Log anomaly detection plays a pivotal role in ensuring system stability and security, particularly in largescale environments characterized by the generation of log data at exceptionally high volumes and velocities. Conventional approaches often struggle to effectively filter log information and fully leverage temporal dynamics, resulting in challenges such as information loss, semantic drift, and heightened computational overhead. To overcome these limitations, we present QYXLAD, an innovative log anomaly detection framework. QYXLAD enhances log representation accuracy by seamlessly integrating temporal and semantic information. It introduces a MPMM(Multi-level Progressive Masking Mechanism)-based Feature Fusion designed to capture temporal dependencies and semantic features across diverse pattern combinations, thereby significantly improving the sensitivity and precision of anomaly detection. Furthermore, QYXLAD utilizes a Mamba-based classifier for anomaly identification. Comprehensive theoretical analysis and empirical evaluations demonstrate that QYXLAD achieves state-of-the-art performance on multiple public log datasets, surpassing existing methods in key metrics such as precision, recall, and F1-score. These results underscore the framework’s efficacy and superiority in addressing log anomaly detection challenges.

DHCP is widely deployed in WLANs to automatically assign IP addresses to WiFi devices when users connect to the WLANs. However, frequent user mobility brings big challenges to the DHCP performance. Recently proposed IP configuration (e.g., IP lease time, size of IP address pool) decisions on DHCP are based on traditional models to study user mobility patterns which lead to poor DHCP performance since the online time of individuals varies due to their personal pReferences and the number of crowds differs spatially and temporally. In this paper, we propose PredHCP, a predictive configuration framework on DHCP to improve the DHCP performance. Specifically, PredHCP utilizes an attention-based recurrent neural network (ARNN) to learn sequential patterns of individual mobility and accurately predicts user online time to ensure the effective IP lease time configuration. Meanwhile, PredHCP introduces a spatio-temporal graph neural network (STGNN) to learn both spatial and temporal dependencies of crowd migration and accurately predict crowd size in each area to ensure effective IP pool configuration. We conduct comprehensive experiments on real network traces for a month to evaluate the performance of PredHCP. Experimental results show that PredHCP can accurately predict user mobility patterns by achieving lower prediction errors. By accurately modeling mobility patterns, PredHCP makes effective IP configuration to ensure high DHCP performance. Large-scale simulation results show that PredHCP can save up to 69% IP addresses and the IP efficiency is 41% which outperforms existing methods by 6%.

BGP anomaly has a major impact on the stability, availability, and efficiency of the Internet, thus locating the network element which initiates the anomaly is crucial for network recovery. However, BGP is an information-hiding protocol and BGP anomalies are heterogeneous, which limit the ability to perform root cause localization. This paper proposes an approach to automatically detect large-scale BGP anomaly and locate the root cause in an efficient and generalized fashion. Firstly, time-series analysis and clustering strategy are performed on BGP traffic to ascertain "when" and "where" anomaly happened to start the investigation. Next, based on interdomain routing’s propagation property, a subtopology is constructed which not only reveals the dynamic evolution during anomaly, but also helps narrow down the scale of the Internet for further root cause analysis. Last, by taking deep analysis in the routing characteristics of the root cause from different anomalous scenarios, a routing dependence-based algorithm is developed to realize the localization goal. The proposed method is validated on three different real-world, large-scale BGP anomalies. Results demonstrate its effectiveness and robustness, and in most cases the root causes identified with maximum likelihood are consistent with ground-truths. Further investigations reveal some insights which are helpful for network administrations.

Resource Public Key Infrastructure (RPKI) defends against BGP prefix hijacking by signing Route Origin Authorizations (ROAs) and filtering malicious BGP routes with ROAs. However, RPKI's low deployment weakens its defense against prefix hijacking. In the absence of a large fraction of Autonomous Systems (ASes) signing ROAs, the incentive to use filtering to eliminate hijacked prefixes commensurately decreases. There is a cyclic dependency here because reduced filtering in turn lessens the incentive for non-adoptees to become adoptees. Previous studies on RPKI deployment are mainly from the measurement perspective or focus on the deployment of large Internet Service Providers (ISPs). The above circular dependency problem inside the RPKI has not been fully studied. To improve RPKI's defense, this paper studies the circular dependency problem from an evolutionary game theory perspective. We model the strategy evolution of ASes choosing to deploy signing alone, deploy filtering alone, or deploy both signing and filtering. The results show that when the deployment rates of signing and filtering reach a certain range, the evolution can reach an ideal deployment state at a faster speed. Therefore, to increase the probability of evolution reaching the ideal deployment state, we propose RPKIN to widen this interval and reduce the minimum deployment rate required for signing and filtering.

The hierarchical network is the more effective platform, which provides multiple channels for various worm propagation. Thus, emerging worms can infect vulnerable hosts by scanning strategy and social media. However, the spread of scan-based worm is restrained due to uneven distribution of vulnerable hosts and NAT (Network Address Translation) technique. Meanwhile, topological dependency dictates to topology-based worm only infecting those hosts in social networks. To avoid their respective disadvantages, modern hybrid worm, which combines the above two propagation mechanisms, can implement efficient IP-address scanning by enhanced combination-scanning strategy, and spread more aggressively in social networks using enhanced reinfection mechanism. This paper presents a Hierarchical-Stochastic Propagation model to understand hybrid worm propagation. Inspired by hybrid worm, we design a new vaccine based on the Hierarchical-Measure Immunization strategy. For physical networking layer, we can estimate vulnerable-host distribution to find vulnerable hosts effectively through Maximum Likelihood estimation. For social networking layer, we use a novel propagation centrality measure to discover vital social nodes accurately. The experimental results show that our model can characterize the propagation mechanism of hybrid worms more comprehensively, and greatly outperforms state of the art models in terms of estimation accuracy. Meanwhile, our strategy is more effective to restrain the hybrid worm from spreading in networks.

