In computer networks, traffic measurement is a module in a network probe to measure flow-level statistics from an IP packet stream, which are the basis for network performance monitoring and malicious activity detection. This module extracts the flow IDs from incoming IP packets, classifies packets into flows, and counts the number of packets (or bytes) for each flow. It is a great challenge to measure the per-flow statistics for a high-speed network device, using only the size-limited SRAM on its line cards. Therefore, many algorithms using sublinear memory have been proposed, such as CountMin and CountSketch. However, most of previous algorithms are designed for specific measurement tasks. To obtain multiple types of statistics, people have to deploy multiple sketches, which demands more resources of a network device. It is useful to design a universal sketch that can track not only the top-$k$largest individual flows (called heavy hitters) but also the overall traffic distribution statistics (called moments). Prior work named UnivMon successfully tackled this ambitious quest. However, it incurs large and variable per-packet processing overhead, which may result in a significant throughput bottleneck in high-rate packet stream, given that each packet requires 33 hashes and 32 memory accesses on average and many times of that in the worst case. To address this performance issue, we fundamentally redesign the solution architecture from hierarchical sampling to new progressive sampling and from CountSketch to new GenericCM, which ensure that per-packet overhead is a small constant (5 hashes and 8 memory accesses in the worst case), making it more suitable for online operations, especially for hardware pipeline implementation. This new design also makes effort to reduce memory footprint or equivalently improve measurement accuracy under the same memory. Our experiments show that our solution reduces measurement error by roughly 98.1% for second-order moment and by 91.5% for entropy, when given the same 0.2MB memory as UnivMon.

Affected by the COVID-19 pandemic, teleworking is becoming more popular, with the exposed attack surface of the internal network expanding. Once outsiders personate accounts or insiders conduct illegal operations, the data security in teleworking with traditional border protection will be broken. Therefore, it is necessary to implement fine-grained and dynamic access control to protect data from malicious access. Attribute-based access control (ABAC) is ideal, where authorization is performed through attributes and rules. On this basis, risk assessment, context awareness, and machine learning are supplemented for dynamic access control. However, these methods have their limitations due to the requirement of sufficient prior knowledge and massive label-classified data. Moreover, it is challenging to obtain the samples of attack behaviors, and the attack behaviors may change frequently to evade detection. In contrast, the normal behaviors are relatively stable except for the update of network services. We propose a dynamic access control model, ABAC-IntroVAE, to address the above issues. ABAC-IntroVAE judges users' requests through rule matching and behavior analysis based on the attributes of the requests. It first filters out requests against the rules by rule matching. Then, the introspective variational autoencoder (IntroVAE) is used for behavior analysis to realize dynamic access decisions. Requests classified as normal can be authorized for access. ABAC-IntroVAE only needs samples of normal requests for training, avoiding the difficult task of collecting massive and frequently changing samples of attack requests. Meanwhile, the IntroVAE model is updated through continual learning to adapt to new-style normal behaviors due to the update of network services. Our experiment study suggests that our proposed ABAC-IntroVAE can effectively perform dynamic access control. It achieves an accuracy of 97.2% in abnormal detection and maintains an accuracy of over 97% through continual learning, despite the addition of new-style user behavior patterns.