Abstract The widespread adoption of encrypted traffic protocols has significantly increased the challenge of detecting malicious traffic. Existing detection methods based on deep learning typically rely on fine-grained features of data packets, such as length sequences and intra-flow interaction graphs. However, these features are highly susceptible to disruption by diverse network environments and traffic obfuscation. This paper proposes MTDecipher, a robust method for detecting encrypted malicious traffic based on multi-task Graph Neural Network (GNN). MTDecipher employs a bidirectional attentive sequence encoder to mitigate the impact of diverse network environments and traffic obfuscation on packet length sequences, along with an edge-block dual sampling method and a multi-task GNN model to mitigate the training bias introduced by the unbalanced distribution of traffic. In the bidirectional attentive sequence encoder, a combination of a Bi-GRU layer and an attention pooling layer is utilized to enhance the bidirectional encoding by generating weights for each element in the sequence, thereby obtaining robust encrypted traffic sequence features. In the edge-block dual sampling method, two rounds of sampling are involved to generate more evenly distributed subgraphs as training data, which reduces the local structural bias resulting from the aggregation of malicious flows. In the multi-task GNN model, the losses for both edge and node classification tasks are simultaneously optimized, thereby minimizing the homogeneity of adjacent edges. Experimental results on two real-world datasets with traffic obfuscation demonstrate that MTDecipher outperforms eight existing methods in terms of effectiveness in detecting encrypted malicious traffic.

In dynamic Internet of Things (IoT) networks, unlabeled incremental network flows with evolving distributions severely degrade the performance of deep learning-based botnet detection systems, primarily due to catastrophic forgetting and reliance on labeled data. This work proposes BotEvolver, a novel framework for continuous, efficient, and interpretable botnet detection in incremental flow environments. BotEvolver integrates two core components: (1) an experience replay-enabled incremental detection model via an attention-based inductive Graph Neural Network (GNN), that preserves key botnet subgraphs to mitigate catastrophic forgetting and enhance interpretability; (2) a multi-feature active annotation model that generates high-precision pseudo-labels while reducing the number of IPs requiring manual annotation in incremental data from the CTU13 dataset to98.6% F1-score across incremental rounds. Overhead tests confirm its practicality where peak Graphics Processing Unit (GPU) VRAM occupancy is ≈1GB, throughput reaches 55.46k flows/sec and 12.83k IPs/sec, and pre-trained models are ≈12MB, enabling distributed deployment for real-time monitoring.

Provenance graphs have emerged as a promising approach for detecting host-based attacks, particularly on Internet of Things (IoT) endpoints where audit logs are available but resources are constrained. Such graphs integrate fine-grained system audit logs and formulate the attack detection process as subgraph matching within the provenance graph. Existing methods relying on exact subgraph matching are computationally intensive and time-consuming, while supervised learning for approximate subgraph matching, although a potential alternative, requires extensive labeled data that is prohibitively costly for annotating provenance graphs at scale. To tackle these problems, we propose ContrastMatcher, a self-supervised adaptive graph contrastive learning for provenance subgraph matching which needs no label for training. ContrastMatcher consists of three modules: reduction, adaptive self-supervised learning, and lightweight detection. By graph reduction and process-centric ego partitioning, the reduction module identifies likely regions where attacks may occur, substantially reducing computational complexity and runtime. The adaptive self-supervised learning module selects effective augmentations to learn the subgraph representations with a carefully designed self-attention encoder, enabling ContrastMatcher to work without any label. Finally, the lightweight detection module classifies the attack relations between each query and the candidates from the learned representations automatically, which avoids setting the approximation manually. Experiments on the DARPA Engagement 3 datasets show that ContrastMatcher can reduce irrelevant host-based log events by 80% − 90%. In addition, without any label in the provenance graph, it achieves a competitive performance regarding the detection accuracy with only 1% training time compared to the existing supervised learning methods.

Social bots constitute a substantial fraction of active accounts on digital platforms, fundamentally threatening information authenticity and democratic discourse. Contemporary detection methods confront critical limitations: information imbalance across heterogeneous relations, computational challenges in processing massive neighborhoods, and inadequate multi-scale representation learning. We propose HIER (Heterogeneous Information Bottleneck and Expert Routing), a pioneering framework that integrates variational information theory with mixture-of-experts paradigms for social network analysis. HIER introduces relation-aware variational information bottleneck for optimal compression across relationship types, dynamic sparse expert routing that extends mixture-of-experts to edge-level graph processing, and dual-scale mutual information maximization enhancing representation discriminability through neighborhood consistency and graph-level contrastive learning. Experimental validation demonstrates HIER's superior performance across real-world datasets, establishing new benchmarks for heterogeneous social bot detection.

In the battlefield of cyberspace, sophisticated attackers often operate by following meticulously designed cyber kill chains, enabling them to maintain a persistent presence within victim systems while evading conventional detection mechanisms. Traditional honeypot-based deception defenses aim to uncover such threats by luring attackers into exposing their malicious activities through decoy systems. However, advanced attackers are frequently able to identify and avoid these traps, making it increasingly challenging to detect and engage them effectively. To overcome this challenge, this study proposes a novel defensive paradigm named as the safeguard mode, which emphasizes the covert identification of attackers rather than solely preventing initial breaches. By proactively recognizing potential threats in a hidden manner, victim systems can be better protected through early threat intelligence. Based on the propsoed safeguard mode concept, we propose$Honey^{4}$, abbreviated as$H^{4}$, a comprehensive framework designed to systematically entrap advanced threats.$H^{4}$comprises four core components: Honeypoint, Honeyproxy, Honeytrace, and Honeycenter, which work in concert to deceive, monitor, and analyze attacker behavior. Furthermore, we explore how Artificial Intelligence Generated Content (AIGC) techniques can enhance$H^{4}$'s capabilities, particularly as attackers themselves begin to leverage AI-driven tactics. The practical efficacy of the proposed safeguard mode and the$H^{4}$framework has been validated through being deployed in real scenarios including the 19th Asian Games and the Canton Fairs, and$H^{4}$has successfully captured a significant number of threatening IP addresses and malicious behavioral patterns, generating actionable cyber threat intelligence that fundamentally safeguards system defense.

Semantic attacks against programmable logic controllers (PLCs) can manipulate industrial control systems (ICS) and cause severe physical disruptions. Yet, existing researches remain target-agnostic: they fail to determine which PLC tags or physical process are most critical when exploited. To address this gap, we introduce Pipe4Stux, a semantic attack framework that generates effective PLC attacks by leveraging key tags and attack semantics. Pipe4Stux first constructs a lexical analyzer and a data dependency subgraph from PLC control logic to capture the relationships among variables and operations. It then identifies key tags, derives semantic features of attacks, and formulates process-aware attack tactic. Experimental results on real ICS scenarios demonstrate that Pipe4Stux enables destructive and reproducible semantic attacks, revealing the potential impact of compromising key tags during specific physical states. In addition, Pipe4Stux provides the first systematic and objective methodology for semantic attack synthesis, offering practical guidance for defense. The framework can also support continuous monitoring by designating key tags as alarm variables within supervisory control and data acquisition (SCADA) systems such as WINCC.

Machine learning (ML) is highly effective for accurate encrypted malicious traffic identification by using highquality training data. In fact, obtaining such data is costly and challenging. As a result, many ML-based models are inevitably trained on low-quality data and perform poorly. To enhance performance, some methods utilize various sample selection techniques to choose confident samples for model training. However, they often rely on a single metric for this selection, which restricts their adaptability across diverse datasets and noise conditions. In this paper, we propose a robust framework BAPTISM for identifying encrypted malicious traffic with low-quality training data. Particularly, BAPTISM selects a suitable base model for each task, and trains it with early stopping to generate traffic representation before overfitting occurs. Then, we devise an adaptive metric selection strategy to select confident samples. By employing two metrics (JSD and CSD) to assess the characteristic of traffic representation from distinct perspective, we find the more proper metric for each class and apply it for confident sample selection. According to the confident samples and selected metric for each class, we develop a label correction tactic which adapts to class nature to improve the quality of training data. Finally, we employ parallel training strategy to train the base model with the corrected data, further mitigating the impact of low-quality data. We conduct experiments across three real-world malicious traffic datasets with various noise settings. The results demonstrate that BAPTISM is compatible with different base models and outperforms across noise ratios ranging from 20% to 90%. Meanwhile, BAPTISM consistently selects the confident samples with the highest purity and volume under each setting.

In recent years, advancements in large language models have led to significant innovation and critical progress in AI. However, some of these innovations are raising privacy and security concerns. Machine unlearning has therefore emerged as a potential solution to mitigate such risks. Yet, while erasing data records from traditional models is relatively straightforward, making a large language model “forget” what it has learned is often very challenging. This is not just because they include so many parameters, it is also because the knowledge they possess is intricately entangled. Further, the privacy risk of unlearned data remains neglected in most unlearning solutions. To overcome these limitations, we took advantage of information retrieval and developed an efficient privacy-preserving unlearning mechanism. Our solution eliminates the impact of targeted information by removing high-risk semantic meanings from the model’s output. It also incorporates differentially-private randomization to make the unlearned information statistically indiscernible. Most importantly, the algorithm requires neither parametric fine-tuning nor in-context prompt calibration. A theoretical analysis demonstrates that this method satisfies rigorous privacy and unlearning guarantees. Additionally, experiments on real-world datasets prove that the method is both effective and has the capacity to handle practical unlearning tasks for large language model applications.

Social spammers pose a serious threat to online social networks by manipulating topics, promoting malicious campaigns, and spreading low-quality or deceptive content at scale. Existing detection methods, including text-based classifiers, graph neural networks, and hybrid models, still suffer from three key limitations: they usually operate at a single structural scale, they treat content and network structure as loosely coupled signals, and they often assign equal importance to all edges within the same relation type. To address these issues, we propose MHGCA, a M ulti-scale H eterogeneous G raph learning framework with C ontent–Structure A lignment for robust spammer detection. MHGCA jointly encodes motif-, community-, and global-level structures, detects structural anomaly patterns, and employs a relation-aware transformer to adaptively align content similarity with relation-specific message passing. Experiments on two real-world Twitter datasets show that MHGCA consistently outperforms strong baselines under severe class imbalance and limited supervision, and remains stable across different training ratios and hyperparameter settings. These results suggest that explicitly aligning content with multi-scale heterogeneous structures is crucial for reliable spammer detection in social networks.

Large Language Models (LLMs) excel in various domains but pose inherent privacy risks.Existing methods to evaluate privacy leakage in LLMs often use memorized prefixes or simple instructions to extract data, both of which well-alignment models can easily block.Meanwhile, Jailbreak attacks bypass LLM safety mechanisms to generate harmful content, but their role in privacy scenarios remains underexplored.In this paper, we examine the effectiveness of jailbreak attacks in extracting sensitive information, bridging privacy leakage and jailbreak attacks in LLMs.Moreover, we propose PIG, a novel framework targeting Personally Identifiable Information (PII) and addressing the limitations of current jailbreak methods.Specifically, PIG identifies PII entities and their types in privacy queries, uses in-context learning to build a privacy context, and iteratively updates it with three gradient-based strategies to elicit target PII.We evaluate PIG and existing jailbreak methods using two privacy-related datasets.Experiments on four white-box and two blackbox LLMs show that PIG outperforms baseline methods and achieves state-of-the-art (SoTA) results.The results underscore significant privacy risks in LLMs, emphasizing the need for stronger safeguards.

The rise of Large Language Models (LLMs) has heightened concerns about the misuse of AI-generated text, making watermarking a promising solution.Mainstream watermarking schemes for LLMs fall into two categories: logits-based and sampling-based.However, current schemes entail trade-offs among robustness, text quality, and security.To mitigate this, we integrate logits-based and sampling-based schemes, harnessing their respective strengths to achieve synergy.In this paper, we propose a versatile symbiotic watermarking framework with three strategies: serial, parallel, and hybrid.The hybrid framework adaptively embeds watermarks using token entropy and semantic entropy, optimizing the balance between detectability, robustness, text quality, and security.Furthermore, we validate our approach through comprehensive experiments on various datasets and models.Experimental results indicate that our method outperforms existing baselines and achieves state-of-the-art (SOTA) performance.We believe this framework provides novel insights into diverse watermarking paradigms.Our code is available at https://github.com/redwyd/SymMark.

Multimedia rumor content has been widely disseminated with the rise of generative technologies. Existing rumor detection approaches typically focus independently on multi-modal data (such as text and images) or social structure analysis, and only a few researchers have attempted to integrate all three modalities for comprehensive rumor detection. Due to the complexity of the relationships between these heterogeneous data, combining them effectively remains a challenge. In this work, we present a novel Graph-Enhanced Multimodal Contrastive Learning (GMCL) to integrate textual, visual, and social graph features more efficiently for rumor detection. We utilize semantic correlation to assist cross-modal contrastive learning to capture fine-grained alignment between text and image and enhance node representations through graph contrastive learning without relying on negative samples. By aligning and integrating these different representations, our method can detect rumors more accurately. Extensive experimental results show that our model outperforms current state-of-the-art methods in multimodal rumor detection.

Deep learning-based malicious traffic detection requires large-scale, accurately labeled datasets. However, realistic malicious traffic datasets contain noisy labels due to annotation errors, which can degrade the performance of detection models. Existing methods for handling noisy labels involve robust training or data cleaning. However, both approaches risk excluding hard samples from model update, leading to suboptimal decision boundaries and reduced classification performance. To this end, we introduce TRACE, a novel framework that leverages multi-loss optimization to induce robust traffic representations while utilizing all samples. TRACE utilizes a one-dimensional convolutional neural network (1D CNN) with multi-head attention to generate fine-grained traffic representations. Then, TRACE employs multi-loss optimization to enhance representation robustness, ensuring representation integrity and class separability, thereby laying the foundation for effective decision boundaries. The experimental results on two public datasets demonstrate that TRACE achieves an accuracy of 88.3% and an F1-score of 81% with 90% label noise, outperforming the state-of-the-art methods.

The rapid growth of social networks has significantly increased the prevalence of spammer activities, which poses substantial challenges to user trust, experience, and public safety. Existing spam detection methods primarily rely on easily circumvented handcrafted features and fail to capture the complexities of user behavior and social relationships fully. These methods often struggle to differentiate users in highly heterogeneous networks and do not adequately address the issue of class imbalance. To overcome these limitations, we propose a novel framework, Multi-Relation Aware Heterogeneous Graph Transformer (MRHGT), which effectively integrates heterogeneous graph representation learning to capture complex social structures. Our approach introduces a novel aggregation mechanism that combines relation-aware multi-head attention, relation-specific graph convolution networks, and cross-attention feature fusion. Additionally, we incorporate a heterogeneous graph contrastive learning strategy to handle class imbalance. Extensive experiments on real-world datasets demonstrate that our method outperforms state-of-the-art approaches in accuracy and robustness.

Stance detection aims to automatically identify social users' attitudes on specific targets by analyzing their textual content and various relationships within social networks. Existing stance detection models predominantly focus on textual content. Although some stance detection methods based on graph neural networks have achieved performance improvements by integrating textual content and social relationships, they overlook the implicit polarity signs of links between nodes. Meanwhile, many real-world social networks do not provide explicit sign information for links, which limits the applicability of existing signed network representation learning methods to these scenarios. This paper proposes a novel social network stance detection model named 'Implicit Sign-enhanced Stance Detection Model with Semantic Graph Attention Network' (ISSDM-SemGAN). Firstly, we propose a semantic graph attention network (SemGAN) that leverages Direction-distance Fusion Scoring Function (DFSF) to enhance the differences between nodes, which lays the foundation for capturing implicit link signs. Additionally, we design implicit sign-enhanced stance detection network to introduce the signed link prediction task and social balance theory to facilitate understanding and learning the implicit link polarity between nodes, thereby enhancing the performance of stance detection tasks. Extensive experiments were conducted on real social network dataset. The experimental results demonstrate that ISSDM-SemGAN achieves state-of-the-art performance.

