Graph alignment, the task of identifying corresponding nodes across different graphs, is crucial for applications ranging from social network analysis to bioinformatics. Although most existing methods leverage graph neural networks (GNNs) to learn node embeddings for attributed graphs and match them based on node similarity, they often rely on objectives designed for node classification or link prediction. These approaches preserve node proximity within individual graphs but fail to capture cross-graph correspondence knowledge, leading to suboptimal alignment performance.

This paper develops a distributed reinforcement learning (RL) method to coordinate cooperative microgrids (MGs). The high uncertainty of power loads and renewable energy sources motivate the operator to perform real-time dispatch. On the one hand, the existing online methods usually utilize approximate models that result in intractable constraint violation. A common method is to relax it as a chance constraint, while it is still hard to ensure its satisfaction in practice. On the other hand, some MGs may hope to preserve the private information on their local costs and states. To address these problems, we make the following contributions. First, the coordination problem is reformulated as a constrained multi-agent Markov decision process. Second, the distributed RL algorithm with a theoretical convergence guarantee is developed. Third, to further preserve the local private information and improve the performance, this algorithm is modified by adding a local feature extraction module for each agent. This module could also be regarded as an encryption module for the local state information. Fourth, numerical experiments are carried out to validate the effectiveness of the modified algorithm.

With the growing complexity of modern micro-architectures, processor design must accommodate a wide array of parameters, resulting in vast design spaces. Identifying the optimal trade-offs among various design metrics poses a significant challenge. Performance is inherently difficult to model analytically, while area can be represented by analytical models. Performance evaluation relies on expensive and time-consuming cycle-accurate simulators (CAS), which puts forward strict requirements on the convergence speed and data dependence of the optimization methods. In this paper, based on the characteristics of the design metrics, the processor design problem is modeled as a hybrid black-box and white-box multi-objective discrete optimization problem (BWMO-DOP). In engineering applications, parallel simulation is a common acceleration technology. Therefore, white-box objective, area, is formulated as parallel constraints, while black-box objective, performance, is approximated by order-preserving surrogate objective. And then, BWMO-DOP is simplified into parallel single-objective expensive black-box optimization problems, which are solved by an efficient SOP-MOOA. SOP-MOOA iteratively explores more design points, enhancing the accuracy of the surrogate model while simultaneously updating the Pareto set. Experimental results demonstrate that the proposed algorithm outperforms baseline algorithm in an engineering case and three general numerical cases. In the engineering experiment for performance-area optimization, the proposed algorithm outperforms the baseline algorithm by a factor of more than two when considering the combined effect of performance improvement percentage and area reduction percentage. In numerical tests conducted on three 40-dimensional black-box functions under the same evaluation overhead, the proposed algorithm consistently identified Pareto set of superior quality.

Buildings account for substantial global energy consumption, with heating, ventilation, and air conditioning (HVAC) systems as major contributors. We study the setpoint schedule optimization of HVAC systems that minimize both energy costs and occupant discomfort. Since building performance simulation (BPS) tools provide high-fidelity models of building dynamics, integrating simulation with optimization is expected to obtain an effective schedule for building energy management. Consequently, many simulation-based optimization methods that integrate BPS into optimization processes are proposed. However, these methods still face challenges due to non-analytical system dynamics, computational complexity, and the lack of theoretical convergence guarantees. To address these challenges, a Lagrangian relaxation-based simulation optimization (LRSO) method is developed in this paper. A dynamic linear surrogate model iteratively refines itself with simulation outputs, balancing tractability and accuracy. Within Lagrangian relaxation framework, the problem is decomposed into simulation and optimization subproblems, which can be solved in a coordinated and decomposed way. The surrogate subgradient method further ensures the convergence. Experimental results demonstrate its superior performance in minimizing energy cost and occupant discomfort across all test scenarios, with computational times suitable for real-time scheduling.

This paper studies the online management of the computational resources between multiple edge clouds to minimize the operational cost for a vehicle-to-network (V2N) service provider, subject to stochastic trajectories of vehicles, the quality-of-service (QoS) and the resource limit. Due to the random mobility of vehicles, it poses challenges in real-time migration management when the computational capacity of each edge cloud and the stringent delay requirement of V2N services are both constrained, resulting in strong temporal-spatial coupling of the migration decisions. The problem could even be intractable to solve as the number of vehicles grows. To tackle these issues, we first propose a multi-layered cloud framework to gather and coordinate migration information between vehicles. Then, a multiagent rollout with feasibility construction approach is developed, where the migration decision can be optimized sequentially for each vehicle based on the coordinated migration information from the central cloud. To handle the potentially infeasible solutions caused by the computational resource constraint, we propose a heuristic method to determine the migration priority at each overloading edge cloud, and an integer program is constructed that can be easily solved to produce feasible solutions. The numerical results show the efficiency of the proposed approach in both economical performance and computational complexity compared to the benchmarks.

Design space exploration (DSE), which aims to optimize the parameter configurations for the processor with a limited evaluation budget, is an important but challenging problem. Processor performance for a given parameter configuration can only be obtained through expensive evaluations. A key characteristic of processor DSE is that the optimization objective is the benchmark score, which is typically computed as a weighted combination of multiple sub-benchmark scores. Each sub-benchmark score can only be obtained through a costly evaluation. Bayesian optimization (BO) is widely used for DSE through an iterative process, where a surrogate model is constructed and updated to guide the selection of parameter configurations in each iteration. However, during the optimization process, it is not always necessary to evaluate all subbenchmarks for every recommended parameter configuration. In some cases, evaluating only a subset of sub-benchmarks can still provide significant improvements to the surrogate model. This paper proposes a BO-based algorithm that effectively utilizes the evaluation budget for efficient optimization. In each iteration, the evaluation budget is divided into two parts: exploitation and exploration. For the exploitation part, we propose a diversity-aware horse racing selection rule and use ordinal optimization to identify configurations with a high likelihood of being optimal. They are evaluated on all sub-benchmarks to obtain the total scores. For the exploration part, we propose a conditional entropy-based greedy algorithm to allocate the evaluation budget across parameter configurations and their corresponding sub-benchmarks, which can effectively improve the surrogate model. We conduct a comprehensive numerical experiment to validate the effectiveness of both components of our algorithm. Furthermore, experiments on three real-world DSE problems demonstrate that our algorithm outperforms state-of-the-art Bayesian optimization methods.

The increasing penetration of renewable energy generation (REG) introduces significant uncertainty into power grids, posing heightened risks for cascading failures. In this paper, a Markov tree model is proposed to assess the risk of cascading failure in power grid with uncertain REG. The model captures the diverse failure paths caused by REG uncertainty, representing the cascading failure process as a sequence of state transitions with probabilities reflecting the likelihood of state transitions. To identify critical tripping branches during cascading failure propagation, a hybrid probability-interval method is introduced. Probabilistic power flow analysis identifies branches with overload risk, while interval positional relationships rank their severity. To improve the efficiency of risk assessment, a risk-based depth-first search (R-DFS) method is proposed. This method uses estimated risk indices to prioritize high-risk failure paths while pruning low-risk paths, significantly reducing simulation time while maintaining assessment accuracy. Compared with existing models, the proposed model balances simulation efficiency and accuracy, effectively identifying high-risk failure paths under REG uncertainty. Simulation results demonstrate the impact of threshold selection on the retention of high-risk paths and simulation performance, providing insights into managing cascading failure risks in power grid with high REG penetration.

The rapid deployment of advanced metering infrastructure facilitates the development of data-driven attack detection methods in smart grids, which typically rely on large amounts of labeled data for training. However, when new types of attacks or faults emerge, security analysts may only intercept limited malicious samples. The scarcity of samples makes it difficult for data-driven methods to learn effective decision boundaries, leading to degraded detection performance. In this work, we bridge the gap by learning class prototype representations from limited samples and learning to match unlabeled samples with corresponding prototypes. Specifically, we propose a meta-learning-based framework termed Learning to Match Prototype (L2MP), which consists of a prototypical network (ProtoNet) that learns prototype representations by aggregating features from labeled samples, and a matching network that assesses the matching degree between unlabeled samples and prototypes for classification. Through episodic training designed to simulate the few-shot setting, L2MP learns to adapt to novel attack and fault types with only a few samples per class. Moreover, we utilize a bilevel optimization strategy to ensure efficient training of both networks. Extensive case studies on smart grid datasets demonstrate that L2MP achieves robust performance under harsh learning conditions and has practical utility in real-world scenarios.

Establishing efficient and robust covert channels is crucial for secure communication within insecure network environments. With its inherent benefits of decentralization and anonymization, blockchain has gained considerable attention in developing covert channels. To guarantee a highly secure covert channel, channel negotiation should be contactlessbeforethe communication, carrier transaction features must be indistinguishable from normal transactionsduringthe communication, and communication identities must be untraceableafterthe communication. Such a full-lifecycle covert channel is indispensable to defend against a versatile adversary who intercepts two communicating parties comprehensively (e.g., on-chain and off-chain). Unfortunately, it has not been thoroughly investigated in the literature. We make the first effort to achieve a full-lifecycle covert channel, a novel blockchain-based covert channel namedABC-Channel. We tackle a series of challenges, such as off-chain contact dependency, increased masquerading difficulties as growing transaction volume, and time-evolving, communicable yet untraceable identities, to achieve contactless channel negotiation, indistinguishable transaction features, and untraceable communication identities, respectively. We develop a working prototype to validateABC-Channeland conduct extensive tests on the Bitcoin testnet. The experimental results demonstrate thatABC-Channelachieves substantially secure covert capabilities. In comparison to existing methods, it also exhibits state-of-the-art transmission efficiency.

Network intrusion detection systems (NIDS) are crucial for network management and security. However, in real-world scenarios, NIDS faces two core challenges: (i) label noise, where mislabeled samples in the training data distort the model's decision boundaries; (ii) unknown attack detection, where existing methods struggle to identify novel attack patterns in dynamic attack environments. More critically, these two challenges are interlinked, forming a vicious cycle that continuously degrades the overall reliability of NIDS. Existing research often addresses these issues in isolation, and no method has yet been proposed to coordinate their antagonistic effects systematically. To tackle this open problem, we propose AEGIS-Net for the first time—a dual anti-noise framework based on multi-prototype correction and model-agnostic detection. AEGIS-Net introduces a density-difference-driven multi-prototype competition mechanism, which achieves fine-grained noise label correction through feature space sub-cluster analysis. We also design a distribution-independent k-nearest neighbors detection paradigm, using the corrected compact feature space to determine unknown attacks in open environments. The two modules are collaboratively optimized through a shared encoder, forming a positive cycle of noise suppression and detection enhancement. Extensive experiments on real-world datasets validate the effectiveness of AEGIS-Net in addressing these dual challenges. Notably, under 50% asymmetric noise conditions, AEGIS-Net achieves classification accuracy of 89.02% for known attacks and 98.76% for unknown attack detection on the MAL_TLS2023 dataset. Theoretical proofs and visualization analysis reveal the anti-noise properties of AEGIS-Net under feature space stability constraints. Our code is available athttps://github.com/niebikong/AEGIS-Net.

An advertiser typically conducts a campaign across several publishers. Different publishers often reach different sets of persons, and some people may be exposed to the campaign via multiple publishers. Due to privacy restrictions, it is prohibited to collect all audience activities from multiple publishers in a centralized manner, therefore, we desire secure protocols for mining audience activities. In this paper, we propose a secure protocol for efficiently estimating the frequency histogram, i.e. the fraction of persons (or users) appearing a given number of times across all publishers. Our protocolMPC-FHis designed based on a novel sketch methodMPSthat uniformly samples a fraction of users across multiple parties and can be efficiently implemented on SPDZ, which is a popular secure multiparty computation (MPC) scheme. Our protocol provides more strict security guarantees than the state-of-the-art. In addition, our experimental results on a variety of large datasets demonstrate that our protocol can also accelerate the computation speed of existing protocols by orders of magnitudes.

Counting distinct elements (cardinality) across multiple data holders (DHs) privately is fundamental with broad applications, ranging from crowd counting to network monitoring. It is referred to as private distributed cardinality estimation (PDCE). Similarly, determining the intersection cardinality between the unions of two DH groups holds practical significance, a problem we call private distributed intersection cardinality estimation (PDICE). While many efficient methods (e.g., FM and LL sketches) exist, their differential privacy relies on secret hash functions. In PDCE, DHs must share the functions to enable sketch merging, which breaks this assumption and invalidates such guarantees. Although a recent protocol implements the FM sketch on a secret-sharing-based multiparty computation (MPC) framework for PDCE, we observe that it lacks differential privacy guarantees and is computationally expensive. To address these limitations, we propose DP-DICE-Bino, a novel protocol that is computationally efficient and differentially private for PDCE. DP-DICE-Bino is flexible in that it can compute the cardinality of any group of DHs without repeatedly interacting with the DHs. Furthermore, DP-DICE-Bino can also handle PDICE. Experiments show that DP-DICE-Bino achieves orders-of-magnitude speedups and reduces the estimation error by several times compared with the state of the art under the same security requirements.

As data traffic and information services surge, 5G base stations (BSs) have become primary energy consumers in wireless networks, with cooling accounting for 40% of BS power use and driving high operational expenditure. This underscores the need for energy-efficient optimization of cooling control. However, existing model-based and AI-driven optimization methods face critical limitations in real-world deployments, including limited generalizability across heterogeneous BSs resulting from their high scenario dependence, the inherent tradeoff between control stability and dynamic adaptability under complex operating conditions, and high deployment costs due to computational demands. To address these challenges, this article develops a three-stage hybrid learning (TSHL) approach that integrates imitation learning, ensemble learning, and deep reinforcement learning into a three-stage offline-to-online architecture, enabling expert knowledge transfer from data-rich BSs to generate high-quality initial policies for data-scarce ones, while online learning ensures continuous adaptation to local dynamics. In addition, we propose a cost-efficient deployment mechanism that leverages only existing monitoring data without additional hardware costs, employs hybrid experience policy updates within a deep Dyna-Q-based architecture to enhance learning efficiency, and incorporates a safety-constrained exploration to enhance policy reliability. Extensive evaluations on both a simulation testbed and a real-world 5G BS demonstrate that TSHL achieves over 18.36% cooling energy savings and outperforms baseline methods in cold-start effectiveness, online adaptability, operational reliability, and overall cost-efficiency. These results highlight TSHL as a practical solution for sustainable 5G BS operations, especially for data-scarce BSs, such as retrofitted or newly established sites, offering a scalable pathway to network-wide energy savings.

Designing complex computer-aided design (CAD) models is often time-consuming due to challenges such as computational inefficiency and the difficulty of generating precise models. We propose a novel language-guided framework for industrial design automation to address these issues, integrating large language models (LLMs) with computer-automated design (CAutoD).Through this framework, CAD models are automatically generated from parameters and appearance descriptions, supporting the automation of design tasks during the detailed CAD design phase. Our approach introduces three key innovations: (1) a semi-automated data annotation pipeline that leverages LLMs and vision-language large models (VLLMs) to generate high-quality parameters and appearance descriptions; (2) a Transformer-based CAD generator (TCADGen) that predicts modeling sequences via dual-channel feature aggregation; (3) an enhanced CAD modeling generation model, called CADLLM, that is designed to refine the generated sequences by incorporating the confidence scores from TCADGen. Experimental results demonstrate that the proposed approach outperforms traditional methods in both accuracy and efficiency, providing a powerful tool for automating industrial workflows and generating complex CAD models from textual prompts.The code is available at https://jianxliao.github.io/cadllm-page/

The combination of Computational Intelligence (CI) and music has attracted many efforts. In these studies, how to evaluate artificial music is a hot topic. The design of an evaluation system based on expert experiences is time-consuming and the performance is sometimes not satisfied. Therefore, learning a system from data is a feasible way. However, existing learning-based methods depend highly on the types of data and the downstream machine-learning tasks. In this paper, we model the evaluation system design problem as an offline inverse reinforcement learning problem. Specifically, we use a linear function to act as the evaluation system. The system is trained by natural evolution strategies (NES) using the Chinese traditional folk music data. The experiments show that the learned evaluation system can reasonably evaluate the developed music data and artificial music data generated by existing EC-based mutation operators. Meanwhile, the learned system can not only be applied to Chinese folk music data but also to Chinese opera music data which is not used in the training process.

Face avatar generation has gained significant attention recently. With the help of the Neural Radiance Field (NeRF), existing 3D methods alleviate facial distortion in 2D methods under large pose changes. However, the state-of-the-art 3D methods still require additional optimization for generation on each given portrait, even in a one-shot manner. To address this research gap, we propose a novel one-shot approach, which achieves effective face avatar generation in only a single forward pass. This is made possible by introducing an inversion encoder trained on a large-scale dataset for accurate latent code estimation and an expression animator for accurate expression control. Our approach is also designed for better preservation of the face identity by training an additional 3D feature refiner based on cross-attention. Experimental results demonstrate the superiority of our approach in terms of 3D consistency, identity similarity, and image quality.

Graph-level Contrastive Learning (GCL) has evolved as a powerful technique to derive representations from contrastive view pairs. Without access to labeled data, GCL typically takes two views augmented from the same graph as a positive pair and embeds them in nearby locations, while treating views from different graphs as negative pairs and pushing away their representations. Since the construction of contrastive pairs plays an important role in GCL, considerable attention has been paid to informative pairs mining. However, existing informative pairs mining methods suffer from the following two challenges: 1) Previous studies merely pay attention to the informative negative pairs while neglecting the informative positive pairs. Nevertheless, most augmentation methods require random perturbations, which may destroy the critical semantics of a graph, leading to false positive pairs (uninformative positives). 2) For informative negatives mining, most existing studies either overly emphasize hard negatives despite their potential unreliability, or rely on precise clustering pseudo-labels, which are error-prone especially in the early training stage. To solve the above challenges, we propose an informative sample-aware progressive graph contrastive learning framework, which filters both uninformative positives and negatives. In particular, we first present a progressive views sampler to evaluate the learning hardness of each view via clustering. Then, we feed model views with appropriate hardness, meaning those that aren't too challenging for the current model to assign pseudo labels confidently. Furthermore, we propose two samplers to filter out uninformative positives and negatives, respectively. Empirical results demonstrate the efficacy of our method IsGCL, which outperforms baselines by a margin of 2.5% on both MUTAG and PTC-MR in unsupervised learning settings. Furthermore, IsGCL maintains competitive training efficiency11Code available at https://github.com/jxzeng-git/IsGCL.

Pseudo-labeling is a widely used strategy in semi-supervised learning. Existing methods typically select predicted labels with high confidence scores and high training stationarity, as pseudo-labels to augment training sets. In contrast, this paper explores the pseudo-labeling potential of predicted labels that **do not** exhibit these characteristics. We discover a new type of predicted labels suitable for pseudo-labeling, termed *two-phase labels*, which exhibit a two-phase pattern during training: *they are initially predicted as one category in early training stages and switch to another category in subsequent epochs.* Case studies show the two-phase labels are informative for decision boundaries. To effectively identify the two-phase labels, we design a 2-*phasic* metric that mathematically characterizes their spatial and temporal patterns. Furthermore, we propose a loss function tailored for two-phase pseudo-labeling learning, allowing models not only to learn correct correlations but also to eliminate false ones. Extensive experiments on eight datasets show that **our proposed 2-*phasic* metric acts as a powerful booster** for existing pseudo-labeling methods by additionally incorporating the two-phase labels, achieving an average classification accuracy gain of 1.73% on image datasets and 1.92% on graph datasets.

With the diversification of cloud services, cloud providers offer flexible access control by letting users apply fine-grained cloud access control policies to secure their cloud resources. However, flexibility comes with the cost that configuring cloud access control policies is error-prone. Therefore, cloud providers have developed SMT-based tools to formally analyze the user-defined policies. Unfortunately, we find these analyzers slow, due to the complex regular expression matching conditions in policies. To this end, this paper introduces Relia, a general method to speed up the analysis of cloud access control policies. The key idea of Relia is to pre-compute a set of String Equivalence Classes (SECs) based on the regular expressions in a policy, assign a unique integer to each SEC, and rewrite the regular constraints into equivalent integer constraints, which are easier to solve. We implement Relia as a transparent layer between our in-house access analyzer and off-the-shelf SMT solvers. Based on real policies from a large public cloud provider, we show that: when enabling Relia, our in-house portfolio solver (consisting of Z3, Cvc4, and Cvc5) can speed up the analysis process for nearly 95% of all cases, with an average speedup of 8.21×.

Distribution grid with electric vehicle (EV) charging infrastructure can be modeled as a coupled network consisting of the cyber network, distribution grid and traffic network. The interconnection of the coupled network allows attackers to launch cyber attacks and control numerous EVs to cause severe load fluctuations, thereby affecting the normal operation of the distribution grid and the traffic flow. To evaluate the cyber-physical security of the coupled network, we present a security assessment model formulated as a coupled Discrete Event System Specification (DEVS). In this model, the evolution of the coupled network is represented as state transitions triggered by events in a discrete-time process, while the interaction is achieved through event transmission, reception and processing. To determine the redistribution of states influenced by the selection of EV charging stations and moving paths, we propose a spatial-temporal evolution mechanism. Based on the assessment model, we propose an event-triggered simulation method. The efficiency of the proposed simulation method is evaluated by comparing it with the multi-layer synchronous simulation method. Compared with the existing security assessment models, the simulation results of our model are more accurate.

The frequent blackouts around the world in the past 20 years have brought the security of the power grid to a head. Among various hazard situations, cascading failure is the one with critical threats due to its widespread propagation and long duration. An effective way to prevent cascading failure is to identify the vulnerable set, which is defined as the composition of transmission line combinations that can initialize the sequence of failures. In this paper, we first elaborate cascading failure model and its adaptation under the scenario of interest. Then a novel framework of data-driven identification model is developed to replace the traditional flow-based detection process, which is computationally heavy. Specifically, a method that seamlessly achieves the globally topological features embedding by designing a tailored messaging mechanism adjusted for the power grid is proposed, overcoming the otherwise problem of the constrained neighborhood in existing graph convolution networks (GCNs). Besides, with the proposed pruning optimization method, the sparsity of the vulnerable set can be naturally enforced and combinatorial explosion is readily alleviated. Numerical experiments are conducted on 30-bus, 200-bus, and 500-bus systems, including static and dynamic load scenarios. All of them verify the excellent performance of the identification model for both effectiveness and efficiency.Note to Practitioners—This paper is motivated by a practical need for mitigate the security threat of cascading failures to power grid through the vulnerable set identification. Existing methods for identifying the vulnerable set have limitations, including a limited number of vulnerabilities identified and challenges related to the high time complexity of cascading failure simulators and combinatorial explosion. To address this issue, we develop a data-driven identification model that integrates both the physical and topological features of the power grid. This model reduces the reliance on cascading failure simulators and enhances the efficiency of vulnerable set identification. Additionally, the pruning optimization method is proposed to further mitigate the high time complexity caused by combinatorial explosion. Simulative studies conduct in both dynamic and static load scenarios validate the performance of the developed data-driven model, demonstrating its ability to achieve rapid identification of the vulnerable set and thereby improve the overall robustness of the power grid against cascading failures.

System testing mainly focuses on finding bugs before online deployment. However, the system’s complexity increases due to a surge in the number of users, which makes scheduling the test case generation time more difficult, impeding testing fidelity and automatic testing. In this paper, we propose a data-driven framework for scheduling the test cases and improving testing fidelity. The developed framework involves two stages: 1) mining the running event interval characteristics from logs obtained from the actual environment in the first stage, and 2) utilizing those characteristics to develop a model for the test case generation time schedule in the second stage. First, we select the running event interval, which is the interval between two adjacent running events processed by the system, as the feature for analysis. Then, we analyze the interval’s distribution characteristics, observing that it adheres to the power-law distribution from multiple aspects. Second, based on the distribution characteristics obtained, we develop a composite event chain with associated relationships (CECAR) model to schedule test case generation time. Finally, we conduct a series of experiments using logs obtained from eight regions. The results show that, compared to baseline methods, the CECAR model reduces average errors in the generated quantity, power exponent, and specific granularity intervals by approximately 1% to 9% across multiple layers, demonstrating the effectiveness of the proposed method. We also made our dataset and code publicly available athttps://github.com/yizhenli-xjtu/CECAR. Note to Practitioners—System testing is a promising way to eliminate bugs and improve system stability before online deployment. If the testing method does not align with the system’s running characteristics in the actual environment, the testing fidelity and efficiency may be greatly reduced. Scheduling the test case generation time is one of the fundamental ways to address this challenge. The CECAR model developed in this paper can reproduce temporal characteristics and incorporate the concurrent relationships between different events, in turn, achieving the goal of fidelity improvement. Furthermore, based on the CECAR model, we can simulate arbitrary scenarios by combining different types of devices, which can greatly improve the testing’s flexibility and practicality.

