The proliferation of high-quality text from Large Language Models (LLMs) demands reliable and efficient detection methods. While existing training-free approaches show promise, they often rely on surface-level statistics and overlook fundamental signal properties of the text generation process. In this work, we reframe detection as a signal processing problem, introducing a novel paradigm that analyzes the sequence of token log-probabilities in the frequency domain. By systematically analyzing the signal's spectral properties using the global Discrete Fourier Transform (DFT) and the local Short-Time Fourier Transform (STFT), we find that human-written text consistently exhibits significantly higher spectral energy. This higher energy reflects the larger-amplitude fluctuations inherent in human writing compared to the suppressed dynamics of LLM-generated text. Based on this key insight, we construct SpecDetect, a detector built on a single, robust feature from the global DFT: DFT total energy. We also propose an enhanced version, SpecDetect++, which incorporates a sampling discrepancy mechanism to further boost robustness. Extensive experiments show that our approach outperforms the state-of-the-art model while running in nearly half the time. Our work introduces a new, efficient, and interpretable pathway for LLM-generated text detection, showing that classical signal processing techniques offer a surprisingly powerful solution to this modern challenge.

Graph-structured data is prevalent in the real world. Recently, due to the powerful emergent capabilities, Large Language Models (LLMs) have shown promising performance in modeling graphs. The key to effectively applying LLMs on graphs is converting graph data into a format LLMs can comprehend. Graph-to-token approaches are popular in enabling LLMs to process graph information. They transform graphs into sequences of tokens and align them with text tokens through instruction tuning, where self-supervised instruction tuning helps LLMs acquire general knowledge about graphs, and supervised fine-tuning specializes LLMs for the downstream tasks on graphs. Despite their initial success, we find that existing methods have a misalignment between self-supervised tasks and supervised downstream tasks, resulting in negative transfer from self-supervised fine-tuning to downstream tasks. To address these issues, we propose Graph Alignment Large Language Models (GALLM) to benefit from aligned task templates. In the self-supervised tuning stage, we introduce a novel text matching task using templates aligned with downstream tasks. In the task-specific tuning stage, we propose two category prompt methods that learn supervision information from additional explanation with further aligned templates. Experimental evaluations on four datasets demonstrate substantial improvements in supervised learning, multi-dataset generalizability, and particularly in zero-shot capability, highlighting the model's potential as a graph foundation model. Our code is available at the anonymous repository https://anonymous.4open.science/r/GALLM-AC54/.

With the rapid proliferation of edge computing, mobile edges interconnected via networks are increasingly ex posed to a wide range of attacks. Considering privacy concerns, federated edge anomaly detection, collaboratively training a global detection model across multiple edge clients without centralizing sensitive data, is a promising paradigm to detecting such attacks. However, mobile edge environment is inherently dynamic, with frequent evolving in both network traffic and participating clients. Most existing methods are pre-defined for specific attacks and fixed client settings, which significantly limits their adaptability in dynamic mobile edges. To address these issues, we define the federated adaptability from both data-level and client-level perspectives for the first time, and derive the decisive factors for improving adaptability, i.e., high smoothness and low gradient similarity. Driven by this theoretical foundation, we propose DIFF, a federated edge anomaly detection framework based on dual fuzzing strategies. DIFF incorporates two novel designs for improving adaptability: (i) a classless fuzzing strategy to improve data-level adaptability by fuzzing the boundary between normal and abnormal samples, thereby encouraging model smoothness and enhancing adaptability to unseen traffic and emerging attacks; and (ii) a direction fuzzing strategy to enhance client-level adaptability by perturbing the optimization directions of local models, enabling the aggregated global model to adapt effectively to new clients. Experiments on public datasets demonstrate the superior adapt ability of DIFF compared to the state-of-art methods.

Traffic classification has a significant impact on maintaining the Quality of Service (QoS) of the network. Since traditional methods heavily rely on feature extraction and largescale labeled data, some recent pre-trained models manage to reduce the dependency by utilizing different pre-training tasks to train generic representations for network packets. However, existing pre-trained models typically adopt pre-training tasks developed for image or text data, which are not tailored to traffic data. As a result, the obtained traffic representations fail to fully reflect the information contained in the traffic, and may even disrupt the protocol information. To address this, we propose TraGe, a novel generic packet representation model for traffic classification. Based on the differences between the header and payload-the two fundamental components of a network packetwe perform differentiated pre-training according to the byte sequence variations (continuous in the header vs. discontinuous in the payload). A dynamic masking strategy is further introduced to prevent overfitting to fixed byte positions. Once the generic packet representation is obtained, TraGe can be finetuned for diverse traffic classification tasks using limited labeled data. Experimental results demonstrate that TraGe significantly outperforms state-of-the-art methods on two traffic classification tasks, with up to a 6.97% performance improvement. Moreover, TraGe exhibits superior robustness under parameter fluctuations and variations in sampling configurations.

Privacy-preserving machine learning (PPML) allows collaborative training without exposing raw data but remains susceptible to gradient leakage. Secure aggregation offers pro-tection via masking and secret sharing, yet suffers from high communication overhead. We propose NET-SA, a secure aggregation architecture based on in-network computing. By employing homomorphic pseudorandom generators for local masking and leveraging programmable switches for seed aggregation, NET-SA eliminates key negotiation and secret sharing steps, reducing communication cost and improving dropout tolerance. Experiments on Tofino switches demonstrate up to 77× faster runtime and 2× lower communication overhead compared to existing methods.

Emerging time-sensitive applications impose demands on bounded latency and jitter of network transmission, introducing their deterministic scheduling problem. There are mainly two types of methods for it, fixed rate limit based and hyper-period based, which still face challenges in scheduling performance and run time. We also noticed that flows may experience redundant queuing delay at some hops because of current methods' inability to distinguish them with different arrival patterns, increasing their end-to-end latency. To address the above issues, we present a method based on Differentiated Cyclic Queuing and Forwarding for time-sensitive flows' deterministic scheduling in large-scale networks, called DCQF. It provides fast and slow transmission modes at each hop and forwards flows in the earliest feasible sending cycles according to their arrival patterns. Due to employing a relatively simple scheduling model and relaxing flows' constraints by reducing their queuing delay, DCQF demonstrates higher computational efficiency and provides lower latency for flows in experiments, reflecting its feasibility and advantages in solving the deterministic scheduling problem in large-scale networks.