With the increasing adoption of Retrieval-Augmented Generation (RAG) systems for knowledge-intensive tasks, ensuring the adequacy of retrieved documents has become critically important for generation quality. Traditional reranking approaches face three significant challenges: substantial computational overhead that scales with document length, dependency on plain text that limits application in sensitive scenarios, and insufficient assessment of document value beyond simple relevance metrics. We propose EAReranker, an efficient embedding-based adequacy assessment framework that evaluates document utility for RAG systems without requiring access to original text content. The framework quantifies document adequacy through a comprehensive scoring methodology considering verifiability, coverage, completeness and structural aspects, providing interpretable adequacy classifications for downstream applications. EAReranker employs a Decoder-Only Transformer architecture that introduces embedding dimension expansion method and bin-aware weighted loss, designed specifically to predict adequacy directly from embedding vectors. Our comprehensive evaluation across four public benchmarks demonstrates that EAReranker achieves competitive performance with state-of-the-art plaintext rerankers while maintaining constant memory usage ($\sim$550MB) regardless of input length and processing 2-3x faster than traditional approaches. The semantic bin adequacy prediction accuracy of 92.85\% LACC@10 and 86.12\% LACC@25 demonstrates its capability to effectively filter out inadequate documents that could potentially mislead or adversely impact RAG system performance, thereby ensuring only high-utility information serves as generation context. These results establish EAReranker as an efficient and practical solution for enhancing RAG system performance through improved context selection while addressing the computational and privacy challenges of existing methods.

Link Flooding Attacks (LFA) exploit network topology knowledge to disrupt connectivity by targeting critical links and nodes. Existing defenses often presuppose an attacker with complete topological awareness and overlook the concentration of attack traffic on specific routers. Furthermore, many countermeasures rely on SDN, which can suffer from performance degradation due to the limited packet processing capabilities of switches. To address these issues, we introduce the GateLFA attacker model, which assumes that attackers lack complete topology knowledge and guide their attacks based on traffic density analysis. We propose the EqualFlow algorithm, which utilizes stub node relocation and insertion to minimize adversarial impact, balance attack traffic, and reduce defense costs. Additionally, we present the Network Topology Obfuscation System, leveraging XDP for high-speed packet processing at the network boundary to overcome the performance challenges of SDN-based solutions. Our experimental results demonstrate that EqualFlow computes high-quality virtual topologies, outperforming existing algorithms across small, medium, and large-scale networks. Moreover, the Network Topology Obfuscation System effectively disrupts prominent topology probing tools through explicit information interference at a 10 Gbps line rate. For implicit interference, the system increases the packet rate of typical traceroute probes by approximately 17% compared to traffic control methods. This research provides an efficient and practical solution for defending against LFA.

With the extensive deployment and application of Internet of Things (IoT) devices, vulnerable edge nodes have emerged as primary targets for Advanced Persistent Threat (APT) attacks. Attackers compromise IoT terminal devices to establish an initial foothold and subsequently exploit lateral movement techniques to progressively infiltrate core business networks. Prior investigation methods struggle with fragmented threat intelligence and sparse attack samples in heterogeneous audit logs, resulting in incomplete attack chain reconstruction and high false positives. We propose a novel approach to APT attack investigation, FALCON, which captures complex causal relationships between entities from discrete audit logs and constructs cross-domain provenance graphs, enabling rapid and accurate identification of potential APT activities. FALCON trains an adaptive edge-side local model with cross-domain behavior sequences containing extensive and remote contextual information, and employs a bidirectional transformer pre-trained model to learn latent representations from unlabeled sequences. To the best of our knowledge, FALCON is the first APT investigation method to conduct causal provenance based on cross-domain audit logs while ensuring privacy protection. The experimental results demonstrate that FALCON effectively detects APT attacks with accuracy 99.71% and reconstructs attack scenarios with accuracy 87.4%.

Abstract In cyberspace, intrusion and detection constitute dynamic and continuous game processes, where data streams are generated incrementally during intrusion. To mitigate intrusions and safeguard assets effectively, it is imperative to take prompt actions based on real-time detection and analysis of the currently available data streams. However, existing approaches that rely on complete and clean data struggle to keep pace with the continuous real-time flow of new network data. To address this issue, we introduce IL-IDS (Incremental Learning for Intrusion Detection Systems), a novel intrusion detection approach that utilizes incremental learning to enable accurate and timely detection of intrusions in real-world scenarios, where the need for real-time processing and learning from newly generated traffic data is paramount. IL-IDS performs in scenarios with limited data availability, where it initially transforms textual data streams into vectorized representations and leverages a variation autoencoder (VAE) to compress these vectors, efficiently extracting their latent features. Then a classifier is trained to distinguish attack and normal behaviors, and a three-way decision method is employed to establish a boundary for ambiguous data that pose challenges in direct classification. Concurrently, threat intelligence is integrated into this process to enhance the accuracy of decision-making. We validate the effectiveness and efficiency of IL-IDS with experiments on real-world deployments during an international activity, highlighting its robustness and reliability in intrusion detection applications, especially under conditions of confined data streams. Notably, IL-IDS has exhibited comparable accuracy and recall results, and attains exceptional 99.93% precision and 96.83% F1-score, which demonstrates a notable improvement of 5.27% and 2.59% respectively in comparison to intrusion detection models trained on complete and readily available data.

The Internet of Things (IoT) has seen widespread adoption across various industries, enabling cross-domain collaboration among devices. As IoT platforms that allows users to manage and control these IoT devices become more prevalent, the security of IoT platforms has come under increasing scrutiny. Cryptographic authentication (CA) has long been central to authentication but poses significant security risks, such as account takeovers due to credential disclosure. Unfortunately, CA remains the most popular authentication scheme for IoT platforms, making them vulnerable to phishing attacks. Current enhancement methods, including challenge-response protocols and multifactor authentication, are still susceptible to phishing and face usability issues, particularly in cross-domain collaboration systems where seamless access is crucial. This article introduces Context-Auth, a context-aware authentication scheme designed to defend against phishing attacks without requiring tamper-resistant hardware. By incorporating contextual features of authentication and access behaviors into access credentials, Context-Auth detects inconsistencies and strengthens security. Our scheme addresses cross-domain verification challenges in federated identity scenarios, ensuring high usability across various devices without additional requirement from users. We conducted comprehensive evaluations and security analyses to ensure that Context-Auth remains secure against potential threats. The experimental results demonstrate that Context-Auth effectively defends against phishing attacks launched by real-world phishing kits.

In Internet of Things (IoT) environments, anti-honeypot attacks exploit device fingerprinting and protocol analysis to undermine traditional honeypot defenses. To this end, we introduce an innovative camouflage defense strategy that dynamically disguises real IoT devices as honeypots to mislead attackers and protect critical resources. We formalize this adversarial interaction using a multi-stage signaling game, thereby reversing the information asymmetry that typically favors attackers. Subsequently, we theoretically derive the Perfect Bayesian Nash Equilibrium (PBNE) under conditions of incomplete information, thereby confirming the existence of mixed-strategy equilibria. Practically, we develop a signaling game-based multi-agent proximal policy optimization (SG-MAPPO) algorithm by integrating LSTM networks and Bayesian updates, overcoming challenges in long-term strategy optimization and parameter convergence in dynamic IoT contexts. Experiments demonstrate that SG-MAPPO outperforms existing methods in terms of training efficiency and stability, effectively reducing attacker success rates and providing a proactive defense solution for IoT security.

Container technology in cloud computing has improved resource utilization and deployment efficiency, but it also introduces new security risks. Excessive privileges in containerized environments can allow attackers to exploit insufficiently restricted system calls, potentially leading to container escapes and other attacks. Some system calls are only necessary during the initialization phase of a container, and allowing them during runtime can increase the risk of exploitation. This paper proposes a Phase-based System Call Filtering (PSF) method to minimize system call permissions during the runtime of cloud containers. The PSF method builds a comprehensive whitelist of system calls during the initialization phase to cover all necessary calls for containerized applications. During runtime, a refined, phase-specific system call whitelist is enforced, dynamically adjusting privileges based on the functions encapsulated within the container. Additionally, we introduce a container phase recognition algorithm to distinguish between initialization and runtime phases, supporting the generation of phase-specific system call lists. Experimental results show that the proposed method enhances runtime system call restrictions, minimizes privileges, and improves the overall security of cloud containers.

Deep learning is promising in open-world network intrusion detection, but current deep learning-based methods mainly focus on open recognition with properties that may not always hold and significantly neglect the inspection of unknown samples, increasing open space risks and manual inspection overhead for deployed models. To address these challenges in real-world environments, we propose a novel system, ORI, designed to tackle two critical tasks: 1) open recognition, including classifying known class samples while recognizing unknown ones, and 2) inspection, involving further inspecting samples recognized as unknown. Specifically, we reformulate open recognition as a binary classification task and propose a density-based method to recognize low-density samples as unknown while classifying known class samples with a closed-world classifier, thereby minimizing the risk associated with open spaces. To reduce the inspection overhead of samples recognized as unknown, we treat unknown sample inspection as a constrained clustering task, using a few manually inspected samples as constraints, and then assign labels to the remaining unknown samples via clustering. We evaluate our system against established open recognition and unknown sample inspection baselines through extensive experiments on three public datasets. Additionally, we simulated a security analyst inspecting unknown samples labeled by ORI. The experimental results demonstrate that ORI accurately classifies known class samples, recognizes unknown samples, and effectively labels samples recognized as unknown, enhancing both open recognition and inspection capabilities.

Model Inversion Attacks (MIAs) pose a certain threat to the data privacy of learning-based systems, as they enable adversaries to reconstruct identifiable features of the training distribution with only query access to the victim model. In the context of deep learning, the primary challenges associated with MIAs are suboptimal attack success rates and the corresponding high computational costs. Prior efforts assumed that the expansive search space caused these limitations, employing generative models to constrain the dimensions of the search space. Despite the initial success of these generative-based solutions, recent experiments have cast doubt on this fundamental assumption, leaving two open questions about the influential factors determining MIA performance and how to manipulate these factors to improve MIAs. To answer these questions, we reframe MIAs from the perspective of information flow. This new formulation allows us to establish a lower bound for the error probability of MIAs, determined by two critical factors: (1) the size of the search space and (2) the mutual information between input and output random variables. Through a detailed analysis of generative-based MIAs within this theoretical framework, we uncover a trade-off between the size of the search space and the generation capability of generative models. Based on the theoretical conclusions, we introduce the Query-Efficient Model Inversion Approach (QE-MIA). By strategically selecting an appropriate search space and introducing additional mutual information, QE-MIA achieves a reduction of$60\%\sim 70\%$in query overhead while concurrently enhancing the attack success rate by$5\%\sim 25\%$.

Federated Class Incremental Learning (FCIL) has emerged as a new paradigm due to its applicability in real-world scenarios. In FCIL, clients continuously generate new data with unseen class labels and do not share local data due to privacy restrictions, and each client’s class distribution evolves dynamically and independently. However, existing work still faces two significant challenges. Firstly, current methods lack a better balance between maintaining sound anti-forgetting effects over old data (stability) and ensuring good adaptability for new tasks (plasticity). Secondly, some FCIL methods overlook that the incremental data will also have a non-identical label distribution, leading to poor performance. This paper proposes CGoFed, which includes relax-constrained gradient update and cross-task gradient regularization modules. The relax-constrained gradient update prevents forgetting the knowledge about old data while quickly adapting to the new data by constraining the gradient update direction to a gradient space that minimizes interference with historical tasks. The cross-task gradient regularization also finds applicable historical models from other clients and trains a personalized global model to address the non-identical label distribution problem. The results demonstrate that the CGoFed performs well in alleviating catastrophic forgetting and improves model performance by 8% -23% compared with the SOTA comparison method.

Although a variety of models have been proposed for urban spatio-temporal forecasting, most existing forecasting models are developed manually for specific tasks. By investigating the correlation between multi-order derivative and spatio-temporal data, we propose a generic yet simple plug-in structure, namedTaylorS, to improve the performance and generalization of existing forecasting models. The TaylorS converts the non-linear regression problem into a multi-order non-linear approximation problem by plugging a Taylor expansion into the forecasting task. To achieve this, we design a two-step training framework, including a training step and an adjusting step. During training, we train a given forecasting model as a base model to be equipped with prior knowledge. During adjusting, we fine-tune the base model while plugging an adjustment model into the base model. The adjustment model, as a multi-order expansion, takes the multi-order derivative of data to evaluate data uncertainty for further forecasting approximation and adjustment. Extensive experimental results demonstrate that the proposed TaylorS framework can consistently improve the performance of existing state-of-the-art methods and generalize these methods to different forecasting tasks.

Federated Graph Learning (FGL) enables multiple clients to collaboratively learn node representations from private subgraph data, such as user transactions or social networks. Local models are trained on clients and then aggregated by a central server, supporting large-scale graph learning without sharing raw data. However, most existing FGL methods assume that the number of nodes in the graph remains constant, while real-world scenarios often evolve, with new nodes and edges continually added and older ones removed due to limited device memory. We define this setting as Federated Continual Graph Learning (FCGL). In FCGL, global model aggregation may cause interference occur inter-task and inter-client, therefore, FCGL suffers from the global catastrophic forgetting: as the global model adapts to newly added nodes, it loses knowledge acquired from earlier graph data of clients. To address this, we propose GRE-FL, a generative replay framework, which can mitigate global catastrophic forgetting by generating a global summary graph at the server to preserve critical information from historical nodes. It also improves performance by equipping local models with a gating graph attention network for better feature extraction. Experiments show that GRE-FL achieves strong performance across multiple datasets.

With the rapid development of mobile and wireless technologies, the industrial manufacturing sector has entered the era of automation. The proliferation of mobile devices, sensor networks, and remote monitoring systems enables factory equipment to be more flexibly connected and controlled. However, the trend towards industrial networks also brings new challenges. Industrial control systems (ICSs) and programmable logic controllers (PLCs) are more susceptible to hacker attacks and interference. Honeypoints have been developed to protect ICSs from addressing these threats, including potential internal attacks. Honeypoints are active deception systems that mitigate the limitations of conventional defense mechanisms, which successfully entice and neutralize internal enemies. This paper presents the PLC Honeypoint Communication Generator (PHCG), enhancing honeypoint protective capabilities in industrial IoT systems. Using an automated construction process, PHCG provides a convenient and efficient deployment method, ensuring quick and effective functioning. The functionality of a PLC relies on a data generation model trained on PLC response data. This model allows PHCG to imitate genuine PLC responses accurately when given authorized commands. The experimental results illustrate the adaptability of information produced by PHCG in different communication processes, with satisfactory timescales for both model training and data generation.

Stance detection on social media aims to identify if an individual is in support of or against a specific target. Most existing stance detection approaches primarily rely on modeling the contextual semantic information in sentences and neglect to explore the pragmatics dependency information of words, thus degrading performance. Although several single-task learning methods have been proposed to capture richer semantic representation information, they still suffer from semantic sparsity problems caused by short texts on social media. This article proposes a novel multigraph sparse interaction network (MG-SIN) by using multitask learning (MTL) to identify the stances and classify the sentiment polarities of tweets simultaneously. Our basic idea is to explore the pragmatics dependency relationship between tasks at the word level by constructing two types of heterogeneous graphs, including task-specific and task-related graphs (tr-graphs), to boost the learning of task-specific representations. A graph-aware module is proposed to adaptively facilitate information sharing between tasks via a novel sparse interaction mechanism among heterogeneous graphs. Through experiments on two real-world datasets, compared with the state-of-the-art baselines, the extensive results exhibit that MG-SIN achieves competitive improvements of up to 2.1% and 2.42% for the stance detection task, and 5.26% and 3.93% for the sentiment analysis task, respectively.