With the popularity of electric vehicles (EVs) and renewable energy sources (RES), the flexibility of charging and discharging of EVs and the intermittency of RES have brought challenges to building operations. Considering the mobility of EVs as commuting tools between buildings and the uncertainty of RES, it is of great practical significance to coordinate multiple buildings with RES and EVs on the premise of meeting the state of energy (SOE) requirements of the future trip. We formulate this coordination problem as a stochastic centralized mixed integer linear programming problem. A polyhedral convex set is constructed to describe the SOE uncertainty of EVs. New nonanticipative constraints (NCs) are derived through forward recursion based on constructed scenarios to guarantee the all-scenario-feasibility (ASF) and nonanticipativity of the decision. A Lagrangian relaxation-based decentralized all-scenario-feasible (LR-DASF) algorithm is developed to solve the centralized optimization problem in a decomposition and coordination way. In this method, the optimal ASF solution can be obtained with a fast convergence rate by updating Lagrangian multipliers without solving all subproblems with NCs. The performance of the LR-DASF algorithm is verified by numerical results, which shows that the algorithm can guarantee the ASF of the solution, as well as promote computational efficiency. Note to Practitioners—EVs as energy storage devices bring energy exchanges between buildings accompanying the mobility of EVs which is an opportunity to improve the energy efficiency of multiple buildings. However, as commuting tools, the SOE of EVs must be guaranteed to be larger than the trip requirement over the randomness of RES generation. Furthermore, solving the coordinated optimization problem of multiple buildings with RES and EVs still faces computational complexity challenge due to the spatio-temperal coupling between EVs and buildings, which may lead to costly computational effort in the premise of guaranteeing the feasibility and nonanticipativity of the decision over the uncertainties in practice. Therefore, in order to overcome the above challenges, an LR-DASF algorithm is developed in this paper to solve the coordinated optimization problem of multiple buildings with RES and EVs. Based on the algorithm, for the system operator, it updates and broadcasts the Lagrangian multipliers information to the local coordinators of buildings. For each building, the local coordinator can make ASF decisions based on new NCs with the information obtained from the system operator independently to guarantee the SOE requirement. The method developed in this paper can make faster optimal decisions without perceivable degradation in accuracy and guarantee the SOE requirement of EVs simultaneously, to meet the requirements of feasibility and computational efficiency of decision making in practice. It is conducive to the future application of LR-DASF in the coordinated optimization of buildings and EVs at the city or regional scale.

Design Space Exploration (DSE) in processors is an expensive discrete simulation optimization problem. The data requirements of the regular data-driven methods are so large that it is challenging to converge to a satisfactory solution within a limited simulation budget. Based on binary integer linear programming (BILP), an iteratively piecewise linear approximate method (IPLAM) is proposed for this kind of problems to reduce the dependence of simulation data. IPLAM starts from an initial reference point. Each iteration generates a set of trial points based on the most promising reference point by piecewise shift method. After evaluating the trial points, a local surrogate model is constructed for the unit neighborhood of the reference point. The surrogate model is then used to guide the exploration of the next reference point. In theory, IPLAM can converge to the global optimal point under mild assumptions, which is further verified by the numerical experiments. Meanwhile, the numerical experiments demonstrate that IPLAM outperforms the advanced Bayesian optimization and differential evolution methods on high-dimensional discrete black-box test functions. Besides, the practical effectiveness of IPLAM is validated by an industrial case for processor DSE.

To address the power system hardening problem, traditional approaches often adopt robust optimization (RO) that considers a fixed set of concerned contingencies, regardless of the fact that hardening some components actually renders relevant contingencies impractical. In this paper, we directly adopt a dynamic uncertainty set that explicitly incorporates the impact of hardening decisions on the worst-case contingencies, which leads to a decision-dependent uncertainty (DDU) set. Then, a DDU-based robust-stochastic optimization (DDU-RSO) model is proposed to support the hardening decisions on distribution lines and distributed generators (DGs). Also, the randomness of load variations and available storage levels is considered through stochastic programming (SP) in the innermost level problem. Various corrective measures (e.g., the joint scheduling of DGs and energy storage) are included, coupling with a finite support of stochastic scenarios, for resilience enhancement. To relieve the computation burden of this new hardening formulation, an enhanced customization of parametric column-and-constraint generation (P-C&CG) algorithm is developed. By leveraging the network structural information, the enhancement strategies based onresilience importance indicesare designed to improve the convergence performance. Numerical results on 33-bus and 118-bus test distribution networks have demonstrated the effectiveness of DDU-RSO aided hardening scheme. Furthermore, in comparison to existing solution methods, the enhanced P-C&CG has achieved a superior performance by reducing the solution time by a few orders of magnitude.

The efficiency and profitability of cloud data centers are significantly influenced by virtual machine (VM) placement. However, the Non-Uniform Memory Access (NUMA), which has been practically applied to reduce the memory bandwidth competition, is often neglected in the existing research. Actually, the incorporation of NUMA may change the traditional resource allocation mechanism, and demands for a new VM placement model. Hence, considering the multi-NUMA architecture, this paper studies the NUMA-aware VM placement (NAVMP) problem in a cloud computing system, where the resource pool is composed of enormous number of heterogeneous servers with diverse multi-resource remains. The NAVMP problem is analytically formulated as an integer program (IP). Also, for the first time, the incarnations of VM types are introduced to simplify the VM deployment rules originated from complex NUMA architecture. We aim to maximize the VM provision ability (VPA) of the resource pool, and thus propose a novel Value Function to describe servers’ VPA. The resulting formulation, which is a new variant of the multiple-choice multiple multi-dimensional knapsack (MMMK) problem, is of significant computational challenges. So we customize a decomposition approach based on Column Generation (CG) to support the offline optimization. Numerical experiments on a practical dataset demonstrate the validity and scalability of the customized CG-based approach. Our approach outperforms a professional IP solver, i.e., Cbc, and a popular meta-heuristic algorithm, i.e., genetic algorithm (GA), and can efficiently address large-scale NAVMP instances with ten thousands of VM demands and servers.Note to Practitioners—This paper proposes a novel IP model for NAVMP. To cope with the complicated deployment logic associated with the complex multi-NUMA architecture of modern multi-core systems, we present an NAVMP formulation from the perspective of incarnations of VM types. Different from the traditional VM placement problem that aims to minimize the number of activated servers, i.e., the vector bin packing (VBP)-based model, we adopt the objective that maximizes the VPA of a resource pool for further improving the resource utilization. The resulting formulation is an MMMK problem, which is computational very challenging for a practical scale resource pool. Hence, to mitigate the computation burden, we design and implement a CG-based decomposition approach to support the offline optimization for NAVMP. Parallelization scheme and nontrivial heuristic strategies are applied to promote the computation efficiency. According to our numerical experiments, the proposed decomposition approach demonstrates a much superior solution capacity to the Cbc solver and GA. In particular, to achieve a comparable solution precision with Cbc, the computing time can be reduced by orders of magnitude. Also the CG-based approach outperforms GA in both the solution quality and computation time for large-scale instances. Besides, compared to the VBP model, our MMMK-based NAVMP model has improved the VPA up to 44.39%. Practically, the proposed offline approach can be leveraged to guide online VM allocation decisions, and perform efficient results evaluation.

The increasing penetration of renewable energy generation (REG) introduces high levels of uncertainty into power grid, potentially causing significant impacts on the evolution of cascading failure. In this paper, we propose a failure tree model that encompasses all possible failure paths resulting from the uncertain power injections from REG to describe the dynamic process of cascading failure in power grid. In order to obtain the failure paths of cascading failure, we propose an interval overload tripping mechanism to model relay protection based on the uncertainty set of REG and dynamic interval power flow. On the basis of the proposed model, we design a forward-backward tree search to efficiently evaluate the impact of the uncertain REG on cascading failure. Compared with the probabilistic power flow (PPF) model and scenario-based model, the simulation results of our model are more accurate because the statistical distribution of demand loss in our model is closer to Monte Carlo simulation (MCS). The efficiency of the proposed simulation method is demonstrated by comparing our model with the MCS under various sample numbers and two existing models. Finally, we analyze the influence of REG uncertainty level and penetration level on cascading failure and simulation performance. Note to Practitioners—To achieve accurate and fast cascading failure analysis in power grid with renewable energy generation (REG), this paper develops a failure tree model that considers the impact of uncertain injected power of REG on the dynamic process of cascading failure. In the model, the dynamic interval power flow and interval overload tripping mechanism are proposed to simulate the physical responses during cascading failure, including power flow redistribution, transmission branch outage and frequency regulation. Therefore, the model is more accurate in describing the actual characteristics of cascading failure in power grid with REG. This will facilitate the development and evaluation of control strategies aimed at improving the stability of power grid. Meanwhile, the model provides a good example for researchers and engineers to simulate network systems without detailed information about the probability distribution of uncertain injection variables. Based on the proposed model, we develop a forward-backward tree search, which allows the decision-maker to make a satisfactory trade-off between accuracy and time consumption. This algorithm allows for fast control strategy implementation to prevent failure propagation.

This paper analyzes the evacuation process of people in a building, and constructs a discrete-time evacuation model that can accurately describe the evacuation problem according to evacuation scenarios. In the discrete time framework, the evacuation policy is dynamically adjusted based on the dynamic transfer of people. For the large-scale evacuation problem, this paper proposes a two-stage method to solve the evacuation policy of edge and node separately, which improves the solving efficiency. The results of case study prove the reliability and efficiency of our method. Note to Practitioners—In this paper, considering the influence of effective edge width and crowd density on the moving speed of people, a discrete time based evacuation model is constructed which accurately reflects the evacuation process. A two-stage method is proposed to solve the difficult problem of large-scale evacuation. The evacuation policy obtained by the two-stage method will be used as the evacuation plan, and the evacuation plan of different evacuation scenarios will be counted. When an evacuation event occurs, the distribution of people is matched with the scenario in the database, and the evacuation plan of the closest scenario is selected for evacuation.

The demands of electric vehicles (EVs) and building heating, ventilation, and air conditioning (HVAC) systems have considerable flexibility. Their flexibility is influenced by occupants’ behavior resulting in huge complementary and dispatchable capability. Therefore, the coordination of EVs and HVAC systems holds significant potential for optimizing the building demand profiles and energy cost under time-of-use (TOU) tariffs. However, solving the coordinated problem in practice still faces the challenges in computational complexity and global information requirement due to the spatio-temperal coupling constraints. In this paper, a mixed-integer linear programming model is developed to formulate the multi-building energy system with EVs and the impact of occupants’ behavior on the demand and flexibility of the system. The problem is converted into a three-level structure using Lagrangian relaxation framework. A dynamic programming-based Lagrangian relaxation (DPLR) algorithm is developed to independently solve all sub-problems of the three-level structure in a decomposition and coordination way while avoiding the iterative computation between the middle and lower level. The numerical results show the developed method can obtain a near-optimal solution in an efficient way without perceivable degradation in accuracy, which is 4% worse but at least three times faster, compared to the existing centralized algorithm. Note to Practitioners—The escalating demand for EVs and HVAC systems results in increased energy costs and challenges to existing power systems, such as frequency deviations and higher peak loads. Therefore, this paper focuses on the coordinated optimization of the EV charging and building HVAC system operation, while considering rooftop photovoltaic generation supply within the system. Optimal coordination of the above system can effectively reduce energy costs under TOU tariffs and enhance the ability to utilize renewable energy sources. However, solving the coordinated optimization problem still faces difficulties since the computational complexity will exponentially grow with increasing problem scale due to the spatio-temperal coupling between the demand of EVs and HVAC systems. Therefore, a DPLR algorithm is developed. There is a central coordinator that collects the demand information of EVs and HVAC systems and broadcasts the coordination information calculated according to the demand information. Every single EV and HVAC system can make decisions based on the coordination information independently. The DPLR algorithm decouples EVs and HVAC systems and avoids the curse of dimensionality. It has great improvement on computational efficiency and global information requirement reduction. The computational efficiency and effectiveness of the developed method is verified through multi-scale case studies. The numerical results show that compared with independent optimization of EVs and HVAC systems, coordinated optimization can reduce over 44% of the energy costs.

Graph contrastive learning (GCL) has shown excellent performance in recommender systems. However, GCL-based methods have two major problems. First, many methods use graph perturbations to create the contrastive view, this operation may compromise the structure of the original graph. Second, some algorithms pursue the uniformity of features, but neglect the alignment, which may lead to the features of similar samples in the feature space distancing from each other, thereby reducing the model’s ability to distinguish similar samples. To address these problems, we propose the SiamGCL framework, which consists of two modules: multilevel alignment (MLA) and enhanced uniformity (EU). MLA uses the siamese network structure to process user and item data in parallel and achieves model-level alignment through shared structure and parameters. In addition, we introduce alignment loss in the optimization process to further refine the alignment of user and item embeddings. EU employs noise modulated augmentation and batch normalization regulator as alternatives to traditional graph perturbation methods. This embedding perturbation strategy effectively prevents over-aggregation in the feature space, which can also enhance the uniformity of the embedding distribution. Experiments on five large-scale benchmark datasets show that SiamGCL improves Recall@20 and NDCG@20 by 0.97%–5.51% and 1.31%–2.73%, respectively, compared with the current state-of-the-art method.

Approximate membership query (AMQ) structures represented by the Bloom Filter and its variants have been popularly researched in recent years. Researchers have recently combined machine learning with this type of structure to reduce space consumption and computation overhead further and make remarkable progress. However, with the booming performance in space or other metrics, researchers tend to ignore the security of the trained model. The machine learning model is vulnerable to poisoning attacks, and naturally, we infer that the learning-based filters also have the same deficiencies. Hence, in this article, to confirm the inference mentioned above, experiments on the real-world datasets of URLs are conducted and prove that it is necessary to consider the security issue when using learning-based filters. We show that by data poisoning, the attacker can deflect learned Bloom Filters to make a false identification, which can lead to a significant loss in some cases. Aiming to solve this issue, we put forward a method named Defensive Learned Bloom Filter (DLBF) to diminish the influence of data poisoning and achieve a better performance compared to types of learned Bloom Filters.

Despite the success of data-driven methods in detecting false data injection (FDI) attacks, the remarkable progress is inseparable from massive labeled and class-balanced measurements. However, the collected measurement datasets in smart grids typically exhibit skewed class distributions and are partially labeled due to the expensive labeling costs. Learning from such non-ideal datasets undoubtedly results in the degenerated detection performance of the data-driven methods. To cope with this issue, we propose an optimal transport (OT)-based framework named DeSSW to promote the utilization of plentiful unlabeled measurements through the self-training technique, which improves the ability to identify FDI attacks by producing distinguishable representations for normal and attacked measurements in the feature space. Specifically, DeSSW consists of a novel re-weighting algorithm and a debiased self-training strategy. The re-weighting algorithm ensures high-confidence unlabeled measurements dominate the self-training procedure, and the debiased self-training strategy mitigates bias accumulation in the iterative self-training procedure. Extensive experiments demonstrate that DeSSW achieves superior detection performance when facing the combinatorial challenge of partially labeled and class-imbalanced measurements, even if the measurements are noisy.

Trojans (backdoors) are known to raise critical security concerns for deep neural networks in machine learning (ML) systems. Despite the extensive backdoor methods and benchmarks, existing research overlooks the perspective of the ML lifecycle (i.e., the entire process from system design to data collection to model deployment). To address this gap, this paper introduces De2Trojan, a Deployable Trojan Analysis Tool via Decoupling, which establishes a standardized pipeline to investigate backdoor attacks and defenses within the ML lifecycle. De2Trojan decouples the attack surface from the general ML process through a stage-first hijacking approach, using an abstract interface for ML lifecycle stages to enhance the deployability to the ML lifecycle. Besides, its benefits are two-fold: (1) Facilitating the systematic analyses of multi-stage attacks/defenses and their combinations, shedding light on how to improve attack and defense strategies. For example, we find that current attacks (defenses) are not effective in continuous scenarios, and combining attacks (defenses) at different stages improves their effectiveness from 30.11% (8.63%), the worst cases, to 90.27% (68.73%). (2) Making it possible to identify potentially vulnerable stages, especially when iteratively updating the model in ML lifecycle. For example, we identify that backdoor attacks in the data collection stage are more vulnerable than expected, and it is more difficult to remove them from the ML lifecycle. To eliminate the impact of such attacks, it is most effective to apply backdoor defense during the deployment stage, in addition to cleaning the data before training. Overall, we present a comprehensive benchmark of backdoors within the ML lifecycle, involving 20 representative attacks and defenses, as well as their combinations, using 11 evaluation metrics.

Battery swapping station (BSS) can provide fast battery swapping and flexible battery charging in off-peak hours, it is thus beneficial for electric vehicles (EVs) and power grid in terms of battery life extension and power grid regulation. However, this increases the charging scheduling complexity in BSS since the batteries are not necessarily required to be charged immediately as they arrived. This problem becomes challenging in the presence of nonlinear battery charging characteristics and demand/supply uncertainties. Since it is difficult for the traditional learning-based methods to deal with the constraints caused by nonlinear charging characteristics, low sampling efficiency and unstable training issues can occur. In order to solve these issues, we present a novel deep reinforcement learning (DRL) approach. In contrast to the traditional approaches where the battery charging characteristic is simplified to a constant-current or constant-power process, we propose an equivalent circuit model (ECM) to capture the nonlinear charging characteristics. In ECM, the battery’s open-circuit voltage (OCV) is a function of its state of charge (SoC), as a result, the upper bound of the charging/discharging power of battery is influenced by its SoC. Then we construct a constrained Markov decision process (CMDP) model and propose a Beta distribution-based DRL approach with a continuous action mask (AM) to improve the sampling efficiency and consistency of the training process. Numerical experiments show that our new approach can provide better results in terms of operation cost and quality of service (QoS) in comparison with other state-of-the-art DRL methods.

The initial alignment is a critical stage for a strapdown inertial navigation system (SINS) and global positioning system (GPS) integrated navigation system. Currently, two major factors degrade the performance of SINS/GPS in-motion initial alignment, i.e., outliers in GPS measurements and cumulative low-accuracy inertial measurement unit (IMU) bias errors. This article considers both factors and proposes GISEIA-EMM: a high-accuracy GPS-inertial state estimator for in-motion alignment based on extended magnitude matching (EMM) method. First, we use the full integral method and non-interpolation procedure to construct the vector observation, which reduces the number of outliers and improves the accuracy of outlier detection. Second, we use an error-state extended Kalman filter (ESEKF), based on an augmented state-space model where the reference vector is regarded as a state, to suppress cumulative IMU bias errors, which improves the alignment accuracy. Third, we propose an EMM method, with the non-drifted expected normalized magnitude error, to detect and eliminate outliers in GPS measurements, which makes the alignment process stable. Simulation and field test results demonstrate that GISEIA-EMM can effectively address the negative impact of the two factors.

Tabular data is prevalent in many fields. In practice, tabular data classification may encounter severe challenges due to class imbalance, i.e., some majority classes overwhelm minority ones. Such imbalance could lead to biased prediction tendency of trained classifiers towards majority classes. Oversampling minority classes is an essential solution due to its generality and independence of downstream tasks. Recent years have witnessed the advantages of generative adversarial networks (GANs) in synthetic data generation, favored for their ability to generate quasi-realistic samples. However, challenges arise when the size of minority classes is too small to provide sufficient information for learning real data distributions. Furthermore, the generated minority-class samples could exacerbate the class overlap problem, i.e., some generated samples unexpectedly overlap with partial majority-class samples. To address these challenges, this paper presents B2BGAN, a novel GAN-based approach for oversampling imbalanced tabular data. To capture the real data distribution in a fine-grained manner, we propose a novel backbone-to-branches neural network for the generator to fit the majority and minority classes simultaneously. The backbone network fits the whole distribution of the entire data, while each branch network grasps the distinctive characteristics of individual classes. To alleviate the class overlap problem of generated samples, we develop a prototype-guided loss function to ensure that generated samples are closer to the corresponding class prototypes. We evaluate the effectiveness of B2BGAN on six real-world datasets using six metrics. Experimental results demonstrate that our method outperforms state-of-the-art models by 5.38% in AUC and 10.19% in AP.

Legal case retrieval aims to automatically scour comparable legal cases based on a given query, which is crucial for offering relevant precedents to support the judgment in intelligent legal systems. Due to similar goals, it is often associated with a similar case matching task. To address them, a daunting challenge is assessing the uniquely defined legal-rational similarity within the judicial domain, which distinctly deviates from the semantic similarities in general text retrieval. Past works either tagged domain-specific factors or incorporated reference laws to capture legal-rational information. However, their heavy reliance on expert or unrealistic assumptions restricts their practical applicability in real-world scenarios. In this article, we propose an end-to-end model named LCM-LAI to solve the above challenges. Through meticulous theoretical analysis, LCM-LAI employs a dependent multi-task learning framework to capture legal-rational information within legal cases by a law article prediction sub-task, without any additional assumptions in inference. In addition, LCM-LAI proposes an article-aware attention mechanism to evaluate the legal-rational similarity between across-case sentences based on the law distribution, which is more effective than semantic similarity. We perform a series of exhaustive experiments that include two different tasks that involving four real-world datasets. The results demonstrate that LCM-LAI achieves state-of-the-art performance.

Legal Judgment Prediction (LJP) aims to automatically predict a law case’s judgment results based on the text description of its facts. In practice, the confusing law articles (or charges) problem frequently occurs, reflecting that the law cases applicable to similar articles (or charges) tend to be misjudged. Although some recent works based on prior knowledge solve this issue well, they ignore that confusion also occurs between law articles with a high posterior semantic similarity due to the data imbalance problem instead of only between the prior highly similar ones, which is this work’s further finding. This article proposes an end-to-end model named D-LADAN to solve the above challenges. On the one hand, D-LADAN constructs a graph among law articles based on their text definition and proposes a graph distillation operator (GDO) to distinguish the ones with a high prior semantic similarity. On the other hand, D-LADAN presents a novel momentum-updated memory mechanism to dynamically sense the posterior similarity between law articles (or charges) and a weighted GDO to adaptively capture the distinctions for revising the inductive bias caused by the data imbalance problem. We perform extensive experiments to demonstrate that D-LADAN significantly outperforms state-of-the-art methods in accuracy and robustness.

Deep Learning models have become an integrated component of modern software systems. In response to the challenge of model design, researchers proposed Automated Machine Learning (AutoML) systems, which automatically search for model architecture and hyperparameters for a given task. Like other software systems, existing AutoML systems have shortcomings in their design. We identify two common and severe shortcomings in AutoML, performance issue (i.e., searching for the desired model takes an unreasonably long time) and ineffective search issue (i.e., AutoML systems are not able to find an accurate enough model). After analyzing the workflow of AutoML, we observe that existing AutoML systems overlook potential opportunities in search space, search method, and search feedback, which results in performance and ineffective search issues. Based on our analysis, we design and implement DREAM , an automatic and general-purpose tool to alleviate and repair the shortcomings of AutoML pipelines and conduct effective model searches for diverse tasks. It monitors the process of AutoML to collect detailed feedback and automatically repairs shortcomings by expanding search space and leveraging a feedback-driven search strategy. Our evaluation results show that DREAM can be applied on two state-of-the-art AutoML pipelines and effectively and efficiently repair their shortcomings.

Molecular representation learning has emerged as a game-changer at the intersection of AI and chemistry, with great potential in applications such as drug design and materials discovery. A substantial obstacle in successfully applying molecular representation learning is the difficulty of effectively and completely characterizing and learning molecular geometry, which has not been well addressed to date. To overcome this challenge, we propose a novel framework that features a novel geometric graph, termed HAGO-Graph, and a specifically designed geometric graph learning model, HAGO-Net. In the framework, the foundation is HAGO-Graph, which enables a complete characterization of molecular geometry in a hierarchical manner. Specifically, we leverage the concept of n-body in physics to characterize geometric patterns at multiple spatial scales. We then specifically design a message passing scheme, HAGO-MPS, and implement the scheme as a geometric graph neural network, HAGO-Net, to effectively learn the representation of HAGO-Graph by horizontal and vertical aggregation. We further prove DHAGO-Net, the derivative function of HAGO-Net, is an equivariant model. The proposed models are validated by extensive comparisons on four challenging benchmarks. Notably, the models exhibited state-of-the-art performance in molecular chirality identification and property prediction, achieving state-of-the-art performance on five properties of QM9 dataset. The models also achieved competitive results on molecular dynamics prediction task.

Computing set difference cardinalities is a critical task in database optimization, network management, and anomaly detection. Due to the limited computational and mem-ory resources, exactly calculating set difference cardinalities becomes impractical in real-world applications. To solve this issue, sketch methods such as Odd sketch, Tug-of-War sketch, and HyperLogLog sketch can be extended to provide approximate estimations of set difference cardinalities. They use a family of hash functions to compress all elements in a set into a compact data structure. Unfortunately, Odd sketch suffers from limited estimation range, while Tug-of-War sketch and HyperLogLog sketch unavoidably face the problems of large estimation errors and high computational costs. In this paper, we design a novel data structure of bit array GXBits to fast and accurately estimate set difference cardinalities in a large range. In GXBits, the prob-ability of each bit recording its corresponding elements follows a variant of geometric distributions and varies across different bits. We conduct extensive experiments on synthetic datasets and real-world datasets. Experimental results demonstrate that our method GXBits is more computationally and memory efficient, and significantly increases the estimation accuracy of existing methods by up to 221.3 times.

The advancement toward deeper graph neural networks is currently obscured by two inherent issues in message passing, oversmoothing and oversquashing. We identify the root cause of these issues as information loss due to heterophily mixing in aggregation, where messages of diverse category semantics are mixed. We propose a novel multi-track graph convolutional network to address oversmoothing and oversquashing effectively. Our basic idea is intuitive: if messages are separated and independently propagated according to their category semantics, heterophilic mixing can be prevented. Consequently, we present a novel multi-track message passing scheme capable of preventing heterophilic mixing, enhancing long-distance information flow, and improving separation condition. Empirical validations show that our model achieved state-of-the-art performance on several graph datasets and effectively tackled oversmoothing and oversquashing, setting a new benchmark of $86.4$% accuracy on Cora.

The domain name system (DNS) is indispensable to nearly every Internet service. It has been extensively utilized for network activity characterization in passive and active approaches. Compared to the passive approach, active DNS cache probing is privacy-preserving and low-cost, enabling worldwide characterization of remote network activities in different networks. Unfortunately, existing probing-based methods are too coarse-grained to characterize the time-varying features of network activities, substantially limiting their applications in time-sensitive tasks. In this paper, we advance DNSScope, a fine-grained DNS cache probing framework by tackling three challenges: sample sparsity, observational distortion, and cache entanglement. DNSScope synthesizes statistical learning and self-supervised transfer learning to achieve time-varying characterization. Extensive evaluations demonstrate that it can accurately estimate the time-varying DNS query arrival rates on recursive DNS resolvers. Its average mean absolute error is 0.124, as low as one-sixth that of the baseline methods.