Encryption is crucial for securing critical network infrastructures, including datacenter networks, 5 G networks, and the Internet of Things (IoT). In-network encryption (INE) offers a promising solution by enabling direct encryption of data on the network's data plane during transmission, thereby eliminating the need for host-side hardware encryption. However, existing INE solutions fail to fully leverage the processing capabilities of programmable switches, leading to low throughput, high resource overhead, and limited key flexibility. These limitations hinder their compatibility with other network functions and restrict their real-world deployment. To address these challenges, we introduce NET-SM4, a high-performance secure encryption mechanism based on in-network computing. NET-SM4 offloads the highly secure and pipeline-optimized SM4 encryption algorithm to programmable switches. By employing a hardwarefriendly table lookup approach, NET-SM4 reduces computation dependency chains and supports parallel encryption inherently, thereby achieving high throughput and low resource overhead for in-network encryption. We implement a prototype of NETSM4 on a commercial Tofino switch and evaluate its performance through testbed experiments and a real-world RDMA-based case study. The results demonstrate that NET-SM4 (1) outperforms state-of-the-art in-network encryption solutions in throughput by up to 293.85 %, and (2) ensures link-speed data transmission with less than$20 \mu$s overhead in real-world scenarios.

Segment routing (SR) is an emerging architecture that can benefit traffic engineering (TE). Nowadays, TE in SR networks (SR-TE) is often solved as an optimization problem to optimize network performance such as link utilization. As network size grows rapidly, implementing SR-TE suffers from scalability issues, including long computation time, high control overhead and expensive deployment cost. In this paper, we propose Smart Node Selection (SNS), a scalable SR-TE method with learning-based node selection (NS). NS is a recently proposed technique for reducing computation time of SR-TE. It first selects a subset of nodes as candidate intermediate nodes to route traffic, then builds linear programming (LP) models that can be solved efficiently. However, existing NS methods use simple heuristics and consider only network topology, which may lead to unsatisfying network performance. To address this problem, we for the first time formulates NS as a reinforcement learning task, which learns a selection policy to achieve better trade-offs between TE performance and computation time, considering both topology and traffic. Besides, we extend NS with additional selection policies and a customized training algorithm, making it a unified framework for scalable SR-TE, which reduces not only computation time, but also control overhead and deployment cost. Performance evaluations on various real-world topologies and traffic matrices show that SNS significantly reduces computation time and control overhead of existing LP models while offering good network performance, and can also be used in partially deployed SR networks to reduce deployment cost.

With the emergence of next-generation video applications and increasing spatial resolutions, delivering high-quality video is still limited by network bandwidth. Adaptive bitrate (ABR) can select the appropriate bitrate for video streaming based on bandwidth, which can mitigate rebuffering caused by insufficient bandwidth. In comparison to Constant Bitrate (CBR), Variable Bitrate’s (VBR) encoding scheme can achieve the same quality with less bandwidth consumption and is gradually being widely used in ABR streaming. However, the quality of the video is still degraded due to a poor network. Recent research utilizes Super-resolution (SR) in ABR streaming to construct neural Video Quality Enhancement (VQE) systems, thereby improving the quality of video segments downloaded due to insufficient bandwidth. However, SR cannot participate in the downsampling encoding process of videos, which results in the effectiveness of existing SR-based VQE systems being inherently limited due to unavoidable information loss during downsampling encoding. Concurrently, SR’s high computational cost restricts neural VQE systems’ deployment on clients without GPUs. In contrast to the unidirectional workflow of SR, Rescaling can be integrated into the downsampling encoding process of videos, allowing favorable information to be retained for VQE. To implement high-quality real-time VQE for ABR streaming of VBR-encoded videos on CPUs, we propose RePC, a novel neural VQE system framework for optimizing existing neural VQE systems based on Rescaling (Re) for the first time, and Patch Content-awareness (PC). In detail, RePC uses Rescaling instead of SR to achieve better VQE by participating in the video downsampling. We also propose a Video Single-Image Rescaling model, VSIR, to indicate the effectiveness of RePC in quality enhancement. To speed up VQE, RePC designs a PC algorithm to mix interpolation and neural computation based on the practical upsampling ability. Our evaluation results demonstrate quality gains of 0.55–2.96 dB in PSNR and 1.79–3.18 in VMAF with fewer parameters, a speed-up of 15×–286× well up to real-time requirements on CPUs, and Quality of Experience (QoE) improvements of 16.58–26.65 are also achieved in an ABR system under various networking conditions.

Modeling complementary relationships greatly helps recommender systems to accurately and promptly recommend the subsequent items when one item is purchased. Unlike traditional similar relationships, items with complementary relationships may be purchased successively (such as iPhone and Airpods Pro), and they not only share relevance but also exhibit dissimilarity. Since the two attributes are opposites, modeling complementary relationships is challenging. Previous attempts to exploit these relationships have either ignored or oversimplified the dissimilarity attribute, resulting in ineffective modeling and an inability to balance the two attributes. Since Graph Neural Networks (GNNs) can capture the relevance and dissimilarity between nodes in the spectral domain, we can leverage spectral-based GNNs to effectively understand and model complementary relationships. In this study, we present a novel approach called Spectral-based Complementary Graph Neural Networks (SComGNN) that utilizes the spectral properties of complementary item graphs. We make the first observation that complementary relationships consist of low-frequency and mid-frequency components, corresponding to the relevance and dissimilarity attributes, respectively. Based on this spectral observation, we design spectral graph convolutional networks with low-pass and mid-pass filters to capture the low-frequency and mid-frequency components. Additionally, we propose a two-stage attention mechanism to adaptively integrate and balance the two attributes. Experimental results on four e-commerce datasets demonstrate the effectiveness of our model, with SComGNN significantly outperforming existing baseline models.

Social bots frequently engage in malicious activities like spreading misinformation and phishing on major social media platforms, significantly impacting the fairness and security of these platforms. Therefore, detecting social bots has become a very critical task. However, we observe two challenges for bot detection methods: neglected discrepancies under various interests (e.g., politics, entertainment) and challenging cases in the real world (e.g., carefully camouflaged bots, individualized genuine users). To tackle these issues, we propose BotCHMIA, a novel interest-aware social bot detection method enhanced with challenging cases. Specifically, to enhance feature representations by various user interests, we propose an interest-aware feature collaboration that utilizes a series of expert networks and an interest adapter to acquire user interest-specific information and fuse it with task-specific feature representations extracted by a bot detection projection. Additionally, we estimate sample hardness during the training process based on the model’s classification confidence and improve existing supervised contrastive loss with randomly selected challenging cases, namely hard samples, to enhance the discriminability of user feature representations. We conduct extensive experiments on two real social bot datasets, and the results demonstrate the practical benefits gained from our proposed detection method.