Learning-based systems have been proved to be vulnerable against model inversion attacks (MIAs), where attackers steal private information of training data by querying the target model using synthetic samples. To alleviate the urgent threat introduced by MIAs, existing advancements are proposed to increase the attack overhead by limiting the information available. Although these methods successfully reduced the attack success rate (ASR) for a one-time inversion attempt, they usually compromise the usability of the protected model. More importantly, existing MIA defense methods fail to capture attack attempts, which can lead to persistent threats to data privacy. To bridge this gap, we propose Neural Honeypoint, an active defense framework against MIAs. The key insight is that MIA attackers will make a series of forward steps in the feature space while benign users will not. Motivated by the observation, defenders can deploy active defense devices (honeypoints) on critical paths to capture attack behaviors. Specifically, Neural Honeypoint first models the attackers' capabilities from the frequency domain and designs specialized honeypoints for protected classes in the training dataset. Subsequently, it deploys these honeypoints into the protected model via backdoor-like model fine-tuning. Then, defenders can distinguish model inversion examples by comparing the similarity of input features with deployed honeypoints. Experiments show that Neural Honeypoint reduces the ASRs of advanced MIAs to 0%~2%. Furthermore, it can effectively capture inversion queries, which helps defenders to detect and block attacks in time.

Personalized federated learning (PFL) has become a hot research topic that can learn a personalized learning model for each client. Existing PFL models prefer to aggregate similar clients with similar data distribution to improve the performance of learning models. However, similarity-based PFL methods may exacerbate the class imbalance problem. In this article, we propose a novel dynamic affinity-based PFL (DA-PFL) model to alleviate the class imbalanced problem during federated learning. Specifically, we build an affinity metric from a complementary perspective to guide which clients should be aggregated. We then design a dynamic aggregation strategy that adjusts client aggregation based on the affinity metric in each round, thereby reducing the risk of class imbalance. Extensive experiments demonstrate that the proposed DA-PFL model can significantly improve the accuracy of each client in four real-world datasets with state-of-the-art comparison methods.

PLC, as the core of industrial control systems, has been turned into a focal point of research for attackers targeting industrial control systems. However, current researched methods for attacking PLCs suffer from issues such as lack of precision and limited specificity. This paper proposes a novel attack method called AOIFF. Specially, AOIFF extracts the binary control logic code from a running PLC and reverses the binary code into assemble code. And then awareness of industrial field information is extracted from assemble code. Finally, it is based on awareness that attack code is generated and injected into a PLC, which can disrupt the normal control logic and then launch precise attacks on industrial control systems. Experimental results demonstrate that AOIFF can effectively perceive information in industrial field and initiate precise and targeted attacks on industrial control systems. Additionally, AOIFF achieves excellent results in the reverse engineering of binary code, enabling effective analysis of binary code.

Sequence-based deep learning models are commonly used to detect anomalies in system logs to ensure the security of communication and information systems. However, recent research has shown that adversarial attack methods against these detection models reveal their vulnerabilities. Attackers can bypass these sequence-based classifiers by tampering with the sequence (e.g., adding or replacing sequence events). In this paper, we propose a novel Multi-Stage Defensive strategy for sequence-based log anomaly detection aimed at combating adversarial attacks. Systematically integrated, this strategy spans the entire detection process, from data embedding representation to anomaly classification, thereby forming a robust defensive approach that is strategically orchestrated to ensure comprehensive protection against a variety of adversarial attacks. Firstly, we compress the semantic feature space of sequences to enhance the anti-interference ability of attack operations on substitution sequences. Then, we propose a novel adaptive sparse multi-head attention mechanism to improve the Transformer model, allowing it to adaptively extract different key patterns in the sequence, thus eliminating irrelevant sequence events added in adversarial sequences. Our approach also integrates the learning of temporal patterns, offering enhanced robustness against deletion operations. Through extensive experiments on two public datasets, the experimental results demonstrate that our approach has high detection performance and robustness against different adversarial attacks.

Multi-task learning (MTL) has succeeded in various industrial applications by utilizing common knowledge among joint training tasks to enhance the generalization of MTL models, resulting in improved performance across all training tasks simultaneously. Unfortunately, training all tasks simultaneously often causes performance degradation compared to single-task models since different tasks might conflict with each other. Despite existing MTL methods that aim to mitigate task conflicts by manipulating task gradients at each iteration, they ignore the potential influence of noisy data from different batches on task gradients. Consequently, the current iteration's task gradient may not accurately reflect the task itself, leading to inadequate alleviation of the dilemma of task conflicts. Moreover, existing works seldom explore the potential source of task conflicts and merely pose an assumption. In this paper, we conduct an in-depth empirical investigation into the potential sources of performance degradation of MTL and find that task gradient conflict is one of the primary reasons for the performance degradation of tasks. Then, to address the task conflicts problem, we propose a novel gradient manipulation approach, namely MoCoGrad, which manipulates task gradients by leveraging the momentum information of the task to calibrate the gradients of conflicting tasks. In addition, we derive theoretical guarantees for the con-vergence of our proposed MoCoGrad and theoretically analyze the convergence rate of MoCoGrad. Finally, to evaluate the effectiveness of MoCoGrad, extensive experiments are conducted on six real-world datasets from different domains. Our approach yields the best performance across all tasks in all six MTL benchmarks, demonstrating the effectiveness and superiority of our method.

Graph contrastive learning (GCL) has gained increasing interest as a solution for graph representation learning. In GCL, graph augmentation is essential to generate contrastive samples used for contrastive learning. Recently, most existing methods employ learnable graph view generators to augment graphs based on the node probability distribution adaptively. However, these methods cannot ensure that semantic-related nodes are preserved during graph augmentation, leading to performance degradation. To tackle this issue, we propose a novel approach called Semantic-aware Graph Contrastive Learning (SGCL), which can generate high-quality contrastive samples by only augmenting semantic-unrelated nodes so as to facilitate the performance of GCL on downstream tasks. Specifically, we first design a Lipschitz constant generator to compute the Lipschitz constants that measure the semantic relevance of each node. Then, we propose the Lipschitz graph augmentation to augment graphs while only dropping these semantic-unrelated nodes with small Lipschitz constants. Furthermore, we propose semanticaware contrastive learning to obtain more refined representations by contrasting the graph-level representation of anchor graphs and high-quality generated samples. Experimental results on unsupervised learning and transfer learning demonstrate the effectiveness of SGCL compared to state-of-the-art methods.

Accurate forecasting of traffic flow plays a crucial role in building smart cities in the new era. Previous work has achieved success in learning inherent spatial and temporal patterns of traffic flow. However, existing works investigated the multiple periodicities (e.g., hourly, daily, and weekly) of traffic via entanglement learning, which has not yet dealt with distribution shift and interaction shift problems in traffic flow. In this paper, we propose a novel disentanglement learning network, called MUSE-Net, to tackle the limitations of entanglement learning by simultaneously factorizing the exclusiveness and interaction of multi-periodic patterns in traffic flow. Grounded in the theory of mutual information, we first learn and dis-entangle exclusive and interactive representations of traffics from multi-periodic patterns. Then, we utilize semantic-pushing and semantic-pulling regularizations to encourage the learned representations to be independent and informative. Moreover, we derive a lower bound estimator to tractably optimize the disentanglement problem with multiple variables and propose a joint training model for traffic forecasting. Extensive experimental results on several real-world traffic datasets demonstrate the effectiveness of the proposed framework. The code is available at: https://github.com/JianyangQin/MUSE-Net.

Caching is a critical method for enhancing the efficiency and the security of the Domain Name System (DNS). Initially, only successful domain name resolution results were cached. To mitigate failures in DNS transactions (e.g. NXDomain), the IETF proposed standards, further developed into RFC 9520 as of December 2023. In addition to the basic implementation, RFC 9520 standardizes more sophisticated forms of negative caching. This new standard aims to reduce redundant query retries in DNS traffic and protect resolvers from Denial of Service (DoS) attacks.In this study, we present a comprehensive examination of the specific implementations of Negative Caching in resolvers. We designed and validated a method for measuring negative caching and conducted experiments on 44 public resolvers, including their Do53, DoH, and DoT interfaces. Our findings indicate that while public resolvers generally implement various types of negative caching, some exhibit unexpected cache handling behaviors when encountering specific negative responses. Additionally, we discovered that most public resolvers modify the TTL value of negative responses before returning them to clients. Despite the lack of explicit TTL values for newly specified negative responses, we devised a method to approximate the default TTL values used by public resolvers.

This paper presents the design and implementation of a novel Network Function Virtualization (NFV) platform, NFVDC, specifically for dynamic service chaining. Unlike traditional service chaining methods, NFVDC supports real-time, reconfigurable service chains that accommodate service functions dynamically joining or leaving the chain. By integrating an advanced traffic steering method, optimized CPU scheduling, and a causal message-passing mechanism, NFVDC addresses challenges in deploying dynamic service chaining, such as traffic steering, resource scheduling, and session state management. Our evaluation demonstrates that NFVDC’s forwarding performance nearly doubles compared to existing solutions when extending service chain lengths to six.

Language models have shown vulnerability against backdoor attacks, threatening the security of services based on them. To mitigate the threat, existing solutions attempted to search for backdoor triggers, which can be time-consuming when handling a large search space. Looking into the attack process, we observe that poisoned data will create a long-tailed effect in the victim model, causing the decision boundary to shift towards the attack targets. Inspired by this observation, we introduce LT-Defense, the first searching-free backdoor defense via exploiting the long-tailed effect. Specifically, LT-Defense employs a small set of clean examples and two metrics to distinguish backdoor-related features in the target model. Upon detecting a backdoor model, LT-Defense additionally provides test-time backdoor freezing and attack target prediction. Extensive experiments demonstrate the effectiveness of LT-Defense in both detection accuracy and efficiency, e.g., in task-agnostic scenarios, LT-Defense achieves 98% accuracy across 1440 models with less than 1% of the time cost of state-of-the-art solutions.

Encrypted traffic classification using deep learning models based on packet length sequences has shown promising results. However, in real-world network conditions, network-induced phenomena such as packet loss, packet retransmission, and packet disorder are prevalent, leading to a decline in performance. To address this challenge, we propose Fractal, a novel approach designed to enhance existing deep learning models by integrating data augmentation and contrastive learning, thereby facilitating robust encrypted traffic classification under various network conditions. Specifically, Fractal employs three data augmentations to simulate different network conditions, generating diverse packet length sequences from the same flow. Contrastive learning is then leveraged to distill robust features from these augmented sequences. Fractal enables deep learning model to discern the intrinsic patterns of each flow, regardless of the variance in packet length sequences caused by network-induced phenomena. Our comprehensive evaluations demonstrate that Fractal enhances the classification performance of deep learning models under different network conditions, achieving 23% increase in accuracy and 15% improvement in F1-score.

Abuse of code signing has garnered attention from security researchers, as evidenced by threat modeling efforts targeting the public key infrastructure trust infrastructure of code signing and empirical studies examining issues surrounding the revocation of code signing certificates. However, current research on code signing remains inadequate in bridging the gap between attack strategies and defensive measures. This shortfall is primarily due to the predominant focus on quantitative measurements in academic studies, often at the expense of a thorough analysis of the underlying code signing mechanisms. Moreover, the misalignment of some threat models and measurement outcomes with real-world attack scenarios further hampers efforts to enhance defenses against code signing abuse. To the best of our knowledge, this article represents the first comprehensive and in-depth analysis of code signing security from both offensive and defensive perspectives. Commencing with a profound understanding of code signing and its verification mechanisms, we constructed an integrated threat model encompassing eight typical attack patterns and distilled a set of critical security properties that directly influence the security of code signing. Proceeding from this foundation, we systematically reviewed and analyzed various defensive strategies associated with these security properties, meticulously discussing their strengths, limitations, and the specific attack types they effectively defend against or mitigate. Lastly, this article conducts a risk statistical analysis based on actual security incidents, with the related results directly impacting the prioritization of defensive mechanism deployments. This ensures, at a practical level, the effectiveness and relevance of the defense strategies implemented.

As a fundamental component of Internet of Things (IoT) devices, firmware plays an essential role. Nowadays, the development of IoT firmware relies extensively on third-party components and substantially enhances development efficiency. However, these components are not inherently secure, and their vulnerabilities can adversely affect the security of IoT firmware. Existing research adopts binary code similarity analysis to detect known vulnerabilities in firmware. However, it encounters significant challenges, primarily in extracting function features from the limited semantic information within binary code. Another challenge is the need for real-world datasets to assess the model’s performance in practical scenarios, such as firmware supply chain analysis. We present a detection model named PDG2VEC based on Program Dependence Graphs (PDGs) to tackle these challenges. PDG2VEC extracts function features at the variable level on PDG and assesses function similarity by evaluating whether two functions can represent each other. We conducted evaluations using three datasets, including one we created to simulate a firmware supply chain scenario. The experimental results demonstrate that PDG2VEC exhibits resilience to cross-architecture challenges and captures more precise semantics than other approaches. Furthermore, PDG2VEC outperforms state-of-the-art tools in the supply chain analysis scenario, with a 16% higher AUC value average against baseline approaches.

Sequence-based deep learning models (e.g., RNNs), can detect malware by analyzing its behavioral sequences. Meanwhile, these models are susceptible to adversarial attacks. Attackers can create adversarial samples that alter the sequence characteristics of behavior sequences to deceive malware classifiers. The existing methods for generating adversarial samples typically involve deleting or replacing crucial behaviors in the original data sequences, or inserting benign behaviors that may violate the behavior constraints. However, these methods that directly manipulate sequences make adversarial samples difficult to implement or apply in practice. In this paper, we propose an adversarial attack approach based on Deep Q-Network and a heuristic backtracking search strategy, which can generate perturbation sequences that satisfy practical conditions for successful attacks. Subsequently, we utilize a novel transformation approach that maps modifications back to the source code, thereby avoiding the need to directly modify the behavior log sequences. We conduct an evaluation of our approach, and the results confirm its effectiveness in generating adversarial samples from real-world malware behavior sequences, which have a high success rate in evading anomaly detection models. Furthermore, our approach is practical and can generate adversarial samples while maintaining the functionality of the modified software.

Top-K sparsification-based compression techniques are popular and powerful for reducing communication costs in federated learning (FL). However, existing Top-K sparsification-based compression methods suffer from two critical issues that severely hinder their implementation, particularly in the context of FL, which often involves a vast number of resource-constrained devices: 1) the low compressibility of the Top-K parameter’s indexes significantly limits the overall compression ratio (CR) and 2) the residual accumulation techniques used to maintain the model quality consume huge memory resources. To address these issues, we propose a novel FL compression framework, named FedComp, for deep neural networks (DNNs). FedComp achieves a higher communication CR while maintaining comparable model quality at low memory cost. Specifically, FedComp incorporates the following three key components: 1) a tensor-wise index-sharing mechanism that greatly reduces the index proportion by sharing one index among multiple elements of the tensor; 2) a fine-grained parameters packing strategy that reduces the transmission of duplicate value and index by considering their properties, thereby further reducing the overall communication cost; and 3) a residual compressor that significantly reduces memory cost by enhancing the compressibility of floating-point residuals and achieving a high CR with a lossless encoding scheme. Experiments on mainstream machine learning (ML) tasks with different DNN structures and datasets demonstrate that our proposed FedComp outperforms the state-of-the-art FL compression algorithms by achieving a higher communication CR of up to$28.5\times $while reducing memory costs by$21.04\times $–$50.59\times $on the local residual model, without degrading FL training performance.

