many-core systems. We have partitioned the Main scheduler into uniform Partial schedulers to achieve a significant gain in term of performance and scalability, while software scheduling solutions impose excessive delays (in order of thousands of clock cycles) to a system. Although we have considered the implementation of the Earliest Deadline First (EDF) algorithm for each Partial scheduler, one can use customized scheduling policies, as needed. Designers can also modify different parts of our proposed architecture to obtain more suitable hardware for their design. HRHS outperforms conventional schedulers, in terms of resource utilization (LUT, register), delay and energy consumption by 36.83, 22.93, 46.36 and 59.26 percent on average, respectively. It also overpowers clustering solutions by circumventing their intrinsic off-line characteristics. The presented designs are also implemented in ASIC with 45-nanometer technology, in which the HRHS design excels in power, area and critical path length by 49.33, 50.67, and 53.33 percent on average, respectively, over other designs implemented in this article.

Coarse-grained reconfigurable arrays (CGRAs) are used as low-power and high-performance accelerators in the processors of the Internet of Things (IoT) and embedded systems to accelerate the computation of intensive tasks. These accelerators speedup loops, including integer and fixed-point instructions of computation-intensive applications, in multimedia, voice coding, and encryption algorithms. The design of an efficient compiler that could map the compiled assembly codes to CGRA is a serious challenge. Even with existing such compiler, the compiled programs are dependent on the hardware of CGRA and processor, i.e., the accelerator is not transparent to compilers and applications. This article proposes a novel accelerator that its CGRA is concatenated with the main ALU of the processor to speedup the execution of integer and logical applications. The proposed accelerator and its hardware-based implemented mapping technique are completely transparent to the compiler, OS, user, and applications. This architecture overcomes the dependence challenge mentioned earlier. The simulation results indicate that the proposed architecture improves the performance and energy consumption on average by 15.8% and 8% in comparison with the baseline architecture, respectively, whereas the area and power overhead of the proposed architecture when the CGRA is used at its optimum case are 4.47% and 4.43%, respectively.

This paper proposes a novel hardware-based multidimensional sorting algorithm and its respective architecture, called real-time hardware sorter (RTHS), for emerging data intensive processing applications where performance and resource conservation are serious concerns. The basic idea behind RTHS is to reduce the hardware complexity of parallel hardware sorting architectures (PHSAs) through a high-performance scalable matrix-based sorting method. The proposed method can also be used for implementing Min/Max queues or finding the largest/smallest records exclusively in the big data application. Implementing the RTHS design on a Virtex-7 field-programmable gate array (FPGA) reveals that the number of lookup tables (LUTs) of the proposed method has decreased by 66.3% and 87.3% compared to the conventional Bitonic sorting network (CBSN) and the state-of-the-art PHSA, respectively. In addition, the number of required registers for the proposed method has decreased by 94.8% compared to the state-of-the-art PHSA.

This paper proposes a cooperative mechanism, to tackle distributed denial of service (DDoS) attacks based on cooperation between the victim server and customer edge routers of the ISPs (internet service providers) that have traffic toward the victim server. The mechanism tackles the attack in three consecutive phases: first, before attack packets can converge to saturate the bandwidth, the victim server through edge routers of its ISP, regulates traffic rate at which traffic load falls below upper bound of its bandwidth (control phase); second, the victim server installs leaky- buckets at customer edge routers of all ISPs that have traffic toward it and then, through a feedback- control process adjusts the size of leaky buckets appropriately (stabilization phase); third, based on a finger- print test, the victim server requests those customer edge routers that purely carry good traffic to remove the leaky-bucket and then based on a reference profile fairly adjusts size of leaky-buckets for the remaining customer edge routers such that those routers that carry both good and attack traffic get bigger leaky-bucket sizes compared to those routers that totally carry attack traffic. Simulation results shows that our technique effectively, defenses a victim server against various DDoS attacks.

Overlay networks are used as proxies which mediate communication between an application and its users with-out revealing the application’s location (IP address). The capability that users can communicate with an application without knowing its location is called location-hiding. Al-though recent years have provided little literature about location-hiding such as Tor or anonymous web publishing, most Internet activities where anonymity is desired require only sender and relationship anonymity, thereby location-hiding needs more academic effort. This paper proposes a novel architecture to achieve location-hiding. We describe the design of a dynamic multilayer routing (DMR) where users can communicate withan application without knowing any information about its location (its IP address). The essential factors of DMR protocol are multi-layering, reconfiguration and host-diversity. The goal of DMR is to overcome or reduce several draw-backs of static structure based techniques. Through analytical analysis, this paper provides a de-tailed study of DMR architecture and shows that DMR is completely strong against penetration attacks. Our analysis shows that attackers have a negligible chance (e.g., 10−8)to penetrate the architecture and disclose the application’slocation.