Graph retrieval aims to find the most similar graphs in a graph database given a query graph, which is a fundamental problem with many real-world applications in chemical engineering, code analysis, etc. To date, existing neural graph retrieval methods generally fall into two categories: Embedding Based Paradigm (Ebp) and Matching Based Paradigm (Mbp). The Ebp models learn an individual vectorial representation for each graph and the retrieval process can be accelerated by pre-computing these representations. The Mbp models learn a neural matching function to compare graphs on a pair-by-pair basis, in which the fine-grained pairwise comparison leads to higher retrieval accuracy but severely degrades retrieval efficiency. In this paper, to combine the advantage of Ebp in retrieval efficiency with that of Mbp in retrieval accuracy, we propose a novel Graph RetrievAl framework via KNowledge Distillation, namely GRAND. The key point is to leverage the idea of knowledge distillation to transfer the fine-grained graph comparison knowledge from an Mbp model to an Ebp model, such that the Ebp model can generate better graph representations and thus yield higher retrieval accuracy. At the same time, we can still pre-compute and index the improved graph representations to retain the retrieval speed of Ebp. Towards this end, we propose to perform knowledge distillation from three perspectives: score, node, and subgraph levels. In addition, we propose to perform mutual two-way knowledge transfer between Mbp and Ebp, such that Mbp and Ebp complement and benefit each other. Extensive experiments on three real-world datasets show that GRAND improves the performance of Ebp by a large margin and the improvement is consistent for different combinations of Ebp and Mbp models. For example, GRAND achieves performance gains of mostly more than 10% and up to 16.88% in terms of Recall@K on different datasets.

Graph few-shot learning (GFSL) has achieved great success in node classification tasks with rare labels. However, graph few-shot classification (GFSC) models often encounter the problem of classifying test samples with unobserved (or unknown) classes due to the rareness of labels. We formulate this problem as out-of-distribution (OOD) sample detection in inductive graph few-shot learning. This paper presents SMUG, a novel GFSL framework that can detect unobserved classes. Since we have no ground-truth OOD samples in a practical training dataset, it is challenging for the GFSC model to retrieve knowledge about unknown classes from labeled samples. To address this difficulty, we propose a sand mixing scheme to introduce observed classes as artificial OOD samples into meta-tasks. We also develop two unsupervised OOD discriminators to identify OOD samples. Thus, we can assess the performance of OOD discriminators since we know the true classes of these artificial OOD samples. Subsequently, we design a novel training procedure to optimize the encoder based on the performance of the OOD discriminators and the GFSC model. It not only enables the GFSL model to distinguish OOD samples but also promotes the classification accuracy of normal samples. We conduct extensive experiments to evaluate the effectiveness of SMUG based on four benchmark datasets. Experimental results demonstrate that SMUG achieves superior performance over state-of-the-art approaches in OOD detection and node classification. The source code of this paper is available at https://github.com/Memepp/SMUG.

Aspect Sentiment Triplet Extraction (ASTE) is an essential task in fine-grained opinion mining and sentiment analysis that involves extracting triplets consisting of aspect terms, opinion terms, and their associated sentiment polarities from texts. While prevailing approaches primarily adopt pipeline frameworks or unified tagging schemes for this task, these methods tend to either overlook syntactic structural information and inherent semantic features, or lack explicit mechanisms for integration of syntax and semantics among the triplets' elements. To overcome these shortcomings, we propose an Enhanced Multi-Encoder Network for ASTE with Syntax and Semantics (SynSem-ASTE). Our model innovatively incorporates syntactic information and semantic features derived from syntactic structures and attention weights, which is achieved through the design of a syntax encoder and a semantics encoder. Furthermore, we adopt a grid tagging scheme and an effective inference strategy to extract triplets simultaneously. Extensive evaluations on four benchmark datasets reveal that SynSem-ASTE not only achieves superior performance in terms of the primary metric F1-score, but also exhibits enhanced robustness against variations in model architecture.

The widespread adoption of EVs brings practical interest to the operation optimization of the charging station. This paper considers the joint scheduling of pricing and charging control to enhance the operational capability of the station. The following contributions are made. First, a joint scheduling model of pricing and charging control is developed to maximize the expected social welfare of the charging station considering the quality of service and the price fluctuation sensitivity of EV drivers. It is formulated as a Markov decision process with a variance criterion to capture uncertainties during operation. Second, a two-phase on-line policy learning algorithm is proposed to solve this joint scheduling problem. In the first phase, it implements event-based policy iteration to find the optimal pricing scheme. In the second phase, it implements scenario-based model predictive control for smart charging under the updated pricing scheme. Third, by leveraging the performance difference theory, the optimality of the proposed algorithm is theoretically analyzed. The feasibility of the proposed method and the improved social welfare of the charging station are numerically demonstrated based on a typical charging station with distributed generation and storage.Note to Practitioners—The popularization of EVs requires the high-efficiency operation of the charging station. The joint scheduling of pricing and charging control can provide a promising way to achieve the balance between EV drivers’ satisfaction and the profit maximization of the charging station. However, it suffers from EV drivers’ uncertain responses to the pricing scheme and the coupled relationship between pricing and charging control. This multi-stage stochastic programming is non-trivial to solve. In this paper, we propose a two-phase on-line policy learning method for this joint scheduling problem. This algorithm can be implemented in the controller of the charging station. In the first phase, the event-based policy iteration can be implemented to iteratively improve the current best pricing scheme until convergence. In the second phase, the scenario-based model predictive control, which is reformulated as a mixed integer linear programming, can be quickly solved for smart charging. Case studies demonstrate the operation enhancement of the station.

The robust unit commitment (UC) is of paramount importance for achieving reliable operations considering the uncertainty of renewable realizations. The typical affine decision rule method and the robust feasible region method may achieve uneconomic dispatches as the dispatch decisions just rely on the current-stage information. Through approximating the future cost-to-go functions, the dual dynamic programming based methods have been shown adaptive to the multistage robust optimization problems, while suffering from high computational complexity. Thus, we propose the robust approximate dynamic programming (RADP) method to promote the computational speed and the economic performance for large-scale robust UC problems. RADP initializes the candidate points for guaranteeing the feasibility of upper bounding the value functions, solves the alternating calculation based bilinear programming to obtain the worst cases, and combines the primal and dual updates for the two-phase robust UC decision-making problem to achieve fast convergence. The finite termination guarantee of the RADP method is verified by the analyses for the multistage robust optimization problems with achieving suboptimal solutions. Numerical tests on 118-bus and 2383-bus transmission systems have demonstrated that RADP can approach the suboptimal economic performance at significantly improved computational efficiency.Note to Practitioners—This paper was motivated by solving the large-scale robust UC problem embedded with the multistage economic dispatch with improved computational and economical performance. Compared to the existing methods, this work suggests a RADP-based approach, which is inspired by the robust dual dynamic programming (RDDP) scheme. The proposed RADP owns lower computational complexity when compared with RDDP. As the problem in this work is formulated in a general form, the proposed RADP can be applied to other robust optimization problems such as the inventory management problem with uncertain demands. To apply the method to large-scale decision-making problems, one needs to solve linear programming problems to obtain the finite upper/lower bounds first, and then initialize the upper-bound points based on the feasible region limits of the decision variables. Conduct the forward pass to generate the candidate points and the backward pass to refine the cost-to-go functions. If the application problems have discrete decision variables as in the two-phase UC, one can solve the nonanticipativity constrained problem to obtain discrete solutions before doing the RADP scheme. The analyses and numerical experiments suggest that this approach can achieve suboptimal solutions. In future research, we will address the accelerated multistage robust decision-making with achieving optimal solutions.

This paper studies the online scheduling of electric vehicle charging by a service provider subject to a demand charge in a distribution system. Demand charge imposes a penalty on the peak power consumption over each billing period, representing a substantial cost for the service provider with a large number of clients. Because the demand charge is calculated at the end of the billing period, it poses challenges in real-time scheduling when energy demand forecasts are inaccurate, resulting in either overly conservative power consumption or substantial demand charge. We propose a block model predictive control approach that decomposes the demand charge into a sequence of stage costs. Optimality conditions on demand patterns are also presented and analyzed. Numerical simulations demonstrate the efficacy of the proposed approach.Note to Practitioners—This paper addresses a significant practical problem of minimizing the demand charge on the real-time scheduling of deferrable demands. In particular, we consider a setting where a commercial electric vehicle (EV) charging service provider has to manage the online scheduling of a large number of arriving EVs at a charging facility subject to a maximum charging power constraint and a tariff with the demand charge. A major practical challenge is to balance the tradeoff between maximizing profit in scheduling as much EV charging as possible and the need to minimize penalty on the peak charging power. We propose a model predictive control strategy that decomposes the overall demand charge into a sequence of terminal costs. Also addressed is the practical constraint arising from the mismatched EV charging decision period and the power measurement period used to compute the demand charge. Using real data collected at the Adaptive Charging Network (ACN) testbed in simulations, the proposed approach yields 8-12% improvement in operational profit over existing benchmarks, while it has yet been tested in actual charging systems. In the future research, we will address the charging scheduling under demand charge over multiple charging stations.

Cascading failures pose a significant security threat to networked systems, with recent global incidents underscoring their destructive potential. The security threat of cascading failures has always existed, but the evolution of cyber-physical systems (CPSs) has introduced novel dimensions to cascading failures, intensifying their threats owing to the intricate fusion of cyber and physical domains. Addressing these threats requires a nuanced understanding achieved through failure modeling and vulnerability analysis. By analyzing the historical failures in different CPSs, the cascading failure in CPSs is comprehensively defined as a complicated propagation process in coupled cyber and physical systems, initialized by natural accidents or human interference, which exhibits a progressive evolution within the networked structure and ultimately results in unexpected large-scale systemic failures. Subsequently, this study advances the development of instructions for modeling cascading failures and conducting vulnerability analyses within CPSs. The examination also delves into the core challenges inherent in these methodologies. Moreover, a comprehensive survey and classification of extant research methodologies and solutions are undertaken, accompanied by a concise evaluation of their advancements and limitations. To validate the performance of these methodologies, numerical experiments are conducted to ascertain their distinct features. In conclusion, this article advocates for future research initiatives, particularly emphasizing the exploration of uncertainty analysis, defense strategies, and verification platforms. By addressing these areas, the resilience of CPSs against cascading failures can be significantly enhanced.

Load frequency control (LFC) is widely employed in power systems to stabilize frequency fluctuation and guarantee power quality. However, most existing LFC methods rely on accurate power system modeling and usually ignore the nonlinear characteristics of the system, limiting controllers' performance. To solve these problems, this article proposes a model-free LFC method for nonlinear power systems based on deep deterministic policy gradient framework. The proposed method establishes an emulator network to emulate power system dynamics. After defining the action-value function, the emulator network is applied for control actions evaluation instead of the critic network. Then, the actor network controller is effectively optimized by estimating the policy gradient based on zeroth-order optimization and backpropagation algorithm. Simulation results and corresponding comparisons demonstrate the designed controller can generate appropriate control actions and has strong adaptability for nonlinear power systems.

Wireless communication system such as the 5G system incurs significant energy consumption due to increased bandwidth, channels, complex architecture, great density of base station (BS) sites, and antennas. This article reviews two main approaches to enhancing energy efficiency of wireless communication systems. Despite the great efforts made, the energy consumption and costs remain high, and energy savings are critical to sustainability of the 5G system. This article presents a new optimization-based approach to reducing the energy consumption and costs of wireless communication systems through the collaborative operation of telecom equipment and supporting infrastructure while satisfying the requirements of the operating environment of BS equipment based on their forecasted traffic loads and durations. The new approach is implemented in various types of the 5G BS sites in operation in Guang Dong Province, China. The meter measurement shows that with the new approach more than 12$\%$total energy cost reduction of the BS sites is achieved.

Kernel density estimation is a useful method for estimating the probability distribution of data. It is a challenge to achieve efficient kernel density estimation, especially for large-scale and high-dimension stream data. We proposerotation kernel, a novel kernel function for density estimation. The rotation kernel density can be fast estimated by a data structure namedRotation Kernel Density Sketch(RKDS). RKDS is a time- and memory-efficient method for kernel density estimation, even over data streams and distributed systems. RKDS is applicable for estimating density at specific points and also for representing data distribution. We provide theoretical analysis for rotation kernel and RKDS. Furthermore, we apply RKDS to outlier detection, concept drift detection, and personalized federated learning. Experiments show that our method improves time efficiency by up to$3\times 10^{3}$times compared with baselines. RKDS also provides comparable detecting precision and better delay on outlier detection and concept drift detection tasks.

Graph alignment aims to find correspondent nodes between two graphs. Most existing algorithms assume that correspondent nodes in different graphs have similar local structures. However, this principle may not apply to some real-world application scenarios when two graphs have different densities. Some correspondent node pairs may have very different local structures in these cases. Nevertheless, correspondent nodes are expected to have similar importance, inspiring us to exploit global topology consistency for graph alignment. This paper presents GTCAlign, an unsupervised graph alignment framework based on global topology consistency. An indicating matrix is calculated to show node pairs with consistent global topology based on a comprehensive centrality metric. A graph convolutional network (GCN) encodes local structural and attributive information into low-dimensional node embeddings. Then, node similarities are computed based on the obtained node embeddings under the guidance of the indicating matrix. Moreover, a pair of nodes are more likely to be aligned if most of their neighbors are aligned, motivating us to develop an iterative algorithm to refine the alignment results recursively. We conduct extensive experiments on real-world and synthetic datasets to evaluate the effectiveness of GTCAlign. The experimental results show that GTCAlign outperforms state-of-the-art graph alignment approaches.

Mobile apps have significantly transformed various aspects of modern life, leading to growing concerns about privacy risks. Despite widespread encrypted communication, app fingerprinting (AF) attacks threaten user privacy substantially. However, existing AF attacks, when targeted at wireless traffic, face four fundamental challenges, namely 1) sample inseparability; 2) app multiplexing; 3) signal attenuation; and 4) open-world recognition. In this paper, we advance a novel AF attack, dubbed PacketPrint, to recognize app user activities over the air in an open-world setting. We introduce two novel models, i.e., sequential XGBoost and hierarchical bag-of-words model, to tackle sample inseparability and enhance robustness against noise packets arising from app multiplexing. We also propose the environment-aware model enhancement to bolster PacketPrint’s robustness in handling packet loss at the sniffer caused by signal attenuation. We conduct extensive experiments to evaluate the proposed attack in a series of challenging scenarios, including 1) open-world setting; 2) simultaneous use of different apps; 3) severe packet loss at the sniffer; and 4) cross-dataset recognition. The experimental results show that PacketPrint can accurately recognize app user activities. It achieves the average F1-score 0.947 for open-world app recognition and the average F1-score 0.959 for in-app user action recognition.

Website fingerprinting (WFP) could infer which websites a user is accessing via an encrypted proxy by passively inspecting the traffic characteristics of accessing different websites between the user and the proxy. Designing WFP attacks is crucial for understanding potential vulnerabilities of encrypted proxies, which guides the design of defensive measures against WFP. In this paper, we design a novel WFP attack against (popular) encrypted proxies that relay connections between the user and the proxy individually (e.g., Shadowsocks, V2Ray), and accordingly implement lightweight countermeasures to effectively defend against the attack. The attack features flow-context-aware and is both accurate and immediately deployable, because it fully considers the obstacle (dubbed training-testing asymmetry) that fundamentally limits the practicability of WFP and addresses the obstacle with built-in spatial-temporal flow correlation mechanism. We implement the countermeasure as middleboxes installed on both the client and server sides of encrypted proxies, without altering any existing infrastructures for compatibility. The middleboxes can obfuscate a website’s flow regularities across different visits. Large-scale experiments in real-world scenarios demonstrate that the WFP attack can generally achieve a detection rate above 98.8% with a false positive rate below 0.2%. The countermeasure forces the attack’s false positive rate to be above 0.2 and true positive rate to be below 0.9 with just five persistent TCP connections while introducing very limited bandwidth overhead (e.g., 0.49%) and almost-zero additional network latency.

Cyber search engines, such as Shodan and Censys, have gained popularity due to their strong capability of indexing the Internet of Things (IoT). They actively scan and fingerprint IoT devices for unearthing IP-device mapping. Because of the large address space of the Internet and the mapping’s mutative nature, efficiently tracking the evolution of IP-device mapping with a limited budget of scans is essential for building timely cyber search engines. An intuitive solution is to use reinforcement learning to schedule more scans to networks with high churn rates of IP-device mapping. However, such an intuitive solution has never been systematically studied. In this paper, we take the first step toward demystifying this problem based on our experiences in maintaining a global IoT scanning platform. Inspired by the measurement study of large-scale real-world IoT scan records, we land reinforcement learning onto a system capable of smartly scanning IoT devices in a principled way. We disclose key parameters affecting the effectiveness of different scanning strategies, and real-world experiments demonstrate that our system can scan up to around 40 times as many IP-device mapping mutations as random/sequential scanning.

Deep learning (DL) has been applied in many applications. Meanwhile, the quality of DL systems is becoming a big concern. To evaluate the quality of DL systems, a number of DL testing techniques have been proposed. To generate test cases, a set of initial seed inputs are required. Existing testing techniques usually construct seed corpus by randomly selecting inputs from training or test dataset. Till now, there is no study on how initial seed inputs affect the performance of DL testing and how to construct an optimal one. To fill this gap, we conduct the first systematic study to evaluate the impact of seed selection strategies on DL testing. Specifically, considering three popular goals of DL testing (i.e., coverage, failure detection, and robustness), we develop five seed selection strategies, including three based on single-objective optimization (SOO) and two based on multi-objective optimization (MOO). We evaluate these strategies on seven testing tools. Our results demonstrate that the selection of initial seed inputs greatly affects the testing performance. SOO-based selection can construct the best seed corpus that can boost DL testing with respect to the specific testing goal. MOO-based selection strategies can construct seed corpus that achieve balanced improvement on multiple objectives.

Network embedding algorithms learn a mapping from the discrete representation of nodes to continuous vector spaces that preserve node proximity. Despite recent efforts to design novel models, little attention has been given to understanding the instability of network embedding. In this paper, we define the stability of node embeddings as the invariance of the nearest neighbors of nodes in different instantiations. We find that existing embedding approaches have significant amounts of instability. In addition, network structures and algorithm models influence the stability of node embeddings significantly. We also examine the implications of embedding instability for downstream tasks and find remarkable impacts on performance.

Counting the number of distinct elements distributed over multiple data holders is a fundamental problem with many real-world applications ranging from crowd counting to network monitoring. Although a number of space and computationally efficient sketch methods (e.g., the Flajolet-Martin sketch and the HyperLogLog sketch) for cardinality estimation have been proposed to solve the above problem, these sketch methods are insecure when considering privacy concerns related to the use of each data holder's personal dataset. Despite a recently proposed protocol that successfully implements the well-known Flajolet-Martin (FM) sketch on a secret-sharing based multiparty computation (MPC) framework for solving the problem of private distributed cardinality estimation (PDCE), we observe that this MPC-FM protocol is not differentially private. In addition, the MPC-FM protocol is computationally expensive, which limits its applications to data holders with limited computation resources. To address the above issues, in this paper we propose a novel protocol DP-DICE, which is computationally efficient and differentially private for solving the problem of PDCE. Experimental results show that our DP-DICE achieves orders of magnitude speedup and reduces the estimation error by several times in comparison with state-of-the-arts under the same security requirements.

The electric vehicle (EV) utilizing vehicle-to-grid (V2G) technology can serve as an important mobile storage in a microgrid of building. Since more and more buildings are equipped with charging piles and distributed renewable energy, it can potentially improve the operation efficiency of building microgrid and reduce the impact of EVs to the grid by V2G scheduling considering the uncertain supply and EV charging demand in the building. We consider this important problem in this paper and make the following contributions. First, we formulate this V2G scheduling problem as a constrained Markov decision process (CMDP). The objective function is to improve the overall building energy operation cost while constraining the expected cycling time to ensure the participation enthusiasm of the EV users. Second, a simulation-based primal-dual approach is developed to decompose the original problem into a continuous optimization subproblem on the supply side and a discrete optimization subproblem on the demand side. The demand side optimization can be further decoupled as a distributed single EV scheduling problem where simulation-based regularized rollout method can be applied to improve from existing base policies. Third, the structural property of the problem and the cost improvement of the proposed method are analyzed to speed up the optimization and ensure the solution quality. Numerical experiments based on real building load data and EV data are conducted to demonstrate the performance of this method.Note to Practitioners—With the rapid adoption of EVs in the microgrid of building, there goes the challenge of how to reduce their charging impact to the microgrid. The V2G scheduling between EVs and building microgrid can provide a promising way to reduce the impact and improve the building operation efficiency. However, it suffers from the uncertain EV charging demand and the conflict between synthesized coordination and ensuring the participation enthusiasm of drivers. In this paper, we propose a constrained V2G scheduling model to address this issue. After formulating the problem as a constrained Markov decision process, a simulation-based primal-dual approach is developed to decompose the problem where the derived control policy in the supply side can be deployed in the building energy controller and the derived control policy in the demand side can be deployed in the controller of each charging pile. Case studies show the performance of the proposed method and its win-win property for the building and EV users.

Renewable energy sources and electric vehicles provide an effective way to reduce the energy cost of an enterprise microgrid. However, the uncertainties of renewable energy sources and the time coupling characteristic of electric vehicles bring great challenges of non-anticipativity and feasibility for supply-demand coordination. To satisfy the non-anticipativity, we develop a supply-demand coordination optimal model using pre-scheduling method with virtual re-scheduling. In this model, the current decision only depends on the current and past realizations of random variables. Furthermore, we enhance the model with time-coupled robust constraints to guarantee the feasibility of the strategy under all possible realizations of the random variables. These time-coupled robust constraints bring high computational complexity to solve this model. So, we develop the method of combining forward recursion and backward recursion to decouple these time-coupled robust constraints in time. In this way, the coordination model is transformed to a mixed integer linear programming (MILP) model which can be efficiently solved. Finally, numerical test based on a real case is analysed and the results show that the energy cost of the enterprise is about 136129$\$ $if the flexible load is about 20% and load shifting and generators rescheduling can reduce the energy cost more than 6%. Note to Practitioners—This study is encouraged by the challenging problem caused by the multi-distributed energy introduced into an enterprise microgrid. In enterprises, as the large-area flat workshop roof assists in convenience for photovoltaics’ development and the EVs are widely used, the issue to best utilize renewable energy and EVs shows vital significance in reducing the energy cost. However, there exist the following three main challenges: (1) the non-anticipativity of the model, (2) the solution’s feasibility under all possible realizations, and (3) the effectiveness of the solution method. For the concerns of non-anticipativity, we develop the model using a pre-scheduling model with virtual re-scheduling in which the current decision only depends on the current and past realizations of random variables. To handle the second challenge, an ideal of scenario model with robust constraints is developed considering both feasibility and economy. In order to solve the model with robust constraints, the all-scenario-feasible method and a combination of the forward recursion and backward recursion method are used to deal with time-independent and the time-coupled robust constraints, respectively. The numeric results demonstrate that load shifting and generators rescheduling can reduce the energy cost more than 6%, and using the method with the forward and backward recursion process can reduce the energy cost more than 9%.

Green and sustainable development of Internet data centers (IDCs) has attracted more attention in both academia and industry. Full utilization of renewable energy sources is widely known as the most effective way to supply electrical and thermal energy while reducing carbon emission. However, the integration of renewable energy into IDCs is still challenging due to the mismatch between uncertain renewable supply and time-varying demand requirements, and high requirement of operation reliability against IDC failures. Therefore, in this paper a hydrogen-water-based energy (HWBE) system is developed and its integrated planning-and-operation problem is formulated as a mixed-integer linear programming problem to determine the optimal capacity of energy facilities in the HWBE system with considering IDC operation reliability. A hybrid physics-based and data-driven method is developed to accurately capture the electrical and thermal energy consumption characteristics and their coupling which are the basis for the optimal planning of the HWBE system. Furthermore, a Benders decomposition-based reliability improvement algorithm is developed to enhance the operation reliability, which decomposes the problem into the planning problem with normal operation as the master problem and the operation problem with IDC failure as the subproblem. The reliability can be enhanced using the solution obtained by the master problem with the feasibility cut obtained from the subproblem. Numerical results show that the developed HWBE system is energy-efficient with low carbon emission, since the power usage efficiency of IDCs could be as low as 1.09 and the carbon emission could be reduced by 74.9% as compared by the electricity-driven IDC energy system.Note to Practitioners—This paper focuses on the integrated planning-and-operation optimization of an HWBE system for the application in IDCs. We improve the energy consumption model of IDCs based on a hybrid physics-based and data-driven method, which can describe the interaction between the dynamic thermal process and electricity consumption of IDCs. In this way, both the high accuracy of the physics-based model and the lower computational effort of the data-driven method could be simultaneously achieved in the energy consumption model. Furthermore, in practice, the optimal planning problem of IDCs is necessary to take into account the operation reliability against data center failures, since the capital expenditure of the backup energy devices is generally significant. This means that a trade-off between the solution accuracy of the planning problem and the computational complexity caused by the operation problem should be considered. Therefore, we develop a Benders decomposition-based reliability improvement algorithm to address the trade-off mentioned above. This technique can integrate the feasibility cut obtained from the operation problem with IDC failure into the planning problem, in order to improve the operation reliability against the supply-demand mismatching and IDC failures while reducing the capital cost, as compared to the system designed by the conventional redundancy standard. Numerical results show the effectiveness of the developed method which can make full use of renewable energy sources and support the green and sustainable development of IDCs.