Distributed Denial-of-Service (DDoS) attacks pose formidable threats to the security and availability of critical Internet infrastructure. In-network computing technology brings new opportunities to address DDoS attacks due to its intrinsic data plane programmability and high performance. However, existing DDoS attacks detection schemes based on in-network computing are difficult to strike a balance between true positive rate and false positive rate, especially in low-rate DDoS attacks scenarios. In response to this challenge, we propose RADD, an entropy-based method to detect DDoS attacks in real time based on in-network computing. RADD measures the distribution of network traffic from the perspective of individual IP address to discern subtle fluctuations within network traffic, hence providing early indications of potential DDoS attacks. We implement a prototype of RADD over programmable switches and results show that our proposed method significantly outperforms the state-of-the-art or has equivalent accuracy in low-rate and highrate DDoS attacks scenarios.

As the increase of geographically distributed applications continues, the demand for high-speed, long-distance data transmission across wide area networks (WANs) has significantly increased. Remote Direct Memory Access (RDMA) is extensively deployed in data center networks (DCNs) for its high throughput, low latency, and reduced CPU utilization, and its extension to WANs is expected to fully leverage these benefits. However, existing RDMA solutions, while demonstrating superior performance in data centers, face a performance gap over WANs due to their reliance on DCNs for optimal performance and lack of optimization for WANs’ high latency and loss rates. To bridge this gap, we introduce Lossy Wide-Area RDMA (LoWAR), a high-goodput, high-reliability RDMA solution for lossy WANs. LoWAR incorporates a forward error correction (FEC) shim layer to protect RDMA messages from packet loss, thus minimizing the inefficiency of retransmissions. It also fully offloads processing to RNICs with minimal computational overhead and storage burden, operating transparently on RNICs without requiring modifications to existing applications and networks. We implement a LoWAR prototype with FPGA and evaluate its performance through testbed experiments. The results demonstrate LoWAR’s enhanced performance in lossy WANs: in WANs with 40ms RTT and 0.001% to 0.01% loss rates, LoWAR increases RDMA goodput by 2.05 to 5.01 times, reduces average flow completion times (FCTs) by 3.5% to 12.2%, and eliminates 99th percentile tail FCTs in most scenarios.

Large-scale Deterministic Network (LDN) is developed to achieve deterministic transmission in large-scale networks, which can provide bounded delay and jitter with the Cycle Specified Queuing and Forwarding (CSQF) and shaping mechanisms. Routing for time-sensitive flows in LDN requires meeting the delay and bandwidth constraints, like the Multi-Constrained Path (MCP) problem. However, there is a discrepancy that the constraints in the MCP problem are definite while in LDN they are uncertain. It is because the flow’s rate can be adjusted by the shaper, which influences the waiting time at the ingress node and reserved bandwidth at the path. We call the routing problem in LDN the Multi Variable Constraints Routing (MVCR) problem. Due to the uncertainty of constraints, existing routing algorithms may encounter overlong runtime or early rejection if applied to the MVCR problem. In this paper, we propose a Heuristic Fast Routing solution to address the MVCR problem in LDN, called HFR-L. Firstly, we establish a pathbook in advance and design a metric for selecting routes from it with taking the variable flow’s rate into consideration. Then, given the possibility of network changes or the absence of feasible paths in pathbook, we design an algorithm to compute routes in real time, which is based on an extended Lagrange Relaxation based Aggregated Cost (LARAC) algorithm and continuously adjusts the flow’s rate to balance the constraints. The experiments show that our HFR-L has excellent routing performance and fast execution speed in both global and online scenarios, confirming its feasibility to be used in LDN.

Multivariate Time Series Anomaly Detection (MTSAD) detects abnormal indicators from Multivariate Time Series (MTS), and provides the rank of the multiple abnormal indicators to meet the expert's detection interest in current environment, which underpin the security and stability of intelligent cyber-physical systems. However, popular integration-based methods, which are pre-defined, fall short in locating the exact abnormal indicator, nor can they perceive the environmental dynamic and evolve accordingly. Let alone meeting the expert's interest. As a result, the expert's workload is exaggerated. These issues motivate us to propose a novel multi-layer collaborative bandit framework MULA for MTSAD. MULA decomposes MTS and pairs individual time series with a bandit arm, which locates the abnormal indicator directly. Then, MULA sorts the indicators by abnormal scores computed based on the expert's feedback, which facilitates the experts. Besides, to address the adaptability issue, we devise a dual signal to comprehensively monitor environmental changes, and design a multi-layer collaborative mechanism for MULA to adapt to the dynamic environment. Theoretical analysis and experiments on public datasets demonstrate the superiority of MULA compared to the state-of-art.

As a promising architectural design for future Internet, Named Data Networking (NDN) relies on data names, instead of destination IP addresses, to deliver data. NDN supports data authenticity and integrity by making public key signatures mandatory on data content and data names. This handles the primary security concern in NDN, but is still vulnerable to new DDoS attacks, including Cache Pollution attacks and Interest Flooding attacks, which degrade NDN transmission significantly, by violating the crucial components of NDN routers. To defend against DDoS attacks in NDN, the most effective way is to persistently detect the malicious traffic and then throttle them. Except for the usual concern of the accuracy and efficiency in attack detection, since these attacks themselves have already imposed a huge burden on victims, to avoid exhausting the remaining resources on the victims for detection purpose, a lightweight detection solution is highly desired. We study DDoS attacks and propose a persistent detection solution based on an observed malicious traffic pattern, which leverages a novel sketch to monitor the malicious traffic in a timely and lightweight way. Additionally, our analysis and experiments demonstrate that, with fixed low resource consumption, the proposed solution can persistently detect DDoS attacks in NDN.

