Microservice architectures have become mainstream for cloud-native applications, and distributed tracing is widely used to ensure system observability. Trace is essentially an aggregated data with multimodal attributes (e.g., performance metric, invocation log, and topology relationships). Existing methods typically do not adequately consider the complex correlations and interactions between the different modalities of trace, whereas fusing multimodal data into a unified analysis provide the possibility to improve performance. On the other hand, most of the existing methods are trained in an unsupervised manner and cannot utilize historical data. Therefore, this article proposes a trace anomaly detection method using graph-based semi-supervised learning, TraceGSAD. It extracts features of trace from multiple modalities and train an improved message-passing neural network to fuse features for unified modeling and generate a graph-level representation. The end-to-end deep anomaly detection model trained in an semi-supervised manner, using only a small amount of labeled data to achieve superior performance. The evaluation on the microservice benchmarks show that TraceGSAD achieves a high precision, outperforming state-of-the-art trace anomaly detection approaches. It also demonstrates the effectiveness of multimodal fusion analysis as well as the use of empirical data in semi-supervised learning that can significantly improve anomaly detection performance.

After trading the hardware cost and deployment complexity of inter-microservice communication architecture, the data plane of service mesh has gradually changed from sidecar mode to sidecarless mode. In sidecarless mode, the traffic of microservices need to be processed by zero-trust tunnel, so that the confidentiality, integrity and authentication of application data can be achieved. Thus, the efficiency of zero trust tunnel has a great impact on the performance of inter-microservices communication. However, current zero trust tunnel schemes require additional data transmission and processing, resulting in serious performance degradation. Thus, in this paper, we propose an efficient zero-trust tunnel which is called EZTunnel. Based on a programmable kernel, EZTunnel can execute L4 traffic management and security policies during system calls, thereby improving the communication performance between microservices. Through experiments under different traffic characteristic, we show that EZTunnel can achieve better inter-microservice request response delay, flow completion time and communication bandwidth than current zero-trust tunnel.

The Transport Layer Security (TLS) protocol has been widely used in software-defined perimeter (SDP) to establish secure, encrypted connections between distributed SDP components. To improve communication efficiency of its handshake protocol, the latest TLS standard (i.e., TLS 1.3) introduces a zero round-trip-time (0-RTT) handshake. However, traditional 0-RTT handshake protocols lack a forward secure key exchange scheme, so encrypted data that have already been transmitted could be potentially leaked to attackers after the pre-shared key (PSK) is compromised. To achieve secure TLS handshake with minimal communication cost, several forward secure 0-RTT key exchange schemes based on puncturable encryption were proposed. However, they are not applicable to real world SDP environments, because they either need to pre-store a large number of secret keys in the host onboard phase, or require a large number of complex cryptography operations (e.g., bilinear-pairing) in the access phase. Therefore, to avoid high computational overhead while still maintaining communication efficiency and forward security, a novel 0-RTT key exchange scheme based on efficient puncturable key encapsulation mechanism is proposed in this paper. Experimental results show that, with reasonable (and configurable) memory consumption, the latency performance of the proposed scheme is about 30% better than FFDHE3072, which is a practical 1-RTT key exchange scheme in TLS 1.3.

Image outpainting technology generates visually plausible content regardless of authenticity, making it unreliable to be applied in practice. Thus, we propose a reliable image outpainting task, introducing the sparse depth from LiDARs (Light Detection And Ranging devices) to extrapolate authentic RGB scenes. The large field view of LiDARs allows it to serve for data enhancement and further multimodal tasks. Concretely, we propose a Depth-Guided Outpainting Network to model different feature representations of two modalities and learn the structure-aware cross-modal fusion. And two components are designed: 1) The Multimodal Learning Module produces unique depth and RGB feature representations from the perspectives of different modal characteristics. 2) The Depth Guidance Fusion Module leverages the complete depth modality to guide the establishment of RGB contents by progressive multimodal feature fusion. Furthermore, we specially design an additional constraint strategy consisting of Cross-modal Loss and Edge Loss to enhance ambiguous contours and expedite reliable content generation. Extensive experiments on KITTI and Waymo datasets demonstrate our superiority over the state-of-the-art method, quantitatively and qualitatively.