Information and communication technology tremendously facilitates the operation efficiency and economy of modern power systems in recent years. However, risks such as bandwidth constraints and malicious attacks threaten the secure load frequency control (LFC) of power systems. To mitigate such risks, this paper proposes distributed observer-based event-triggered LFC schemes for multi-area power systems under cyber attacks. Considering the practical situation that only local system output information may be available, distributed observer-based LFC schemes are designed. Meanwhile, to reduce the communication burden, an event-triggered mechanism is adopted to design control laws, where both static and dynamic event-triggered approaches are taken and the dynamic one is proved to be more economical in terms of control cost. Verifiable sufficient conditions are established to guarantee the stability of the closed-loop system in the presence of cyber attacks and the controller gains are explicitly derived. Finally, validation studies on a three-area interconnected power system are carried out to demonstrate the proposed control schemes. Note to Practitioners—Load frequency is a crucial index for evaluating the quality of electric energy and thus LFC has brought considerable attention in the area of power systems control. Although many achievements have been made on the LFC of multi-area power systems, the risks such as bandwidth constraints and malicious attacks affect the normal operation of LFC due to the interconnection between different power systems. To deal with these risks, this paper focuses on designing event-triggered LFC to guarantee the stability of the frequency deviation while reducing the communication burden and mitigating cyber attacks. More importantly, the proposed event-triggered LFC is designed based on an observer and can be implemented in a distributed manner, which is relatively practical in real applications. The results presented in this paper aim to provide a helpful reference for stable and secure LFC design of multi-area power systems, such that the corresponding application research can be promoted.

Load frequency control (LFC) is crucial for the economic operation and safety of power systems. Therefore this paper addresses the LFC problem for uncertain multi-area power systems with actuator failures. Specifically, actuator failures, uncertainties and communication bandwidth constraints appearing in multi-area power systems are taken into account simultaneously, and novel reliable event-triggered LFC schemes are proposed to cope with these troubles. The proposed schemes can ensure the asymptotical stability of the closed-loop system when only matched uncertainty exists. For the case of coexisting matched and mismatched uncertainties, the state trajectories of the closed-loop system can be controlled within a bounded set, where the size of the bounded set is only related to the mismatched uncertainty. To illustrate the theoretical results, a numerical example of three-area interconnected power system is presented. Note to Practitioners—Load frequency directly affects the quality of electric energy and is one of the main observation states of power systems, hence LFC has been widely investigated in the literature. For multi-area power systems, the system model to be controlled may be subjected to multiple unfavorable factors in practical situations, such as limited bandwidths, model uncertainties and actuator failures. To cope with these unfavorable factors, this paper is devoted to developing a unified control framework to guarantee the stability of the frequency deviation based on the event-triggered mechanism. Considering both matched and unmatched system uncertainties may exist as well as the bound of system uncertainties can be unknown, event-triggered control schemes including static event-triggered LFC and adaptive event-triggered LFC are accordingly designed to deal with aforementioned situations such that the closed-loop system is asymptotically or boundedly stable. The research outcome of this paper provides simple but effective LFC approaches that can be used to maintain the reliable and stable operation of multi-area power systems.

Phonation mode detection predicts phonation modes and their temporal boundaries in singing and speech, holding promise for characterizing voice quality and vocal health. However, it is very challenging due to the domain disparities between training data and unannotated real-world recordings. To tackle this problem, we develop a disentangled adversarial domain adaptation network, which adapts the phonation mode detection model with the structure of the convolutional recurrent neural network pre-trained on the source domain to the target domain without phonation mode labels. Based on our curated sung and spoken dataset for phonation mode detection, we demonstrate that the subject and the singing-speech mismatches cause performance decline. By disentangling domain-invariant phonation mode and domain-specific embeddings, our method greatly enhances the effectiveness and explainability of unsupervised adversarial domain adaptation. Experiments show that the performance drop caused by the subject mismatch is alleviated via adaptation, resulting in 44.7% and 6.8% improvement of the F-score for singing and speech, respectively. The singing and speech domain adaptation experiment indicates that a model trained on singing data can be adapted to speech, yielding an F-score of 0.56, commensurate with the F-score of 0.59 achieved using a model exclusively trained on speech data. By further investigating the disentangled embeddings, we find that the phonation mode feature shared by singing and speech is invariant to pitch. These results inspire reliable and versatile applications in voice quality evaluation and paralinguistic information retrieval.

The power-law distribution is ubiquitous and common in many natural, engineering, and social systems. In this article, we found that goal orientation is the driving reason on the power-law distribution in typical social behaviors. A unified model is constructed to formulate the goal orientation mechanism in many social systems. Three mathematical characteristics of tonal music melody are found based on music composition theory. The constrained entropy maximization model (CEMM) is constructed, and the power-law distribution of melodic intervals is the result of solving the problem formulated in this model. Three other typical power-law models in economics, linguistics/informatics, and design of complex engineering systems are reviewed, and their goal orientation behaviors are analyzed. It is found that the models quantifying different social behaviors with goal orientation are consistent with the unified model. The power law is actually the result of the well-known social distribution mechanisms with limited resources, such as the maximal wealth with limited economic capability, the minimal cost under constrained resources, and the maximal entropy with restrictions. If without limit or constraint, these social systems would not observe the power law. This finding could inspire the study on other common laws in computational social systems.

Welcome to the first issue of IEEE Transactions on Computational Social Systems (TCSS) of 2023. The past 2022 was again a very productive year, in which we have published 159 articles with about 1850 pages in six issues. We also received much great and exciting news.

The well-known Gumbel-Max Trick for sampling elements from a categorical distribution (or more generally a non-negative vector) and its variants have been widely used in areas such as machine learning and information retrieval. To sample a random element$i$in proportion to its positive weight$v_{i}$, the Gumbel-Max Trick first computes a Gumbel random variable$g_{i}$for each positive weight element$i$, and then samples the element$i$with the largest value of$g_{i}+\ln v_{i}$. Recently, applications including similarity estimation and weighted cardinality estimation require to generate$k$independent Gumbel-Max variables from high dimensional vectors. However, it is computationally expensive for a large$k$(e.g., hundreds or even thousands) when using the traditional Gumbel-Max Trick. To solve this problem, we propose a novel algorithm,FastGM, which reduces the time complexity from$O(kn^+)$to$O(k \ln k + n^+)$, where$n^+$is the number of positive elements in the vector of interest. FastGM stops the procedure of Gumbel random variables computing for many elements, especially for those with small weights. We perform experiments on a variety of real-world datasets and the experimental results demonstrate that FastGM is orders of magnitude faster than state-of-the-art methods without sacrificing accuracy or incurring additional expenses.

Graphs are widely used to represent the relations among entities. When one owns the complete data, an entire graph can be easily built, therefore performing analysis on the graph is straightforward. However, in many scenarios, it is impractical to centralize the data due to data privacy concerns. An organization or party only keeps a part of the whole graph data, i.e., graph data is isolated from different parties. Recently, Federated Learning (FL) has been proposed to solve the data isolation issue, mainly for Euclidean data. It is still a challenge to apply FL on graph data because graphs contain topological information which is notorious for its non-IID nature and is hard to partition. In this work, we propose a novel FL framework for graph data, FedCog, to efficiently handle coupled graphs that are a kind of distributed graph data, but widely exist in a variety of real-world applications such as mobile carriers’ communication networks and banks’ transaction networks. We theoretically prove the correctness and security of FedCog. Experimental results demonstrate that our method FedCog significantly outperforms traditional FL methods on graphs. Remarkably, our FedCog improves the accuracy of node classification tasks by up to 14.7%.

Graph Neural Networks (GNNs) have been success-fully applied to a variety of graph analysis tasks. Some recent studies have demonstrated that decoupling neighbor aggregation and feature transformation helps to scale GNNs to large graphs. However, very large graphs, with billions of nodes and millions of features, are still beyond the capacity of most existing GNNs. In addition, when we are only interested in a small number of nodes (called target nodes) in a large graph, it is inefficient to use the existing GNNs to infer the labels of these few target nodes. The reason is that they need to propagate and aggregate either node features or predicted labels over the whole graph, which incurs high additional costs relative to the few target nodes. To solve the above challenges, in this paper we propose a novel scalable and effective GNN framework COSAL. In COSAL, we substitute the expensive aggregation with an efficient proximate node selection mechanism, which picks out the most important$K$nodes for each target node according to the graph topology. We further propose a fine-grained neighbor importance quantification strategy to enhance the expressive power of COSAL. Empirical results demonstrate that our COSAL achieves superior performance in accuracy, training speed, and partial inference efficiency. Remarkably, in terms of node classification accuracy, our model COSAL outperforms baselines by significant margins of 2.22%, 2.23%, and 3.95% on large graph datasets Amazon2M, MAG-Scholar-C, and ogbn-papers100M, respectively.11Code available at https://github.com/joyce-x/COSAL.

Cyber search engines, such as Shodan and Censys, have gained popularity due to their strong capability of indexing the Internet of Things (IoT). They actively scan and fingerprint IoT devices for unearthing IP-device mapping. Because of the large address space of the Internet and the mapping’s mutative nature, efficiently tracking the evolution of IP-device mapping with a limited budget of scans is essential for building timely cyber search engines. An intuitive solution is to use reinforcement learning to schedule more scans to networks with high churn rates of IP-device mapping. However, such an intuitive solution has never been systematically studied. In this paper, we take the first step toward demystifying this problem based on our experiences in maintaining a global IoT scanning platform. Inspired by the measurement study of large-scale real-world IoT scan records, we land reinforcement learning onto a system capable of smartly scanning IoT devices in a principled way. We disclose key parameters affecting the effectiveness of different scanning strategies, and find that our system would achieve growing advantages with the proliferation of IoT devices.

The development of Industrial Internet of Things has made industrial control systems more vulnerable to cyber attacks. Many defense measures have been proposed to prevent attacks in upper IP-based networks. However, the security of underlying field bus networks has not received enough attention. Adversaries could tap intrusive devices into the field bus network via unauthorized physical access. As adversaries’ behaviors could be highly concealed when they are eavesdropping or camouflaging, it is challenging and costly to identify these inactive intrusive devices through the network traffic. However, inevitable changes in channel state caused by intrusive devices could be leveraged to detect unauthorized physical access. This article theoretically proves that the transmitted signal’s voltage amplitude would vary after tapping intrusive devices into the field bus network. Leveraging the signal’s variation, we propose an unauthorized physical access detection method via fingerprinting the channel state. Specifically, we adopt weak signal processing technologies to recover the signal’s weak variation and extract its features for detection. The effectiveness of the proposed detection method is validated based on a real testbed. Moreover, simulation experiments with diverse settings demonstrate that the proposed detection method could successfully detect intrusive devices under different scenarios.

Networked microgrids that integrate the hydrogen fueling stations (HFSs) with the on-site renewable energy sources (RES), power-to-hydrogen (P2H) facilities, and hydrogen storage could help decarbonize the energy and transportation sectors. In this paper, to support the hydrogen-based networked microgrids planning subject to multiple uncertainties (e.g., RES generation, electric loads, and the refueling demands of hydrogen vehicles), we propose a two-stage stochastic formulation with mixed integer conic program (MICP) recourse decisions. Our formulation involves the holistic investment and operation modeling to optimally site and configure the microgrids with HFSs. The MICP problems appearing in the second-stage capture the nonlinear power flow of networked microgrids system with binary decisions on storage charging/discharging status and energy transactions (including the trading of electricity, hydrogen, and carbon credits to recover the capital expenditures). To handle the computational challenges associated with the stochastic program with MICP recourse, an augmented Benders decomposition algorithm (ABD) is developed. Numerical studies on 33- and 47-bus exemplary networks demonstrate the economics viability of electricity-hydrogen coordination on microgrids level, as well as the benefits of stochastic modeling. Also, our augmented algorithm significantly outperforms existing methods, e.g., the progressive hedging algorithm (PHA) and the direct use of a professional MIP solver, which has largely improved the solution quality and reduced the computation time by orders of magnitude. Note to Practitioners—This paper proposes an optimal planning model for electricity-hydrogen microgrids with the renewable hydrogen production, storage, and refueling infrastructures. Our planning model is extended under a two-stage stochastic framework to address the multi-energy-sector uncertainties, e.g., RES generation, electric loads, and the refueling demands of hydrogen vehicles. The first-stage problem is to optimize the siting and sizing plan of microgrids. Then, in the second-stage problem, the coordinated scheduling of electricity and hydrogen supply systems is modeled as second-order conic programs (SOCPs) to accurately capture the power flow representation under stochastic scenarios. Also, the logical constraints with binary variables are introduced to describe the energy transactions and storage operations, which results in an MICP recourse structure. Note that the stochastic MICP formulation could be very challenging to compute even with a moderate number of scenarios. One challenge certainly comes from integer variables that cause the problem nonconvex. Another challenge follows from the fact that the strong duality of SOCPs might not hold in general. To mitigate those two challenges, we prove that the continuous relaxation of our recourse problem has strong duality, and make use of that continuous relaxation and other enhancements to design an augmented decomposition algorithm. As revealed by our numerical tests, the proposed decomposition method outperforms PHA in both the solution quality and computational efficiency. Comparing to the PHA, our ABD method often achieves tighter bounds with trivial optimality gaps. Also, it could reduce the computation time by orders of magnitude. With the help of advanced analytical tool, the proposed planning framework can be readily implemented in real-world applications.

This paper presents a dynamic pricing mechanism in the industrial park with demand response programs. A Lagrangian relaxation based dynamic pricing model for electricity and thermal coupled industrial park is formulated, taking into account energy balance, feeder exchange and other systems operating constraints. Considering two-markets clearing mechanism and two types of demand response programs, a dynamic prices prediction model is proposed by long short-term memory (LSTM) technique. Based on the prediction model, we proposed a real-time prices spike detection model for industrial park, which can detect prices spike hourly by history data and give rolling prices spike warning for next short-term operating horizon. Simulation experiments validate the theoretic results and show the effectiveness of the dynamic prices spike detection model.Note to Practitioners—This paper focuses on the dynamic pricing mechanism and prices spike detection for the customers in the industrial park. We improve the pricing model based on the Lagrangian relaxation method and develop a dynamic prices prediction model to handle the uncertainty in real-time. Furthermore, we develop a prices spike detection mechanism, which can achieve rolling detect whether the electricity and thermal prices may exceeded the threshold in the next short-term operating horizon. This technique can give the customers a prices spike early warning service and let them to reschedule their own strategy to minimize their operation cost with respect to the uncertainties in the energy price. Experimental results show that the proposed prices spike detection mechanism can issue spike warnings correctly in most supply-demand mismatching cases.

Machines consume intensive energy in some production systems. Although substantial efforts have been devoted to performance analysis, continuous improvement, and design of production systems, the research on reducing the energy consumption in these systems is limited. In this article, the problem of minimizing the energy consumed by machines in the two-machine Bernoulli serial line, which has been formulated as nonlinear programming with production rate constraint, is investigated. Specifically, structural characteristics and optimality conditions of the problem are analyzed, and two nonlinear algebraic optimality equations are established. To solve the optimality equations, their properties are explored, and an effective algorithm based on the binary search method is developed. Furthermore, the sensitivity of the optimal solution with respect to system parameters is quantitatively analyzed. Based on the sensitivity analysis, some useful insights on the optimal objective value are extracted.Note to Practitioners—In energy-intensive manufacturing enterprises, reducing the energy consumption in their production systems is urgent and challenging. In this article, an energy consumption optimization problem in a simple model of production systems (i.e., in the two-machine Bernoulli line) is investigated. Machine efficiencies are optimized so that the total energy consumption of machines is minimized, while a required production rate is ensured. The reported results enable a novel managerial paradigm for production systems, especially for energy-intensive systems. Although the model of the two-machine Bernoulli line is simple, as a cornerstone, this research will be extended, in the future, to long Bernoulli lines and more practical production systems, e.g., lines with geometric, exponential, and non-exponential machine reliability models.

Cascading failure models are important for understanding the mechanism of blackouts and evaluating the control strategies to prevent the failure propagation. The evolution of cascading failure in actual power grid is a continuous dynamic process triggered by discrete events, such as initial disturbances and physical responses. In this paper, we develop an event-triggered hybrid system model to describe the dynamic process of cascading failure. In the model, the evolution of continuous states of power grid is described by differential algebraic equations and the discrete events are defined as transitions between discrete states of power grid. The model also integrates multiple physical responses including relay protection, frequency regulation and dispatching action. Based on the developed model, we propose an event-triggered simulation method of cascading failure to accelerate the simulation process. Compared with the DC power flow model, hidden failure model and topological model, the simulation results of our model are more accurate because the statistical distribution of demand loss in our model is closer to historical blackouts data. The efficiency of the proposed event-triggered method is demonstrated by comparing our model with the time-driven model and three existing models. The experimental results show that our model can trade off the simulation accuracy and time consumption.Note to Practitioners—This paper focuses on modeling the dynamic process of cascading failure with multiple physical responses in power grid. We develop an event-triggered hybrid system model for cascading failure. In the model, the continuous dynamics of power grid and discrete events triggering the evolution of cascading failure are all described by the framework of hybrid system, which is a good example of modeling the hybrid system for automation researchers and engineers. By this way, the model is more accurate in describing the actual characteristics of cascading failure in power grid, and thus supporting the design and evaluation of control strategies for improving the stability of power grid. Based on the developed model, we propose an event-triggered simulation method of cascading failure, which aims to improve simulation accuracy while potentially reducing time consumption. In practice, the model can make fast control strategies to prevent the failure propagation.

The operation of smart grids heavily relies on secure and accurate meter measurements provided by phasor measurement units (PMUs). Therefore, the optimal PMU placement (OPP) aiming to achieve the complete system observability of smart grids with as few PMUs as possible has been extensively investigated. Although many existing studies have focused on the OPP, few of them are concerned with the placement order of PMUs. To protect as many buses as possible in smart grids when installing PMUs in stages owing to high cost, this paper proposes the attack-resilient OPP strategy which places PMUs in order by using reinforcement learning guided tree search, where the sequential decision making of reinforcement learning is utilized to explore placement orders. The least-effort attack model is carried out to screen vulnerable buses such that the buses adjacent to these buses can be placed PMUs in advance to reduce the state space and action space of the large-scale smart grid environment. Based on that, the reinforcement learning guided tree search approach is used to explore the key buses which need placing PMUs, where the repeated exploration of the agent is avoided by tree search. Then, a reasonable placement order of PMUs is obtained according to the action sequence the proposed method provides. Finally, the effectiveness of the proposed method is verified on various IEEE standard test systems and the comparison results with existing methods are provided.

Many real-world datasets are given in the stream of entity-identifier pairs, and measuring data distribution on these datasets is fundamental for applications such as privacy protection. In this paper, we study the problem of computing the cumulative distribution for different cardinalities (i.e., the number of distinct entities owning the same identifier). However, previous sketch-based methods cost large memory space especially when there are a large number of identifiers, and sampling-based methods require much time for cardinality estimation. A recent work KHyperLogLog combines both sketch and sampling methods but it is wasteful to separately build a HyperLogLog sketch of large size for identifiers with small cardinalities. To address these challenges, we propose a memory-efficient method EV-HLL, which designs a shared structure to store all sampled identifiers and their entities and utilizes additional sketches to track value updates during the sampling procedure. Meanwhile, EV-HLL provides real-time unbiased estimations according to value changes whenever a new entity-identifier pair arrives. We evaluate the performance of EV-HLL and other state-of-the-arts on real-world available datasets. Experimental results demonstrate that comparing to other methods, EV-HLL effectively reduces their memory usage with the same estimation accuracy and has higher accuracy with the same memory usage.

Online monitoring user cardinalities in graph streams is fundamental for many applications such as anomaly detection. These graph streams may contain edge duplicates and have a large number of user-item pairs, which makes it infeasible to exactly compute user cardinalities due to limited computational and memory resources. Existing methods are designed to approximately estimate user cardinalities, but their accuracy highly depends on complex parameters and they cannot provide anytime-available estimation. To address these problems, we develop novel bit/register sharing algorithms, which use a bit/register array to build a compact sketch of all users’ connected items. Our algorithms exploit the dynamic properties of the bit/register arrays (e.g., the fraction of zero bits in the bit array) to significantly improve the estimation accuracy, and have low time complexity$O(1)$to update the estimations for a new user-item pair. In addition, our algorithms are simple and easy to use, without requirements to tune any parameter. Furthermore, we extend our methods to detect super spreaders with large cardinalities in real-time. We evaluate the performance of our methods on real-world datasets. The experimental results demonstrate that our methods are several times more accurate and faster than state-of-the-art methods using the same amount of memory.

Bipartite graphs widely exist in real-world scenarios and model binary relations like host-website, author-paper, and user-product. In bipartite graphs, a butterfly (i.e.,$2\times 2$bi-clique) is the smallest non-trivial cohesive structure and plays an important role in applications such as anomaly detection. Considerable efforts focus on counting butterflies in static bipartite graphs. However, they suffer from high time and space complexity when the bipartite graph of interest is given as a stream of edges. Although there are methods for approximately counting butterflies from bipartite graph streams, they suffer from either low accuracy or high time complexity. Therefore, it is still a challenge to accurately estimate butterfly counts from bipartite graph streams in a short time. To address this issue, we develop novel algorithms by exploiting the bipartite nature, which subtly integrates sampling and sketching techniques. We provide accurate estimators for butterfly counts and derive simple yet exact formulas for bounding their errors. We also conduct extensive experiments on a variety of real-world large bipartite graphs. Experimental results demonstrate that our algorithms are up to 20.0 times more accurate and up to 286.3 times faster than state-of-the-art methods under the same memory usage.

With numerous nodes on online heterogeneous networks, how to reach and extract target nodes of our specific interests is a pressing problem. In this paper, we propose a novel heterogeneous network crawler,MCrawl. It addresses the problem via iterative online heterogeneous network crawling by navigating its available APIs, starting from a set of target nodes, i.e., seed nodes. We are facing two challenges towards addressing the problem. First, to navigate within a vast network, how do we start from a small set of target nodes? In other words, which nodes in the “current frontier” and which direction shall we expand, to reach promising target nodes quickly? We propose motif-based crawling to exploit the complex structures and rich semantics of heterogeneous networks. Second, in many scenarios, we do not have a classifier to assess the quality of the harvested nodes and thus the motifs to expand. We develop a probabilistic inference framework to estimate the yield and harvest rates of motifs, achieving principled bootstrapping for crawling. Our experiment on real networks of MCrawl achieves significant margins over baselines.

Network embedding algorithms learn a mapping from the discrete representation of nodes to continuous vector spaces that preserve the proximities of nodes. The techniques have a wide range of applications in various downstream tasks such as node classification, link prediction, and network alignment. Despite recent efforts to the design of novel models, little attention has been paid to understanding the instability of network embedding. In this paper, we fill this gap by investigating several state-of-the-art network embedding methods. Node embeddings form a geometric shape in the latent space. Characterizing the geometry is critical to figure out the variance of network embedding. Hence, we define two metrics to characterize the geometric properties and find that node embeddings tremble in different instantiations of an embedding space. Then, we formally define the stability of node embeddings as the invariance of the nearest neighbors of nodes. Experimental results show that existing embedding approaches have significant amounts of instability. We explore the influence factors that affect the stability of different methods and find that both network structure and algorithm models affect the stability of node embeddings significantly. Finally, we examine the implications of embedding instability for downstream tasks and find remarkable impacts on the performance.

Understanding mobile data traffic and forecasting future traffic trend is beneficial to wireless carriers and service providers who need to perform resource allocation and energy saving management. However, predicting wireless traffic accurately at large-scale and fine-granularity is particularly challenging due to the following two factors: the spatial correlations between the network units (i.e., a cell tower or an access point) introduced by user arbitrary movements, and the time-evolving nature of user movements which frequently changes with time. In this paper, we use a time-evolving graph to formulate the time-evolving nature of user movements, and propose a model Graph-based Temporal Convolutional Network (GTCN) to predict the future traffic of each network unit in a wireless network. GTCN can bring significant benefits to two aspects. (1) GTCN can effectively learn intra- and inter-time spatial correlations between network units in a time-evolving graph through a node aggregation method. (2) GTCN can efficiently model the temporal dynamics of the mobile traffic trend from different network units through a temporal convolutional layer. Experimental results on two real-world datasets demonstrate the efficiency and efficacy of our method. Compared with state-of-the-art methods, the improvement of the prediction performance of our GTCN is 3.2 to 10.2 percent for different prediction horizons. GTCN also achieves 8.4× faster on prediction time.

With the popularization of Internet of Things (IoT) devices in smart home and industry fields, a huge number of IoT devices are connected to the Internet. However, what devices are connected to a network may not be known by the Internet Service Provider (ISP), since many IoT devices are placed within small networks (e.g., home networks) and are hidden behind network address translation (NAT). Without pinpointing IoT devices in a network, it is unlikely for the ISP to appropriately configure security policies and effectively manage the network. Additionally, inferring fine-grained user interactions of IoT devices is also an interesting yet unresolved problem. In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting from an ISP’s perspective in consideration of practical issues like learning-testing asymmetry. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and the number of each type of device that share the same IP address. Our system can also detect user interactions and meanwhile identify their (concurrent) number through a multi-output regression model. Through extensive evaluation, we demonstrate that the system can generally identify IoT devices with an F1-Score above 0.999, and estimate the number of the same type of IoT device behind NAT with an average error below 5%. By studying 29 user interactions of 7 devices, we show that our system is promising in detecting user interactions.