The complexity and ongoing evolution of Advanced Persistent Threats (APTs) compromise the efficacy of conventional cybersecurity measures. Firewalls, intrusion detection systems, and antivirus software, which are dependent on static rules and predefined signatures, are increasingly ineffective against these sophisticated threats. Moreover, the use of system audit logs for threat hunting involves a retrospective review of cybersecurity incidents to reconstruct attack paths for attribution, which affects the timeliness and effectiveness of threat detection and response. Even when the attacker is identified, this method does not prevent cyber attacks. To address these challenges, we introduce ThreatInsight, a novel early-stage threat detection solution that minimizes reliance on system audit logs. ThreatInsight detects potential threats by analyzing IPs captured from HoneyPoints. These IPs are processed through threat data mining and threat feature modeling. By employing fact-based and semantic reasoning techniques based on the APT Threat Intelligence Knowledge Graph (APT-TI-KG), ThreatInsight identifies and attributes attackers. The system generates analysis reports detailing the threat knowledge concerning IPs and attributed attackers, equipping analysts with actionable insights and defense strategies. The system architecture includes modules for HoneyPoint IP extraction, Threat Intelligence (TI) data analysis, attacker attribution, and analysis report generation. ThreatInsight facilitates real-time analysis and the identification of potential threats at early stages, thereby enhancing the early detection capabilities of cybersecurity defense systems and improving overall threat detection and proactive defense effectiveness.

The Top-K sparsification-based compression framework is extensively explored for reducing communication costs in distributed learning. However, we identified several issues with existing Top-K sparsification-based compression methods: (i) The limited compressibility of the Top-K parameter's indexes critically restricts the overall communication compression ratio; (ii) Several time-consuming compression operations significantly offset the benefits of communication compression; (iii) The use of error feedback techniques to maintain model quality results in a high memory footprint consumption. To solve these issues, we propose BIRD, a lightweight tensor-wiseBi-Random samplingstrategy with an expectation invariance property. Specifically, BIRD applies a tensor-wiseindex sharingmechanism that reduces the index proportion by allowing multiple tensor elements to share a single index, thus improving the overall compression ratio. Additionally, BIRD replaces the time-consuming Top-K sorting with a fasterBi-Random samplingstrategy based on the aforementionedindex sharingmechanism, significantly reducing compression overheads; Moreover, BIRD establishes anexpectation invarianceproperty into theBi-Random samplingto ensure an approximate unbiased representation for the$L_1$-norm of the sampled tensors, effectively maintaining the model quality without incurring extra memory costs. We further optimize BIRD to BIRD+ by introducing the uniform distribution-based sampling and Gamma correction on the tensor-wise sampling process, achieving a more flexibly adjustment of the sparsity with better convergence performance. Experimental evaluations across multiple conventional distributed learning tasks demonstrate that compared to state-of-the-art approaches, BIRD+ achieves higher communication compression ratios up to 36.2$\times$and higher computation throughput up to 149.6$\times$while maintaining the model quality without incurring extra memory costs.

Multi-task learning (MTL) has emerged as a promising approach for sharing inductive bias across multiple tasks to enable more efficient learning in text classification.However, training all tasks simultaneously often yields degraded performance of each task than learning them independently, since different tasks might conflict with each other.Existing MTL methods for alleviating this issue is to leverage heuristics or gradient-based algorithm to achieve an arbitrary Pareto optimal trade-off among different tasks.In this paper, we present a novel gradient trade-off approach to mitigate the task conflict problem, dubbed GetMTL, which can achieve a specific tradeoff among different tasks nearby the main objective of multi-task text classification (MTC), so as to improve the performance of each task simultaneously.The results of extensive experiments on two benchmark datasets back up our theoretical analysis and validate the superiority of our proposed GetMTL.

The Domain Name System (DNS) is an essential component of the internet, providing name resolution services to navigate clients to various resources on the network. Caches are critical to the efficient operation of DNS, both in terms of service quality and security. Major service providers maintain complex DNS infrastructure with multiple cache layers to handle client queries. Unfortunately, access to these caches is not available, making it difficult to understand the cache structure. In this study, we propose methodologies for identifying hidden cache structures in DNS infrastructure using watermark records. We further applied our methods to conduct global measurements, utilizing open resolvers as vantage points. Our measurement results indicated that flawed DNS cache structures exist, leaving the DNS infrastructure vulnerable and inefficient. Thousands of client networks suffer from severe cache fragmentation. Furthermore, a large number of recursive resolvers rely on fragile or poor cache structures.

Website Fingerprinting (WF) is commonly used to deanonymize the Tor users. Meanwhile, WF can also be applied to the hidden service (HS) side, to destroy the anonymity of the HS operator. However, the attacker faces the problem of no available data for training. To solve this problem, previous researchers build mirror sites and use the data collected on them to train the classifier. However, this approach still has limitations: The attacker cannot tell whether the target HS is some HS that is not in the set of sites he mirrors, i.e, an HS in the wild. To address this, we propose a novel two-phase approach to deanonymize HSs that using the website fingerprint collected on the remote node, i.e., a node on the same RP circuit with HS. Our approach does not rely on mirror sites because we decouple feature extraction from classification, so that mirror sites are only involved in the training of the feature extractor and are not related to the classification process. The experimental results show that our attack is effective in both closed-world and open-world scenarios.

Deep Neural Networks (DNNs) have achieved remarkable success in various real-world applications. However, running a Deep Neural Network (DNN) typically requires hundreds of megabytes of memory footprints, making it challenging to deploy on resource-constrained platforms such as mobile devices and IoT. Although mainstream DNNs compression techniques such as pruning, distillation, and quantization can reduce the memory overhead of model parameters during DNN inference, they suffer from three limitations: (i) low model compression ratio for the lightweight DNN structures with little redundancy, (ii) potential degradation in model inference accuracy, and (iii) inadequate memory compression ratio is attributable to ignoring the layering property of DNN inference. To address these issues, we propose a lightweight memory-efficient DNN inference framework called Smart-DNN+, which significantly reduces the memory costs of DNN inference without degrading the model quality. Specifically, ① Smart-DNN+ applies a layerwise binary-quantizer with a remapping mechanism to greatly reduce the model size by quantizing the typical floating-point DNN weights of 32-bit to the 1-bit signs layer by layer. To maintain model quality, ② Smart-DNN+ employs a bucket-encoder to keep the compressed quantization error by encoding the multiple similar floating-point residuals into the same integer bucket IDs. When running the compressed DNN in the user’s device, ③ Smart-DNN+ utilizes a partially decompressing strategy to greatly reduce the required memory overhead by first loading the compressed DNNs in memory and then dynamically decompressing the required materials for model inference layer by layer. Experimental results on popular DNNs and datasets demonstrate that Smart-DNN+ achieves lower 0.17%–0.92% memory costs at lower runtime overheads compared with the states of the art without degrading the inference accuracy. Moreover, Smart-DNN+ potentially reduces the inference runtime up to 2.04× that of conventional DNN inference workflow.

Multitask learning (MTL) is a powerful technique for jointly learning multiple tasks. However, it is difficult to achieve a tradeoff between tasks during iterative training, as some tasks may compete with each other. Existing methods manually design specific network models to mitigate task conflicts, but they require considerable manual effort and prior knowledge about task relationships to tune the model so as to obtain the best performance for each task. Moreover, few works have offered formal descriptions of task conflicts and theoretical explanations for the cause of task conflict problems. In this article, we provide a formal description of task conflicts that are caused by the gradient interference problem of tasks. To alleviate this issue, we propose a novel model-agnostic approach to mitigate gradient interference (MAMG) by designing a gradient clipping rule that directly modifies the interfering components on the gradient interfering direction. Specifically, MAMG is model-agnostic and thus it can be applied to a large number of multitask models. We also theoretically prove the convergence of MAMG and its superiority to existing MTL methods. We evaluate our method on a variety of real-world large datasets, and extensive experimental results confirm that MAMG can outperform some state-of-the-art algorithms on different types of tasks and can be easily applied to various methods.

Top-k sparsification method is popular and powerful forreducing the communication cost in Federated Learning(FL). However, according to our experimental observation, it spends most of the total communication cost on the index of the selected parameters (i.e., their position informa-tion), which is inefficient for FL training. To solve this problem, we propose a FL compression algorithm for convolution neural networks (CNNs), called SmartIdx, by extending the traditional Top-k largest variation selection strategy intothe convolution-kernel-based selection, to reduce the proportion of the index in the overall communication cost and thusachieve a high compression ratio. The basic idea of SmartIdx is to improve the 1:1 proportion relationship betweenthe value and index of the parameters to n:1, by regarding the convolution kernel as the basic selecting unit in parameter selection, which can potentially deliver more informationto the parameter server under the limited network traffic. Tothis end, a set of rules are designed for judging which kernel should be selected and the corresponding packaging strategies are also proposed for further improving the compressionratio. Experiments on mainstream CNNs and datasets show that our proposed SmartIdx performs 2.5×−69.2× higher compression ratio than the state-of-the-art FL compression algorithms without degrading model performance.

Data privacy and security issues are preventing a lot of potential on-cloud machine learning as services from happening. In the recent past, secure multi-party computation (MPC) has been used to achieve the secure neural network predictions, guaranteeing the privacy of data. However, the cost of the existing two-party solutions is expensive and they are impractical in real-world setting.

Stance detection aims to identify people's standpoints expressed in the text towards a target, which can provide powerful information for various downstream tasks.Recent studies have proposed multi-task learning models that introduce sentiment information to boost stance detection.However, they neglect to explore capturing the fine-grained task-specific interaction between stance detection and sentiment tasks, thus degrading performance.To address this issue, this paper proposes a novel multi-task interaction network (MTIN) for improving the performance of stance detection and sentiment analysis tasks simultaneously.Specifically, we construct heterogeneous taskrelated graphs to automatically identify and adapt the roles that a word plays with respect to a specific task.Also, a multi-task interaction module is designed to capture the wordlevel interaction between tasks, so as to obtain richer task representations.Extensive experiments on two real-world datasets show that our proposed approach outperforms state-ofthe-art methods in both stance detection and sentiment analysis tasks.

Aspect-based sentiment analysis aims to identify sentiment polarity of social media users toward different aspects.Most recent methods adopt the aspect-centric latent tree to connect aspects and their corresponding opinion words, thinking that would facilitate establishing the relationship between aspects and opinion words.However, these methods ignore the roles of syntax dependency relation labels and affective semantic information in determining the sentiment polarity, resulting in the wrong prediction.In this paper, we propose a novel multi-graph fusion network (MGFN) based on latent graph to leverage the richer syntax dependency relation label information and affective semantic information of words.Specifically, we construct a novel syntax-aware latent graph (SaLG) to fully leverage the syntax dependency relation label information to facilitate the learning of sentiment representations.Subsequently, a multi-graph fusion module is proposed to fuse semantic information of surrounding contexts of aspects adaptively.Furthermore, we design an affective refinement strategy to guide the MGFN to capture significant affective clues.Extensive experiments on three datasets demonstrate that our MGFN model outperforms all state-of-the-art methods and verify the effectiveness of our model.

Existing anomaly detection models show success in detecting abnormal images with generative adversarial networks on the insufficient annotation of anomalous samples. However, existing models cannot accurately identify the anomaly samples which are close to the normal samples. We assume that the main reason is that these methods ignore the diversity of patterns in normal samples. To alleviate the above issue, this paper proposes a novel anomaly detection framework based on generative adversarial network, called ADe-GAN. More concretely, we construct a self-supervised learning task to fully explore the pattern information and latent representations of input images. In model inferring stage, we design a new abnormality score approach by jointly considering the pattern information and reconstruction errors to improve the performance of anomaly detection. Extensive experiments show that the ADe-GAN outperforms the state-of-the-art methods over several real-world datasets.

The surprising wave of blockchain has led to rapid progress of Byzantine fault tolerant protocol. However, most researches concentrate on the centralized trust such as PBFT, in which all participants trust each other equally. This paper presents DWBFT, a weighted Byzantine fault tolerant protocol with decentralized trust under the weak synchrony assumption. In DWBFT, the nodes can assign weights to each other depending on their decentralized trust relationship, which are adopted to make decisions. DWBFT can achieve safety under the condition that the weight of Byzantine nodes is less than 1/5 of the total weight of all nodes under any weight assignment. The experimental results show that DWBFT can achieve a throughput of nearly 13,000 tps under 32 nodes, and has no significant performance degradation compared with PBFT.

Binary code similarity identification is an important technique applied to many security applications (e.g., plagiarism detection, bug search). The primary challenge of this research topic is how to extract sufficient information from the binary code for similarity comparison. Although numerous approaches have been proposed to address the challenge, most of them leverage features determined by human experience or extracted using machine learning methods and ignore some critical technique semantic information. Additionally, they assess their approach exclusively in laboratory environments and lack real-world datasets. Both problems lead to the limited effectiveness of these methods in real application scenarios (e.g., vulnerable function search).In this paper, we propose a novel approach PDG2Vec, which extracts the data dependence graph and control dependence graph (i.e., program dependence graph (PDG)) as the features of functions and uses them for identifying function similarity. Meanwhile, we design several strategies to optimize the PDG’s construction and use them in similarity comparison to balance time-consuming and accuracy. We implement the prototype of PDG2Vec, which can perform binary code similarity comparison across architectures of x86, x86_64, MIPS32, ARM32, and ARM64. We evaluate PDG2Vec with two datasets. The experimental results show that PDG2Vec is resilient to cross-architecture and extracts more precise semantics than other approaches. Moreover, PDG2Vec outperforms the state-of-the-art tools in the vulnerable function search scenario and has excellent performance.

DNS-based data exfiltration has become increasingly popular among advanced persistent threat (APT) attackers owing to the ubiquity and penetrability of the DNS protocol. AI-powered methods solve the defect that attackers can easily bypass because of the fixed threshold and weight in rule matching while still suffer from several issues. Such as the lack of malware samples for training, the amplified impact of even low FPR present enormous obstacles to applying the model in real-world detection.We present a method to generate malicious traffic covering an extensive sample space based on Tactics, Techniques, and Procedures (TTPs). We then propose a sticky mechanism, which transforms certain decision-making into dynamic human-computer interaction decision-making, to verify the suspicious hosts recognized by the AI model. The experimental results demonstrate the superiority of our model by identifying eight kinds of real attacks precisely. The good performance on real-world traffic shows our method is a solid foothold for applying AI-powered detection to practical applications.

Cyber attacks have become increasingly complicated, persistent, organized, and weaponized. Faces with this situation, drives a rising number of organizations across the world are showing a growing willingness to leverage the open exchange of cyber threat intelligence (CTI) for obtaining a full picture of the fast-evolving cyber threat situation and protecting themselves against cyber-attacks. However, modeling CTI is challenging due to the explicit and implicit relationships among CTI and the heterogeneity of cyber-threat infrastructure nodes involved in CTI. Owing to the limited labels of cyber threat infrastructure nodes involved in CTI, automatically identifying the threat type of infrastructure nodes for early warning is also challenging. To tackle these challenges, a practical system calledHinCTIis developed for modeling cyber threat intelligence and identifying threat types. We first design a threat intelligence meta-schema to depict the semantic relatedness of infrastructure nodes. We then model cyber threat intelligence on heterogeneous information network (HIN), which can integrate various types of infrastructure nodes and rich relations among them. Following, we define a meta-path and meta-graph instances-based threat Infrastructure similarity (MIIS) measure between threat infrastructure nodes and present a MIIS measure-based heterogeneous graph convolutional network (GCN) approach to identify the threat types of infrastructure nodes involved in CTI. Moreover, through the hierarchical regularization strategy, our model can alleviate the problem of overfitting and achieve good results in the threat type identification of infrastructure nodes. To the best of our knowledge, this work is the first to model CTI on HIN for threat identification and propose a heterogeneous GCN-based approach for threat type identification of infrastructure nodes. WithHinCTI, comprehensive experiments are conducted on real-world datasets, and experimental results demonstrate that our proposed approach can significantly improve the performance of threat type identification compared to the existing state-of-the-art baseline methods. Our work is beneficial to greatly relieve security analysts from heavy analysis work and efficiently protect organizations against cyber-attacks.