Software Defined Network (SDN) has been widely used in modern network architecture. The SD-WAN is considered as a technology that has a potential to revolutionize the WAN service usage by utilizing the SDN philosophy. Attacking SDN router and controller can affect the network and block the entire services. In this paper, we propose a machine learning based anomalous traffic detection framework named OADSD over SD-WAN that can achieve task independent and has the ability of adapting to the environment. The OADSD adopts Distributed Dynamic Feature Extraction (DDFE) to extract representative features directly from the raw traffic, and proposes the On-demand Evolving Isolation Forest (OEIF) to make the system adapt to an environment. We provide a theoretical analysis of the performance of the OADSD. We also conduct comprehensive experiments to evaluate the performance of the OADSD with real world public datasets as well as a small real testbed. Our experiments under real world public datasets show that, the OADSD can accurately detect various kinds of attacks with a high performance. Compared with the state-of-the-art systems, the OADSD can achieve up to 60% accuracy improvement.

In the inter-domain network, route leaks can disrupt the Internet traffic and cause large outages. The accurate detection of route leaks requires the sharing of AS business relationship information. However, the business relationship information between ASes is confidential. ASes are usually unwilling to reveal this information to the other ASes, especially their competitors. In this paper, we propose a method named FL-RLD to detect route leaks while maintaining the privacy of business relationships between ASes by using a blockchain-based federated learning framework, where ASes can collaboratively train a global detection model without directly disclosing their specific business relationships. To mitigate the lack of ground-truth validation data in route leaks, FL-RLD provides a self-validation scheme by labeling AS triples with local routing policies. We evaluate FL-RLD under a variety of datasets including imbalanced and balanced datasets, and examine different deployment strategies of FL-RLD under different topologies. According to the results, FL-RLD performs better in detecting route leaks than the single AS detection, whether the datasets are balanced or imbalanced. Additionally, the results indicate that selecting ASes with the most peers to first deploy FL-RLD brings more significant benefits in detecting route leaks than selecting ASes with the most providers and customers.

Human mobility prediction is of great importance for various applications such as smart transportation and personalized recommender systems. Although many traditional pattern-based methods and deep models ($e.g.,$ recurrent neural networks) based methods have been developed for this task, they essentially do not well cope with the sparsity and inaccuracy of trajectory data and the complicated high-order nature of the sequential dependency, which are typical challenges in mobility prediction. To solve the problems, this paper proposes a novel framework named G raph C onvolutional D ual-a ttentive N etworks (GCDAN), which consists of two modules: spatio-temporal embedding and trajectory encoder-decoder. The first module employs a bidirectional diffusion graph convolution to preserve the spatial dependency in the location embedding. The second module employs a dual-attentive mechanism based on a Sequence to Sequence architecture to effectively extract the long-range sequential dependency within a trajectory and the correlation between different trajectories for predictions. Extensive experiments on three real-world datasets show that GCDAN achieves significant performance gain compared with state-of-the-art baselines.

The rapid growth of video traffic imposes significant challenges on content delivery over the Internet. Meanwhile, edge computing is developed to accelerate video transmission as well as release the traffic load of origin servers. Although some related techniques (e.g., transcoding and prefetching) are proposed to improve edge services, they cannot fully utilize cached videos. Therefore, we propose a Learning-based Fuzzy Bitrate Matching scheme (LFBM) at the edge for adaptive video streaming, which utilizes the capacity of network and edge servers. In accordance with user requests, cache states and network conditions, LFBM utilizes reinforcement learning to make a decision, either fetching the video of the exact bitrate from the origin server or responding with a different representation from the edge server. In the simulation, compared with the baseline, LFBM improves cache hit ratio by 128%. Besides, compared with the scheme without fuzzy bitrate matching, it improves Quality of Experience (QoE) by 45%. Moreover, the real-network experiments further demonstrate the effectiveness of LFBM. It increases the hit ratio by 84% compared with the baseline and improves the QoE by 51% compared with the scheme without fuzzy bitrate matching.

Software Defined Networking (SDN) provides flexible and convenient means to support fine-grained management by the logically centralized control. Thus SDN can not only result in better network capacity utilization but can offer better customer satisfaction. In this paper, we analyze and consolidate the utility theory of network bandwidth allocation to offer better customers' satisfaction in SDNs especially when SDNs are incrementally introduced into an existing network. The utilities are modeled as sigmoid curves, since they are well-known functions and often used to describe the perception of Quality of Service (QoS). We propose an optimization bandwidth allocation strategy to maximize the network utility and thus increase the customer satisfaction. The results show that the network utility based on customer satisfaction improvements are possible with proper bandwidth allocation even only a part of SDN forwarding devices in a network topology. Compared with other bandwidth allocation strategies based on fairness, our strategy is more efficient in fulfilling the basic demand of customers.

Database driven IP geolocation is a convenient and common way to determine geographic location of an IP address. However, the underlying problem is that it is often difficult for users to determine which provider is reliable enough to meet their own scenarios. In this paper, we tackle this challenge in a data fusion perspective. We first evaluate the consistency degree of data entries among 5 free geolocation databases and employ it as an indicator of data quality assessment. We find that this indicator varies by geographic scope and granularity for a certain provider. Therefore we are able to evaluate data quality for different parts and dimensions within a database. Then a data fusion method utilizing data consistency degree and quota-based votes is proposed and analyzed. Over 40 million IP geolocation ground truth data in China, i.e., more than 10% of the total address space allocated to China, is applied to verify the effectiveness and advantage of the proposed method. In this work, we provide insights into comprehensive utilization of multi-databases characteristics for data entry fusion in the absence of enough priori knowledge.