Many real-world datasets are given in the format of data streams, and processing these data streams is fundamental for many applications such as anomaly detection. In this paper, we study the problem of computing item frequencies, finding topk hot items, and detecting heavy changes. However, the widelyused sketches cost large memory usage and their performance is easily affected by the unbalanced distribution of data streams. To solve this issue, a novel method Cold Filter (CF) is proposed to split cold items and hot items, and use a separate structure to record the frequencies of hot items. Typically, CF has a small filter range and is only effective for filtering cold items with small frequencies. For some real-world applications, however, the cold items' frequencies may also be greater than hundreds or even tens of thousands. To solve the above challenges, we exploit the “LogLog” structure and develop a memory-efficient method LogLog Filter (LLF) to accurately estimate the above three metrics. LLF builds a register array where each register approximately counts the sum of item frequencies hashed into it. Our method remarkably enlarges the filter range of CF with fewer bits and only requires 4 bits to filter cold items with frequencies up to 224. We conduct extensive experiments on real-world and synthetic datasets, and the experimental results demonstrate the efficiency and effectiveness of our method.

Website fingerprinting (WFP) could infer which websites a user is accessing via an encrypted proxy by passively inspecting the traffic between the user and the proxy. The key to WFP is designing a classifier capable of distinguishing traffic characteristics of accessing different websites. However, when deployed in real-life networks, a well-trained classifier may face a significant obstacle of training-testing asymmetry, which fundamentally limits its practicability. Specifically, although pure traffic samples can be collected in a controlled (clean) testbed for training, the classifier may fail to extract such pure traffic samples as its input from raw complicated traffic for testing. In this paper, we are interested in encrypted proxies that relay connections between the user and the proxy individually (e.g., Shadowsocks), and design a context-aware system using built-in spatial-temporal flow correlation to address the obstacle. Extensive experiments demonstrate that our system does not only enable WFP against a popular type of encrypted proxies practical, but also achieves better performance than ideally training/testing pure samples.

Kernel density estimation method is a powerful tool and is widely used in many important real-world applications such as anomaly detection and statistical learning. Unfortunately, current kernel methods suffer from high computational or space costs when dealing with large-scale, high-dimensional datasets, especially when the datasets of interest are given in a stream fashion. Although there are sketch methods designed for kernel density estimation over data streams, they still suffer from high computational costs. To address this problem, in this paper, we propose a novel Rotation Kernel. The Rotation Kernel is based on a Rotation Hash method and is much faster to compute. To achieve memory-efficient kernel density estimation over data streams, we design a method, RKD-Sketch, which compresses high dimensional data streams into a small array of integer counters. We conduct extensive experiments on both synthetic and real-world datasets, and experimental results demonstrate that our RKD-Sketch saves up to 216 times computational resources and up to 104 times space resources than state-of-the-arts. Furthermore, we apply our Rotation Kernel in active learning. Results show that our method achieves up to 256 times speedup and saves up to 13 times space to achieve the same accuracy as the baseline methods.

As an efficient tool for approximate similarity computation and search, Locality Sensitive Hashing (LSH) has been widely used in many research areas including databases, data mining, information retrieval, and machine learning. Classical LSH methods typically require to perform hundreds or even thousands of hashing operations when computing the LSH sketch for each input item (e.g., a set or a vector); however, this complexity is still too expensive and even impractical for applications requiring processing data in real-time. To address this issue, several fast methods such as OPH and BCWS have been proposed to efficiently compute the LSH sketches; however, these methods may generate many sketches with empty bins, which may introduce large errors for similarity estimation and also limit their usage for fast similarity search. To solve this issue, we propose a novel densification method, i.e., BiDens. Compared with existing densification methods, our BiDens is more efficient to fill a sketch's empty bins with values of its non-empty bins in either the forward or backward directions. Furthermore, it also densifies empty bins to satisfy the densification principle (i.e., the LSH property). Theoretical analysis and experimental results on similarity estimation, fast similarity search, and kernel linearization using real-world datasets demonstrate that our BiDens is up to 106 times faster than state-of-the-art methods while achieving the same or even better accuracy.

Global buildings account for about 30% of the total energy consumption and carbon emission, raising severe energy and environmental concerns. Therefore, it is significant and urgent to develop novel smart building energy management (SBEM) technologies for the advance of energy efficient and green buildings. However, it is a nontrivial task due to the following challenges. First, it is generally difficult to develop an explicit building thermal dynamics model that is both accurate and efficient enough for building control. Second, there are many uncertain system parameters (e.g., renewable generation output, outdoor temperature, and the number of occupants). Third, there are many spatially and temporally coupled operational constraints. Fourth, building energy optimization problems can not be solved in real time by traditional methods when they have extremely large solution spaces. Fifthly, traditional building energy management methods have respective applicable premises, which means that they have low versatility when confronted with varying building environments. With the rapid development of Internet of Things technology and computation capability, artificial intelligence technology find its significant competence in control and optimization. As a general artificial intelligence technology, deep reinforcement learning (DRL) is promising to address the above challenges. Notably, the recent years have seen the surge of DRL for SBEM. However, there lacks a systematic overview of different DRL methods for SBEM. To fill the gap, this article provides a comprehensive review of DRL for SBEM from the perspective of system scale. In particular, we identify the existing unresolved issues and point out possible future research directions.

The economic dispatch problem of a smart grid under vicious denial of service (DoS) is the main focus of this paper. Taking the actual situation of power generation as a starting point, a new distributed optimization model is established which takes the environmental pollution penalty into account. For saving the limited bandwidth, a novel distributed event-triggered scheme is proposed to keep the resilience and economy of a class of cyber-power systems when the communication network is subject to malicious DoS attack. Then an improved multi-agent consensus protocol based on the gradient descent idea is designed to solve the minimization problem, and the prerequisites to minimize the system power generation cost are analyzed from the aspects of optimality and stability. Finally, the theoretical results are verified through a single-area 10-generator unit simulation.

The penetration of plug-in electric vehicles (PEVs) has greatly increased over the past few years. By using vehicle-to-grid (V2G) technology, PEVs can be used as “mobile batteries” in a microgrid. Here, we aim to coordinate the V2G dispatch with traditional energy management in a corporate energy system (CES). To do so, a two-stage robust optimization (RO) model is built with respect to uncertainties in the CES, e.g., photovoltaic (PV) power. Particularly, relationships between the working time schedule and PEVs are investigated and analyzed for the first time, and a novel PEV aggregator model, i.e., shift-working V2G, is presented. The shift-working V2G model provides beneficial characteristics, like weakened randomness and stable storage capacity. A quantitative method to evaluate the V2G capacity is then presented. An analytical solution methodology is also proposed, which can equivalently convert the robust “min-max-min” model to a single-level mixed-integer linear programming (MILP) model. Case studies are conducted for an iron and steel company in Shanghai, China, with almost 40 000 PEVs. The results show that V2G integration can significantly improve the load-tracking ability of CES and help reduce the energy cost, although the V2G cost is considered. The computational efficiency is also improved compared with the existing methods. Note to Practitioners-This article is motivated by the problem of using the battery storage capacities of plug-in electric vehicles (PEVs) in a corporate energy system (CES) such as an iron and steel plant, aiming at minimizing the energy cost. In existing studies, behaviors of PEVs (e.g., arriving or leaving time) have usually been elusive since they are directly decided by drivers, and thus, it is difficult to determine how much storage capacity PEVs can provide. However, in a CES where a shift-work regulation is implemented, employees should arrive or leave punctually during each shift, and the same is true of their PEVs. Based on this fact, PEVs within one shift could show weakened randomness and stable storage capacities. In this article, the influences of the shift-work regulation on the PEVs are fully analyzed, and the shift-working V2G provides an easy way to integrate PEVs into the CES. In practice, the shift-working V2G model can be applied to any energy system that also implements a shift-work regulation, such as a fire station.

The idea of using wind power to charge electric vehicles (EVs) has attracted more and more attention nowadays due to the potential in significantly reducing air pollution. However, this problem is challenging on account of the uncertainty in the wind power generation and the charging demand from the EVs. Simulation-based policy improvement (SBPI) has been an important method for decision-making in stochastic dynamic programming and, in particular, for charging decisions of EVs in microgrids. However, the problem of allocating the limited computing budget for the best decision-making in online applications is less discussed. We consider this important problem in this work and make the following three major contributions. First, we show that the significant uncertainty in wind power generation forecasting could make the policy that is the outcome of an SBPI worse than the base policy. Second, we apply two existing methods to address this issue, namely, the optimal computing budget allocation (OCBA) for maximizing the probability of correct selection (OCBA_PCS) and the OCBA for minimizing the expected opportunity cost (OCBA_EOC). The asymptotic optimality is briefly reviewed. Third, we numerically compare the performance of OCBA_PCS and OCBA_EOC with the equal allocation (EA), a principle-based method, and a stochastic scenario-based method on small-scale and large-scale experiments. This work sheds light on the EV charging decision in general. Note to Practitioners-Together with the growing adoption of EVs in modern societies, there goes the challenge of how to satisfy the charging demand. Given the high uncertainty both in the wind power generation and in the charging demand, it is important to make decisions online using up-to-date estimation on the renewable power generation and the charging demand. Simulation-based policy improvement (SBPI) is shown both theoretically and practically to be useful to improve a given base policy in various applications, including this EV charging problem. However, the high uncertainty in forecasting could sometimes make the output of SBPI worse than that of the base policy. In this work, we first use numerical experiments to demonstrate the risk for such scenarios. Then, we propose to use two computing budget allocation procedures to address this issue. The asymptotic optimality of both algorithms is briefly reviewed. We demonstrate their performance on numerical experiments when there are only several EVs and when there are 100 EVs.

With the rapid growth of Android malware, many machine learning-based malware analysis approaches are proposed to mitigate the severe phenomenon. However, such classifiers are opaque, non-intuitive, and difficult for analysts to understand the inner decision reason. For this reason, a variety of explanation approaches are proposed to interpret predictions by providing important features. Unfortunately, the explanation results obtained in the malware analysis domain cannot achieve a consensus in general, which makes the analysts confused about whether they can trust such results. In this work, we propose principled guidelines to assess the quality of five explanation approaches by designing three critical quantitative metrics to measure their stability, robustness, and effectiveness. Furthermore, we collect five widely-used malware datasets and apply the explanation approaches on them in two tasks, including malware detection and familial identification. Based on the generated explanation results, we conduct a sanity check of such explanation approaches in terms of the three metrics. The results demonstrate that our metrics can assess the explanation approaches and help us obtain the knowledge of most typical malicious behaviors for malware analysis.

Estimating set similarity and detecting highly similar sets are fundamental problems in areas such as databases and machine learning. MinHash is a well-known technique for approximating Jaccard similarity of sets and has been successfully used for many applications. Its two compressed versions, b-bit MinHash and Odd Sketch, can significantly reduce the memory usage of the MinHash, especially for estimating high similarities (i.e., similarities around 1). Although MinHash can be applied to static sets as well as streaming sets, of which elements are given in a streaming fashion, unfortunately, b-bit MinHash and Odd Sketch fail to deal with streaming data. To solve this problem, we previously designed a memory-efficient sketch method, MaxLogHash, to accurately estimate Jaccard similarities in streaming sets. Compared with MinHash, our method uses smaller sized registers (each register consists of less than 7 bits) to build a compact sketch for each set. In this paper, we further develop a faster method, MaxLogOPH++. Compared with MaxLogHash, MaxLogOPH++ reduces the time complexity for updating each coming element from O(k) with a small additional memory. We conduct experiments on a variety of datasets, and experimental results demonstrate the efficiency and effectiveness of our methods.

Asynchronous iterative computations (AIC) are common in machine learning and data mining systems. However, the lack of synchronization barriers in asynchronous processing brings challenges for continuous processing while workers might fail. There is no global synchronization point that all workers can roll back to. In this article, we propose a fault-tolerant framework for asynchronous iterative computations (FAIC). Our framework takes a virtual snapshot of the AIC system without halting the computation of any worker. We prove that the virtual snapshot capture by FAIC can recover the AIC system correctly. We evaluate our FAIC framework on two existing AIC systems, Maiter and NOMAD. Our experiment result shows that the checkpoint overhead of FAIC is more than 50 percent shorter than the synchronous checkpoint method. FAIC is around 10 percent faster than other asynchronous snapshot algorithms, such as the Chandy-Lamport algorithm. Our experiments on a large cluster demonstrate that FAIC scales with the number of workers.

In this paper, we study covert communications between a pair of legitimate transmitter-receiver against a watchful warden over slow fading channels. There coexist multiple friendly helper nodes who are willing to protect the covert communication from being detected by the warden. We propose an uncoordinated jammer selection scheme where those helpers whose instantaneous channel gains to the legitimate receiver fall below a pre-established selection threshold will be chosen as jammers radiating jamming signals to defeat the warden. By doing so, the detection accuracy of the warden is expected to be severely degraded while the desired covert communication is rarely affected. We then jointly design the optimal selection threshold and message transmission rate for maximizing covert throughput under the premise that the detection error of the warden exceeds a certain level. Numerical results are presented to validate our theoretical analyses. It is shown that the multi-jammer assisted covert communication outperforms the conventional single-jammer method in terms of covert throughput, and the maximal covert throughput improves significantly as the total number of helpers increases, which demonstrates the validity and superiority of our proposed scheme.

Machine Learning systems are vulnerable to adversarial attacks and will highly likely produce incorrect outputs under these attacks. There are white-box and black-box attacks regarding to adversary's access level to the victim learning algorithm. To defend the learning systems from these attacks, existing methods in the speech domain focus on modifying input signals and testing the behaviours of speech recognizers. We, however, formulate the defense as a classification problem and present a strategy for systematically generating adversarial example datasets: one for white-box attacks and one for black-box attacks, containing both adversarial and normal examples. The white-box attack is a gradient-based method on Baidu DeepSpeech with the Mozilla Common Voice database while the black-box attack is a gradient-free method on a deep model-based keyword spotting system with the Google Speech Command dataset. The generated datasets are used to train a proposed Convolutional Neural Network (CNN), together with cepstral features, to detect adversarial examples. Experimental results show that, it is possible to accurately distinct between adversarial and normal examples for known attacks, in both single-condition and multi-condition training settings, while the performance degrades dramatically for unknown attacks. The adversarial datasets and the source code are made publicly available.

Music tone quality evaluation is generally performed by experts. It could be subjective and short of consistency and fairness as well as time-consuming. In this paper we present a new method for identifying the clarinet reed quality by evaluating tone quality based on the harmonic structure and energy distribution. We first decouple the quality of reed and clarinet pipe based on the acoustic harmonics, and discover that the reed quality is strongly relevant to the even parts of the harmonics. Then we construct a features set consisting of the even harmonic envelope and the energy distribution of harmonics in spectrum. The annotated clarinet audio data are recorded from 3 levels of performers and the tone quality is classified by machine learning. The results show that our new method for identifying low and medium high tones significantly outperforms previous methods.

With the popularization of Internet of Things (IoT) devices in smart home and industry fields, a huge number of IoT devices are connected to the Internet. However, what devices are connected to a network may not be known by the Internet Service Provider (ISP), since many IoT devices are placed within small networks (e.g., home networks) and are hidden behind network address translation (NAT). Without pinpointing IoT devices in a network, it is unlikely for the ISP to appropriately configure security policies and effectively manage the network. In this paper, we design an efficient and scalable system via spatial-temporal traffic fingerprinting. Our system can accurately identify typical IoT devices in a network, with the additional capability of identifying what devices are hidden behind NAT and how many they are. Through extensive evaluation, we demonstrate that the system can generally identify IoT devices with an F-Score above 0.999, and estimate the number of the same type of IoT device behind NAT with an average error below 5%. We also perform small-scale (labor-intensive) experiments to show that our system is promising in detecting user-IoT interactions.

We study the problem of node classification on graphs with few-shot novel labels, which has two distinctive properties: (1) There are novel labels to emerge in the graph; (2) The novel labels have only a few representative nodes for training a classifier. The study of this problem is instructive and corresponds to many applications such as recommendations for newly formed groups with only a few users in online social networks. To cope with this problem, we propose a novel Meta Transformed Network Embedding framework (MetaTNE), which consists of three modules: (1) A \emph{structural module} provides each node a latent representation according to the graph structure. (2) A \emph{meta-learning module} captures the relationships between the graph structure and the node labels as prior knowledge in a meta-learning manner. Additionally, we introduce an \emph{embedding transformation function} that remedies the deficiency of the straightforward use of meta-learning. Inherently, the meta-learned prior knowledge can be used to facilitate the learning of few-shot novel labels. (3) An \emph{optimization module} employs a simple yet effective scheduling strategy to train the above two modules with a balance between graph structure learning and meta-learning. Experiments on four real-world datasets show that MetaTNE brings a huge improvement over the state-of-the-art methods.

The well-known Gumbel-Max Trick for sampling elements from a categorical distribution (or more generally a nonnegative vector) and its variants have been widely used in areas such as machine learning and information retrieval. To sample a random element i (or a Gumbel-Max variable i) in proportion to its positive weight vi, the Gumbel-Max Trick first computes a Gumbel random variable gi for each positive weight element i, and then samples the element i with the largest value of gi + ln vi. Recently, applications including similarity estimation and graph embedding require to generate k independent Gumbel-Max variables from high dimensional vectors. However, it is computationally expensive for a large k (e.g., hundreds or even thousands) when using the traditional Gumbel-Max Trick. To solve this problem, we propose a novel algorithm, FastGM, that reduces the time complexity from O(kn+) to O(kln k + n+), where n+ is the number of positive elements in the vector of interest. Instead of computing k independent Gumbel random variables directly, we find that there exists a technique to generate these variables in descending order. Using this technique, our method FastGM computes variables gi + ln vi for all positive elements i in descending order. As a result, FastGM significantly reduces the computation time because we can stop the procedure of Gumbel random variables computing for many elements especially for those with small weights. Experiments on a variety of real-world datasets show that FastGM is orders of magnitude faster than state-of-the-art methods without sacrificing accuracy and incurring additional expenses.

Microgrid usually associated with distributed renewable energy sources plays a key role in reducing the requirement of traditional power sources and the emission of CO2. Connecting multiple microgrids to the electric power grid can facilitate a more powerful and reliable operation. Microgrids need decentralized dispatch with the requirement of security and privacy, and at the same time, they need to cooperate to satisfy the constraints from the power grid. We consider online decentralized and cooperative dispatch problem in this paper. In order to capture the randomness in the wind and solar power generation and the system dynamics, we formulate the problem as a decentralized Markov decision process (Dec-MDP). We propose a new method to calculate the approximate Q-value functions by constructing the initial feasible policy with reasonable space and time complexity. Bayesian games (BGs) is applied to model the decentralized dispatch with delayed communication in order not to slow down the online decision-making. Also, the alternating minimization method is used to solve this BGs based on the approximate Q-value functions. Numerical results demonstrate that the proposed algorithm is very effective in reducing the state space and computing time and achieving the requirement of real-time scheduling. Motivated by the problem of decentralized dispatch of multi-microgrids in grid-connected mode, we consider the online decentralized operation and pay special attention to the grid tie-line power fluctuation. This problem is challenging due to the randomness of the renewable power generation, the global constraints about multiple microgrids, and the correlation among stages. We model the decentralized dispatch problem as a rolling horizon Dec-MDP and provide an approximate solution method, namely, alternately minimizing among different microgrids at the online stage and calculating approximate value functions in the offline preparation process. The approximate value functions make the online decision turn out to be a single-stage decentralized decision problem. Online decision calculation based on delayed communication is to guarantee all the microgrids to start conducting an action immediately while receiving the information related to them. We hope this paper brings insight onto the tie-line power fluctuation stabilization while multiple microgrids connecting to the same point of interconnection.

Many optimization problems for heating, ventilation, and air conditioning (HVAC) control systems usually refer to multiple timescales. This paper studies a two-timescale decision problem for indoor temperature regulation by HVAC with the objective to improve user's comfort under limited energy consumption. A slow timescale is divided into several fast timescales, so the two timescales have inherent association. Using states of fast timescale to represent the state of its slow timescale properly is challenging, thereby the weighted mean type is proposed in this paper. We find that the realizability and consistency in two-timescale cannot be guaranteed in existing empirical models, which are the bases for physical application. Therefore, this paper proposes a method that building the fast timescale model first and then inducing the slow timescale model from the fast timescale model. In addition, such a problem in the high-order system is more complex, whose solution is also discussed in this paper. The results of case studies show that the induced model can guarantee the consistency and realizability and meet the user desired temperature for comfort. This paper was motivated by the multi-timescale problem that making a decision of controlling the indoor temperature for the user's comfort with energy constraint. Existing approaches to build a two-timescale model by experience would cause the inconsistent deviation. If the HVAC works in a closed environment system like a space station, besides crew comfort, the temperature for experiments in the space station should be accurate. Therefore, the deviation from the actual temperature and the desired temperature will cause adverse effects. In this paper, we mathematically derive the thermal state transfer equations and analyze some problems. Then, this paper suggests a new approach to build the two-timescale model for various conditions, in which the models of two timescales are consistent with each other. Preliminary experiments suggest that this approach is feasible and effective. In future research, we will jointly make optimization and decision of multiple appliances in home energy management (HEM) system.

The intermittency and uncertainty of the renewable energy deteriorate the stability of microgrids. In this article, we focus on a grid-connected microgrid with the wind power and a battery energy storage system (BESS). The electricity load of the microgrid is satisfied by the power from the wind turbine, the BESS, and the grid, together. The purpose is to reduce the fluctuation of grid power by charging or discharging the BESS dynamically. A Markov chain is used to depict the randomness of the wind power and the fluctuation is measured by the variance of grid power. Since the variance measurement is quadratic and nonadditive, the dynamic optimization problem of the BESS does not fit the standard model of Markov decision processes (MDPs) and the dynamic programming (DP) is not applicable. In this article, we introduce the sensitivity-based optimization theory to derive a difference formula to overcome this obstacle. Based on the difference formula, an iterative optimization algorithm is developed and its efficiency is similar to the policy iteration in MDPs. The optimal scheduling policy of the BESS can be derived based on this approach. Besides, we propose a divide-and-conquer method that is much faster than traditional methods of computing the steady-state probability distribution of the large Markov chain. The performance of our approach is verified through numerical experiments using real data. Simulation results demonstrate the efficiency of our approach. In addition, the type selection and capacity sizing of the battery storage are also investigated, which can provide industry guidance for the design of BESS. Note to Practitioners-This article is motivated by the problem of reducing the long-term fluctuation of renewable energy and increasing the stability of microgrids. The frequent and tremendous power exchange between the microgrid and the main grid has an impact on the stability and economy of the main grid since the other plants, such as fuel-burning generators connected to the main grid, must quickly response. Also, the associated cost of conservative spinning reserve and transmission line capacity would be large. Therefore, it is of great practical interest to optimally schedule the battery energy storage system (BESS) to make the total power generated by the BESS and the wind turbine match the demand such that the long-term fluctuation of the grid power is reduced and the stability and economy of the grid are improved. In this article, we use a Markov chain to depict the randomness of wind power and formulate the long-term fluctuation reduction problem as an Markov decision process (MDP) problem. We apply the variance of grid power to the measurement of the fluctuation and develop an iterative algorithm to obtain the optimal policy. Another challenge is the high cost of the BESS. To make a tradeoff between the economic cost and performance, we investigate the problem of type selection and capacity sizing of the BESS. It is shown that the NaS batteries have the highest performance-cost ratio among different batteries considering the capital budget, lifespan, battery availability, and performance by case study. The optimal capacity of batteries is also investigated. These results can provide insights for implementing the BESS in renewable energy systems.

With the advancement of large-scale coordinated attacks, the adversary is shifting away from traditional distributed denial of service (DDoS) attacks against servers to sophisticated DDoS attacks against Internet infrastructures. Link flooding attacks (LFAs) are such powerful attacks against Internet links. Employing network measurement techniques, the defender could detect the link under attack. However, given the large number of Internet links, the defender can only monitor a subset of the links simultaneously, whereas any link might be attacked. Therefore, it remains challenging to practically deploy detection methods. This paper addresses this challenge from a game-theoretic perspective, and proposes a randomized approach (like security patrolling) to optimize LFA detection strategies. Specifically, we formulate the LFA detection problem as a Stackelberg security game, and design randomized detection strategies in consideration of the adversary's behavior, where best and quantal response models are leveraged to characterize the adversary's behavior. We employ a series of techniques to solve the nonlinear and nonconvex NP-hard optimization problems for finding the equilibrium. The experimental results demonstrate the necessity of handling LFAs from a game-theoretic perspective and the effectiveness of our solutions. We believe our study is a significant step forward in formally understanding LFA detection strategies.

Analyzing mouse-interaction behaviors for implicitly identifying computer users has received growing interest from security and biometric researchers. This study presents a simple but efficient active user authentication system by modeling mouse-interaction behavior, which is accurate and competent for future deployments. A pattern-growth-based mining method is proposed to extract frequent behavior segments, in obtaining a stable and discriminative representation of mouse-interaction behavior. Then procedural features are extracted to provide an accurate and fine-grained characterization of the behavior segments. A SVM-based decision procedure using one-class learning techniques is applied to the feature space for performing authentication. Analyses are conducted using data from around 1,526,400 mouse operations of 159 participants, and the authentication performance is evaluated across various application scenarios and tasks. Our experimental results show that characteristics from frequent behavior segments are more stable and discriminative than those from holistic behavior, and the system achieves a practically useful level of performance with FAR of 0.09 percent and FRR of 1 percent. Additional experiments on usability to sample length, reliability to application task, scalability to user size, robustness to mimic attack, and response to behavior change are provided to further explore the applicability. We also compare the proposed approach with the state-of-the-art approaches for the collected data.