Large low Earth orbit (LEO) satellite constellations provide low-latency and high-bandwidth Internet connectivity at the global scale. One major challenge is to handle frequent satellite handovers. Named Data Networking (NDN) adopts a pull-based communication model, which allows users to retrieve data that fail to come back because of satellite handovers by retransmitting the corresponding requests, hence simplifying mobility management when retrieving data. However, we find that relying on such retransmissions alone can be highly inefficient in typical LEO satellite constellations. Specifically, typical inter-satellite topologies and satellite handover strategies may produce bad cases for retransmissions, generating a significant amount of additional traffic. Motivated by this observation, this paper attempts to consolidate NDN's advantage in mobility management with the Data Recovery Link Service (DRLS), a shim layer service operating between the network and link layer in the NDN protocol stack. DRLS hides recurring satellite handovers from forwarding by recovering data from the previously connected satellite via alternative paths, thus ensuring the bidirectional request-response exchange of NDN without retransmitting requests. A prototype of DRLS is implemented in the reference NDN software forwarder and evaluated through simulations. Results prove the efficacy of the proposed mechanism at reducing the overall traffic volume.

DNS-over-HTTPS (DoH), as a rising star to improve DNS security and privacy, has developed rapidly in recent years. It mixes with HTTP features, shares ports with other web services and provides API with URI templates. The unique characteristics of DoH, as well as its fast growth, bring both promising prospects and new risks, e.g. botnet communication, name abuse and data exfiltration. It is essential for network operators to learn about adoption and usage of DoH resolvers. Active scanning may be a possible way. However, it is considered to incur significantly additional overhead, which can be inefficient and aggressive. In this paper, we present DOHUNTER, a system for automati-cally discovering DoH resolvers. DOHUNTER: (i) picks DoH flow from miscellaneous HTTPS traffic, (ii)confirms DoH resolvers based on the detected DoH flow, (iii)mines other related DoH resolvers from the known ones. Our real-world experiments demonstrate the effectiveness of DOHUNTER in detecting DoH flow and finding DoH resolvers. Utilizing DOHUNTER, we witness an alarming increase in DoH adoption. Additionally, we also reveal oblivious growing trends of DoH, which may provide advice for both users and network operators.

Greybox fuzzing has been widely used in vulnerabilities detection. Most greybox fuzzing tools are coverage-based, which usually use basic block transition to gain code coverage and focus on improving it to trigger more bugs. However, only increasing code coverage is insufficient to find some heap-based vulnerabilities such as use-after-free (UAF) and double-free (DF). This is because, to trigger these vulnerabilities, one needs not only to cover more code, but also to execute special heap operations to satisfy a particular temporal constraint (i.e., allocating heap memory, free memory, and accessing the heap memory). In this paper, we propose an approach, namely MDFuzz, to detect heap-based vulnerabilities adopting multi-level directed greybox fuzzing. The key idea is identifying different targets to guide the fuzzing process to cover specific heap operations without wasting resources exploring unrelated program components. We first perform a static analysis to automatically recognize three critical targets related to heap operations and then calculate each basic block's distance to the targets. Moreover, we propose a probability-based multi-level seed queue and a novel seed selection strategy to augment the guidance of directed fuzzing. To evaluate MDFuzz, we have performed an evaluation on 7 real-world applications. The experimental results demonstrate that MDFuzz significantly outperforms the state-of-the-art fuzzers, including AFL, AFLFast and VUzzer, in terms of the time consumed to discover heap-based vulnerabilities. Moreover, MD-Fuzz found 4 previously unknown vulnerabilities in real-world programs.

In many advanced network analysis applications, like social networks, e-commerce, and network security, hotspots are generally considered as a group of vertices that are tightly connected owing to the similar characteristics, such as common habits and location proximity. In this article, we investigate the formation of hotspots from an alternative perspective that considers the routes along the network paths as the auxiliary information, and attempt to find the route hotspots in large labeled networks. A route hotspot is a cohesive subgraph that is covered by a set of routes, and these routes correspond to the same sequential pattern consisting of vertices' labels. To the best of our knowledge, the problem of Finding Route Hotspots in Large Labeled Networks has not been tackled in the literature. However, it is challenging as counting the number of hotspots in a network is #P-hard. Inspired by the observation that the sizes of hotspots decrease with the increasing lengths of patterns, we prove several anti-monotonicity properties of hotspots, and then develop a scalable algorithm called FastRH that can use these properties to effectively prune the patterns that cannot form any hotspots. In addition, to avoid the duplicate computation overhead, we judiciously design an effective index structure called RH-Index for storing the hotspot and pattern information collectively, which also enables incremental updating and efficient query processing. Our experimental results on real-world datasets clearly demonstrate the effectiveness and scalability of our proposed methods.

Domain Name System (DNS) is a widely used infrastructure for remote control and batch management of IoT devices. As a critical Internet infrastructure, DNS is structured as a tree‐like hierarchy with single root zone authority at the top, which puts the operation of DNS at risk from single point of failure. The current root zone management is lack of transparency and accountability, since only the root zone file is published as the final outcome of operations inside the root zone authority. Towards distributed root zone operation in DNS, this paper presents a blockchain‐based root operation architecture—RootChain, composed of multiple root servers. On the basis of maintaining the single root authority for top‐level domain (TLD), RootChain decentralizes TLD data publication by empowering delegated TLD authorities to publish authenticated data directly. The transparency and accountability of root zone operation are attained by smart‐contracting the whole life cycle of TLD operation and logging all operations on the chain. RootChain is transparent to recursive/stub resolver and DNS/DNSSEC‐compatible. A proof‐of‐concept prototype of RootChain has been implemented with Hyperledger Fabric and evaluated by experiments.

False information detection on social media is challenging as it commonly requires tedious evidence-collecting but lacks available comparative information. Clues mined from user comments, as the wisdom of crowds, could be of considerable benefit to this task. However, it is non-trivial to capture the complex semantics from the contents and comments in consideration of their implicit correlations. Although deep neural networks have good expressive power, one major drawback is the lack of explainability. In this paper, we focus on how to learn from the post contents and related comments in social media to understand and detect the false information more effectively, with explainability. We thus propose a Quantum-probability based Signed Attention Network (QSAN) that integrates the quantum-driven text encoding and a novel signed attention mechanism in a unified framework. QSAN is not only able to distinguish important comments from the others, but also can exploit the conflicting social viewpoints in the comments to facilitate the detection. Moreover, QSAN is advantageous with its explainability in terms of transparency due to quantum physics meanings and the attention weights. Extensive experiments on real-world datasets show that our approach outperforms state-of-the-art baselines and can provide different kinds of user comments to explain why a piece of information is detected as false.

The domain name system (DNS) is the infrastructure of many services and applications, thus the availability and consistency of the domain name resolution process are crucial but have long troubled DNS. The availability problem is caused by a denial-of-service (DoS) attack or a single point of failure (SPOF). The consistency problem originates from the lack of a forced data synchronization mechanism between authoritative server replicas or between parent/child authoritative servers. We proposed a novel blockchain-based domain name resolution and management architecture named FI-DNS to solve the above problems fundamentally. FI-DNS solves availability and consistency problems in the name resolution process from the mechanism level and guarantees the authenticity and integrity of name resolution results by using public-key cryptography. FIDNS also supports root zone collaborative management based on smart contracts, which is compatible with the current governance model led by Internet Corporation for Assigned Names and Numbers (ICANN). We implemented the prototype system to prove the feasibility and effectiveness of the FI-DNS architecture. We built an experimental environment with real domain name data, evaluated the name resolution performance and stability of the FI-DNS prototype system, and compared the prototype system with DNS.

In this paper, we propose the Napping Guard attack which can deanonymize hidden services in a stealthy way. The key insight of our method is utilizing a design flaw of hidden service's requests to build a simplex covert channel, which can send message from a malicious guard relay to the collusive Client-OP. With the help of this covert channel, the guard relay delivers the actual IP address of the hidden service to the collusive Client-OP. Considering the Client-OP knows the onion address of hidden service, the adversary is able to deanonymize the hidden service through correlating the actual IP address and onion address on Client-OP. In particular, compared with previous attacks, our covert channel utilizes latency signal instead of traffic signal, and eliminates the dependency of malicious Rend-Point, so as to achieve a better concealment and lower cost. Our experiment shows that the covert channel is reliable that has the precision and recall about 99.35% and 99.19%. In addition, we also propose a mitigation of Napping Guard attack, and report the design flaw to the Tor project.

With the development of Internet-of-Things (IoT) technology, various types of information, such as social resources and physical resources, are deeply integrated for different comprehensive applications. Social networking, car networking, medical services, video surveillance, and other forms of the IoT information service model gradually change people's daily lives. Facing the vast amounts of IoT information data, the IoT search technology is used to quickly find accurate information to meet the real-time search needs of users. However, IoT search requires using a large amount of user private information, such as personal health information, location information, and social relations information, to provide personalized services. Employing private information from users will encounter security problems if an effective access control mechanism is missing during the IoT search process. An access control mechanism can effectively monitor the access activities of resources and ensure that authorized users access information resources under legitimate conditions. This survey examines the growing literature on access control for an IoT search. Problems and challenges of access control mechanisms are analyzed to facilitate the adoption of access control solutions in real-life settings. This article aims to provide theoretical, methodological, and technical guidance for IoT search access control mechanisms in large-scale dynamic heterogeneous environments. Based on a literature review, we also analyzed the future development direction of access control in the age of IoT.

Forecasting the stock market trend is a vital component of financial systems. Traditional methods mainly rely on quantitative trading data to make predictions. With the increasing volume of Web information, researchers begin to extract effective indicators (e.g., the events and sentiments) from the Web to facilitate the prediction. It is beneficial to fuse the heterogeneous multi-sourced data to achieve superior performance. Existing solutions adopt simple data fusing methods with conventional machine learning models, which may fail to effectively model the complex interactions among the data. With the success of deep neural networks (DNN) in various fields, we propose a DNN-based model that considers the various interactions and complex correlations among the multi-sourced data into one unified framework. In such a framework, the low-and high-order feature interactions are modeled with the factorization machine and the deep neural network respectively, and stock correlations are incorporated with an attention-based feature embedding method. Evaluations on the stock data from the year 2015 to 2017 show that our model can outperform the state-of-the-art methods.

The application of social network has produced a large amount of entity data in different formats, which accompanied by problems such as data offset and attribute missing. The existing research on dealing with multiple data scenarios and accuracy performance is insufficient. To solve the problem of data cleaning, EDCleaner is carried out on transforming entity information into structured data with attribute labeling. The method of attribute recognition and data normalization for semi-structured data is proposed in EDCleaner, which efficiently identifies the attribute tag relationship of data and obtains the structured data with uniform specifications. Furthermore, a data cleaning model with active learning extension is established. The machine learning classifier is used to further improve the accuracy of attribute recognition, and finally form an efficient and accurate data cleaning method. Experimental results show that EDCleaner improves the cleaning accuracy and other performing indicators of entity information and exceeds the level of state of the art.

The DNS system is gradually becoming the infrastructure of many services and applications. The availability and security of the domain name resolution process must be guaranteed. We propose a graph-based formal model and a general analysis method for quantifying the name resolution process. We define metrics to quantify the availability and security of resolution process for a domain name. We conducted four measurements of the top 1 million popular domains within a one-year period. Our survey shows that for more than 50% of domains, if the most critical authoritative server of the domain name becomes unavailable or compromised, the probability of resolution failure or insecure answer is over 50%.

Private set intersection (PSI) is a specific application problem in the field of secure multi-party computation. It allows the participants to compute set intersection collaboratively without learning any additional information about the sets. It is a building block for many real-world privacy-related applications. The state-of-the-art PSI protocol is mainly based on Random Oblivious Transfer (ROT) and cuckoo hash. It is efficient enough in computation but needs high communication cost and high network bandwidth. In this paper, we describe a novel PSI protocol based on ROT and balance hash under semi-honest adversary model. Experiments demonstrate that our protocol has better performance than the cuckoo hash based PSI at the expense of leaking a part of the indexes of hash bucket. We have proved that the impact of information leakage on security is almost negligible. In addition, for the purpose of reducing the communication overhead, we utilize cuckoo filter to optimize our protocol.

Botnets are one of predominant threats to Internet security. To date, machine learning technology has wide application in botnet detection because that it is able to summarize the features of existing attacks and generalize to never-before-seen botnet families. However, recent works in adversarial machine learning have shown that attackers are able to bypass the detection model by constructing specific samples, which due to many algorithms are vulnerable to almost imperceptible perturbations of their inputs. According to the degree of adversaries' knowledge about the model, adversarial attacks can be classified into several groups, such as gradient- and score-based attacks. In this paper, we propose a more general framework based on deep reinforcement learning (DRL), which effectively generates adversarial traffic flows to deceive the detection model by automatically adding perturbations to samples. Throughout the process, the target detector will be regarded as a black box and more close to realistic attack circumstance. A reinforcement learning agent is equipped for updating the adversarial samples by combining the feedback from the target model (i.e. benign or malicious) and the sequence of actions, which is able to change the temporal and spatial features of the traffic flows while maintaining the original functionality and executability. The experiment results show that the evasion rates of adversarial botnet flows are significantly improved. Furthermore, with the perspective of defense, this research can help the detection model spot its defect and thus enhance the robustness.

Monitoring kernel object modification of virtual machine is widely used by virtual-machine-introspection-based security monitors to protect virtual machines in cloud computing, such as monitoring dentry objects to intercept file operations, etc. However, most of the current virtual machine monitors, such as KVM and Xen, only support page-level monitoring, because the Intel EPT technology can only monitor page privilege. If the out-of-virtual-machine security tools want to monitor some kernel objects, they need to intercept the operation of the whole memory page. Since there are some other objects stored in the monitored pages, the modification of them will also trigger the monitor. Therefore, page-level memory monitor usually introduces overhead to related kernel services of the target virtual machine. In this paper, we propose a low-overhead kernel object monitoring approach to reduce the overhead caused by page-level monitor. The core idea is to migrate the target kernel objects to a protected memory area and then to monitor the corresponding new memory pages. Since the new pages only contain the kernel objects to be monitored, other kernel objects will not trigger our monitor. Therefore, our monitor will not introduce runtime overhead to the related kernel service. The experimental results show that our system can monitor target kernel objects effectively only with very low overhead.

Because cloud storage services have been broadly used in enterprises for online sharing and collaboration, sensitive information in images or documents may be easily leaked outside the trust enterprise on-premises due to such cloud services. Existing solutions to this problem have not fully explored the tradeoffs among application performance, service scalability, and user data privacy. Therefore, we propose CloudDLP, a generic approach for enterprises to automatically sanitize sensitive data in images and documents in browser-based cloud storage. To the best of our knowledge, CloudDLP is the first system that automatically and transparently detects and sanitizes both sensitive images and textual documents without compromising user experience or application functionality on browser-based cloud storage. To prevent sensitive information escaping from on-premises, CloudDLP utilizes deep learning methods to detect sensitive information in both images and textual documents. We have evaluated the proposed method on a number of typical cloud applications. Our experimental results show that it can achieve transparent and automatic data sanitization on the cloud storage services with relatively low overheads, while preserving most application functionalities.