Few-shot Named Entity Recognition (NER) aims to recognize unseen name entities based on a tiny support set that consists of seen name entities and labels, which is obviously different from traditional supervised NER methods. Contrastive learning has become a popular solution for few-shot NER, which improves the robustness of NER to handle unlabeled entities by learning a similarity metric to measure the semantic similarity between test samples and entity labels. However, existing contrastive learning based NER methods individually learn the word embedding in source and target domains, ignoring connections between entities with the same label and limiting the effectiveness of contrast learning. In this paper, we propose a novel few-shot NER framework that jointly models different domain texts and optimizes a generalized objective of differentiating between words in all stages. The proposed model builds the cross-domain attention layer to enhance the feature representations of words and transfer the entity similarity information from the source domain to the target domain. This significantly reduces the divergence between entities with same label. Experimental results on the largest Few-shot NER dataset show that CDANER significantly outperforms all baseline methods, which verifies the effectiveness and robustness of the proposed model.

In recent years, the concept of Zero Trust Networks (ZTN) has been proposed to overcome unrealistic security assumptions, e.g., what lies in private networks (such as data centers) is always trusted and safe. In ZTN, no device or user is assumed to be secure, instead all connections have to be authenticated and authorized before being established. Software Defined Perimeter (SDP) is one of the most promising solution for ZTN, where the gateway allows clients to access services only after receiving legitimate Single Packet Authorization (SPA) data. However, existing SDP solutions either (1) need to decouple the SPA from the connection request, resulting in redundant communication processes and impersonation attacks; or (2) need to copy the SPA data to the user space from sniffers, causing the packets to enter the protocol stack repeatedly. Due to the large number of short-lived streams in the data center, inefficiency and insecurity of the SPA process lead to severe connection delays and network attacks (e.g., DDoS). To this end, we propose an eBPF-based Dynamic Perimeter (EDP) to enhance the security and performance of SDP. By using EDP, authentication data can be efficiently embedded into every packet and checked before entering the receiver's protocol stack. Experimental results show that the connection delay of EDP is 80% less than that of the existing state-of-the-art solutions.

Nowadays, we have witnessed the rise of botnet malicious activities. These botnets, as expected, are launched by Domain generation algorithm (DGA) to evade detection. There is a growing concern that the artificially designed DGA detection features are being vulnerable to attackers, where any well-designed manipulations would evade these existing feature-based detection and even the more robust behavior-based detection. One common point of existing evasion for behavior detection is using domain names with low query rate. In this paper, we propose FProbe, a novel technology using co-occurrence matrix and relaxed clustering procedure, which performs excellent performance in the scene of detecting low query rate and multi-domain evasion. We use a simple intuition, that is, DGA queries have a strong correlation between temporal and spatial features, but these temporal and spatial correlations are not very synchronous. The FProbe uses the co-occurrence matrix, which is widely used in the field of product recommendation and word frequency co-occurrence, and use these unsupervised methods to cluster infected hosts. In particular, through this matrix, we can quickly and effectively locate infected hosts in the scene of low query rate, instead of discarding the domain for its high threshold. Then, we use the relax association rules of Frequent Sequence Tree to cluster related domain names, and use supervised learning to determine malicious clusters. The FProbe has been evaluated in the campus network (4000 active users in peak load hours) and ISP DNS traffic (one billion queries per hour). The experimental results ( 96.3% accuracy rate of 1.9% false positive on average) illustrate the efficiency and accuracy of FProbe.