Millions of crimes arise each year, which threatens public safety and harms the victims. Precise crime inference is of great significance in preventing crimes. The sharply increasing large-scale heterogeneous data provide a chance to reveal the patterns and trends in crimes. Several approaches employing feature-based regression or spatiotemporal distribution fitting are proposed but lack of some considerations: 1) ignore the dynamic mutual influences among crimes and locations; and 2) overlook the large scale, incompleteness, uncertainty, and vagueness in the heterogeneous data. This article comprehensively investigates the reliability and applicability of proposing a coevolutionary model to formulate the interaction pattern among the crimes and locations and develops a fuzzy-rough-set-based feature selection method to discover the distinctiveness and permanence properties of the crimes and locations with different latent features. Extensive experiments show that our algorithm achieves the mean absolute error of 1.529 (hour) in the crime time inference and the accuracy of 0.653 and 0.633 in the crime type and location inference, which surpass the state of the arts more than 6.5, 1.9, and 1.8 times, respectively. Additional experiments on different parameter settings of our model are provided to further explore its effectiveness and scalability.

Anomaly detection is an important technique used to identify patterns of unusual network behavior and keep the network under control. Today, network attacks are increasing in terms of both their number and sophistication. To avoid causing significant traffic patterns and being detected by existing techniques, many new attacks tend to involve gradual adjustment of behaviors, which always generate incomplete sessions due to their running mechanisms. Accordingly, in this work, we employ the behavior symmetry degree to profile the anomalies and further identify unusual behaviors. We first proposed a symmetry degree to identify the incomplete sessions generated by unusual behaviors; we then employ a sketch to calculate the symmetry degree of internal hosts to improve the identification efficiency for online applications. To reduce the memory cost and probability of collision, we divide the IP addresses into four segments that can be used as keys of the hash functions in the sketch. Moreover, to further improve detection accuracy, a threshold selection method is proposed for dynamic traffic pattern analysis. The hash functions in the sketch are then designed using Chinese remainder theory, which can analytically trace the IP addresses associated with the anomalies. We tested the proposed techniques based on traffic data collected from the northwest center of CERNET (China Education and Research Network); the results show that the proposed methods can effectively detect anomalies in large-scale networks.

People use various online social networks for different purposes. The user information on each social network is usually partial. Thus, matching the users across these multiple online social networks is of great significance for providing new services as well as new insights on user behaviors. Recent research shows that group structure widely exists on social networks, in which members work together with certain purpose and are more influential than individuals on online social networks. Previous works provide outstanding solutions for mapping individuals, but few ones pay attention to the study of groups across multiple social networks. To address the research gap, we first aim to propose an effective method to detect similar group across multiple social networks. The method mainly has three steps, including detecting group structure based on random walks, extracting similarity features, and inferring group similarity using probabilistic graphical model. We evaluate our algorithm on five different types of online social networks. Experimental results show that our method achieves 0.693, 0.779, 0.729 in precision, recall, and F1-measure, which significantly surpass the state-of-the-art by 31.4%-44.3%, 17.3%-26.3%, and 25.9%-31.6%, respectively. The outstanding performance of our method demonstrates that our proposal can reach the requirement of detecting similar groups across social networks. In particular, the result of this paper paves the way for the recommendation system, link prediction and information diffusion across sites.

The increasing usage of wearable devices for ambulatory monitoring and pervasive computing systems has given rise to the need of convenient and efficient activity recognition techniques. Hand-dominated activity recognition has great potential in understanding users' gesture and providing context-aware computing services. This paper investigates the feasibility and applicability on the usage of wristband-interaction behavior for recognizing hand-dominated activities, with the advantage of great compliance and long wearing time. For each action, sensor data from wristband are analyzed to obtain kinematic sequences. The sequences are then depicted by statistics-, frequency-, and wavelet-domain features for providing accurate and fine-grained characterization of hand-dominated actions, and the correlation between the wristband-sensor features and the actions is analyzed. Classification techniques (Naive Bayes, nearest neighbor, neural network, support vector machine, and Random Forest) are applied to the feature space for performing hand-dominated activity recognition. Analyses are conducted using the data from 51 participants with a diversity in gender, age, weight, and height. Extensive experiments demonstrate the efficacy of the proposed approach, achieving a recognition rate of 97.29% and an F-score above 0.94. Additional experiments on the effect of feature selection and wristband sampling rate are provided to further examine the effectiveness of our approach. Our data are publicly available.

Many real-world networks such as Twitter and YouTube are given as fully dynamic graph streams represented as sequences of edge insertions and deletions. (e.g., users can subscribe and unsubscribe to channels on YouTube). Existing similarity estimation methods such as MinHash and OPH are customized to static graphs. We observe that they are indeed sampling methods and exhibit a sampling bias when applied to fully dynamic graph streams, which results in large estimation errors. To solve this challenge, we develop a fast and accurate sketch method VOS. VOS processes each edge in the graph stream of interest with small time complexity O(1) and uses small memory space to build a compact sketch of the dynamic graph stream over time. Based on the sketch built on-the-fly, we develop a method to estimate user similarities over time. We conduct extensive experiments and the experimental results demonstrate the efficiency and efficacy of our method.

Recently, considerable efforts have been devoted to approximately computing the global and local (i.e., incident to each node) triangle counts of a large graph stream represented as a sequence of edges. Existing approximate triangle counting algorithms rely on sampling techniques to reduce the computational cost. However, their estimation errors are significantly determined by the covariance between sampled triangles. Moreover, little attention has been paid to developing parallel one-pass streaming algorithms that can be used to fast and approximately count triangles on a multi-core machine or a cluster of machines. To solve these problems, we develop a novel parallel method REPT to significantly reduce the covariance (even completely eliminate the covariance for some cases) between sampled triangles. We theoretically prove that REPT is more accurate than parallelizing existing triangle count estimation algorithms in a direct manner. In addition, we also conduct extensive experiments on a variety of real-world graphs, and the results demonstrate that our method REPT is several times more accurate than state-of-the-art methods.

Online monitoring user cardinalities (or degrees) in graph streams is fundamental for many applications. For example in a bipartite graph representing user-website visiting activities, user cardinalities (the number of distinct visited websites) are monitored to report network anomalies. These real-world graph streams may contain user-item duplicates and have a huge number of distinct user-item pairs, therefore, it is infeasible to exactly compute user cardinalities when memory and computation resources are limited. Existing methods are designed to approximately estimate user cardinalities, whose accuracy highly depends on parameters that are not easy to set. Moreover, these methods cannot provide anytime-available estimation, as the user cardinalities are computed at the end of the data stream. Realtime applications such as anomaly detection require that user cardinalities are estimated on the fly. To address these problems, we develop novel bit and register sharing algorithms, which use a bit array and a register array to build a compact sketch of all users' connected items respectively. Compared with previous bit and register sharing methods, our algorithms exploit the dynamic properties of the bit and register arrays (e.g., the fraction of zero bits in the bit array at each time) to significantly improve the estimation accuracy, and have low time complexity (O(1)) to update the estimations each time they observe a new useritem pair. In addition, our algorithms are simple and easy to use, without requirements to tune any parameter. We evaluate the performance of our methods on real-world datasets. The experimental results demonstrate that our methods are several times more accurate and faster than state-of-the-art methods using the same amount of memory.

Despite significant progress, deep reinforcement learning (RL) suffers from data-inefficiency and limited generalization. Recent efforts apply meta-learning to learn a meta-learner from a set of RL tasks such that a novel but related task could be solved quickly. Though specific in some ways, different tasks in meta-RL are generally similar at a high level. However, most meta-RL methods do not explicitly and adequately model the specific and shared information among different tasks, which limits their ability to learn training tasks and to generalize to novel tasks. In this paper, we propose to capture the shared information on the one hand and meta-learn how to quickly abstract the specific information about a task on the other hand. Methodologically, we train an SGD meta-learner to quickly optimize a task encoder for each task, which generates a task embedding based on past experience. Meanwhile, we learn a policy which is shared across all tasks and conditioned on task embeddings. Empirical results on four simulated tasks demonstrate that our method has better learning capacity on both training and novel tasks and attains up to 3 to 4 times higher returns compared to baselines.

Estimating set similarity and detecting highly similar sets are fundamental problems in areas such as databases, machine learning, and information retrieval. MinHash is a well-known technique for approximating Jaccard similarity of sets and has been successfully used for many applications such as similarity search and large scale learning. Its two compressed versions, b-bit MinHash and Odd Sketch, can significantly reduce the memory usage of the original MinHash method, especially for estimating high similarities (i.e., similarities around 1). Although MinHash can be applied to static sets as well as streaming sets, of which elements are given in a streaming fashion and cardinality is unknown or even infinite, unfortunately, b-bit MinHash and Odd Sketch fail to deal with streaming data. To solve this problem, we design a memory efficient sketch method, MaxLogHash, to accurately estimate Jaccard similarities in streaming sets. Compared to MinHash, our method uses smaller sized registers (each register consists of less than 7 bits) to build a compact sketch for each set. We also provide a simple yet accurate estimator for inferring Jaccard similarity from MaxLogHash sketches. In addition, we derive formulas for bounding the estimation error and determine the smallest necessary memory usage (i.e., the number of registers used for a MaxLogHash sketch) for the desired accuracy. We conduct experiments on a variety of datasets, and experimental results show that our method MaxLogHash is about 5 times more memory efficient than MinHash with the same accuracy and computational cost for estimating high similarities.

Electric vehicles (EVs) have experienced a rapid growth due to the economic and environmental benefits. However, the substantial charging load brings challenging issues to the power grid. Modern technological advances and the huge number of high-rise buildings have promoted the development of distributed energy resources, such as building integrated/mounted wind turbines. The issue to coordinate EV charging with locally generated wind power of buildings can potentially reduce the impacts of EV charging demand on the power grid. As a result, this paper investigates this important problem and three contributions are made. First, the real-time scheduling of EV charging is addressed in a centralized framework based on the ideas of model predictive control, which incorporates the volatile wind power supply of buildings and the random daily driving cycles of EVs among different buildings. Second, an EV-based decentralized charging algorithm (EBDC) is developed to overcome the difficulties due to: 1) the possible lack of global information regarding the charging requirements of all EVs and 2) the computational burden with the increasing number of EVs. Third, we prove that the EBDC method can converge to the optimal solution of the centralized problem over each planning horizon. Moreover, the performance of the EBDC method is assessed through numeric comparisons with an optimal and two heuristic charging strategies (i.e., myopic and greedy). The results demonstrate that the EBDC method can achieve a satisfactory performance in improving the scalability and the balance between the EV charging demand and wind power supply of buildings.Note to Practitioners—This paper is motivated by the challenging problem due to the substantial charging load of electric vehicles (EVs) on the power grid. Nowadays, modern technological advances and the rapid increase of high-rise buildings have promoted the development of building integrated/mounted wind turbines. As the EVs are usually parked in buildings for a large proportion of time every day, the issue to best utilize locally generated wind power of buildings to suffice EV travelling requirements shows vital significance in reducing their dependence on the power grid. However, there exist two main challenges including: 1) the multiple uncertainties regarding the uncertain wind power generation and the random driving behaviors of EVs and 2) the scalability of the solution method. To tackle the first challenge, the idea of model predictive control is introduced to make charging decisions at each stage based on a short-term prediction of the on-site wind power and the current collection of EVs parked there. To consider the scalability and overcome the lack of global charging information of all EVs in practical deployment, an iterative EV-based decentralized charging algorithm (EBDC) is derived, in which each EV can dynamically update its own charging decisions according to a dynamic charging “price” announced by the buildings. Alternatively, the buildings dynamically adjust the charging “price” to motivate the EVs to get charged during the time periods with sufficient wind power supply. Numeric results demonstrate that the EBDC method is scalable and performs well in improving the balance between the EV charging demand and the wind power supply of buildings.

People participate in multiple online social networks, e.g., Facebook, Twitter, and Linkedin, and these social networks with heterogeneous social content and user relationship are named as heterogeneous social networks. Group structure widely exists in heterogeneous social networks, which reveals the evolution of human cooperation. Detecting similar groups in heterogeneous networks has a great significance for many applications, such as recommendation system and spammer detection, using the wealth of group information. Although promising, this novel problem encounters a variety of technical challenges, including incomplete data, high time complexity, and ground truth. To address the research gap and technical challenges, we take advantage of a ratio-cut optimization function to model this novel problem by the linear mixed-effects method and graph spectral theory. Based on this model, we propose an efficient algorithm called D igger to detect the similar groups in the large graphs. D igger consists of three steps, including measuring user similarity, construct a matching graph, and detecting similar groups. We adopt several strategies to lower the computational cost and detail the basis of labeling the ground truth. We evaluate the effectiveness and efficiency of our algorithm on five different types of online social networks. The extensive experiments show that our method achieves 0.693, 0.783, and 0.735 in precision, recall, and F1-measure, which significantly surpass the state-of-arts by 24.4%, 15.3%, and 20.7%, respectively. The results demonstrate that our proposal can detect similar groups in heterogeneous networks effectively.

Monitoring user behaviors over high speed links is important for applications such as network anomaly detection. Previous work focuses on monitoring anomalies such as extremely frequent users occurring in a short timeslot such as 1 minute. Little attention has been paid to detect users with stealthy behaviors (e.g., persistent, co-occurrence, anti-co-occurrence, and periodic behaviors) over a long period of time at the timeslot granularity. Due to limited computation and storage resources on routers, it is prohibitive to collect massive network traffic in a long period of time. We develop an end-to-end method for solving challenges in both long-term online traffic collection and offline user behavior analysis. We conduct extensive experiments on a variety of real-world traffic to evaluate the performance of detecting persistent, co-occurrence, anti-co-occurrence, and periodic behaviors, and the results demonstrate that our method significantly outperforms state-of-the-art methods.

Distinct sampling is fundamental for computing statistics (e.g., the age and gender distribution of distinct users accessing a particular website) depending on the set of distinct keys (e.g., user IDs) in a large and high speed data stream such as a sequence of key-update pairs. However, the major shortcoming of existing methods is their high computational cost incurred by determining whether each incoming key in the data stream is currently in the set of sampled keys and keeping track of sampled keys’ update aggregations. To solve this challenge, we develop a new methodrandom projection and eviction(RPE) that uses a list of buckets to continuously sample distinct keys and their update aggregations. RPE processes each key-update pair with small and nearly constant time complexity$O(1)$. Besides centralized data streams, we also develop a novel method DRPE to deal with distributed data streams consisting of key-update pairs observed at multiple distributed sites. We conduct extensive experiments on real-world datasets, and the results demonstrate that RPE and DRPE reduce the memory, computational, and message costs of state-of-the-art methods by several times.

Despite recent efforts in counting 3-node and 4-node graphlets, little attention has been paid to characterizing 5-node graphlets. In this paper, we develop a computationally efficient sampling method to estimate 5-node graphlet counts. We not only provide a fast sampling method and unbiased estimators of graphlet counts, but also derive simple yet exact formulas for the variances of the estimators which are of great value in practice-the variances can be used to bound the estimates' errors and determine the smallest necessary sampling budget for a desired accuracy. We conduct experiments on a variety of real-world datasets, and the results show that our method is several orders of magnitude faster than the state-of-the-art methods with the same accuracy.

Domain Name System (DNS) is one of the pillars of today's Internet. Due to its appealing properties such as low data volume, wide-ranging applications and encryption free, DNS traffic has been extensively utilized for network monitoring. Most existing studies of DNS traffic, however, focus on domain name reputation. Little attention has been paid to understanding and profiling what people are doing from DNS traffic, a fundamental problem in the areas including Internet demographics and network behavior analysis. Consequently, simple questions like “How to determine whether a DNS query for www.google.com means searching or any other behaviors?” cannot be answered by existing studies. In this paper, we take the first step to identify user activities from raw DNS queries. We advance a multiscale hierarchical framework to tackle two practical challenges, i.e., behavior ambiguity and behavior polymorphism. Under this framework, a series of novel methods, such as pattern upward mapping and multi-scale random forest classifier, are proposed to characterize and identify user activities of interest. Evaluation using both synthetic and real-world DNS traces demonstrates the effectiveness of our method.

Mining user behaviors over high speed links is important for applications such as network anomaly detection. Previous work focuses on monitoring anomalies such as extremely frequent users occurring in a short timeslot such as 1 minute. Little attention has been paid to detect users with stealthy behaviors such as persistent frequent and co-occurrence behaviors over a long period of time at the timeslot granularity (e.g., 1 minute granularity level). Unlike frequent users, persistent users do not necessarily occur more frequently than other users in a single timeslot, but persist and occur in a larger number of timeslots. Due to limited computation and storage resources on routers, it is prohibitive to collect massive network traffic in a long period of time. We develop an end-to-end method for solving challenges in both long-term online traffic collection and offline user behavior analysis. To achieve this goal, we design a user embedding (UE) method to fast build compact sketches of user-occurrence events over time. To reduce the estimation error introduced by Bloom Filter, we model UE as a sampling method and propose methods to accurately mine a variety of user behaviors from user-occurrence events rebuilt from UE sketches. In addition, we introduce another new embedding method reversible UE (RUE) to detect persistent frequent behaviors when monitored users' IDs are not given in advance for offline analysis. We conduct extensive experiments on real-world traffic, and the results demonstrate that our methods significantly outperform state-of-the-art methods.

The optimal control of the heating, ventilation, and air-conditioning (HVAC) system in buildings has a significant energy saving potential and therefore is of a great practical interest. An event-based HVAC control adjusts control actions when certain events occur, which may be faster and more scalable than state-based or time-driven control methods. However, events may capture either local or global changes in the rooms. The choice of events is a tradeoff between the computational efficiency and the control performance. This challenging problem remains open. We consider this as an important problem in this paper and make three major contributions. First, we define local and global events for the HVAC control problem. The complexity of these event-based control policies is defined. Second, based on hypothesis testing, we develop a method to select events that capture a sufficient state information and with a relatively small event space. Third, we demonstrate the performance of this method on two groups of examples, including one group of small-scale problems for the proof of concept and the other group of large-scale problems in the HVAC control. It is shown that our method outperforms the Levin search, which is a traditional complexity-based search method and finds event-based HVAC control policies with a good performance.Note to Practitioners—When there are multiple rooms in a building, the HVAC control may achieve a significant energy saving and an indoor comfort satisfaction in the same time through exploring the coupling among the rooms. By appropriately defining the events, the size of the event space is usually much smaller than the state space. Therefore, an event-based control is more scalable and preferred in practice. Local events capture the state changes of rooms in a small neighborhood, which leads to a small event space but limited information. Global events capture the state changes of rooms in a large neighborhood, which leads to more information but a large event space. It remains open how to select events in large-scale HVAC control problems, especially when the computing budget is limited. In this paper, we define the complexity of an event-based control policy by the number of neighboring rooms considered. We develop a method based on hypothesis testing to select events with a proper complexity in order to achieve a good system performance. The performance of this method is demonstrated on an HVAC control problem.

The increasing use of smartphones as personal computing platforms to access personal information has stressed the demand for secure and usable authentication techniques, and for constantly protecting privacy. Smartphone sensors can measure users' unique behavioral characteristics when they interact with smartphones, based on different habits, gestures, and angle preferences of touch actions. This paper investigates the reliability and applicability of using motion-sensor behavior for active and continuous smartphone authentication across various operational scenarios, and presents a systematic evaluation of the distinctiveness and permanence properties of the behavior. For each sample of sensor behavior, kinematic information sequences are extracted and analyzed, which are characterized by statistic-, frequency-, and wavelet-domain features, to provide accurate and fine-grained characterization of users' touch actions. A Markov-based decision procedure, using one-class learning techniques, is developed and applied to the feature space for performing authentication. Analyses are conducted using the sensor data of 520 200 touch actions from 102 subjects across various operational scenarios. Extensive experiments show that motion-sensor behavior exhibits sufficient discriminability and stability for active and continuous authentication, and can achieve a false-rejection rate of 5.03% and a false-acceptance rate of 3.98%. Additional experiments on usability to operation length, sensitivity to application scenario, scalability to user size, contribution to different sensors, and response to behavior change are provided to further explore the effectiveness and applicability. We also implement an authentication system into the Android system that can react to the presence of the legitimate user.

Counting 3-, 4-, and 5-node graphlets in graphs is important for graph mining applications such as discovering abnormal/ evolution patterns in social and biology networks. In addition, it is recently widely used for computing similarities between graphs and graph classification applications such as protein function prediction and malware detection. However, it is challenging to compute these graphlet counts for a large graph or a large set of graphs due to the combinatorial nature of the problem. Despite recent efforts in counting 3-node and 4-node graphlets, little attention has been paid to characterizing 5-node graphlets. In this paper, we develop a computationally efficient sampling method to estimate 5-node graphlet counts. We not only provide a fast sampling method and unbiased estimators of graphlet counts, but also derive simple yet exact formulas for the variances of the estimators which are of great value in practice-the variances can be used to bound the estimates' errors and determine the smallest necessary sampling budget for a desired accuracy. We conduct experiments on a variety of real-world datasets, and the results show that our method is several orders of magnitude faster than the state-of-the-art methods with the same accuracy.

The pervasiveness of wearable devices furnished with state-of-the-art sensors has shown the powerful capability in context-aware applications. However, embedded sensors also become targets for adversaries to launch potential side-channel attacks. In this paper, we present a self-adaptive and pretraining-independent pattern attack that infers a graphical password by recovering the victim's hand movement trajectory via motion sensors of a wrist-worn smart device. With the adaptive pattern inference algorithm, the discovered attack can be launched remotely without requiring previous training data from victims or the prior knowledge about the keyboard input settings. Toward the proposed attack, we create a method to detect the sliding behavior that draws a graphical password on the screen. We also propose an inference algorithm to generate password candidates from hand movement trajectories for different keypad input settings. We implement the discovered attack on a smartwatch and conduct experiments to evaluate the impact of this attack. The evaluation results show that for complex graphical patterns, with a single try, the attack can infer the passwords at a success rate as high as 80%, and the success rate can be further boosted to over 90% within five attempts, which reveals the overlooked privacy information threat caused by sensor data leakage.

Recently, network traffic classification has attracted a great deal of attention among researchers. In this paper, we proposed a traffic classification approach based on characteristics of subflows and ensemble learning. Aiming at neutralization of unstable network environment as well as taking advantage of ensemble learning, we divided the traffic flows into different subflows in order to reduce the affection of time. Moreover, we develop truncation method on flows for real-time processing and an aggregation machine learning method based on accuracy of each classifier to different applications. Finally, the experimental results based on actual traffic traces collected from the campus network of Xian Jiaotong University verify the effectiveness of our methods.

Counting triangles in a large graph is important for detecting network anomalies such as spam web pages and suspicious accounts (e.g., fraudsters and advertisers) on online social networks. However, it is challenging to compute the number of triangles in a large graph represented as a stream of edges with a low computational cost when given a limited memory. Recently, several effective sampling-based approximation methods have been developed to solve this problem. However, they assume the graph stream of interest contains no duplicate edges, which does not hold in many real-world graph streams (e.g., phone calling networks). In this paper, we observe that these methods exhibit a large estimation error or computational cost even when modified to deal with duplicate edges using deduplication techniques such as Bloom filter and hash-based sampling. To solve this challenge, we design a one-pass streaming algorithm for uniformly sampling distinct edges at a high speed. Compared to state-of-the-art algorithms, our algorithm reduces the sampling cost per edge from O (log k ) ( k is the maximum number of sampled edges determined by the available memory space) to O (1) without using any additional memory space. Based on sampled edges, we develop a simple yet accurate method to infer the number of triangles in the original graph stream. We conduct extensive experiments on a variety of real-world large graphs, and the results demonstrate that our method is several times more accurate and faster than state-of-the-art methods with the same memory usage.

The matching between random wind supply and electric vehicle (EV) charging demand can reduce the requirement of traditional power sources and the emission of CO2. This problem is of great practical interest but involves system dynamics in multiple timescales. We consider this an important problem in this paper. In order to capture the randomness in the wind supply and EV charging demand, we formulate the problem as a bilevel Markov decision process. At the upper level, the charging demand of EVs in different locations is aggregated into multiple aggregators. The system operator dispatches power among the aggregators in a coarse timescale to maximize the wind power utilization. At the lower level, the aggregator schedules the charging process of individual EVs at a finer timescale to minimize the charging cost. In order to solve this large-scale problem, a bilevel simulation-based policy improvement (SBPI) method is developed. It is mathematically proved that the SBPI can improve from base policies in both levels. The performance of this multi-timescale and bilevel coordination approach is demonstrated through case studies in the city of Beijing.

Symbolic execution is a powerful technique for systematically exploring the paths of a program and generating the corresponding test inputs. However, its practical usage is often limited by thepath explosionproblem, that is, the number of explored paths usually grows exponentially with the increase of program size. In this paper, we argue that for the purpose of fault detection it is not necessary to systematically explore the paths, and propose a new symbolic execution approach to mitigate the path explosion problem by predicting and eliminating the redundant paths based on symbolic value. Our approach can achieve the equivalent fault detection capability as traditional symbolic execution without exhaustive path exploration. In addition, we develop a practical implementation called Dependence Guided Symbolic Execution (DGSE) to soundly approximate our approach. Through exploiting program dependence, DGSE can predict and eliminate the redundant paths at a reasonable computational cost. Our empirical study shows that the redundant paths are abundant and widespread in a program. Compared with traditional symbolic execution, DGSE only explores 6.96 to 96.57 percent of the paths and achieves a speedup of 1.02$\times$to 49.56$\times$. We have released our tool and the benchmarks used to evaluate DGSE$^\ast$.

Users can participate in variety topics and express their opinions using different kinds of online applications, and the IDs (nickname) they used are usually virtual and difficult for finding the physical person. Which pose great challenges for network security management and user's online behavior supervision. Focus on this problem, we proposed methods for nickname detection based on the user's online connection structure and similarity propagation model. Firstly, we collected user's profile information from two popular online applications, sina microblog and RenRen network. Then we mark several matched pairs which belong to the same person from the applications with hardly manually effort, and those IDs are selected as seed set for nickname detection. Secondly, we proposed an nickname detection model based on the connection structure and similarity propagation. We selected one matched pairs from the seed set and obtain all their neighbors. Then we calculated the similarity of each pairs from the neighbor set and calculate their neighbors' connection similarity and neighbors' location similarity. If the similarity is bigger than a selected threshold, we claim they are matched pairs and insert them into the seed sets. On one hand, the correlation results can propagated based on the updated seed set. On the other hand, the computational complexity are greatly reduced as we only employ the neighbors' profiles to calculate the similarity. Experimental results verify the efficiency of the proposed method, which can lay a solid foundation for the online network management and user's behavior supervision.