Gradient compression technology has attracted much attention in recent years, due to its high effectiveness in alleviating the communication bottleneck of distributed deep learning. However, except for the communication reduction, it also brings in a significant increase of computational overhead, which limits or even eliminates the communication-reduction benefit brought by gradient compression. To solve the high computational overhead problem, we propose an FPGA-based accelerator for gradient compression in this paper. A high-performance and programmable accelerator architecture is developed for accelerating various gradient compression algorithms by offloading compute-intensive compression operations to FPGA. Also, we design and implement the FPGA-based accelerator based on the popular gradient compression algorithm top-k sparsification. Experimental results show that the new accelerator achieves up to hundreds of times faster than the compression algorithm implemented on CPU and GPU. What's more, the stable and controllable performance under different datasets demonstrates that the proposed accelerator is insensitive to data distribution, which is essential for time-sensitive applications.

Traffic engineering (TE) is fundamental and important in modern communication networks. Deep reinforcement learning (DRL)-based TE solutions can solve TE in a data-driven and model-free way thus have attracted much attention recently. However, most of these solutions ignore that TE is a real-world application and there are challenges applying DRL to real-world TE like: (1) Efficiency. Existing learning-from-scratch DRL agent needs long-time interactions to find solutions better than traditional methods. (2) Safety. Existing DRL-based solutions make TE decisions without considering safety constraints, poor decisions may be made and cause significant performance degradation. In this paper, we propose a safe training approach for DRL-based TE, which tries to address the above two problems. It focuses on making full use of data and ensuring safety so that DRL agent for TE can learn more quickly and possibly poor decisions will not be applied to real environment. We implemented the proposed method in ns-3 and simulation results show that our method performs better with faster convergence rate compared to other DRL-based methods while ensuring the safety of the performed TE decisions.

Segment routing (SR) is an emerging architecture that can benefit traffic engineering (TE). To solve TE in SR networks (we call it SR-TE), linear programming (LP) is often used. But LP methods proposed so far for SR-TE are computationally expensive thus do not scale well in practice. To achieve trade-off between performance and time, we can select a set of nodes as candidates for intermediate nodes to route all traffic instead of considering all the nodes. However, existing node selection methods are all rule-based and only pay attention to the structure of network topology without considering flows, so they are not flexible and may lead to poor performance. In this paper, we for the first time formulate node selection for SR-TE as a reinforcement learning (RL) task. When performing node selection, we consider the impact of both topology and traffic matrix. Also, a customized training algorithm for our task is proposed because existing RL algorithms can not be used directly. Performance evaluations on various real-world topologies and traffic matrices show that our method can achieve good TE performance with much less running time.

Social networks have been the widespread popular tools for communication and socialization, and it also been the ideal platform for bots to publish malicious information. Therefore, social bot detection is essential for the social network's security. Existing methods almost ignore the differences in bot behaviors in multiple domains. Thus, we first propose a DomainAware detection method with Multi-Relational Graph neural networks (DA-MRG) to improve detection performance. Specifically, DA-MRG constructs multi-relational graphs with users' features and relationships, obtains the user presentations with graph embedding and distinguishes bots from humans with domainaware classifiers. Meanwhile, considering the similarity between bot behaviors in different social networks, we believe that sharing data among them could boost detection performance. However, the data privacy of users needs to be strictly protected. To overcome the problem, we implement a study of federated learning framework for DA-MRG to achieve data sharing between different social networks and protect data privacy simultaneously. We conduct extensive experiments on TwiBot-20, and the results demonstrate that the proposed method can effectively achieve federated social bot detection.

Private protocols, whose specifications are agnostic, are widely used in the Industrial Internet. While providing customized service, they also raise essential security concerns as well, due to their agnostic nature. The Protocol Reverse Analysis (PRA) techniques are developed to infer the specifications of private protocols. However, the conventional PRA techniques are far from perfection for the following reasons: (i) Error propagation: Canonical solutions strictly follow the "from keyword extraction to message clustering" serial structure, which deteriorates the performance for ignoring the interplay between the sub-tasks, and the error will flow and accumulate through the sequential workflow. (ii) Increasing diversity: As the protocols’ diversities of characteristics increase, tailoring for specific types of protocols becomes infeasible. To address these issues, we design a novel dual-track framework SPRA, and propose Share Learning, a new concept of protocol reverse analysis. Particularly, based on the share layer for protocol learning, SPRA builds a parallel workflow to co-optimize both the generative model for keyword extraction and the probability-based model for message clustering, which delivers automatic and robust syntax inference across diverse protocols and greatly improves the performance. Experiments on five real-world datasets demonstrate that the proposed SPRA achieves better performance compared with the state-of-art PRA methods.

With the surging development of information technology, to provide a high quality of network services, there are increasing demands and challenges for network analysis. As all data on the Internet are encapsulated and transferred by network packets, packets are widely used for various network traffic analysis tasks, from application identification to intrusion detection. Considering the choice of features and how to represent them can greatly affect the performance of downstream tasks, it is critical to learn high-quality packet representations. In addition, existing packet-level works ignore packet representations but focus on trying to get good performance with independent analysis of different classification tasks. In the real world, although a packet may have different class labels for different tasks, the packet representation learned from one task can also help understand its complex packet patterns in other tasks, while existing works omit to leverage them.

To ensure the security and stabilization of the communication networks, anomaly detection is the first line of defense. However, their learning process suffers two major issues: (1) inadequate labels : there are many different kinds of attacks but rare abnormal nodes in mt of these atstacks; and (2) inaccurate labels : considering the heavy network flows and new emerging attacks, providing accurate labels for all nodes is very expensive. The inadequate and inaccurate label problem challenges many existing methods because the majority normal nodes result in a biased classifier while the noisy labels will further degrade the performance of the classifier. To tackle these issues, we propose SemiADC, a Semi -supervised A nomaly D etection framework for dynamic C ommunication networks. SemiADC first approximately learns the feature distribution of normal nodes with regularization from abnormal ones. It then cleans the datasets and extracts the nodes sasainaccurate labels by the learned feature distribution and structure-based temporal correlations. These self-learning processes run iteratively with mutual promotion, and finally help increase the accuracy of anomaly detection. Experimental evaluations on real-world datasets demonstrate the effectiveness of our SemiADC, which performs substantially better than the state-of-art anomaly detection approaches without the demand of adequate and accurate supervision.