Flow watermarking is a promising active traffic tracking technology. It helps to establish the correspondence between the sender and the receiver, by embedding watermarks into packets with certain features of active interference traffic. Existing watermarking technologies have several drawbacks, such as the vulnerability to multi-flow attacks, low robustness and invisibility. This paper proposes a new traffic tracking technique based on hidden Markov model, called Hidden Markov State-based Flow Watermarking (HMSFW). HMSFW divides the observation range, i.e., inter-packet time, as Markov states and uses the State Transition Probability Mean (STPM) as the watermark carrier. It then adjusts the STPM of a given time interval according to historical traffic characteristics. The proposed HMSFW not only improves the robustness of embedded watermarks, but also effectively enhances their invisibility. The feasibility and invisibility of HMSFW are validated via extensive experimental results.

A growing number of multi-view data arises naturally in many scenarios, including medical diagnosis, webpage classification, and multimedia analysis. A challenge in learning from multi-view data is that not all instances are fully represented in all views, resulting in missing view data. In this paper, we focus on feature-level completion for missing view of multi-view data. Aiming at capturing both semantic complementarity and identical distribution among different views, an Isomorphic Linear Correlation Analysis (ILCA) method is proposed to linearly map multi-view data to a feature-isomorphic subspace through learning a set of excellent isomorphic features, thereby unfolding the shared information from different views. Meanwhile, we assume that missing view obeys normal distribution. Then, the missing view data matrix can be modeled as a low-rank component plus a sparse contribution. Thus, to accomplish missing view completion, an Identical Distribution Pursuit Completion (IDPC) model based on the learned features is proposed, in which the identical distribution constraint of missing view to the other available one in the feature-isomorphic subspace is fully exploited. Comprehensive experiments on several multi-view datasets demonstrate that our proposed framework yields promising results.

In multi-view learning applications, like multimedia analysis and information retrieval, we often encounter the corrupted view problem in which the data are corrupted by two different types of noises, i.e., the intra- and inter-view noises. The noises may affect these applications that commonly acquire complementary representations from different views. Therefore, how to denoise corrupted views from multi-view data is of great importance for applications that integrate and analyze representations from different views. However, the heterogeneity among multi-view representations brings a significant challenge on denoising corrupted views. To address this challenge, we propose a general framework to jointly denoise corrupted views in this paper. Specifically, aiming at capturing the semantic complementarity and distributional similarity among different views, a novel Heterogeneous Linear Metric Learning (HLML) model with low-rank regularization, leave-one-out validation, and pseudo-metric constraints is proposed. Our method linearly maps multi-view data to a high-dimensional feature-homogeneous space that embeds the complementary information from different views. Furthermore, to remove the intra- and inter-view noises, we present a new Multi-view Semi-supervised Collaborative Denoising (MSCD) method with elementary transformation constraints and gradient energy competition to establish the complementary relationship among the heterogeneous representations. Experimental results demonstrate that our proposed methods are effective and efficient.

In some real world applications, like information retrieval and data classification, we often are confronted with the situation that the same semantic concept can be expressed using different views with similar information. Thus, how to obtain a certain Semantically Consistent Patterns (SCP) for cross-view data, which embeds the complementary information from different views, is of great importance for those applications. However, the heterogeneity among cross-view representations brings a significant challenge on mining the SCP. In this paper, we propose a general framework to discover the SCP for cross-view data. Specifically, aiming at building a feature-isomorphic space among different views, a novel Isomorphic Relevant Redundant Transformation (IRRT) is first proposed. The IRRT linearly maps multiple heterogeneous low-level feature spaces to a high-dimensional redundant feature-isomorphic one, which we name as mid-level space. Thus, much more complementary information from different views can be captured. Furthermore, to mine the semantic consistency among the isomorphic representations in the mid-level space, we propose a new Correlation-based Joint Feature Learning (CJFL) model to extract a unique high-level semantic subspace shared across the feature-isomorphic data. Consequently, the SCP for cross-view data can be obtained. Comprehensive experiments on three data sets demonstrate the advantages of our framework in classification and retrieval.