SDN has become the wide area network technology, which the academic and industry most concerned about.The limited table sizes of today’s SDN switches has turned to the most prominent short planks in the network design implementation. TCAM based flow table can provide an excellent matching performance while it really costs much. Even the flow table overflow cannot be prevented by a fixed-capacity flow table. In this paper, we design FTS(Flow Table Sharing) mechanism that can improve the performance disaster caused by overflow. We demonstrate that FTS reduces both control messages quantity and RTT time by two orders of magnitude compared to current state-of-the-art OpenFlow table-miss handler.

OpenFlow, as the Software Defined Networking (SDN) primitive, provides a simple forwarding plane abstraction, which heavily relies on the fast memory inside the OpenFlow Switch (OFS). OFS components, e.g. flow table, meter table, counters, have to compete for the limited fast memory resource. As a result, only a few counting functions are defined as mandatory in the OFS specification, although a lot of SDN proposals depend on a detailed states collected by the optional counters in the specification. This fact motivates us to rethink the way to maintain counters in the OFS. We propose a new architecture called CACTI, which only consumes several registers in the fast path and moves the completed counters into the on chip RAM like cache in the slow path processor. Theoretical analysis and experiments on the prototype system demonstrated the efficiency of our architecture: CACTI is capable to achieve the throughput of 29.4-39.7M pps packets per second (pps). No RAM resource is needed any more in the fast path, instead, CACTI consumes only 0.24-0.54\% Look-Up Table and 0.35-0.43\% flip-flops compared with the entire FPGA-based OFS design in the fast path, and the unused CPU cache in the slow path.

Continuous authentication offers the ability to continuously verify users' identity for accessing to the protected resource. Although current explorations such as face and fingerprint verification have seen varying rates of success, three main problems may limit their applicability in the context of information protection and access control: they can be of low availability in some practical scenarios, they can be intrusive, and they commonly require costly equipment. This paper presents a multimodal biometrics authentication system that can continuously verify the presence of a logged-in user. Three passive biometric modalities are currently used - keystroke (i.e., behavioral biometric), face (i.e., physiological biometric), and skin color (i.e., soft biometric) - but our approach can also be readily extended to include more modalities. By fusing these three passive biometrics, the continuous authentication system combines both temporal and modality information holistically, and can keep verifying who is using the computing system, without troubling users' routine activities. Based on real data resulting from our implementation, we find the results to be very promising with a false-acceptance rate of 0% and a false-rejection rate of 0.72%. Additional experiment on the size of observation window is provided to further examine the applicability of the proposed approach.

Analysis of mouse-interaction behaviors for identifying individual computer users has experienced growing interest from information security and biometric researchers. This paper presents a simple and efficient user verification system by modeling mouse-interaction behavior, which is accurate and competent for future deployment. For each mouse-operation sample, holistic attributes of mouse trajectories are first analyzed using a power transformation method, to derive a schematic representation of behavior eigenspace. Then, a propagation-based segmentation method is developed to model the detailed dynamic process of mouse movements by performing adaptive behavior segmentation and then characterizing each obtained segment using fine-grained procedural motion metrics. Both schematic and procedural cues from mouse-interaction behaviors may be used independently for verification, being fused at the decision level using combination rules. Analyses are conducted using data from 106 subjects with 21 200 mouse-operation samples. The verification system achieves a 1.96% false-rejection rate and a 1.18% false-acceptance rate with a short verification time (about 6 s) and lightweight system overload. Additional experiments on the effect of sample length and subject pool further examine the applicability of our verification system. We also compare the proposed approach with the state-of-the-art approaches for the data collected. Our findings suggest that mouse-interaction behaviors can enhance traditional authentication systems.

The increasing use of touchscreen smartphones to access sensitive and privacy data has given rise to the need of secure and usable authentication technique. Smartphone users have their own unique behavioral characteristics when performing touch operations. These personal characteristics are reflected on different rhythm, strength, and angle preferences of touch-interaction behavior. This paper investigates the reliability and applicability on the usage of users' touch-interaction behavior for active authentication on smartphones. For each common type of touch operations, both static and dynamic features are extracted and analyzed for fine-grained characterization of users' touch behavior. Classification techniques (nearest neighbor, neural network, support vector machine, and random forest) are applied to the feature space for performing the task of active authentication. Analyses are conducted using data from around 134 900 touch operations of 71 participants in real-world scenarios, and the authentication performance is evaluated across various types of touch operations, varying operation lengths, different application tasks, and different application scenarios. The extensive experimental results are included to show that touch-interaction behavior exhibits sufficient discriminability and stability among smartphone users for active authentication, and achieves equal-error rates between 1.72% and 9.01% for different types of touch operations with the operation length of 11; the authentication accuracies improve when having long observation or small timespan between the training and testing phases, and express more reliably and stably in a specific task than in the free task. We also discuss a number of avenues for additional research that we believe are necessary to advance the state-of-the-art in this area.

Random walk-based graph sampling methods have become increasingly popular and important for characterizing large-scale complex networks. While powerful, they are known to exhibit problems when the graph is loosely connected, which slows down the convergence of a random walk and can result in poor estimation accuracy. In this work, we observe that many graphs under study, called target graphs, usually do not exist in isolation. In many situations, a target graph is often related to an auxiliary graph and an affiliation graph, and the target graph becomes better connected when viewed from these three graphs as a whole, or what we called a hybrid social-affiliation network. This viewpoint brings extra benefits to the graph sampling framework, e.g., when directly sampling a target graph is difficult or inefficient, we can efficiently sample it with the assistance of auxiliary and affiliation graphs. We propose three sampling methods on such a hybrid social-affiliation network to estimate target graph characteristics, and conduct extensive experiments on both synthetic and real datasets, to demonstrate the effectiveness of these new sampling methods.

With the growing stickiness of the Internet, numerous automated programs running in terminal facilities (e.g., laptops) tend to keep closely connected to the Internet by repetitively interacting with remote services. It is of fundamental importance to study such repeating behaviors of automated programs in areas like traffic engineering and network monitoring. This paper focuses on repeating behaviors in packet arrivals that are of interest, aiming at a hierarchical characterization of packet arrivals, detection methods and quantitative metrics. To this end, we present a structure-oriented characterization of packet arrivals, which reflects the temporal structure of repeating behaviors at different scales. Based on such characterization, a repeating behavior detection method is proposed by leveraging online-learning prediction, and two novel metrics of repeating behaviors are proposed from different aspects. In addition, a denoising method is developed to enhance the noise-tolerant capability of detection and measurement in face of noises. Experimental results based on real-world traces demonstrate the effectiveness of our proposed approaches in automated program behavior detection and behavioral botnet analysis.

Zonal occupant level is of great practical interest for building energy saving under normal operations and for fast evacuation under emergency. Though there are many existing sensing systems to estimate this information, the problem is still challenging due to the privacy concerns, the random human movement, and the accumulative error. In this paper, we consider this important problem and focus on infrared beam systems that monitor the zonal arrival and departure events. We make the following contributions. First, a rule (i.e., Rule 1) based on the stay time is developed to reduce the accumulated estimation error in each zone. Second, a rule (i.e., Rule 2) is designed to coordinate the estimation among neighboring zones. A decentralized estimation method is then developed using these two rules. Third, the advantage of this method is demonstrated through simulation results and field tests. We hope this work brings insight to zonal occupant level estimation in buildings in more general situations.

Due to the large amount of energy consumed in buildings, building energy savings has attracted more and more attention recently. The total energy consumed during building operations is determined by the building energy efficiency and the total demand. On the one hand, though most existing studies focus on improving building energy efficiency, there are limits. On the other hand, the demand grows fast and without limit. Therefore it is important to coordinate the supply and demand in buildings. We consider this important problem in this paper and make the following major contributions. First, the concept of average price of electricity (APE) is defined to measure the average generation cost of electricity using multiple devices. Second, a comfort model of occupant is developed to capture the tradeoff between thermal comfort and cost. Human building interaction allows the user to adjust their temperature set ranges according to the APE in real time. Third, an iterative solution method is developed to solve the supply demand coordination optimization problem. Numerical examples show that significant energy saving is possible through exploring the soft comfort requirement of the occupants, and the iterative method achieves a solution which is close to that of the centralized method, but in a much faster way. We hope this work brings insight to building energy saving in general.

Characterizing user pair relationships is important for applications such as friend recommendation and interest targeting in online social networks (OSNs). Due to the large-scale nature of such networks, it is infeasible to enumerate all user pairs and thus sampling is used. In this article, we show that it is a great challenge for OSN service providers to characterize user pair relationships, even when they possess the complete graph topology. The reason is that when sampling techniques (i.e., uniform vertex sampling (UVS) and random walk (RW)) are naively applied, they can introduce large biases, particularly for estimating similarity distribution of user pairs with constraints like existence of mutual neighbors, which is important for applications such as identifying network homophily. Estimating statistics of user pairs is more challenging in the absence of the complete topology information, as an unbiased sampling technique like UVS is usually not allowed and exploring the OSN graph topology is expensive. To address these challenges, we present unbiased sampling methods to characterize user pair properties based on UVS and RW techniques. We carry out an evaluation of our methods to show their accuracy and efficiency. Finally, we apply our methods to three OSNs—Foursquare, Douban, and Xiami—and discover that significant homophily is present in these networks.

System objects play different roles in a computer system and exhibit different degrees of importance with respect to system security. Identifying importance metrics can help us to develop more effective and efficient security protection methods. However, there is little previous work on evaluating the importance of objects from the perspective of security. In this paper, we propose a novel approach to evaluate the importance of various system objects based on a bipartite dependency network representation of access behaviors observed in a computer system. We introduce centrality metrics from network science to quantitatively measure the relative importance of system objects and reveal their inherent connections to security properties such as integrity and confidentiality. Furthermore, we propose importance-metric based models to characterize process behaviors and identify abnormal access patterns with respect to confidentiality and integrity. Extensive experimental results on one real-world dataset demonstrate that our model is capable of detecting 7,257 malware samples from 27,840 benign processes at 93.94% TPR under 0.1% FPR. Moreover, a selective protection scheme based on a partial behavioral model of important objects achieves comparable or even better results in malware detection when compared with complete behavior models. This demonstrates the feasibility of the devised importance metrics and presents a promising new approach to malware detection.

An appropriate tool to generate real network traffic plays an important role in testing network system. Traditionally, such a tool relies on software solutions that copies data back and forth between different part of memory to capture or replay network traffic. In this paper, we propose an FPGA-centric approach using parallel logic, which can ensure high accuracy of time and high throughput. We first design an FPGA add-on board dealing with the multifarious work like adding content or calculate statistical value. The system is implemented on an own designed off-the-shelf FPGA network add-on card to demonstrate the viability of our assumption. Experiments demonstrate reasonable performance improvement (higher throughput and replay time precision) when compared with software based solutions.

Malicious information like harassment, slander or bogus news is becoming a serious problem on social networking sites, and solving it requires profound insight into user behaviors of malicious and victim accounts. In this paper, we conduct a preliminary study on a whistleblowing network, constructed from 328472 whistleblowing (complaining) reports. To evaluate its efficiency, we perform a series of network analysis. Macroscopically, it shows weak connectivity, strong power law degree distribution; microscopically, it exhibits interesting micro structural patterns. The indiscriminate treatment of whistleblowees with low and high degree indicates that there is still much room to increase the efficiency of the current system. To understand the link between the macro and micro characteristics and the network forming mechanism, we propose a generating algorithm framework called Dynamic Configuration Framework. The simulation result demonstrates that the micro structural patterns are naturally formed along with the macro characteristics and the degree distribution can be qualitatively but not quantitatively explained by linear preferential attachment. The capability of our model to predict dynamic network evolution is the key to implement a new proactive defending layer. These findings provide a deep understanding of the whistleblowing network, and can give guidelines to improve the system fighting against malicious information.

Mouse dynamics is the process of identifying individual users on the basis of their mouse operating behaviors. Mouse dynamics analysis techniques do not provide an acceptable level of accuracy, perhaps due to behavioral variability. This study presents a dimensionality-reduction-based approach to mitigate the behavioral variability of mouse dynamics and improve the performance of mouse-dynamics-based continuous authentication. Variability was measured over the schematic features and motor-skill features extracted from each mouse behavior data session. A unified framework of employing dimensionality reduction methods (Multidimensional Scaling, Laplacian Eigenmap, Isometric Feature Mapping, and Local Linear Embedding) was developed to reduce behavioral variability by obtaining predominant characteristics from the original feature space. Classification techniques (Random Forest, Support Vector Machine, Neural Network, and Nearest Neighbor) were applied to the transformed feature space to perform the authentication task. Analyses were conducted using data from 840 half-hour sessions of 28 participants. Results indicated that for sufficiently long sequences, the transformed feature spaces had much less variability and the corresponding authentication performance was better than the original feature space with improvements of the false-acceptance rate by 89.6% and of the false-rejection rate by 77.4% in some cases. Additionally, an investigation of the relationships between variability and authentication error rates and detection time indicated that the variability and authentication error rates reduce greatly with the increase of detection time. For the data collected, the approach fared better than the state-of-the-art approaches. These findings suggest that variability reduction could improve mouse dynamics, so it may enhance current authentication mechanisms.

As the domain name system (DNS) plays a critical role in malicious services and number of networks, especially small enterprise networks and home networks that are generally and poorly managed, grows rapidly, it is highly desired to outsource the malicious domain detection service to a thirdparty system that can aggregate information from multiple vantage points to perform detection. To this end, we propose DNSRadar, a system that explores the coexistence of domain cache-footprints distributed in all networks that participate in the outsourcing service. Bootstrapping from a list of prelabeled malicious domains, DNSRadar leverages link analysis techniques to infer maliciousness likelihood of unknown domains based on coexistence information. As DNSRadar only uses the existence of an unknown domain in a network for detection, privacy concerns have been drastically reduced. Both MapReduce and lightweight matrix analysis techniques are employed to implement DNSRadar, making scalability as a built-in feature. Taking advantage of a large number of open recursive DNS servers, we have performed extensive evaluation at scale. Experimental results have demonstrated that DNSRadar can efficiently detect ~90% malicious domains given a low false positive rate of 1%. Of all these detected malicious domains, ~30% are on average 6 days earlier than public DNS reputation services, indicating DNSRadar's great early detection capability.

The host connection degree distribution (HCDD) is an important metric for network security monitoring. However, it is difficult to accurately obtain the HCDD in real time for high-speed links with a massive amount of traffic data. In this paper, we propose a new sketch method to build a probabilistic traffic summary of a host's flows using a uniform Flajolet-Martin sketch combined with a small bitmap. To study its performance in comparison with previous sampling and sketch methods, we present a general model that encompasses all these methods. With this model, we compute the Cramér-Rao lower bounds and the variances of HCDD estimations. The theoretic analysis and numerical experimental results show that our sketch method is six times more accurate than state-of-the-art methods with the same memory usage.

Exploring statistics of locally connected subgraph patterns (also known as network motifs) has helped researchers better understand the structure and function of biological and Online Social Networks (OSNs). Nowadays, the massive size of some critical networks—often stored in already overloaded relational databases—effectively limits the rate at which nodes and edges can be explored, making it a challenge to accurately discover subgraph statistics. In this work, we propose sampling methods to accurately estimate subgraph statistics from as few queried nodes as possible. We present sampling algorithms that efficiently and accurately estimate subgraph properties of massive networks. Our algorithms require no precomputation or complete network topology information. At the same time, we provide theoretical guarantees of convergence. We perform experiments using widely known datasets and show that, for the same accuracy, our algorithms require an order of magnitude less queries (samples) than the current state-of-the-art algorithms.

Phishing is the third cyber-security threat globally and the first cyber-security threat in China. There were 61.69 million phishing victims in China alone from June 2011 to June 2012, with the total annual monetary loss more than 4.64 billion US dollars. These phishing attacks were highly concentrated in targeting at a few major Websites. Many phishing Webpages had a very short life span. In this paper, we assume the Websites to protect against phishing attacks are known, and study the effectiveness of machine learning based phishing detection using only lexical and domain features, which are available even when the phishing Webpages are inaccessible. We propose several novel highly effective features, and use the real phishing attack data against Taobao and Tencent, two main phishing targets in China, in studying the effectiveness of each feature, and each group of features. We then select an optimal set of features in our phishing detector, which has achieved a detection rate better than 98%, with a false positive rate of 0.64% or less. The detector is still effective when the distribution of phishing URLs changes.

Bad Data Injection (BDI) in Smart Grid is considered to be the most dangerous cyber attack, as it might lead to energy theft on the end users, false dispatch on the distribution process, and device breakdown on the power generation. State Estimation and Bad Data Detection, which are applied to reduce the observation errors and detect false data in the traditional power grid, could not detect the bad data in smart grid. In this paper, three BDI attack cases in IEEE 14-bus system are designed to bypass the traditional bad data detection. The potential risks on economy and security are analyzed exploiting the MATPOWER. A new method based on Distributed State Estimation (DSE) is proposed to detect BDI, named as DSE-based bad data detection. The power system is divided into several subsystems, and a Chi-squares test is applied to detect the bad data respectively in each subsystem. Simulation results demonstrate that the DSE-based bad data detection can detect all bad data in three attack cases. Moreover, it can locate the bad data in specific subsystem which is helpful for the further identification.

It is an important task in Internet demography and security monitoring to accurately measure the user population of an application in a network. In previous works, the Domain Name System (DNS) cache probing technique was proposed to estimate λ¯, the average DNS querying rate for a domain name associated with the given application. One can readily obtain the user population given another empirical parameter from DNS traces, i.e., average number of DNS queries per user. The previous estimator for λ¯ was based on the assumption that the DNS query arrivals can be described by a homogeneous Poisson process. In this paper, we verify this assumption by measuring real DNS traces and find that it is over-simplified. In fact, the DNS query arrivals exhibit non-stationary property dominated by a diurnal pattern in general, thereby making the previous estimator underestimate λ¯. Then, an asymptotically unbiased estimator is proposed using the Bayesian forecasting. The proposed estimator is more general as compared with the previous one because it can accurately estimate λ¯ when the DNS query arrivals can be described by either homogeneous or non-homogeneous Poisson processes. The proposed estimator meets the minimum mean squared error principle, and the experimental results show that it significantly outperforms the previous one. The DNS cache probing technique offers promising applications because it is low-cost, less invasive and privacy preserving. Our work greatly boosts the practicability of this technique.

In recent years, a novel BitTorrent (BT) technology, Private Tracker (PT), has received extensive attentions in academia. Due to its huge amount of traffic volumes and population, it is essential to understand the characteristics for system management. In this paper, by using the data crawled from a number of well-known PT sites in China, we present an in-depth measurement and analysis on the PT system, in terms of resources characteristics and user behavior characteristics. Our analysis on the activity and age distribution of torrents reveals that the sequence of torrent activities follows a power-law distribution and the sequence of torrent ages follows a linear distribution. By investigating the characteristics of the core users and the resources in different PT sites, two observations have been made. Firstly, every PT site has a number of users with stable levels who contribute to the survivability and popularity of the site. Secondly, a large amount of redundancy exists among the distributed resources and many popular resources are duplicated among these sites, which leads to the quick spread of pirate resources. Based on the measurement results, we analyze the drawbacks of PT mechanisms and propose useful suggestions to promote the healthy development and performance of PT.

Characterizing user pair relationships is important for applications such as friend recommendation and interest targeting in online social networks (OSNs). Due to the large scale nature of such networks, it is infeasible to enumerate all user pairs and so sampling is used. In this paper, we show that it is a great challenge even for OSN service providers to characterize user pair relationships even when they possess the complete graph topology. The reason is that when sampling techniques (i.e., uniform vertex sampling (UVS) and random walk (RW)) are naively applied, they can introduce large biases, in particular, for estimating similarity distribution of user pairs with constraints such as existence of mutual neighbors, which is important for applications such as identifying network homophily. Estimating statistics of user pairs is more challenging in the absence of the complete topology information, since an unbiased sampling technique such as UVS is usually not allowed, and exploring the OSN graph topology is expensive. To address these challenges, we present asymptotically unbiased sampling methods to characterize user pair properties based on UVS and RW techniques respectively. We carry out an evaluation of our methods to show their accuracy and efficiency. Finally, we apply our methods to two Chinese OSNs, Doudan and Xiami, and discover significant homophily is present in these two networks.

Bad data injection is one of most dangerous attacks in smart grid, as it might lead to energy theft on the end users and device breakdown on the power generation. The attackers can construct the bad data evading the bad data detection mechanisms in power system. In this paper, a novel method, named as Adaptive Partitioning State Estimation (APSE), is proposed to detect bad data injection attack. The basic ideas are: 1) the large system is divided into several subsystems to improve the sensitivity of bad data detection; 2) the detection results are applied to guide the subsystem updating and re-partitioning to locate the bad data. Two attack cases are constructed to inject bad data into an IEEE 39-bus system, evading the traditional bad data detection mechanism. The experiments demonstrate that all bad data can be detected and located within a small area using APSE.

This work investigates the maximization of topic propagation jointly driven by multiple user nodes in micro-blogging. In this paper, we propose a new method to find a set of user nodes that jointly propagate topics approximately the most widely. First, we obtain multiple nodes with strong influence; Second, we exactly compute the breadth of information spread driven by a single node based on probabilistic models; Finally, we analyze the information propagation jointly driven by multiple nodes and derive an approximately optimal set of driving nodes. We find that the breadth of information propagation jointly driven by multiple nodes is approximately linear with both the breadth of information propagation of single driving nodes and the strength of tie among them, which indicates that selecting the optimal driving nodes needs to consider the link information among them as well as the ability of each node. Experimental results demonstrate the effectiveness of our method.

Numerous smart devices are deployed in smart grid for state measurement, decision-making and remote control. The security issues of smart devices attract more and more attention. In our work, the communication protocol, storage mechanism and authentication of smart devices are analyzed and a toolbox is developed to evaluate the security risks of smart devices. In this demo, our toolbox is applied to scan 3 smart meters/power monitor systems. A potential risk list is generated and the vulnerabilities are further verified.

Automotive painting shops consume electricity and natural gas to provide the required temperature and humidity for painting processes. The painting shop is not only responsible for a significant portion of energy consumption with automobile manufacturers, but also affects the quality of the product. Various storage devices play a crucial role in the management of multiple energy systems. It is thus of great practical interest to manage the storage devices together with other energy systems to provide the required environment with minimal cost. In this paper, we formulate the scheduling problem of these multiple energy systems as a Markov decision process (MDP) and then provide two approximate solution methods. Method 1 is dynamic programming with value function approximation. Method 2 is mixed integer programming with mean value approximation. The performance of the two methods is demonstrated on numerical examples. The results show that method 2 provides good solutions fast and with little performance degradation comparing with method 1. Then, we apply method 2 to optimize the capacity and to select the combination of the storage devices, and demonstrate the performance by numerical examples.

Behavior-based user authentication with pointing devices, such as mice or touchpads, has been gaining attention. As an emerging behavioral biometric, mouse dynamics aims to address the authentication problem by verifying computer users on the basis of their mouse operating styles. This paper presents a simple and efficient user authentication approach based on a fixed mouse-operation task. For each sample of the mouse-operation task, both traditional holistic features and newly defined procedural features are extracted for accurate and fine-grained characterization of a user's unique mouse behavior. Distance-measurement and eigenspace-transformation techniques are applied to obtain feature components for efficiently representing the original mouse feature space. Then a one-class learning algorithm is employed in the distance-based feature eigenspace for the authentication task. The approach is evaluated on a dataset of 5550 mouse-operation samples from 37 subjects. Extensive experimental results are included to demonstrate the efficacy of the proposed approach, which achieves a false-acceptance rate of 8.74%, and a false-rejection rate of 7.69% with a corresponding authentication time of 11.8 seconds. Two additional experiments are provided to compare the current approach with other approaches in the literature. Our dataset is publicly available to facilitate future research.

Robustness is an important requirement on many critical networked infrastructures. One of the most important ways to achieve robustness is to keep an appropriate level of redundancy by adding redundant resources for the critical networked infrastructures. Considering wireless with good reconfigurabilities, we add wireless communication capacities to selected nodes of a wired networked system in this paper, where we firstly focus on adding minimum wireless communication capacities to achieve biconnectivity requirements, secondly optimize the wireless capacities installation that maximizes the efficiency of reconfiguration, and thirdly propose an approach of topology reconfiguration with wireless communication to keep system connectivity if there are node failures. To resolve the computational complexity issue in searching for the optimal node combination to add wireless capacities, we propose the concept of the equivalent network that reduces the system topology as a simplified acyclic network. The topology optimization is under a metric of reconfiguration distance which guarantees the maximum of the shortest distances between any one node and that in the set of reconfigurable nodes to be minimal such that the efficiency of topology reconfiguration with node failure is the highest. The performances of the methods presented in the paper are demonstrated through numerical experiments and testing.

Given the popularity of smartphones and mobile devices, mobile botnets are becoming an emerging threat to users and network operators. We propose a new form of cloud-based push-styled mobile botnets that exploits today's push notification services as a means of command dissemination. To motivate its practicality, we present a new command and control (C&C) channel using Google's Cloud to Device Messaging (C2DM) service, and develop a C2DM botnet specifically for the Android platform. We present strategies to enhance its scalability to large botnet coverage and its resilience against service disruption. We prototype a C2DM botnet, and perform evaluation to show that the C2DM botnet is stealthy in generating heartbeat and command traffic, resource-efficient in bandwidth and power consumptions, and controllable in quickly delivering a command to all bots. We also discuss how one may deploy a C2DM botnet, and demonstrate its feasibility in launching an SMS-Spam-and-Click attack. Lastly, we discuss how to generalize the design to other platforms, such as iOS or Window-based systems, and recommend possible defense methods. Given the wide adoption of push notification services, we believe that this type of mobile botnets requires special attention from our community.