By moving computing resources close to where they are needed (i.e., the network edges), edge computing can significantly reduce burden on the centric cloud data centers. However, extreme scale of on-line big data may impose a significant burden on the network backbones. Information-centric edge networking can address this challenge by incorporating in-network caching into edge networks. This however, opens a door for many new security issues and requires various security defenses. One of those is efficient access control design specifically for information-centric edge networking. In this work, we aim to design an efficient and secure access control scheme for information-centric edge networking. In our design, we propose the confidentiality-enhanced network coding which can ensure that, without having access to the authorization key, the attacker will not be able to obtain the original content. And thanks to the properties of confidentiality-enhanced network coding, highly efficient access control can be realized by encrypting only part of the encoding matrix. In addition, our design can allow efficiently revoking users. Security analysis and experimental evaluation on NS3 demonstrate that our scheme can successfully enforce access control in information-centric edge networking with a small overhead.

Network flows are the basic components of the Internet. Considering the serious consequences of abnormal flows, it is crucial to provide timely anomaly detection in dynamic communication networks. To obtain accurate anomaly detection results in dynamic networks, supervision from experts is highly demanded. However, to obtain high-quality ground truth of abnormal flows, we suffer from two major problems: (1)limited labor resources: experts with the latest domain knowledge are much fewer than the large number of flows; and (2)dynamic environment: considering the new abnormal patterns (i.e., new attacks) and continuously changing network structures, it requires timely supervision to adaptively update the parameters. To tackle these problems, we propose HADDN, a novel bandit framework for periodic-updated anomaly detection in dynamic communication networks. We formulate the task as a bandit problem, where by interactions, supervision is offered by human experts to provide the ground truth to a fraction of flows. We construct semi-parametric expected rewards to optimize the estimation of flows’ abnormality in limited interactions. Also, we utilize feature-based clusters and structural correlations to make connections between historical flows and new flows to improve both efficiency and accuracy of abnormality estimation. What’s more, we provide two implementations for the semi-parametric expected reward of the proposed HADDN with theoretical proof. Experimental evaluations on public datasets demonstrate the substantial improvement of our proposed approaches compared to state-of-art anomaly detection methods.

Currently, a large volume of IoT devices generate huge amounts of data in edge networks, which can open up many research and applications for machine learning. However, traditional machine learning requires data to be sent to a server and centrally trained, which will cause the waste of the bandwidth and expose privacy of individuals. Federated learning allows data to be locally trained in their device and only send model updates to the central server for aggregation. But the security of model updates in the aggregation should also be carefully addressed. Existing works mainly focus on secure multiparty computation or differential privacy, which depends on heavy encryption or brings low accuracy. In this paper, we propose an efficient secure aggregation method for model updates in federated learning by pre-processing the model updates from each participant and only encrypting portion of the processed updates by functional encryption for inner product to protect the whole parameters, thus achieving efficient aggregation of model update vectors. Security analysis and experimental evaluation demonstrate that our scheme can efficiently aggregate the model updates without losing security.

Wi-Fi Protected Access II Pre-Shared Key (WPA2-PSK) is a hot way to wireless security in public Wi-Fi networks. It works on a pre-configured passphrase shared with all stations in the same Wi-Fi network. Session keys (e.g., Pairwise Transient Key, PTK) between stations and the access point (AP) are derived from the passphrase. The WPA2-PSK networks can authenticate external stations, however, they fail to guarantee confidential communication if internal attackers own the passphrase in the network since all stations derive their PTK using the same passphrase. To prevent internal stations from eavesdropping the PTK, a secure session key negotiation scheme in WPA2-PSK Networks (SSKNS) is proposed. We introduce a temporary session key (TSK), which is encrypted using elliptic curve cryptography (ECC) and exchanged securely between the station and the AP in the Wi-Fi association process. Through AES algorithm with TSK, the station encrypts its own nonce used to generate the unique PTK in the 4-way process. Our scheme neither modifies the legacy process related to PTK generation nor adds plethoric overhead on excessive protection of all messages. Security analysis and simulations performed in NS-3 demonstrate that by consuming a few computation overheads, SSKNS can effectively provide security level, compared with the existing schemes.

Blockchain can be used to ensure trust in a decentralized environment in which no trusted authority is available. Its original idea is to collect transactions in a block, and to chain the blocks together in such a way that attackers cannot forge the chain if the majority of the network is honest. Since its creation in 2008, blockchain technology has been used broadly in Internet to support decentralized payments, cloud computing, publishing, etc. This work focuses on public permissionless blockchain which neither guards against bad actors nor enforces access control. Named data networking (NDN) uses name-based routing and in-networking caching to support efficient content delivery, making it a promising future Internet architecture as well as a great network technology which can improve blockchain data delivery. Therefore, it is a very necessary task to enable deployment of blockchain applications over NDN. However, NDN is not immediately compatible with typical blockchain, since (permissionless) blockchain applications usually require broadcasting transactions and blocks in real time, which is not supported by the “pull” design of NDN. In this work, we propose BoNDN which enables blockchain applications over NDN. Unlike previous work, BoNDN follows the core design of NDN. We treat each type of blockchain data needed to be broadcast individually. Specifically, we rely on Interest broadcasting to support real-time broadcasting of blockchain transactions, which is small in size and can be brought by an Interest packet. In addition, we propose a subscription-push approach to support broadcasting of blockchain blocks, in which each miner performs subscription, and once a block is generated, the subscribed miner will receive the block.

User-generated content on social media platforms are major forces in the shaping and diffusion of popular topics. Online rumors among regular user-generated content have increased considerablely, and stimulate the diffusion of fake popular topics in the social network or even panic among people. The existing researches on rumor detection, such as the detection mechanisms based on Convolutional Neural Network (CNN) or Long Short-Term Memory (LSTM), suffer from their rough feature extraction processes, and thus need to be improved in terms of contextual feature extraction. This paper proposes a dynamic slide-window based text feature scoring and extraction mechanism, which facilitates accurate semantic structure representation. In addition, we design an effective rumor detection scheme by incorporating the proposed feature scoring and extraction with CNN. Extensive experiments on real-world datasets demonstrate that the proposed feature scoring and extraction mechanism can extract the important text features by considering their roles in on-line texts and the relations of these features, and thus the detection scheme can distinguish rumors from regular messages more accurately.