Legal judgment prediction (LJP) plays an important role in legal assistant systems and aims to provide feasible judgment suggestions, including the charges, applicable law articles, and prison term. In practice, there exist many confusing charges which result in the decline of LJP performance of the existing works. To address this issue, we introduce the legal constitutive elements as the discriminative features to distinguish confusing charges. We propose an element-driven attentive neural network model, EDA-NN, which takes the textual description of a criminal case as the input and learns both element-free and element-aware case representations. Moreover, the element-driven attention mechanism is incorporated with the hierarchical sequence encoders, to generate crucial representations oriented to the legal constitutive elements at both the word and sentence levels. With the concatenation of element-free and element-aware representations, the EDA-NN can jointly predict the legal constitutive elements and judgment results. The experiments are conducted on a real-world dataset of criminal cases in mainland China. The experimental results demonstrate that our approach significantly outperforms all the baseline models on the LJP task for criminal cases with confusing cases.

In this paper, we propose the SignalCookie attack which can reveal guard relays of multiple hidden services in parallel. The key insight of our method is utilizing Rendezvous Cookie and circuit watermark to deliver the hidden services' identifiers to our controlled relays. By conducting the attack in parallel, the speed of our method increases about 11.6 times compared with the previous work, so that we can continually monitor the guard relays of 13604 hidden services for 7 months. And we have an interesting finding by analyzing the distribution of hidden services binding on each guard relays. The distribution is quite uneven, that only 20% of guard relays serve about 89.32% hidden services. These guard relays would bind all hidden services at least one time in about 17 months. At last, we analyze several security problems aggravated by the uneven distribution, and find that just one corrupt guard relay may cause hundreds of hidden services being de-anonymized or eclipsed.

Domain Name System (DNS) is indispensable in a large number of network applications. Identifying DNS infrastructures into different roles hierarchically is highly desired for a variety of purposes such as network management and threat evaluation. However, traditional measurements almost all depend on active scanning without considering dynamic packet-level features of different DNS infrastructures.In this paper, we propose a high-performance model IDNS (Identifying DNS) based on passive measurement. IDNS: (i) extracts single-packet field features (SFF) and multi-packet statistical features (MSF) from DNS traffic, (ii) utilizes an estimation algorithm to calculate MSF for satisfying online processing speed, and (iii) applies several classifiers in Ensemble Learning and Incremental Learning. We perform an extensive evaluation based on a large volume of DNS queries and responses collected from one ISP. The evaluation results demonstrate that the best classifier in Ensemble Learning can reach 90% accuracy rate while the classifier in Incremental Learning can reach 80% with the highest scalability.

Summary In‐VM management is usually needed by cloud service providers for cloud management, which includes monitoring the in‐VM application running state, reconfiguring VM system settings, etc. In‐VM management is also very useful in green cloud computing, because it provides the abilities of in‐VM monitoring, VM reconfiguration, performance measurement, etc. Leveraging a shell or an in‐VM agent to manage VMs is faced with generality and security challenges. In this paper, we propose a secure automated in‐VM management approach, ie, SAVM, which likes a hypervisor‐based shell managing the VMs in an out‐of‐box way. To bridge the semantic gap, we reuse the target VM's system calls to process the semantic information automatically. More importantly, we introduce a secure instruction fetch approach to enhance the system security. As a result, SAVM does not rely on the target VM's kernel integrity. In addition, we also present a dummy process selection and a system call injection method to further enhance the system security and transparency. After the implementation, we evaluate the prototype. The experimental results show that SAVM can achieve most of the in‐VM management operations. Furthermore, SAVM can work correctly under the target VM attacked by several popular rootkits.

The interaction between mobile Internet of Things (IoT) devices is based on a hybrid communication architecture. To improve packet delivery ratio, reduce end-to-end delay, and protect data privacy, designing an efficient data forwarding scheme is crucial in guaranteeing the quality of data transmission. Fog computing, a novel distributed computing framework, can decrease the amount of data transmission on the Internet and improve quality of services. In this paper, we propose a fog computing-assisted trustworthy forwarding (FCTF) scheme. To the best of our knowledge, this paper is the first study that investigates the role of fog infrastructure nodes (FINs) in forwarding scheme design. FCTF first selects the contact probability and the service degree as the basic trustworthy metrics between node pairs, and combines high-performance optimization algorithms to design a dynamic detection model of overlapping trustworthy communities (DOTCs). Then, we construct logical joint edge community structures on the basis of the results of DOTC and the distribution of FINs at each timestamp. Finally, based on the logical joint edge community, we define the forwarding utilities for FINs and mobile devices, respectively, and design self-adaptive forwarding rules. The experimental results prove that our FCTF scheme can enhance the delivery ratio, and decrease the latency and average hop-count more effectively, and has better routing quality compared with some popular forwarding models in mobile IoT applications.

Tor hidden services (HSs) are used to provide anonymity services to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor HSs use decentralized architecture that makes it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor HSs that allow an adversary with an extremely low cost to block arbitrary Tor HSs. We found that the dominant cost of this attack is IP address resources, the experimental results show that we can use only three IP addresses to eclipse an arbitrary HS with 100% success probability. To understand the severity of the Eclipse attack problems on Tor HSs, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of HSs at any time. Finally, we discuss countermeasures and future works.

In networks, multiple contagions, such as information and purchasing behaviors, may interact with each other as they spread simultaneously. However, most of the existing information diffusion models are built on the assumption that each individual contagion spreads independently, regardless of their interactions. Gaining insights into such interaction is crucial to understand the contagion adoption behaviors, and thus can make better predictions. In this paper, we study the contagion adoption behavior under a set of interactions, specifically, the interactions among users, contagions' contents, and sentiments, which are learned from social network structures and texts. We develop an effective and efficient interaction-aware diffusion (IAD) framework, incorporating these interactions into a unified model. We also present a generative process to distinguish user roles, a co-training method to determine contagions' categories and a new topic model to obtain topic-specific sentiments. Evaluation on the large-scale Weibo dataset demonstrates that our proposal can learn how different users, contagion categories, and sentiments interact with each other efficiently. With these interactions, we can make a more accurate prediction than the state-of-art baselines. Moreover, we can better understand how the interactions influence the propagation process and thus can suggest useful directions for information promotion or suppression in viral marketing.

Network embedding has gained much attention in recent years. Embedding network into a low-dimensional vector space has shown promising performance in many graph mining tasks such as node classification, link prediction, and community detection. However, in many real-world applications, a variety of networks could be abstracted and presented in a multilayer fashion with rich information, such as user profiles of friendship networks and textual content of citation networks. Most existing algorithms focus on single-layer networks or homogeneous networks with a single type of nodes and edges. They fail to leverage the rich attributes and consider the rich semantic correlations of the nodes which are among within-layer or cross-layer. In this paper, we exploit the rich semantic information embedded in the multi-layer network by means of meta-path-based proximities and leverage the rich source of attributes in the multi-layer network to improve network embedding. Specifically, the semantic correlations come from both within-layer and cross-layer node connections, and attribute proximity is considered to refine the homogeneity of nodes that belong to the same type. We propose a generic Attributed Multi-layer Network Embedding framework, which learns representations for nodes by capturing both the rich semantic correlations and attribute information simultaneously in a unified optimization framework. Our extensive experimental evaluations on real-world multi-layer networks demonstrate that the proposed framework achieves better performance compared with the state-of-the-art embedding algorithms.

Security measurement matters to every stakeholder in network security. It provides security practitioners the exact security awareness. However, most of the works are not applicable to the unknown threat. What is more, existing efforts on security metric mainly focus on the ease of certain attack from a theoretical point of view, ignoring the “likelihood of exploitation.” To help administrator have a better understanding, we analyze the behavior of attackers who exploit the zero-day vulnerabilities and predict their attack timing. Based on the prediction, we propose a method of security measurement. In detail, we compute the optimal attack timing from the perspective of attacker, using a long-term game to estimate the risk of being found and then choose the optimal timing based on the risk and profit. We design a learning strategy to model the information sharing mechanism among multiattackers and use spatial structure to model the long-term process. After calculating the Nash equilibrium for each subgame, we consider the likelihood of being attacked for each node as the security metric result. The experiment results show the efficiency of our approach.

Millions of the co-owned items, such as photos, comments etc., are uploaded to OSNs everyday. These co-owned items contain plenty of privacy information. One important information is the social relations which can be inferred from the items. When sharing these items, the owners may just want to make themselves visible alone while hiding these social relations. It leaves us a problem that making each single co-owner visible alone is acceptable, but showing them together is not allowed. To avoid the privacy leakage, we should choose proper owners to be visible to the visitor. Unfortunately, traditional access control for OSNs cannot fit this concern thus cannot provide a suitable answer. To deal with this problem, we first define the `dislike relation' and its corresponding conflicts. Then we propose a communication-intensity-based scheme to measure the social intimacies between the visitor and co-owners of the accessed item. Based on the social intimacies, we can provide a decision support when conflicts occur. Case studies and user studies are performed to illustrate the effectiveness of our proposed scheme.

In the age of big data, a traditional scanning search pattern is gradually becoming unfit for a satisfying user experience due to its lengthy computing process. In this paper, we propose a sampling-based approximate search framework called Hermes, to meet user's query demand for both accurate and efficient results. A novel metric, (ε,δ)-approximation, is presented to uniformly measure accuracy and efficiency for a big data search service, which enables Hermes to work out a feasible searching job. Based on this, we employ the bootstrapping technique to further speed up the search process. Moreover, an incremental sampling strategy is investigated to process homogeneous queries; in addition, the reuse theory of historical results is also studied for the scenario of appending data. Theoretical analyses and experiments on a real-world dataset demonstrate that Hermes is capable of producing approximate results meeting the preset query requirements with both high accuracy and efficiency.

Tor hidden Services are used to provide anonymity service to users on the Internet without disclosing the location of the servers so as to enable freedom of speech. However, existing Tor hidden services use decentralized architecture making it easier for an adversary to launch DHT-based attacks. In this paper, we present practical Eclipse attacks on Tor hidden services that allow an adversary with an extremely low cost to block arbitrary Tor hidden services. We found that the dominant cost of this attack is IP address resources. The experimental results show that we can eclipse an arbitrary hidden service with 100% success probability with only 6 IP addresses. To understand the severity of the Eclipse attack problems on Tor's hidden services, and its security implications, we present the first formal analysis to evaluate the extent of threat such vulnerabilities may cause and quantify the costs of Eclipse attacks involved in our attack via probabilistic analysis. Theoretical analysis suggests that adversaries with a modest number of IP address resources can block a large number of hidden services at any time.

Summary Regular expression matching as a core component of deep packet inspection is widely used in various kinds of modern network intrusion detection system, traffic classification system, network monitoring system, and so on. In these systems, regular expressions are typically converted to a deterministic finite automaton (DFA), which takes O(1) to scan each input character. However, DFA generally consumes a large amount of memory. This paper proposes a novel, space‐efficient and time‐efficient DFA presentation, called reduced input character set DFA (RICS‐DFA). A character escaping and replacing scheme is first introduced to decrease the size of DFA's character set and then to reduce DFA's space requirement with a series of optimization techniques. Based on transition rewriting, a RICS‐DFA constructing algorithm with time complexity of O(n) is presented in this paper. For real rule‐sets, RICS‐DFA reduces the memory consumption by 68–92%, compared with the original DFA. Finally, this paper designs a scalable RICS‐DFA matching engine on field‐programmable gate array platform in which the reduced state transition matrix is mapped to on‐chip memories. The throughput of executing deep packet inspection for real rule‐sets can achieve 7–50.5 Gbps. Copyright © 2016 John Wiley & Sons, Ltd.

With the rapid development of big data analytics, mobile computing, Internet of Things, cloud computing, and social networking, cyberspace has expanded to a cross-fused and ubiquitous space made up of human beings, things, and information. Internet applications have evolved from Web 1.0 to Web 2.0 and Web 3.0, and web information has seen an explosive growth, which is strongly promoting the advent of a global era of big data. In this ubiquitous cyberspace, traditional search engines can no longer fully satisfy the evolving needs of various types of users. Therefore, search engines must make completely innovative, revolutionary changes for the next generation of search, which is referred to as “big search”. This paper first studies the development needs of big search. Then, big search is defined, and the 5S properties (Sourcing, Sensing, Synthesizing, Solution, and Security) of big search, which are different from those of traditional search engines, are elaborated. Also, the paper provides a system architecture for big search, explores the key technologies that support the 5S properties, and describes potential application fields of big search technology. Finally, the research opportunities of big search are discussed.

Protecting critical files in file systems is very important to computer systems. To protect critical files, the VMI-based Real-time File-system Monitor tools are promising options. However, these tools are always operation-based and introduce high overhead. The operation-based approaches intercept some kind of file operation to monitor critical files. The selected file operation is intercepted by the monitor whenever it is being executed. As file operation are high-frequency, the operation-based methods always result in the high performance degradation. In this paper, we present a VMI-based low overhead real-time critical file monitor method, CFWatcher, to meet the performance requirements of real-time monitor tools. CFWatcher is a target-based monitor tool which means it only intercepts the file operations accessing the user-defined critical files, and then obtains enough information to check the rules. The overhead of CFWatcher is related to the frequency of the target being accessed. Besides monitoring critical files, CFWatcher can take actions to prevent the illegal access if there is any rule violation. We implemented the prototype of CFWatcher and then evaluated the performance. Experimental results show that the overhead of our approach is low.

In recent years, more and more internet companies trend to fuse their products with personal recommendation functions. Although the idea of this business model satisfies characteristic of Internet industry felicitously, scientists and engineers gradually find out that the effect is worse than they expected. The quality of recommendation is limited by cold start, data sparse, lack of learning contextual aware, and so on. One of the most important drawbacks of existing recommendation systems is that they usually use only rating matrix as useful information and not fully consider item attributes. In this paper, we proposed an optimized recommendation system, which based on modeling of items in a multidimensional space of item's attribute. The presented approach takes item attributes, user preferences and user context into consideration, and is mainly composed of two modules: (1) attribute-latent factor model, which is used to show user latent preference for each attribute, (2) multi-attribute model, which is used to show user preference between all attributes. The research is conducted in a practical application environment, and the preliminary experimental results show the validity of the recommendation.

This paper presents Griffin, a scheme of geometric routing on flat names to conduct massive content distribution and retrieval. A tree-based metric space T is proposed according to the concept of hierarchical division of symbol space. In Griffin, the network topology is embedded into the T-space, and content names are mapped to the T-space. Content publication and retrieval are supported by geometric routing in the T-space. Different from previous embedding schemes, Griffin constructs the T-space according to the network topology before embedding. In contrast to prior name resolution schemes, Griffin operates directly on the network topology without establishing an overlay. The correctness of Griffin is proved by the greediness of geometric routing. The experiments by simulation demonstrate that Griffin is efficient and scalable.

With increasing concern for erosion of privacy, privacy preserving and censorship-resistance techniques are becoming more and more important. Anonymous communication techniques offer an important method defending against Internet surveillance, but these techniques don't conceal themselves when used. In this paper, we propose StegoP2P, an unobservable communication system with Internet users in overlay network that relies on Innocent users' oblivious data downloading, StegoP2P works by deploying a end-to-middle proxies, which inspect special steganography flows from StegoP2P users to innocent-looking destinations and mirror them to the true destination requested by oblivious P2P users. The hidden communication is indistinguishable from normal network communications to any adversaries without a private key, hence, making the StegoP2P clients unobservable. We have developed a proof-of-concept application based on Vuze and conducted evaluations through experiments.

