Despite being widely used in network intrusion detection systems (NIDSs), machine learning (ML) has proven to be vulnerable to adversarial attacks. White-box and black-box adversarial ML attacks of NIDS have been explored in several studies. However, white-box attacks unrealistically assume that the attackers have full knowledge of the target NIDSs. Meanwhile, existing black-box attacks can not achieve high attack success rate due to the weak adversarial transferability between models (e.g., neural networks and tree models). Additionally, neither of them explains why adversarial examples exist and why they can transfer across models. To address these challenges, this paper introduces ETA, anExplainableTransfer-based Black-Box AdversarialAttack framework. ETA aims to achieve two primary objectives: 1) create transferable adversarial examples applicable to various ML detectors and 2) provide insights into the existence of adversarial examples and their transferability within NIDSs. Specifically, we first provide a general transfer-based adversarial attack method applicable across the entire ML space. Following that, we exploit a unique insight based on cooperative game theory and perturbation interpretations to explain adversarial examples and adversarial transferability. On this basis, we propose an Important-Sensitive Feature Selection (ISFS) method to guide the search for adversarial examples, achieving stronger transferability and ensuring traffic-space constraints. Finally, the experimental results on three NIDSs datasets show that our method performs significantly effectively against several classical and state-of-the-art ML classifiers, outperforming the latest baselines. We conduct three interpretation experiments and two cases to verify our interpretation method's correctness. Meanwhile, we uncover two major misconceptions about applying machine learning to NIDSs systems.

To bridge the gap of conventional single-hop task offloading schemes in infrastructure-free scenarios, multi-hop task offloading schemes for IoT devices in Mobile Edge Computing (MEC) are desired to jointly optimize task offloading decisions and routing paths. In this paper, we investigate a hierarchical multi-hop edge computing framework and propose a joint Task Offloading and Relay Selection (TORS) scheme. It considers real-time computation at each relay node and employs directional searches to facilitate the task execution and results reporting at the fastest speed. However, finding the optimal TORS solution is a formidable challenge due to the time-varying network environments, the strong interdependence of decision sets across different time slots, and the high computational complexity. To address these challenges, we first leverage Lyapunov optimization to transform the stochastic TORS problem into a deterministic per-slot block problem, avoiding the need for extensive system prior knowledge. Subsequently, we propose a Soft Actor-Critic (SAC)-based algorithm, SAC-TORS, to find a satisfactory TORS solution with minimal computational complexity in a distributed manner. Accordingly, each IoT device can independently make self-determined and directional decisions with observable network information. Through extensive experiments, we demonstrate that the SAC-TORS outperforms state-of-the-art solutions, achieving performance improvements of up to 66%.

Effective adversarial attacks simulation is essential for the deployment of ensemble Intrusion Detection Systems (en- semble IDSs) in Satellite-Terrestrial Integrated Network (STIN). This is because it can automatically generate a large amount of adversarial samples to evaluate the robustness of different classifiers. Based on the result, it can further guide the STIN engineers to select proper classifiers in ensemble IDSs. Moreover, it can help the IDSs improve detect performance by their self- learning property in the adversarial attack process. However, the existing adversarial attack approaches suffer from the problems of low success rate and high overhead of communication and calculation due to the limited computing resources and long communication links of STIN. This results in their inefficiency in STIN. To address the above problems, we provide StinAttack as a robustness evaluation scheme for STIN. First, StinAttack provides a comprehensive and automatic robustness evaluation framework for IDSs in STIN with only few times interactions between terrestrial and satellite nodes. Second, StinAttack proposes an effective adversarial attack simulation based on lightweight gradient evaluation for ensemble IDSs. Third, we conduct experiments on 11 typical IDSs, 4 baseline popular adversarial attacks and our StinAttack. Experimental results show that our approach can effectively attack ensemble IDSs and the evaluation results based on real STIN dataset are instructive for designing secure networks.

In remote regions (e.g., mountain and desert), cellular networks are usually sparsely deployed or unavailable. With the appearance of new applications (e.g., industrial automation and environment monitoring) in remote regions, resource-constrained terminals become unable to meet the latency requirements. Meanwhile, offloading tasks to urban terrestrial cloud (TC) via satellite link will lead to high delay. To tackle above issues, Satellite Edge Computing architecture is proposed, i.e., users can offload computing tasks to visible satellites for executing. However, existing works are usually limited to offload tasks in pure satellite networks, and make offloading decisions based on the predefined models of users. Besides, the runtime consumption of existing algorithms is rather high. In this paper, we study the task offloading problem in satellite-terrestrial edge computing networks, where tasks can be executed by satellite or urban TC. The proposed Deep Reinforcement learning-based Task Offloading (DRTO) algorithm can accelerate learning process by adjusting the number of candidate locations. In addition, offloading location and bandwidth allocation only depend on the current channel states. Simulation results show that DRTO achieves near-optimal offloading cost performance with much less runtime consumption, which is more suitable for satellite-terrestrial network with fast fading channel.

Advanced Persistent Threat (APT) is a stealthy, continuous and sophisticated method of network attacks, which can cause serious privacy leakage and millions of dollars losses. In this paper, we introduce a new game-theoretic framework of the interaction between a defender who uses limited Security Resources(SRs) to harden network and an attacker who adopts a multi-stage plan to attack the network. The game model is derived from Stackelberg games called a Multi-stage Maze Network Game (M2NG) in which the characteristics of APT are fully considered. The possible plans of the attacker are compactly represented using attack graphs(AGs), but the compact representation of the attacker’s strategies presents a computational challenge and reaching the Nash Equilibrium(NE) is NP-hard. We present a method that first translates AGs into Markov Decision Process(MDP) and then achieves the optimal SRs allocation using the policy hill-climbing(PHC) algorithm. Finally, we present an empirical evaluation of the model and analyze the scalability and sensitivity of the algorithm. Simulation results exhibit that our proposed reinforcement learning-based SRs allocation is feasible and efficient.

With the rapid growth of multimedia content in the social content-centric network (SocialCCN), in-network caching and caching strategy are becoming more and more important for efficient content delivery, but it also brings huge challenges to the cache space and computing capabilities in the network. In order to increase cache space and improve the computing capability in SocialCCN, in this paper, we integrate Mobile edge computing with SocialCCN (MeSoCCN) and design a novel caching strategy in MeSoCCN. Firstly, we proposed MeSoCCN, a novel architecture that integrates Mobile Edge Computing (MEC) in SocialCCN. Then, in MeSoCCN, a caching strategy based on popularity prediction is designed, which can increase the cache hit rate and reduce hop redundancy. We predict content popularity in the future and make cache placement and replacement decisions based on the prediction results. Finally, we conducted experiments and verified the effectiveness of the proposed caching strategy in MeSoCCN.