Distributed intelligence and secure interconnected communication networks constitute recognized key factors for the economic operation of electricity infrastructures in competitive power markets. Hence, electric power utilities need to extend risk management frameworks with adequate tools for assessing consequences of ICT (Information and Communication Technologies) threats on their critical business. This requires realistic probability estimates to cyber threat occurrences and consequent failure modes. Due to data sensitivity and rapid discovery of new vulnerability exploits, historical data series of ICT failures affecting power control infrastructures are not sufficient for a timely risk treatment. Such lack of data can partially be overcome by setting up testbeds to run controlled experiments and collect otherwise unavailable data related to cyber misbehaviours in power system operation. Within the project CRUTIAL (CRitical UTility InfrastructurAL resilience) two testbed platforms have been set up for experimentally evaluating malicious threats on macro and micro grid control scenarios. Results from experimental campaigns are analyzed in the paper by means of an evaluation framework.

Filtering techniques are one of the main approaches to protect applications from denial of service attacks (DoS).However filtering techniques suffer from two main challenges: a) the accuracy detection of DoS traffic and b) processing time. Fosel (filtering with the help of an overlay security layer) has been proposed to protect application sites from denial-of-service attacks. The Fosel architecture addresses how an efficient and well-suited filter can be designed to improve the filtering challenges. This paper explores the effectiveness of the Fosel architecture by implementing an experimental testbed. Experimental study shows that by employing the Fosel architecture, DoS attacks have a negligible chance to saturate the target by malicious packets. These results confirm simulation study of Fosel and provide an empirical evidence that Fosel can be used to tolerate DoS attacks.

Today, overlay networks are used as a promising platform to deploy wide area of applications and services in the Internet. The application level state maintained by the overlay networks should have high degree of availability.This can be compromised when a significant percentage of overlay nodes fails simultaneously (massive failure). The first problem: when a significant fraction of nodes fails simultaneously the loss rate increases awfully. The second problem: End-to-end latency increases dramatically when massive failure occurs. The third problem: in some overlay networks, an adversary can discover connectivity information of routing path easily and consequently he can prevent communication by attacking only the specific nodes.Random path diversity (RPD) is a technique that we use to handle such problems. This paper shows that how sending the same packet through few overlay paths in a random manner improves robustness of overlay networks against massive failure and routing path discovery. The Chord network is a case study of this paper.Experimental results show RPD makes the Chord overlay network more robust against massive failure. Results show 4-RPD (i.e. simultaneously sending the same packet through four different paths) improves resilience of Chord against massive failure on average 40%. It also reduces end-to-end latency made by massive failure more than 30% (on average). By the way randomness gives the network anonymity that makes network more complicated for routing path discovery. Results show 4-RPD improves anonymity more than 55% in compare to no diversity.

In the last few years, P2P systems have rapidly evolved and emerged as a promising platform to deploy new applications and services in the internet. The main reasons for this is that P2P systems are self-organizing, have a decentralized nature, good scalability, efficient query search, and good resilience in the presence of node failures. However malicious faults (attacks) are serious threats in these systems.

Overlay networks enable applications to communicate with users without disclosing their IP addresses; hence overlay networks are used to protect applications against DoS attacks by hiding an applicationpsilas location. This paper analyzes three popular overlay networks (Chord, CAN, and Pastry) by simulation to answer to this question: which topology is more favorable for location-hiding and resisting against DoS attacks? Simulation results show that a CAN overlay network has a better topology structure for location-hiding and resistance against DoS attacks than Chord and Pastry. Simulation results also show the topologies with low average vertex degree are favorable for location-hiding techniques.