With the rapid growth of event-based social networks (EBSNs) like Meetup, the demand for event recommendation becomes increasingly urgent. In EBSNs, event recommendation plays a central role in recommending the most relevant events to users who are likely to participate in. Different from traditional recommendation problems, event recommendation encounters three new types of information, i.e., heterogenous online+offline social relationships, geographical features of events and implicit rating data from users. Yet combining the three types of data for offline event recommendation has not been considered. Therefore, we present a Bayesian latent factor model that can unify these data for event recommendation. Experimental results on real-world data sets show the performance of our method.

Building a trustworthy cloud is critical for its practical use. Most current researches usually take integrity measurements using trusted computing to address trust issue, such as integrity measurement architecture (IMA) implemented in Linux kernel. However, some runtime attacks intrude the system while not tampering with the programs, which cannot be detected by integrity mechanism. We call them non-tampering attacks. This paper presents TraceVirt, a framework for detecting these non-tampering attacks, which combines the strong isolation and event-driven capacity to log runtime information. The logging data is processed by remote intrusion analysis cluster to analyze potential attacks. The experimental results show that TraceVirt can detect the real world non-tampering attacks and the performance overhead is acceptable.

To study Internet's routing behavior on the granularity of Autonomous Systems (ASes), one needs to understand inter-domain routing policy. Routing policy changes over time, and may cause route oscillation, network congestion, and other problems. However, there are few works on routing policy changes and their impact on BGP's routing behaviors. In this paper, we model inter-domain routing policy as the preference to neighboring ASes, noted as neighbor preference, and propose an algorithm for quantifying routing policy changes based on neighbor preference. As a further analysis, we study the routing policy changes for the year of 2012, and find that generally an AS may experience a routing policy change for at least 20% prefixes within 6 months. An AS changes its routing policy mainly by exchanging two neighboring ASes' preference. In most cases, an AS changes a stable fraction of its prefixes' routing policy, but non-tier1 ASes may endure a large scale routing policy changing event. We also analyse the main reasons of routing policy changes, and exclude the possibilities of AS business relationship changes and topology changes.

In mobile networks, cooperative authentication is an efficient way to recognize false identities and messages. However, an attacker can track the location of cooperative mobile nodes by monitoring their communications. Moreover, mobile nodes consume their own resources when cooperating with other nodes in the process of authentication. These two factors cause selfish mobile nodes not to actively participate in authentication. In this paper, a bargaining-based game for cooperative authentication is proposed to help nodes decide whether to participate in authentication or not, and our strategy guarantees that mobile nodes participating in cooperative authentication can obtain the maximum utility, all at an acceptable cost. We obtain Nash equilibrium in static complete information games. To address the problem of nodes not knowing the utility of other nodes, incomplete information games for cooperative authentication are established. We also develop an algorithm based on incomplete information games to maximize every node's utility. The simulation results demonstrate that our strategy has the ability to guarantee authentication probability and increase the number of successful authentications.

Regular expression matching is considered important as it lies at the heart of many networking applications using deep packet inspection (DPI) techniques. For example, modern networking intrusion detection systems (NIDSs) typically accomplish regular expression matching using deterministic finite automata (DFA) algorithm. However, DFA suffers from the high memory consumption for the state blowup problem. Many algorithms have been proposed to compress the DFA memory storage space, meanwhile, they usually pay the price of low matching speed and high memory bandwidth. In this paper, we first propose an effective DFA compression algorithm by exploiting the similarity between DFA states. Then, we apply a next-state prediction strategy and present a fast DFA matching engine. Carefully designing the DFA matching circuit, we keep the prediction success rate by more than 99,5%, thus get a comparable matching speed with original DFA algorithm. On the side of memory consumption, experimental results show that with typical NIDS rule sets, our algorithm compressed the original DFA by more than 99%. Mapping this algorithm on Xilinx Virtex-7 FPGA chip, we get a throughput of more than 200Gbps.

Nowadays, the problem of Internet services accessibility has become a hot topic with more and more cyber attacks and censorship. This has prompted the rapid development of jamming-resistance infrastructure consisting of multiple dynamic access points such as proxies, anonymous communication nodes and covert communication nodes. However, the channel between user and access point has become an emerging attacking target for the adversary. Once the channel is detected and identified by the adversary, the channel will be interrupted. Though users can require new access points from the infrastructure and resume the communication to their destination, the service quality will be downgraded dramatically due to the time-consuming bootstrapping process. In this paper, a moving target framework is proposed to improve the network service accessibility, which combines both time-consuming bootstrapping and frequent and low-cost channel refreshing operations. The constant channel refreshing operations is imported to limit the adversary's ability of detecting and blocking communications, thus to make the lifespan of effective communication longer. With theoretical and simulating analysis, the optimized refreshing strategy is proposed, which can help improve service accessibility.

In MANETs, cooperative authentication, requiring cooperation of neighbor nodes, is a significant authenticate technique. However, when nodes participate in cooperation, their location may easily be tracked by misbehaving nodes, meanwhile, their resources will be consumed. These two factors lead selfish nodes reluctant participate in cooperation and decrease the probability of correct authentication. To encourage nodes to take part in cooperation, we proposed a bargaining-based dynamic game model for cooperative authentication to analyze dynamic behaviors of nodes and help nodes decide whether to participate in cooperation or not. Further, to analyze the dynamic decision-making of nodes, we discussed two situations - complete information and incomplete information, respectively. Under complete information, Sub game Perfect Nash Equilibriums are obtained to guide nodes to choose its optimal strategy to maximize its utility. In reality, nodes often do not have good knowledge about others' utility (this case is often called incomplete information). To dealt with this case, Perfect Bayesian Nash Equilibrium is established to eliminate the implausible Equilibriums. Based on the model, we designed two algorithms for complete information and incomplete information,, and the simulation results demonstrate that in our model nodes participating in cooperation will maximize their location privacy and minimize their resources consumption with ensuing the probability of correct authentication. Both of algorithms can improve the success rate of cooperative authentication and extend the network lifetime to 160%-360.6%.

ABSTRACT A base station is the controller and the data‐receiving center of a wireless sensor network. Hence, a reliable and secure base station is critical to the network. Once an attacker locates the base station, he or she can do many damages to the network. In this paper, we examine the base station location privacy problem from both the attack and defense sides. First, we present a new attack on base station: parent‐based attack scheme (PAS). PAS can locate a base station within one radio (wireless transmission) range of sensors in high‐density sensor networks. Different from existing methods, PAS determines the base station location on the basis of parent–child relationship of sensor nodes. Existing base station protection schemes cannot defend against PAS. Second, on the basis of PAS, we propose a two‐phase parent‐based attack scheme (TP‐PAS). Our simulation results demonstrate that TP‐PAS is able to determine the base station successfully in both low‐density and high‐density sensor networks. Then, to defend against PAS and TP‐PAS, we design a child‐based routing protocol and a parent‐free routing protocol for sensor networks. Our theory analysis and experiment results show that the parent‐free routing protocol has more communication cost and less end‐to‐end latency compared with the child‐based routing protocol. Copyright © 2012 John Wiley & Sons, Ltd.

As one of the most popular anonymous communication systems, Tor has become a research hotspot in this area. Recently, Tor nodes from Tor families (referred to as family nodes) have played an increasingly important role and caused significant influence on the Tor network. However, existing research about Tor mostly focuses on the entire Tor network without much consideration about the difference between family nodes and the others. In order to analyze family nodes' contribution to the entire Tor network as well as their influence, this paper distinguishes family nodes from the others, and gives an empirical analysis of family nodes based on the live Tor network data of 3 years. Results show that, family nodes compose a small but full functional subset of Tor nodes; and compared with the other Tor nodes, they can provide relatively stable and high-performance service to Tor users. Furthermore, family nodes naturally form a hot area in the Tor network, relaying increasingly high-density traffic through a small number of nodes. Compared with random node targets, selective attacks focusing on family nodes can cause serious availability downgrade of the Tor network with much lower cost.

BitTorrent (BT) is a widely-used peer-to-peer (P2P) application. Most of BT's characteristics (except the topology) have been studied extensively by measurement approaches. In this paper, we deploy a measurement system to examine some performance-related topology properties of BT. Our goal is to provide a measurement view of the real-world BT topologies and to verify the previous estimations via simulations and real-world experiments. We observe that at the steady stage, a BT topology has short distances and low clustering coefficients, and its degree-frequency exhibits a Gaussian-like distribution. These indicate that a BT network is very close to a random network rather than a scale-free network or a small world. The proportion of peers with large download percentages is very high at the steady stage, showing that the swarm is robust from the resource perspective. We also find out that most high-degree peers have a very fast download speed. However, the low Spearman's rank correlation coefficient indicates that there is no strong correlation between the peer connection degree and the download speed. Different from previous results, we find that the diameter of a BT network at the initial stage is small even when 95% of peers use the peer exchange extension.

Nowadays, most of research on botnet survivability only focuses on the advanced design of downstream (from botmasters to bots, used to deliver commands) command and control (C&C) channel. However, the upstream (from bots to botmasters, used to upload the collected data on victims) C&C channel remains vulnerable and low-efficiency in most of botnets to this day. To address the problem, we propose a C&C channel division scheme and then establish a Botnet Triple-Channel Model (BTM). BTM divides a traditional C&C channel into three independent sub-channels, denoting as Command Download Channel (CDC), Registration Channel (RC) and Data Upload Channel (DUC), respectively. To illuminate the feasibility and advantages, we implement a BTM botnet prototype which exploits URL Flux for CDC, Domain-flux for RC, and introduces a new approach (Cloud-based File Hosting and URL Shortening Services) for DUC. Compared with current botnets, the proposed BTM botnet will promise to be as robust as P2P botnets and as efficient as centralized botnets. The ultimate goal of our work is to increase the understanding of advanced botnets which will promote the development of more efficient countermeasures.

Due to the unattended operation nature, nodes in Unattended Wireless Sensor Networks (UWSNs) are susceptible to physical attacks. Once a sensor is compromised, the adversary will be able to learn all its secrets. While some previous works tried to address the node self-healing issue in UWSNs, little effort has been devoted to ensure the sustainability of node self-healing. In this paper, we present a novel sustainable node self-healing protocol for UWSNs. We generate unpredictable random data for key update and thus the node self-healing capability doesn't decrease when the number of attack rounds increases. We show both analytically and through simulation experiments that our protocol provides efficient and sustainable node self-healing capabilities with small overheads.

BitTorrent (BT) is one of the most popular Peer-to-Peer (P2P) network applications. Most characteristics (except the topology) of BT network have been examined extensively by measurement approaches. In this work, we deploy a measurement system to study the performance-related properties of BT topologies. We also use our measurement system to verify some previous simulation and experiment results obtained by other researchers. Different from previous results, we observe that a BT swarm has short distance, low clustering coefficient and Gaussian-like degree-frequency distribution. This indicates that a BT swarm is very close to a random network rather than a scale-free network or a small world. We observe that the diameter of a BT network at the initial stage is small even when 95% of peers use the peer exchange extension but the networks are not fully connected at the steady stages.

A base station (BS) is the controller and the data receiving center of a wireless sensor network. Hence, a reliable and secure BS is critical to the network. Once an attacker locates the BS, he can do a lot of damages to the network. In this paper, we study the BS location protection issue. First, we present a new attack on BS: the Parent-based Attack Scheme (PAS). The PAS can locate a BS within one radio (wireless transmission) range of sensors. Different from existing methods, the PAS determines the BS location based on parent-child relationship of sensor nodes. The PAS cannot be defended by existing BS protection schemes. To defend against the PAS, we design a new parent-free (PF) secure routing protocol for sensor networks. Our simulation results show that the PF protocol has small communication and computation costs, while ensuring the security of the BS.

BitTorrent (BT) is a well-known Peer-to-Peer (P2P) downloading protocol and has been implemented in several versions. New features and extensions used to improve performance of BitTorrent systems also bring some security issues. In this paper, we analyze potential DDoS vulnerabilities of BT and its Peer Exchange extension. We show the ways of launching connection-exhausted DDoS attacks. Our experiments demonstrate these attacks are persistent and incur few costs for the attacker. By analyzing the main causes we find that both the defect of implement and the lack of trust and authentication mechanism are to blame, while the latter is critical. To defend against the DDoS attacks, we propose a score-based peer Reputation Exchange (REX) mechanism. Using REX, the score of a malicious peer is less than that of a good peer after several iterations, hence has less chance to be connected. REX makes it difficult to launch a DDoS attack and it can effectively mitigate the effect of the attack.

The cache replacement policy is the key factor affecting the performance of the ISP merged Content Delivery Networks. Current cache replacement schemes only consider the frequency and locality as the basis of replacement. However, we argue the access interval change rate is more valuable in predicting the new objects arrival through analyzing the real network logs. Considering this new metric, we propose a novel cache replacement algorithm based on access density. Using this novel method, the cache can achieve higher hit rate. Experiments with real network data show that our method improves 3% to 5% hit rate than the typical cache schemes and ISP can reduce 3% to 7% network traffic.

ABSTRACT Anonymous communication is very important for many wireless sensor networks, because it can be used to hide the identity of important nodes, such as the base station and a source node. In sensor networks, anonymous communication includes several important aspects, such as source anonymity, communication relationship anonymity, and base station anonymity. Existing sensor network anonymous schemes either cannot achieve all the anonymities or have large computation, storage, and communication overheads. In this paper, we propose an efficient anonymous communication protocol for sensor networks that can achieve all the anonymities while having small overheads on computation, storage, and communication. We compare our anonymous communication protocol with several existing schemes, and the results show that our protocol provides strong anonymity protection and has low overheads. Copyright © 2011 John Wiley & Sons, Ltd.

Xunlei is a P2P file sharing application that is popular in China. The performance of previous P2P applications is limited by the selfishness of peers and the widely use of firewall. Xunlei applies implicit uploading strategy and firewall bypassing technologies to conquer above drawbacks. To evaluate the effects of above solutions, we perform a series of measurements on Xunlei and BitTorrent networks. Our study provides three new findings by comparing the situation in the two networks. (1)Compared with the free control strategy in BitTorrent, the implicit uploading strategy improves not only the number of active peers but also the seed ratio. Benefit from the strategy, Xunlei has much better downloading performance in our measurement. (2)The strategy extends the seed service time that is related to swarm lifespan. According to our result, Xunlei swarm lives longer than BitTorrent one. (3)The connectivity influences the performance greatly. The result of our measurement shows that only 5% peers can be connected directly. Our theoretical analysis and measurement results show that better connectivity also leads to higher downloading speed and longer lifespan.

Anonymous communication is a challenging task in resource constrained wireless sensor networks (WSN). However, anonymity is important for many sensor networks, in which we want to conceal the location and identify of important nodes (such as source nodes and base stations) from attackers. Existing WSN anonymous protocols either cannot achieve complete anonymity, or have large computation and/or storage overheads. In this paper, we present an efficient anonymous communication protocol for sensor networks. Our protocol can achieve sender/source anonymity, communication -relationship anonymity, and the base station anonymity simultaneously, while having small overheads on computation, storage and communication.

Although peer-to-peer system is scalable for content distribution, its lifespan is shorter than traditional systems. More and more researchers pay close attention to swarm lifespan and propose specialized methods to extend it. Bundling technique and SRE (Share Ratio Enforcement) mechanism in Private Tracker system are two successful enhancements which are proved by practical systems. However, they have side effects to system users. One of the reason is that the enhancements do not take effect on the key factors. So there is a question, what factors influence lifespan? A model which can answer this question is needed to help system designers. Facing the challenges, we measure a popular BitTorrent system with a macro view which is different from previous works. Based on our measurement, we model the long term evolution to find out factors that influence swarm lifespan. In order to unveil the trend of a swarm, we propose a half-life based metric. According to the metric, our model fits the real swarms more closely. By the help of our model, we analyze the strengths and shortcomings of bundling technique and SRE incentives.