Full-duplex (FD) wireless is an attractive PHY technology with high potential to improve the throughput of WLAN due to bidirectional transmissions. However, existing FD MACs fail to fully take advantage of bidirectional transmissions because of neglecting a feature of FD wireless that whether to build bidirectional transmissions relies on the queuing state of peers. In this paper, we design PQ-MAC, the first FD MAC which exploits more bidirectional transmission opportunities by leveraging peers' queuing information. Since PQ-MAC seizes the neglected but important feature, PQ-MAC can improve the performance with a slight transmission overhead. Simulations show that, in a 1-cell FD WLAN, PQ-MAC can achieve higher throughput than existing MACs when the buffer of AP is relatively small (≤200 frames). When the buffer of AP is relatively large (>200 frames), PQ-MAC can reduce the queuing delay without the loss of throughput.

In today's society, there are plenty of services available, and customers are facing bigger challenge in choosing them than ever before. Therefore, it is important to build a reliable reputation mechanism for selecting a credible service. To address the challenges of reputation evaluation, including the diverse and dynamic natures of services, incompleteness of user feedback, and intricacy of malicious ratings, a High-reliability Multi-faceted Reputation evaluation mechanism for online services (HMRep) is proposed. First, HMRep starts with addressing the incomplete feedback and estimates missing ratings based on both the service quality and a user's rating behavior. Second, HMRep identifies and removes malicious collusive raters and irresponsible raters to improve the accuracy of reputation calculation. Further, the reputation calculation is based on the user credibility and incorporates historical information to reflect the change of the services. Finally, we provide a multi-faceted evaluation method to satisfy some specific needs of customers who are only concerned about a subset of a services features. Experimental results verify the design of HMRep, and reveal HMRep can effectively defend against malicious ratings, and accurately calculate the reputation values of services. HMRep can be applied in lots of sectors for different kinds of services, especially those complex ones.

Review history is widely used by recommender systems to infer users' preferences and help find the potential interests from the huge volumes of data, whereas it also brings in great concerns on the sparsity and cold-start problems due to its inadequacy. Psychology and sociology research has shown that emotion information is a strong indicator for users' preferences. Meanwhile, with the fast development of online services, users are willing to express their emotion on others' reviews, which makes the emotion information pervasively available. Besides, recent research shows that the number of emotion on reviews is always much larger than the number of reviews. Therefore incorporating emotion on reviews may help to alleviate the data sparsity and cold-start problems for recommender systems. In this paper, we provide a principled and mathematical way to exploit both positive and negative emotion on reviews, and propose a novel framework MIRROR, exploiting eMotIon on Reviews for RecOmmendeR systems from both global and local perspectives. Empirical results on real-world datasets demonstrate the effectiveness of our proposed framework and further experiments are conducted to understand how emotion on reviews works for the proposed framework.

Privacy leakage is an important issue for social recommendation. Existing privacy preserving social recommendation approaches usually allow the recommender to fully control users' information. This may be problematic since the recommender itself may be untrusted, leading to serious privacy leakage. Besides, building social relationships requires sharing interests as well as other private information, which may lead to more privacy leakage. Although sometimes users are allowed to hide their sensitive private data using privacy settings, the data being shared can still be abused by the adversaries to infer sensitive private information. Supporting social recommendation with least privacy leakage to untrusted recommender and other users (i.e., friends) is an important yet challenging problem. In this paper, we aim to address the problem of achieving privacy-preserving social recommendation under personalized privacy settings. We propose PrivSR, a novel framework for privacy-preserving social recommendation, in which users can model ratings and social relationships privately. Meanwhile, by allocating different noise magnitudes to personalized sensitive and non-sensitive ratings, we can protect users' privacy against the untrusted recommender and friends. Theoretical analysis and experimental evaluation on real-world datasets demonstrate that our framework can protect users' privacy while being able to retain effectiveness of the underlying recommender system.

Mobile edge computing (MEC) enables battery‐powered mobile nodes to acquire information technology services at the network edge. These nodes desire to enjoy their service under power saving. The sampling rate invariant detection (SRID) is the first downclocking WiFi technique that can achieve this objective. With SRID, a node detects one packet arrival at a downclocked rate. Upon a successful detection, the node reverts to a full‐clocked rate to receive the packet immediately. To ensure that a node acquires its service immediately, the detection performance (namely, the miss‐detection probability and the false‐alarm probability) of SRID is of importance. This paper is the first one to theoretically study the crucial impact of SRID attributes (e.g., tolerance threshold, correlation threshold, and energy ratio threshold) on the packet detection performance. Extensive Monte Carlo experiments show that our theoretical model is very accurate. This study can help system developers set reasonable system parameters for WiFi downclocking.

Named Data Networking (NDN) is a content-oriented future Internet architecture, which well suits the increasingly mobile and information-intensive applications that dominate today's Internet. NDN relies on in-network caching to facilitate content delivery. This makes it challenging to enforce access control since the content has been cached in the routers and the content producer has lost the control over it. Due to its salient advantages in content delivery, network coding has been introduced into NDN to improve content delivery effectiveness. In this paper, we design ACNC, the first Access Control solution specifically for Network Coding-based NDN. By combining a novel linear AONT (All Or Nothing Transform) and encryption, we can ensure that only the legitimate user who possesses the authorization key can successfully recover the encoding matrix for network coding, and hence can recover the content being transmitted. In addition, our design has two salient merits: 1) the linear AONT well suits the linear nature of network coding; 2) only one vector of the encoding matrix needs to be encrypted/decrypted, which only incurs small computational overhead. Security analysis and experimental evaluation in ndnSIM show that our design can successfully enforce access control on network coding-based NDN with an acceptable overhead.

This paper is concerned with the adaptation to multi-feature preferences on personalized search. In the existing work, the personalized search mainly leverages semantic features extracted from user history and ignores other non-semantic latent features, lets alone adapt to preference distribution on non-semantic features. To tackle this problem, we propose an adaptive model for multi-feature preferences, in which we adapt latent non-semantic features extracted from visited pages to reflect diverse aspects of user preferences. We also utilize a novel algorithm in our model to improve the adaptation for diverse preference distribution on these features for different users. Our experimental results demonstrate that our model can improve personalized search performance by enhanced adaptation to diverse user preferences.