Today Internet is becoming an emerging technology for remote control of industrial applications, where one site needs to control another site remotely (e.g. power plants controllers). Denial-of-Service (DoS) attacks may cause significant disruptions to the Internet which will threaten the operation of such network based control systems. Overlay networks have been proposed to protect Internet application sites by location-hiding technique. This paper analyzes a large domain of previous approaches against this problem. This paper addresses how an interface to an overlay network can be designed such that communication services among geographically distributed application sites are secured against DoS attacks. This paper presents a novel architecture called overlay protection layer (OPL) that proactively protect application sites from DoS attacks. Through simulation this paper shows DoS attacks have a negligible chance to disrupt communications services via the OPL architecture. Even if attackers attack 50% of overlay nodes via a Distributed DoS attack still 75% of communication channels are available.

Denial of service (DoS) attacks are major threat againstavailability in the Internet. A large number of countermea-sure techniques try to detect attack and then filter out DoSattack packets. Unfortunately these techniques that filterDoS traffic by looking at known attack patterns or statisticalanomalies in the traffic patterns can be defeated by chang-ing the attack patterns and masking the anomalies that aresought by the filter. Hence, detecting DoS traffic is one ofthe main challenges for filtering techniques. Furthermoretechniques that drop any malicious packet need to processthe packet and processing is time-consuming.This paper addresses how an efficient and good filter canbe designed by helping an overlay network layer to mitigateDoS attacks. Fosel (Filtering by helping an Overlay Secu-rity Layer) filter is independent from DoS attack types, sowe do not worry about the changing attack patterns. Fur-thermore it reduces processing time noticeably.Through simulation this paper shows by employing Foselfilter, DoS attacks have a negligible chance to saturate thetarget by malicious packets. Our simulation demonstratesthat Fosel architecture reduces the probability of successfulattack to minuscule levels. Furthermore Fosel is between10% and 50% faster than SOS (Secure Overlay Services) architecture to drop malicious packets based on attackrate.

Today, peer-to-peer (P2P) systems are used as a promising platform to deploy new applications and services in the internet. There are much interest in emerging P2P overlay network because they provide a good substrate for creating large scale data sharing, content distribution and application-level multicast applications. Overlay networks also have following advantages: redundant storage, efficient query search, anonymity, fault-tolerance, trust and authentication.This paper compares and analyzes various types of P2P overlay networks from dependability view. Main topics of comparison and analysis are scalability, reliability, security, availability, integrity and anonymity. We verify dependability analysis of P2P overlay networks by simulation. Both analysis and simulation results show that the purely structured decentralized type (e.g.Chord) is the most dependable P2P overlay network.

The general approach to fault tolerance in uniprocessor systems is to maintain enough time redundancy in the schedule so that any task instance can be re-executed in presence of faults during the execution. In this paper a scheme is presented to add enough and efficient time redundancy to the earliest-deadline-first (EDF) scheduling policy for periodic real-time tasks. This scheme can be used to tolerate transient faults during the execution of tasks. We describe a recovery scheme which can be used to re-execute tasks in the event of transient faults and discuss conditions that must be met by any such recovery scheme. For performance evaluation of this idea a tool is developed.

This paper presents the performance analysis of several well-known partitioning scheduling algorithms in real-time and fault-tolerant multiprocessor systems. Both static and dynamic scheduling algorithms are analyzed. Partitioning scheduling algorithms, which are studied, are heuristic algorithms that are formed by combining any of the bin-packing algorithms with any of the schedulability conditions for the rate-monotonic (RM) and earliest-deadline-first (EDF) policies. A tool is developed which enables to experimentally evaluate the performance of the algorithms from the graph of tasks. The results show that among several partitioning algorithms evaluated, the RM-small-task (RMST) algorithm is the best static algorithm and the EDF-best-fit (EDF-BF) is the best dynamic algorithm, for non fault-tolerant systems. For fault-tolerant systems which require about 49% more processors, the results show that the RM-first-fit decreasing utilization (RM-FFDU) is the best static algorithm and the EDF-BF is the best dynamic algorithm. To decrease the number of processors in fault-tolerant systems, the RMST is modified. The results show that the modified RMST decreases the number of required processors between 7% and 78% in comparison with the original RMST, the RM-FFDU and other well-known static partitioning scheduling algorithms

The general approach to fault tolerance in uniprocessor systems is to use time redundancy in the schedule so that any task instance can be re-executed in presence of faults during the execution. In this paper a scheme is presented to add enough and efficient time redundancy to the rate-monotonic (RM) scheduling policy for periodic real-time tasks. This scheme can be used to tolerate transient faults during the execution of tasks. For performance evaluation of this idea a tool is developed