Mouse dynamics is the process of identifying individual users based on their mouse operating characteristics. Although previous work has reported some promising results, mouse dynamics is still a newly emerging technique and has not reached an acceptable level of performance. One of the major reasons is intrinsic behavioral variability. This study presents a novel approach by using pattern-growth-based mining method to extract frequent-behavior segments in obtaining stable mouse characteristics, employing one-class classification algorithms to perform the task of continuous user authentication. Experimental results show that mouse characteristics extracted from frequent-behavior segments are much more stable than those from holistic behavior, and the approach achieves a practically useful level of performance with FAR of 0.37% and FRR of 1.12%. These findings suggest that mouse dynamics suffice to be a significant enhancement for a traditional authentication system. Our dataset is publicly available to facilitate future research.

Domain names play an increasingly important role for the botnet activities. Traditionally, DNS traces from several local DNS servers are used passively to measure the DNS query behavior. However, since botnets are a wide-scale threat and usually reside in geographically dispersed networks, the vantage point of several local DNS servers is sometimes too small to help us understand the DNS query behavior (e.g., whether queried or not, average query rate) of botnets. In this paper, we actively measure the DNS query behavior of botnets in geographically dispersed networks via the DNS cache probing technique. We first analytically characterize how multiple domain names are queried by botnets in different networks under certain circumstances. Then, we actively measure real botnet samples in the wild to gain insight into how multiple domain names are queried by botnets in 480 geographically dispersed networks globally, and show that our analytical characterization well describes the DNS query behavior of the botnet samples. The active measurement technique can help to acquire extensive DNS query information in different networks and thus potentially facilitate various DNS-related research and applications.

With the number of Internet users and applications continues to grow, it becomes increasingly important to understand the users' behavior character for efficient network management and security monitoring. Web is one of the most popular applications, which can help users to obtain anything they want. In this paper, we propose a new framework to measure and monitor users' web access behavior character. Firstly, web services are divided into 12 types according to the content they provide. As user like to access different web services at different time instants, we proposed the behavior spectrum to describe the users' access character in an easily understandable way. Secondly, we employ three traffic features (number of connections, number of packets and number of bytes) to measure the intensity of users' access behavior. Based on the spectrums and features obtained, two kinds of user's access characters are analyzed: the characters at a particular time instant and the dynamic changing characters at continuous time points. Finally, we employ the Renyi entropy to cluster the users into different groups based on the spectrum and find the results are useful for network management. To verify the method, several actual traffic traces are collected from the Northwest Regional Center of CERNET (China Education and Research Network) and the experimental results prove the efficiency of the proposed methods.

The emergence of online social network has changed the Internet users' online behaviors dramatically. Microblog, as an emerging online social network service, has attracted hundreds of millions of users to produce and share all kinds of content since its foundation. How to improve the Quality of Experience of the service and keep the users' passions for participant has become one of the most important problems confronted by the quick development of microblogging services. On the other hand, the QoE of a service influences and is influenced by its users' activities. In this paper, we analyzed the users' activities in Sina Weibo, a popular Chinese microblog website which has a profound influence on Chinese netizens. With the aim to find possible ways to improve users' Quality of Experience, we conduct a research to gain an in-depth understanding of what kinds of users are more active and what kinds of content are favored most. When we compare the distributions of the degrees of followers, we find Sina Weibo is still younger than Twitter, a famous worldwide microblogging service. Based on the following analysis, we find that users with around 300 friends in SinaWeibo are the most active users, which we believe is consistent with the Dunbar number. Furthermore, we find users in Sina Weibo are very keen on the content embedded with images and videos, which make up the majority of retweeted tweets. Through the analysis results, we confirm that inspiring users to follow others and improving the renderings of images and videos are the basic ways to improve the Quality of Experience.

Traffic volume control is one of the fundamental requirements in traffic generation and transformation. However, due to the complex interactions between the generated traffic and replay environment (delay, packet loss, connection blocking, etc), controlling traffic volume in interactive network traffic replay becomes a challenging problem. In this paper, we present a novel model-based analytical method to address this problem where the generated traffic volume is regulated through adjustment of input traffic volume. By analyzing the replay mechanism in terms of how packets are processed, and properly choosing buffered packets amount and to-be-received packets amount as system states, we present a novel model-based analytical method to obtain the desired input volume. The traffic volume control problem is then converted to a state prediction problem where we employ Recursive Least Square (RLS) filter to predict system states. As compared to other adaptive control techniques, our method does not involve any learning scheme and hence completely requires no convergence time. Experimental studies further indicate that our method is efficient in tracking target traffic volume (both static and time-varying) and works under a wide range of network conditions.

In the identity authentication, many advanced encryption techniques are applied to confirm and protect the user identity. Although the identity information is transmitted as cipher text in the Internet, the attackers can theft and fraud the identity by eavesdropping, cryptanalysis and forging. In this paper, a new identity authentication mechanism is proposed, which exploits the Timing Covert Channel (TCC) to transmit the identity information. TCC was originally a hacker technique to leak information under supervising, which uses the sending time of packets to indicate the information. In our method, the intervals between packets are applied to indicate the authentication tags. It is difficult for the attackers to eavesdrop, crack and forge the TCC identity, since the packets are too huge to analyze and the noise is different between the users and the attackers. A platform is designed to verify our proposed method. The experiment shows that the intervals and the thresholds are the key factors on the accuracy and efficiency. And it also proves our method is a secure way for identity information, which could be implanted on various network applications.

SUMMARY Millions of new malicious programs are produced by the mature industry of malware production. These programs have tremendous challenges on the signature‐based antivirus products. Machine learning techniques are applicable for detecting unknown malicious programs without knowing their signatures. In this paper, a layered classification method is developed to detect malwares with a two‐layer framework. The low‐level‐classifier is employed to identify whether the programs perform any malicious functions according to the API‐calls of the programs; the up‐level‐classifier is applied to detect malwares according to the function identification. A hybrid structure called Type‐Function, constituting of the classification results of low‐level‐classifier and up‐level‐classifier, is proposed to describe the malware. This method is compared with Naive Bayes, decision tree, and boosting using a comprehensive test dataset containing 16,135 malwares and 1800 benign programs. The experiments demonstrate that our method outperforms other algorithms in terms of detection accuracy. Moreover, the Type‐Function structure is proved as an unprejudiced and effective method for malware description. Copyright © 2011 John Wiley & Sons, Ltd.

Abstract Modern Internet routers have to handle a large number of packet classification rules, which requires classification schemes to be scalable both in time and space. In this paper, we present a scalable packet classification algorithm that is developed by combining two new concepts to the well‐known bit vector (BV) scheme. We propose a range search method based on a cache‐aware tree (CATree) which makes full use of processor's cache line to reduce the number of dynamic random access memory (DRAM) accesses. Theoretically, the number of DRAM accesses of CATree is about log(m+1) times lower than that of the widely used binary search algorithm, where m is the number of keys in a single cache line. Based on our computational results on a set of 1024 keys, the CATree algorithm is 36% faster than binary search algorithm and the performance is better when applied to a larger set of keys. In addition, we develop a rule re‐arrangement algorithm to reduce the bitmap space of BV. With this re‐arrangement, the rules for the same action may be assigned an identical priority. This reduces the number of priorities as well as the memory space of the bitmap. Furthermore, this also reduces the number of memory accesses and hence, increases the CPU cache utilization. With CATree and rule re‐arrangement, the cache‐aware bit vector with rule re‐arrangement algorithm achieves better performance in comparison with the regular BV scheme, both in space and time. In our experiments, the proposed algorithm reduces the bitmap memory space of a practical set of firewall rules by two orders of magnitude and is 91% faster than the regular BV.

Nowadays, millions of Internet users watch and upload a large number of videos on User Generated Content (UGC) sites (e.g., Youtube) everyday. Moreover, online videos about hot events, such as breaking news and Olympic games, attract lots of users. In this paper, we study the characteristics of hot-event videos by collecting video traces of the largest UGC site in China for 28 days. We first empirically study statistical properties of such videos and find that hot-event videos contribute a large number of views, even though the total number of hot-event videos is relatively small. In addition, there exist extremely active uploaders and top 10% active uploaders upload over 60% videos. The video popularity demonstrates high skewness, where top 5% the most popular videos contribute over 80% views. Finally, we analyze the popularity evolution of hot-event videos using the consecutive 28-day video traces. The popularity of the studied videos decays very fast and most of these videos remain popular for only a week. Our findings reflect the most recent developments of UGC sites, which provide technical and commercial insights for engineers and UGC site owners.

We present a new virtual indexing method for estimating host connection degrees for high speed links. It is based on the virtual connection degree sketch where a compact sketch of network traffic is built by generating the associated virtual bitmaps for each host. Each virtual bitmap consists of a fixed number of bits selected randomly from a shared bit array by a new method for recording the traffic flows of the corresponding host. The shared bit array is efficiently utilized by all hosts since its every bit is shared by the virtual bitmaps of multiple hosts. To reduce the “noise” contaminated in a host's virtual bitmaps due to sharing, we propose a new method to generate the “filtered” bitmap used to estimate host connection degree. Furthermore, it can be easily implemented in parallel and distributed processing environments. The experimental and testing results based on the actual network traffic show that the new method is accurate and efficient.

The problem of cognitive access of channels of primary users by a secondary user is considered. The transmissions of primary users are modeled as independent continuous-time Markovian on-off processes. A secondary cognitive user employs a slotted transmission format, and it senses one of the possible channels before transmission. The objective of the cognitive user is to maximize its throughput subject to collision constraints imposed by the primary users. The optimal access strategy is in general a solution of a constrained partially observable Markov decision process, which involves a constrained optimization in an infinite dimensional functional space. It is shown in this paper that, when the collision constraints are tight, the optimal access strategy can be implemented by a simple memoryless access policy with periodic channel sensing. Analytical expressions are given for the thresholds on collision probabilities for which memoryless access performs optimally. Extensions to multiple secondary users are also presented. Numerical and theoretical results are presented to validate and extend the analysis for different practical scenarios.

Timely supply of vital materials to disaster hit areas plays a critical role in emergency relief. The problem involves warehouse selection, fleet routing, and scheduling so as to meet demand in the strict time window. The problem is NP-hard, in general, and extremely difficult to solve. The congestion caused by heavy traffic further aggravates the problem. To obtain a scalable solution, a new method based on successive subproblem solving in Lagrangian Relaxation (LR) framework is developed. The route capacity and location selection constraints are relaxed by Lagrange multipliers, and the problem is converted into a two-level optimization problem. The subproblems at the lower level are solved successively in dual iterations with convergence assurance so that the indecomposable location constraints can be incorporated. A systematic method is developed to obtain a feasible solution by adding the once relaxed constraints back into the dual problem successively in feasibility iterations. Convergence proof of the new method and its properties are presented. Numerical results show that the new method is effective and efficient, and can be applied to large-scale problems.

Due to the massive amount of data in high-speed network traffic and the limit on processing capability, it is a great challenge to accurately measure and monitor network traffic over high-speed links online. A new data structure is presented in this paper for locating the hosts associated with large connection degrees or significant changes in connection degrees based on the reversible connection degree sketch to monitor anomalous network traffic. The reversible connection degree sketch builds a compact summary of host connection degrees efficiently and accurately. For each packet coming, it only needs to set several bits selected in a bit array by a group of hash functions. These hash functions are designed based on the Chinese Remainder Theorem so that the in-degree or out-degree associated with a given host can be accurately estimated. With this new data structure, we develop a new reverse sketch method for locating abnormal hosts. Although the reversible connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large connection degrees or significant changes in connection degrees by a simple calculation purely based on the characteristics of the hash functions. Furthermore, a reinforced reversible connection degree sketch, the double connection degree sketch, is developed to reduce false positives which are commonly encountered in the sketch-based methods. A traffic monitoring system based on this double connection degree is developed to detect and classify the abnormal hosts associated with large connection degrees or significant changes in connection degrees. The experiments are conducted based on the actual network traffic and the testing results show that our method is accurate and efficient.

Interactive network traffic replay plays an important role in testing and evaluating in-line network security devices such as Firewalls, IPSs, etc. In this paper we present a balance-based method for improving the performance of interactive TCP traffic replay. The new method is based on the inherent feature of the TCP protocol, that is, two communicating peers keep synchronized with each other using data acknowledgment. This feature is converted as a balance mechanism in interactive TCP traffic replay and incorporated into the current state-based method. In this way, the cost of state-checking can be significantly reduced and the replay performance is thus enhanced. To validate the effectiveness of the method we implement it by building an interactive replay system. The experimental results indicate that: 1) balance-checking reduces the overhead of state-checking by 40%; 2) the balance-based method enhances the overall replay performance by an average of 5% when the actual TCP traffic traces are replayed.

The problem of cognitive access of channels of primary users by a secondary user is considered. The transmissions of primary users are modeled as independent continuous-time Markovian on-off processes. A secondary cognitive user employs slotted transmissions, and it senses one of the possible channels before transmission. The objective of the cognitive user is to maximize its throughput subject to collision constraints imposed by the primary users. The optimal access strategy is in general a solution of a constrained partially observable Markov decision process, which involves a constrained optimization in an infinite dimensional functional space. It is shown in this paper that, when the collision constraints are tight, the optimal access strategy can be implemented by a simple memoryless access policy with periodic channel sensing. Numerical results are presented to validate and extend the analysis for different practical scenarios.

Botnets have become a serious threat to Internet and are often deployed to control a large pool of zombies and perform notorious activities such as DDoS, information theft and spam sending. In this paper, a new method is developed for detecting IRC botnets by analyzing the characteristic of packet size sequence of the TCP conversation between IRC zombies and their command and control (C&C) servers. In comparison with IRC chat, the TCP conversations within IRC botnets show a nature of approximate periodicity defined as quasi-periodicity in this paper. A simple yet effective detection method is presented to detect IRC botnets by measuring the quasi-periodicity degree and packet average size of IRC conversations based on ukkonen algorithm. We evaluated our method using real-world IRC botnet traces captured from honeynet. The results show that our method can detect real-world IRC botnets from IRC traffic with high accuracy and has a low false positive rate.

In this paper we propose a new multi-view semi-supervised learning algorithm called Local Co-Training(LCT). The proposed algorithm employs a set of local models with vector outputs to model the relations among examples in a local region on each view, and iteratively refines the dominant local models (i.e. the local models related to the unlabeled examples chosen for enriching the training set) using unlabeled examples by the co-training process. Compared with previous co-training style algorithms, local co-training has two advantages: firstly, it has higher classification precision by introducing local learning; secondly, only the dominant local models need to be updated, which significantly decreases the computational load. Experiments on WebKB and Cora datasets demonstrate that LCT algorithm can effectively exploit unlabeled data to improve the performance of web page classification.

In Wireless Sensor Network (WSN) based tracking, the random factors in the target's movement and the sensors' measurement together with the limited sensing ability will cause target loss. Therefore, target loss probability is important for the WSN design and performance evaluation. In this paper, a theoretical analysis of the target loss probability with other key parameters is carried out. Based on the analysis, an adaptive-radius activation policy is developed to reduce target loss. Numerical examples demonstrate adaptive-radius activation policy is effective.

Dynamic spectrum access (DSA) aims to improve spectrum efficiency via spectrum sensing and optimal spectrum access. An essential component in DSA is the joint design of sensing and access strategies. This paper focuses on dynamic spectrum access in the time domain. To maximize channel utilization while limiting interference to primary users, a framework of linear programming is presented based on the stationary distribution of the primary user channels. It is shown that the optimal tradeoff between sensing and transmitting is achieved with required limit on the interference to the primary users.

Long-term scheduling for cascaded hydro energy systems is very important for low carbon energy production. It aims at determining the water release over a planning horizon to meet water resource requirements and the system demands for electric power. The problem is challenging in view of the complicated and stochastic system dynamics, nonlinear marginal cost, coupled hydraulic constraints, and the large problem size. In this paper we formulate the long-term scheduling problem of cascaded hydro energy systems with annual consumption and release constraints as a finite horizon constrained Markov decision process (CMDP), and develop a new rollout algorithm to optimize the policies. Numerical results demonstrate the effectiveness and the efficiency of the formulation and the new algorithm.

Performance evaluation of complex manufacturing systems is challenging due to many factors such as system complexity, parameter uncertainties, problem size, just to name a few. In many cases when a system is too complex to model using mathematical formulas, simulation is used as an effective alternative to conduct system analysis. A manufacturing system is a good example of such cases where both system performance and system complexity are greatly impacted by material handling (MH) strategy, management, and operational control. In this paper, we study vehicle general assembly (GA) system with MH, and focus on developing an efficient simulation method for modeling and analysis where traditional simulation methods may suffer from computation intensity. Making use of the partial system decomposability, we introduce an aggregated event-scheduling simulation method with two-level framework. A dividing mechanism with boundary conditions is employed in top-level simulation to divide the global event list into small sizes. A timing-focuses strategy based on max-plus algebra is applied in bottom-level local simulation to further reduce local event lists. With this new method it is possible to mimic real production systems fast and accurately within a reasonable computational time frame. The effectiveness and efficiency of the new simulation method are validated through experimental results.

Measuring and monitoring the changes of network traffic patterns in large-scale networks are crucial for effective network management. In this paper, we present a framework and method for detecting and measuring the dynamic changes of the pivotal traffic patterns. A bidirectional regional flow model is established to aggregate traffic packets and extract the traffic metrics and profiles. The characteristics of the regional flows are analyzed and interesting findings are obtained. A directed graph model is applied to describe the flow metrics and six flow features are extracted to capture the dynamic changes of the flow patterns. The measurements based on Renyi entropy are developed to quantitatively monitor these changes. The experimental results based on the actual network traffic data traces show that the method presented in this paper can capture the dynamic changes of pivotal traffic patterns effectively.

This paper presents a novel Trojan detection and defense system. The prototype searches the important files which contain users' confidential information on the disk. And then, these files will be monitored to find which processes will access them by capturing and analyzing the IRPs (I/O request packets). The processes of Trojans will be distinguished from regular ones by evaluating their API-calls with several machine-learning models, rather than traditional signature-based mechanism. Testing results show that this prototype could detect and defend the unknown Trojans quickly and accurately.

Locating hosts with large connection degree is very important for monitoring anomalous network traffics. The in-degree (out-degree), defined as the number of distinct sources (destinations) that a network host is connected with (connects) during a given time interval. Due to massive amount of data in high speed network traffics and limit on processing capability, it is difficult to accurately locate hosts with large connection degree over high speed links on line. In this paper we present a new data streaming method for locating hosts with large connection degree based on the reversible connection degree sketch to monitor anomalous network traffics. The required memory space is small and constant, and more importantly the update/query complexity would not depend on the amount of data. The hash functions for data sketch are designed based on the remainder characteristics of the number theory so that in-degree/out-degree associated with a given host can be accurately estimated. Although the connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large in-degree/out-degree by a simply equation purely based on the characteristics of the hash functions without using any host address information. This procedure is highly efficient since the computational time is constant and ignorable. Furthermore, this reversible connection degree sketch based method can be easily implemented in distributed systems. The experimental and testing results based on the actual network traffics show that the new method is truly accurate and efficient.

The randomness of the network behaviors poses serious challenges for discovering the abnormal patterns in network traffic flows. This paper presents a method based on blind source separation approach for detecting abnormal traffic flows. It decomposes the network traffic into two components: the routine pattern and the abnormal pattern. The scale-space filter with adaptive scale is applied to filter the noise without affecting the main behavior patterns which can be used to form the abnormal traffic metrics and profiles. The zero-crossing method is applied to extract the stochastic behavior pulse widths and the largest width is selected as the scale space factor. In this way, the influence of the inherent randomness could be removed or greatly reduced. The extracted patterns of the routine behaviors imply the user's habit and the abnormal patterns are useful for discovering anomalous behaviors such as scanning, flooding and content distribution attacks. A salient feature of the method is that no supervised learning process is needed. This is a very important advantage since obtaining labeled samples in traffic monitoring is extremely difficult. Experimental results based on the datasets of an actual network show that this method is effective for monitoring anomaly traffic flows in the gigabytes traffic environment and the identification accuracy is above 95%.

Mouse dynamics has recently become an interesting new topic in the area of behavioral biometrics due to its non-intrusiveness and convenience. Some promising results have been shown by previous researches on identity authentication and monitoring using characteristics in users' mouse actions. This paper explores mouse dynamics further by focusing on an important issue not addressed previously: behavioral variability. With an empirical study of long term behaviors of 10 computer users, we show variations are obvious in mouse activities and can have a serious impact if not considered carefully. To tackle the problem of variability, we propose a dimensionality reduction based approach which is demonstrated to be effective in our experiments. More specifically, the classification results after preprocessing by PCA and ISOMAP are shown to be much better than direct classification. Moreover, the results of a false acceptance rate (FAR) 0.55% and false rejection rate (FRR) 3.00% by the nonlinear method ISOMAP are comparable to the best result reported in literature while being subject to more behavioral variability.

Wireless sensor networks are often composed of resource-constrained sensor nodes with limited memory space, computational capacity and communication range. The links in WSN are often lossy and unreliable. In order to make fluent and reliable data transport on memory-constrained sensor nodes, we propose a new transport layer protocol reliable transport with memory consideration (RTMC), which provides both hop-by-hop retransmission and congestion control. We have implemented RTMC on MICA2 with only 4 K bytes RAM. Experiment, analysis and simulation results show that RTMC can use channel resource effectively and enable all of the segments to be received by the sink with low transport time and low memory cost.

The need to quickly and accurately classify Internet traffic for security and QoS control has been increasing significantly with the growing Internet traffic and applications over the past decade. Pattern recognition by learning the features in the training samples to classify the unknown flows is one of the main methods. However, many methods developed in the previous works are too complicated to be applied in real-time, and the prior probabilities based on the training samples are severely biased. This paper uses the SVM (support vector machine) method to train 7 classes of applications of different characteristics, captured from a campus network backbone. A discriminator selection algorithm is developed to obtain the best combination of the features for classification. Our optimized method yields approximately 96.9% accuracy for un-biased training and testing samples. For regular biased samples, the accuracy is about 99.4%. Furthermore, all the feature parameters are computable in real time from captured packet headers, suggesting real time network traffic classification with high accuracy is achievable.

Resource planning for a complex remanufacturing system is in general extremely difficult in terms of, e.g., problem size and uncertainties. In many cases, simulation is the only way to select a good plan among a great number of candidates. When there exist complicated constraints, direct selection could be very inefficient since many candidates may not be feasible but cannot be excluded beforehand. To meet the challenge, a machine learning method is introduced in this paper to perform feasibility analysis. The rough set theory is first applied to establish the relationship between a plan and its feasibility and an iterative reinforcement process is applied to enhance confidence. The numerical testing results show that this method is promising and scalable for the large-scale problems. The research lays a basis for developing an efficient simulation-based optimization method with complicated constraints. Note to Practitioners-This paper was motivated by the resource planning problem for a complex remanufacturing system, which is very important but in general extremely difficult to deal with in terms of, e.g., problem size and uncertainties. Simulation is probably the only way available to select a good plan among a number of candidates. When there exist complicated constraints, simulation becomes even more difficult and selection through simulation could be very inefficient since many candidates may not be feasible but cannot be excluded before simulation. Determining feasibility beforehand is extremely difficult by analytical or numerical methods. This paper suggests a new method using a machine learning-based approach to predict the plan feasibility required in practical applications and can be considered as the first step for optimization-based planning. By applying the rough set theory, the prediction rules are obtained or learned from a training dataset generated by simulation. Then, an iterative reinforcement process is applied to enhance the confidence of learning and to perform iterative retraining on new datasets by the rough set method to generate new rules to add to the knowledge base until the preset threshold is satisfied. The numerical testing results show that the above method is capable of determining the feasible plans for a remanufacturing system with good accuracy. The method is efficient and scalable for the large-scale problems. The method developed in the paper is being incorporated in the framework of ordinal optimization, and a new constrained ordinal optimization method has been developed for remanufacturing planning.

Abstract: Intrusion detection is important in the defense‐in‐depth network security framework. This paper presents an effective method for anomaly intrusion detection with low overhead and high efficiency. The method is based on rough set theory to extract a set of detection rules with a minimal size as the normal behavior model from the system call sequences generated during the normal execution of a process. It is capable of detecting the abnormal operating status of a process and thus reporting a possible intrusion. Compared with other methods, the method requires a smaller size of training data set and less effort to collect training data and is more suitable for real‐time detection. Empirical results show that the method is promising in terms of detection accuracy, required training data set and efficiency.

Underlying each production system are activities fraught with uncertainty; for example, uncertain future demand, machine breakdowns, and processing time estimates for one-of-a-kind parts. These uncertain events can cause any detailed schedule to become outdated, and the effects may propagate throughout the schedule, affecting product delivery dates. Scheduling algorithms considering future uncertainties could improve the quality of schedules and, as a result, smooth the production of the system. As a step towards incorporating uncertainties in the scheduling consideration, this paper presents a fuzzy optimization methodology for scheduling single operation parts on identical machines with possible breakdowns. A fuzzy optimization formulation is first developed. A Lagrangian relaxation technique is used to decompose the problem into part-level subproblems and a fuzzy membership subproblem. The Lagrange multipliers are then updated by using a subgradient method. To evaluate the performance of the resulting algorithm in a dynamic environment, fuzzy simulation is developed. Preliminary testing results show that, with possible machine breakdowns, this algorithm outperforms the deterministic one.>