As a promising architectural design for future Internet, named data networking (NDN) relies on in-network caching to efficiently deliver name-based content. However, the in-network caching is vulnerable to cache pollution attacks (CPA), which can reduce cache hits by violating cache locality and significantly degrade the overall performance of NDN. To defend against CPA attacks, the most effective way is to first detect the attacks and then throttle them. Since the CPA attack itself has already imposed a huge burden on victims, to avoid exhausting the remaining resources on the victims for detection purpose, we expect a lightweight detection solution. We thus propose ELDA, an Efficient and Lightweight Detection scheme against cache pollution Attacks, in which we design a Lightweight Flajolet-Martin (LFM) sketch to monitor the interest traffic. Our analysis and simulations demonstrate that, by consuming a few computation and memory resources, ELDA can effectively and efficiently detect CPA attacks.

The current BitTorrent-like file sharing systems suffer from peer selfish behaviors. The uncooperative peers can freeload compliant users by free-riding and exploiting. To study the performance of BitTorrent's embedded incentive mechanism against selfishness, a fluid model with three different classes of peers, namely normal peers, exploiters and free-riders, is established. We point out that the current BitTorrent system can not provide an effectively differentiated service in accordance with contribution of peers. Therefore, a reputation based incentive (RBI) mechanism for selfish BitTorrent system is proposed. RBI defines a trust value for each peer associative to its historical performance to the whole system. With the trust value, the choking mechanism is modified to ensure the more trustworthy peers will have more chances to get served. Our simulation study indicates that RBI mechanism can remarkably prevent exploiting behaviors, severely penalize free-riders, and thus result in a fairer allocation of bandwidth among peers.

To counter malicious peers in P2P systems, PeerTrust-like schemes take advantage of similarity between peers to compute service provider's trust value. To derive the similarity, there currently exist some approaches documented which however mostly are interested in algorithm or process enhancement, the analytic study in theory for these PeerTrust-like mechanisms might be missed. This paper focuses on the basic problems in PeerTrust-like trust schemes and makes the following distinctive contributions. It formalizes the generic framework of trust mechanisms in a probabilistic manner; gives the mathematical description for PeerTrust-like trust mechanisms; attempts to figure out some unclear questions: based on PeerTrust-like schemes, how to compute similarity via Euclidean distance; should all feedback be counted in; how to compare PeerTrust-like mechanisms with other distance/similarity computations.

Existing multipath routing protocols for MANET ignore the topology-exposure problem. This paper analyzes the threat of topology-exposure and proposes a Topology-Hiding Multipath Routing protocol (THMR). THMR doesn't allow packets to carry routing information, so malicious nodes cannot deduce topology information and launch various attacks based on that. The protocol can also establish multiple node-disjoint routes in a route discovery attempt and exclude unreliable routes before transmitting packets. We formally prove that THMR is loop-free and topology-hiding. Simulation results show that our protocol has better capability of finding routes and can greatly increase the capability of delivering packets in the scenario where there are attackers at the cost of low routing overhead.

The home agent can be a single point of failure in mobile IPv6 networks. Fault tolerance can be used to provide reliable home agent service. This paper proposes a home agent fault-tolerant method for mobile IPv6 networks. All home agents are formed into the structure of ring detection & backup chain by sorting them using a deterministic sorting algorithm, in which each home agent backups its bindings on the next adjacent home agent and its validation is monitored by the adjacent home agents. Each home agent is not only an active home agent, but also a standby one. Service takeover is fleetly implemented by the single replica of mobility bindings. Simulation results show that our method has less service break time and less global signal cost.

GPS navigators have been widely adopted by drivers. However, due to the sensibility of GPS signals to terrain, vehicles cannot get their locations when they are inside a tunnel or on a road surrounded by high-rises where the satellite signal is blocked. This incurs the safety and convenience problems. To address the issue, we propose a novel Grid-based On-road localizaTion system (GOT), where vehicles with or without accurate GPS signals self-organize into a vehicular ad hoc network (VANET), exchange location and distance information and help each other to calculate an accurate position for all the vehicles inside the network. GOT uniquely evaluates some fuzzy geometric relationship among vehicles and employs a grid-based approach to calculate vehicle's locations, by which GOT solves the issues of lack of beacon nodes and error propagation that are the two major challenges in on-road localization. Simulation shows our GOT system is very effective and efficient in calculating the vehicular positions.

To address the selfishness issue in application-layer multicast, we present a selfishness-aware application-layer multicast (SAM). SAM defines an altruism value for each node associative to its contributions to the system. Nodes are first partitioned into topologically-aware clusters using the binning scheme. Within the cluster, the subtree is constructed to place the nodes with greater altruism value at the higher layer of the tree. As compared to other studies in this area, SAM exhibits innovative advantages in both altruism value computation and multicast tree construction. Firstly, the node's altruism value is generated from the feedback from its parent and children which enables the system to detect the selfish nodes effectively. Peers don't need the extra probe messages to measure the QoS of their neighbors. During the process of tree construction and maintenance, only O(logN) nodes need to be adjusted. Lastly, the altruism value calculation and multicast tree construction are realized in a decentralized manner without any single point of failure. Simulation results show that even with a significant portion of nodes being selfish, SAM is able to build a dissemination tree that provides high overall streaming quality with low control overhead.

The current BitTorrent-like file sharing systems suffer from peer selfish behaviors. The uncooperative peers can freeload the compliant peers by various methods. To prevent the selfishness, this paper presents a file swap scheme, also known as Odd for Even (OFE), as an enhancement to the current BitTorrent. With OFE, the file is segmented into odd and even pieces; the peers swap the pieces according to "odd first, even later" rule. To study the performance of OFE against the selfish behaviors, a modeling for the related factors is established. We suggest that by using an appropriate file segmentation policy, the free-riders who don't make any contribution will undergo a longer download time; the semi-free-riders who only upload odd pieces, deliberately refuse to provide the even ones to save up half upload volume will not get their burden lessened. The experimental results show that OFE can punish these selfish peers effectively.

Recently, the IETF MIPSHOP working group proposes Fast PMIPv6 (FPMIPv6) and Transient Binding PMIPv6 (TPMIPv6) to reduce the handover latency and packets loss of PMIPv6. The research and standardization of FPMIPv6 and TPMIPv6 are just in the initial stage. The system performance analysis of them is benefit to the protocol design and deployment. In this paper, through the theoretical analysis and system simulation, we evaluate the handover latency of PMIPv6, FPMIPv6 and TPMIPv6 in vertical handover environment. Furthermore, in order to reflect handover performance more comprehensively, in system simulation, we also evaluate the UDP packets loss rate and the TCP throughput declining degree of such protocols. The results of theoretical analysis and simulation show that: (1) in vertical handover, the handover latency of FPMIPv6 is much larger than TPMIPv6 and PMIPv6. But the UDP packet loss rate of FPMIPv6 is smaller than TPMIPv6 and PMIPv6; (2) the handover performance of FPMIPv6-pre and TPMIPv6 much depend on MN's residence time in signal overlapped area.