Xunlei [1] is a new P2P content distribution system which is popular in China. It composes traditional HTTP/FTP downloading and P2P content distribution features which attract many people including researchers. Xunlei's network is Bit Torrent-like and the measurement is more difficult than other P2P networks [2]. There are many constrains on Xunlei tracker, so we can not obtain information from tracker easily. Besides this, the measurement will encounter some challenges that skew the results. Most of previous works on Bit Torrent system are based on tracker logs. However, we can not obtain tracker logs of Xunlei. As far as we know, there is no proposal about precise and detailed measurement method that probes the network directly in this area. Face to the challenges, we analyze the constrains that appear in most Bit Torrent-like systems and propose a stratified random selection model to describe the behavior of tracker. Based on the model, we design a measurement tool called XunleiProbe. With the help of our solutions that increase the accuracy of our results, we measure a popular swarm for about 22 hours. The results show that the average peer coverage of our tool can reach about 93%.

Short term traffic speed prediction is very important in intelligent transportation systems. Neural networks have been widely used for traffic speed prediction. However, the classical neural network usually lacks satisfactory generalization ability, which usually results in an imprecise prediction of traffic speed. Regularization is an essential technique to improve the generalization ability of neural network. Regularization is realized by adding a weight decay function to the energy function of the neural network. One of the key problems of the regularization technique is how to decide the parameter of the weight decay function. In this paper, the Bayesian technique is used to optimize these regularization parameters and a Bayesian regularized neural network (BRNN) used for traffic speed prediction is proposed. The speed prediction model was validated by the real-world traffic speeds of the Hangzhou city collected from the floating car system. The experimental results show that the proposed method is able to improve the generalization ability of neural networks, and can achieve better prediction results than several traditional prediction models.

The folksonomies built from the large-scale social annotations made by collaborating users are perfect data sources for bootstrapping Semantic Web applications. In this paper, we develop an ontology induction approach to harvest the emergent semantics from the folksonomies. We propose a latent subsumption hierarchy model to uncover the implicit structure of tag space and develop our ontology induction approach on basis of this model. We identify tag subsumptions with a set-theoretical approach and model the tag space as a tag subsumption graph. While turning this graph into a concept hierarchy, we address the problem of inconsistent subsumptions and propose a random walk based tag generality ranking procedure to settle it. We propose an agglomerative hierarchical clustering algorithm utilizing the result of tag generality ranking to generate the concept hierarchy. We conduct experiments on the Delicious dataset. The results of both qualitative and quantitative evaluation demonstrate the effectiveness of the proposed approach.

A pseudo-random sequence generator (PRNG), L12RC4, inspired by the LZSS compression algorithm and RC4 stream cipher, was presented and implemented. The result of the NIST and Diehard test suite indicate that the L12RC4 is a good PRNG, and so it seems to be sound and may be suitable for use in some cryptographic applications. We also found that the probability distribution of the index value frequency is associated with the compression pass and INDEX_BIT_COUNT value. As for one pass mode, the greater INDEX_BIT_COUNT value, the more uniformly distributed, and the double pass mode has better uniformity than the one pass mode.

In this paper, we studied the block LZSS algorithm and investigated the relationship between the compression ratio of block LZSS and the value of index or length. We found that as the block size increases, the compression ratio becomes better. We also found that the bit of length has little effect on the compression performance, and the bit of index has a significant effect on the compression ratio. We showed that the more the bit of index is set, the bigger optimal block size is obtained.

Distributed Web crawling (DWC) over DHTs is proposed to solve the bottlenecks in the traditional Web crawling. The core of this kind of system is its fully distributed task scheduling mechanism in which the crawlers are treated as peers and the crawlees are treated as resources maintained by the peers. A system model based on the content addressable network (CAN) can further optimize the scheduling mechanism by exploiting the network proximity of the crawlers and the crawlees. In this paper, we propose a new method for CAN in order to achieve load balancing in the CAN-based DWC system. The method not only keeps the load balancing among peers but also keeps the distance between peers and resources very short in our simulations. The shortened peer-resource distance fulfills the need of shortening crawler-crawlee latencies.

Traceroute-like method is of foundation for inferring forward IP paths that in succession are often used for generating different level Internet topologies. Based on Paris traceroute method of avoiding traceroute anomalies, this paper examines the practical feasibility of inferring forward IP paths by sending mixed TCP packets with other control bit(s) instead of SYN to a set of well-known Web sites. We also provide two kinds of novel evaluation metrics to evaluate the effectiveness of probe methods. Finally, we present a novel kind of methods termed as hybrid TCP probe method, for inferring forward IP paths. We hope this case study broadening ways of forward IP path inference.

Spam fighting is a classic puzzle in network security. In the past decades, many filtering spam solutions have been proposed. However, currently the conventional techniques still suffer from high false positives and false negatives, especially the former which usually cannot be accepted by the end users. This paper proposes a novel online URL-based spam filter (UBSF) on the basis of analyses over the conventional especially the URL-based anti-spam techniques. UBSF identifies spam by comparing the similarity of the extracted URLs (universal resource locator) from them with the URLs from our user-oriented standard URL Library (SUL). Experimental evaluations both from the contrast experiment and the prototype based on UBSF demonstrate it can significantly raise the filtering accuracy, effectively reduce false positives and can be applied to online process and heavy traffic environment by reducing the computational cost than the state-of-the-art techniques.

In this paper we present a universal compression algorithm for English text, ERecode. The proposed scheme highlights the importance of pre-processing work for English text, and employs one or two bytes code values to recode the 511 most common used English words, sequences of symbols and ASCII codes based on their occurrence frequency. Acting as a pre-processing tool for English text by the popular compression utilities, ERecode can improve their compression ratio from 0.89% to 19.65%. The proposed method also is applicable to text files for other languages.

In order to prevent network bandwidth being uncontrolled occupied, various network traffic must be identified and then applied to responding controlling policy. To achieve this, this paper proposed a framework for network traffic identification. This framework uses the plug-in mechanism to manage the identification process. Since each plug-in can work independently, plug-ins can be easily updated or added so as to adapt the changing of applications or appearance of new applications. This paper also proposed priority based mechanism and competition based mechanism in the scheduling to eliminate redundant processing. The experimental results show that this framework is scalable and high efficient. It can provide effective management support for current high-speed network.

For protection of the confidentiality and integrity of the mobile codes, this paper proposes a new decentralized label model and a implementation of this model in Linux system, MCGuard. Using MCGuard, the owners can flexibly define their security policies to control the dissemination of their mobile codes just by labelling them. By intercepting system calls, MCGuard inserts an interposition layer between the processes and system calls to control the data flows of mobile codes and guarantee them not to be transmitted to insecure channels and manipulated by malicious principals. In MCGuard, the labelling and control of the mobile codes and their transmitting channels is performed at the level of standard operating system abstractions, and the labels can migrate between hosts. This makes the MCGuard applicable in mobile code systems composed of the stock Linux OS and existing mobile codes.

Most template detection methods process web pages in batches that a newly crawled page can not be processed until enough pages have been collected. This results in large storage consumption and a huge delay of data refreshing. In this paper, we present an incremental framework to detect templates in which a page is processed as soon as it has been crawled. In this framework, we don't need to cache any web page. Experiments show that our framework consumes less than 7% storage than traditional methods. And also the speed of data refreshing is accelerated because of the incremental manner.

Intrusion detection is a critical component of secure information systems. Network anomaly detection has been an active and difficult research topic in the field of Intrusion Detection for many years. However, it still has some problems unresolved. They include high false alarm rate, difficulties in obtaining exactly clean data for the modeling of normal patterns and the deterioration of detection rate because of some "noisy" data in the training set. In this paper, we propose a novel network anomaly detection method based on improved TCM-KNN (Transductive Confidence Machines for K-Nearest Neighbors) machine learning algorithm. A series of experimental results on the well-known KDD Cup 1999 dataset demonstrate it can effectively detect anomalies with high true positive rate, low false positive rate and high confidence than the state-of-the-art anomaly detection methods. In addition, even interfered by "noisy" data (unclean data), the proposed method is robust and effective. Moreover, it still retains good detection performance after employing feature selection aiming at avoiding the "curse of dimensionality".

This paper presents our preliminary work in network anomaly detection. The experimental results demonstrate an inspiring and promising trend for lightweight on-line network anomaly detection, which is rather meaningful for the ever-increasing network traffic and the accompanied network threats. In our future work, we will further verify and optimize our methods in terms of the concrete applications, as well as deploying it in our national backbone network to detect anomalies such as DoS, DDoS, probe, spam, etc.

With the increase of network bandwidth, high performance protocol processing plays more and more important role in high speed network security. Recent studies show that current computer architecture advances and CPU performance improvements have limited impact on network protocol processing performance. Some studies find that in real SMT processor like Intel Xeon processor with hyper-threadings, the sharing resources (like cache) contention between threads can hurt the processing performance of network applications like servers or IDS. How to make protocol processing cope with the advances in computer architecture has been widely studied. In this paper, we put our focus on the processing performance of TCP automata phases, using execution based simulations to model the relationship between each phase performance and cache size, and then measuring the cache contention between threads. We find (1) the load/store units can be the bottleneck of protocol processing; and (2) in connection establishing phase of TCP processing, cache contention between threads is more aggressive than any other phase. We also suggest a FSM decomposition based parallel processing approach to use sharing cache of SMT processors effectively.

Current increase in network bandwidth raised an aggressive challenge in network security, and stateful packet inspection based security systems is playing a more and more important role. Recent advances in scheduling theory show that it is possible to reduce the expected mean response time of a queuing system, simply by changing the order in which we schedule the requests according to the job size, which is so called size-based scheduling policy. In this paper, we start by an analysis of connection sojourn time distribution of network traffic. Based on this analysis, first we design a two level session table in order to avoid session table explosion. Then we propose a connection scheduling policy in stateful packet inspection systems called LASF (Least Attained Sojourn First). We show that our policy can improve mean response time and flow throughput especially when system is overloaded. Finally we assess the costs of LASF in terms of unfairness.

In the long term usage of the network, users will form certain types of habit according to their specific characteristics, individual hobbies and given restrictions. On the burst-out of worms, the overwhelming flow caused by worm's scanning will temporarily alter the behavior representation of users. Therefore, it is reasonable to conclude that the statistics and classification of user habits can contribute to the detection of worms. We observe that number of destinations accessed in a long time range by a user is approximately limited, it means possible to record the access habit of users. Based on the analysis of both users and worms, we construct the patterns of user-habit and propose a new approach for the early warning of worms. And a better quarantine strategy is proposed to insure the normal access of user.

We propose an unsupervised spam filter called Bulk Mail Traffic Classification (BMTC) for filtering junk mails from the perspective of ISPs. Our insight is that spammers generally sent mass unsolicited emails with few alterations to a common message content, which can be found at an extensive traffic environment. In our approach, we classify email delivery traffic into different categories by the similarity of message contents. Then we can decide whether or not a particular email category is spam by the number of similar mails of this category and take measures to filter it. We also design a simulator, two sketches data structure, and a series of algorithms to support our method. We have applied BMTC to email traffic data captured at one of the largest commercial Internet service providers in China, and the experimental result indicates that a 70.4% reduction of emails can be achieved with our method. The results also show that BMTC is practical. We can implement it in a high-volume traffic environment handling over millions of mails every day with small memory consumption.

Tremendous increases in spam traffic have made an imperative to develop effective techniques that can filter Internet spam traffic for using in network operation and security management. In this paper, we propose a more effective scheme called improved bulk mail traffic classification (IBMTC) for filtering spam from bulk delivery E-mails traffic. Based on our earlier designed scheme, we further address some issues related to spam attack and running performance. We also develop a series of more effective techniques to support our method. We have applied IBMTC to the E-mail traffic data captured at one of the largest commercial Internet service providers in China, and the experimental result indicates that the new scheme is more effective and can further improve the performance of filter

Spam prevention is a classic puzzle in the research area of network security. The conventional spam filtering techniques still result to high false positives and have weak on-line processing ability. This paper presents a novel two-tier spam filter (TTSF) on the basis of analyses over the conventional anti-spam techniques. TTSF on-line filters spam by using URLs and off-line filters spam using digest-based approach. Experimental evaluations from the constructed prototype based on TTSF demonstrate it can significantly raise the filtering accuracy, effectively reduce false positives and can be applied to on-line processing and heavy traffic environment by reducing the computational cost than the state-of-the-art techniques

Worms have seriously harmed computer and network systems due to their rapid spread rate. Therefore, it is necessary to research automatic worm detection systems in large networks. In this paper, data stream based anomaly detection is used to screen out anomalous network data flow, subsequently, the signature is extracted. After analyzed, the signature is updated to the misuse detection pattern. Based on an automatic worm defense, a system could discover an epidemic situation effectively and detect an unknown worm.

Quality of Service (QoS) has now become a central issue in network design and application. This article describes a distributed architecture for linking geographically distributed network performance measurement and evaluation system (NPMES) based on in-depth research on the key techniques of network QoS. The prototype implementation of NPMES and the performance evaluation criteria based on performance aggregation are carefully introduced. Our contribution is presenting a new performance evaluation criteria based on performance aggregation to access QoS. Experiment results indicate the scalable NPMES can do the real-time detection on network performance of ISPs from the end user’s perspective. The performance aggregation approach is a bran-new idea, and of a definite practicability.

Nowadays, worms have been one of the leading threats to information security and service availability. Current operational practices have not been able to manage the threat effectively. So it is very important to make early warning of the burst of worm in large scale network. In this paper we analyze the real network traffic in large scale network. Based on long time statistic, we construct a network traffic model which concern two parameters: the traffic volume and curve of traffic function. And then we propose a method to computer the function curve of normal traffic function in ideal condition. We deployed them in our campus network (more than 20000 computers, 400M/s bandwidth to internet).It is shown that the worms are detected automatically and efficiently.

Scientists and engineers are faced with more and more out-of-core problems which involve solving large amounts of data. The Grid infrastructure is a large-scale distributed software system that provides a wide and scalable environment for out-of-core computations. This paper constructs a framework of out-of-core computation service on Grids. To provide the users an easy and efficient out-of-core computing interface on computational Grids, a user-level middleware upon the Globus platform is described, which is implemented by adopting the Grid portal technique and the message passing programming model as well as template classes.

Summary form only given. Multisite resource selection and task scheduling is paid more and more attention under the grid environment nowadays with the emergence of high speed WAN. Especially in a distributed computational grid, multisite resource selection and scheduling can significantly reduce the average execution time of grand applications with a limited demand in communication. Therefore we present a CGRS resource selection algorithm based on a new density-based grid resource-clustering algorithm, and implement it in our scalable environment. The analysis and experimental results show the correctness and effectiveness of our resource selection algorithm.

Flash crowd events (FCEs) and malicious traffic including DDoS and worm attacks present a real threat to the stability of Web services. In this paper, we design a practical defense system that can provide some needed relief from the two types of events and protect the availability of Web services. A novel method of dynamic bandwidth arbitration using Generalized Vickrey auction based on microeconomics is proposed. By adopting this approach, not only the availability of Web services is improved but also the total utility of users can be maximized. Initial simulations have shown that this mechanism is promising direction to control both FCEs and malicious traffic. The presentation in this paper is a first step towards a more rigorous evaluation.