Data-driven overlay network (DONet) especially works well with live-event streaming because data can be propagated in a relatively continuous way even with node dynamics. However, optimal streaming demands the cooperation of individual nodes. In the real world, some selfish participants which might delay forwarding or stop forwarding data can affect the overall streaming quality. To address the selfishness issue, we propose a selfishness-aware DONet (SA-DONet) in this paper. SA-DONet allows each node associative with an altruism value for its contributions to peers. Based on the altruism value, segment requesting and sending algorithms are designed to ensure the more altruistic nodes will have more chances to be served. The primary characteristic of our mechanism lies in three aspects. Firstly, SA-DONet can discover the selfish nodes in a decentralized manner and adjust the segment sending and requesting strategy dynamically. Secondly, selfish assessment (altruism value) comes from the node's history and doesn't require any extra probe and measuring packets. Lastly, our algorithms remain comparable computing complexity to DONet. Simulation results show that compared with DONet, even with a significant portion of nodes being selfish, SA-DONet can improve the streaming quality of global multicast session with low control overhead.

Trust relationship among multiple domains is the basis for inter-domain fast authentication. This paper proposes a fast authentication method combining inter-domain trust relationship for wireless mobile IPv6 networks. In order to implement inter-domain trust relationship, a dynamic trust maintenance mechanism is designed. Based on Combined Public Key (CPK) algorithm, a new signature and verification scheme is applied to accelerate the authentication process. This scheme supports the proposed trust-based mutual authentication between mobile node and the access network. Theoretical analysis and numerical results show that the proposed method is more effective in reducing authentication delay and signaling overhead. Additionally, the proposed method is proven to be tolerant of existential forgery and man-in-the-middle attacks.

In MIPv6, the home agent (HA) is the key entity to ensure a mobile nodepsilas (MN) reachability. A single HA on the home link will become a performance bottleneck. In order to enhance service availability and improve system performance, it is necessary to configure multiple HAs on the home link and efficiently balance load among these HAs. This paper proposes a dynamic multiple HA load balancing mechanism based on active overload prevention (DHALAOP). The solution actively prevents HA from overloading in advance, rather than just passively transferring excess load among HAs as previous load balancing mechanisms do. A novel dynamic weight load evaluation algorithm is introduced to provide the basis for optimal load balancing decision. In addition, DHALAOP utilizes single HA mirror image and load slicing scheme to achieve the transparency of load balancing and eliminate unnecessary additional overhead. The theoretical analysis results show that DHALAOP can be more efficient in enhancing service availability and improving system performance as compared with the previous mechanisms. At the same time it introduces a lower signaling cost.

In Mobile IPv6 networks, mutual authentication between mobile users and the network guarantees security of both sides. The integration of handoff procedure and authentication procedure may affect performance of the former while improving efficiency of the later. One important issue is to improve the overall efficiency of fast authentication. Based on the Combined Public Key (CPK) algorithm, a new signature and verification scheme is designed, which has a lower computational complexity than identity-based signature (IBS) scheme. Furthermore, a fast authentication method based on this scheme is proposed to realize mutual authentication in one round-trip. Theoretical analysis and numerical results show that the proposed method is more effective in reducing total handoff and authentication delay and the signaling overhead. Security analysis shows that the method is sufficient for privacy and unforgeability.

Access authentication is very important for deploying mobile IPv6 networks. In this paper, we design a two-level hierarchical identity-based signature scheme, based on which we propose a new hierarchical authentication scheme for mobile IPv6 networks. Our solution adopts multi-level network access identifier (NAI) as public key, which simplifies key management in wireless mobile environment. The handover procedure integrating authentication is also cut down by our hierarchical solution. And our solution accomplishes mutual authentication between terminal and network. We propose the handover latency analytical model to evaluate handover latency. The results show that our solution is more efficient than others, especially when a terminal is far away from its home domain and moves frequently. Security analysis shows that the proposed scheme is sufficient for privacy and unforgeability. An extended version for access authentication in multi-hierarchical mobile IPv6 networks is discussed.

Mobile IPv6 (MIPv6) protocol was released by IETF in 2004. Conformance testing is necessary to accelerate MIPv6 practicality. Formal description and test generation is the key issue in conformance testing. In order to describe and test MIPv6, we define finite state machine (FSM) and multi-node finite state machine (MN-FSM). We propose the method of hierarchical protocol description. MIPv6 is divided into four layers: network system layer, MIPv6 nodes layer, inner data structure management layer and discrete behaviors layer. We separately present the approaches to describe each layer by FSM and MN-FSM. We propose the test generation algorithm and generate MIPv6 test suite. The results of comparison show the validity of our proposed methods.

Session initiation protocol (SIP) has already been accepted as the signaling standard in 3G wireless systems. However, the handover procedure with SIP suffers from undesirable delay in multimedia applications. The performance for real-time mobile communication is decided by multiple factors, we only focus on the handover delay due to host mobility in this paper, especially the delay accumulated during movement detection, duplicate address detection (DAD), SIP session reestablishment, and AAA procedure. This paper offers a fast handover solution for SIP-based mobility (named FMSIP for short). The proposed method utilizes movement anticipation, tunneling, and AAA context transfer to alleviate handover delay. The performance analysis and simulation results are presented at the end of this paper

IPv6 is in its growing stage in which new protocols are being proposed and more and more IPv6 devices are being produced. Conformance testing is the most important method to improve the reliability of IPv6 implementations. With a view to provide test ability for IPv6, the features and the test requirements of IPv6 are analyzed. Two difficulties of the standard test framework applying to IPv6 conformance testing, test packets description and complicated algorithm implementation, are pointed out. IPv6 test framework is proposed to solve the two difficulties, in which a new IPv6 test suite specification language is defined. Two test methods, called the virtual test method and the low-layer congregating test method, are adopted to enhance single physical tester's test ability. IPv6 test suite is designed and four IPv6 implementations are tested. An example of test case is given to explain IPv6 test framework and IPv6 test suite specification language.