While Large Language Models (LLMs) are safeguarded by strict alignment protocols, current defense mechanisms primarily focus on detecting malicious intent within the explicit text of a prompt. In this paper, we target the "Context-Content Gap," a critical vulnerability where LLMs reject harmful instructions in isolation yet readily divulge identical operational procedures when embedded within benign, dual-use scenarios (e.g., emergency rescue). To systematically exploit this gap, we propose DUA(Dual-Use Attack), a Two-Stage Decoupled Framework that automates the jailbreak process. Unlike optimization-based baselines that necessitate computationally expensive iterative feedback, DUA operates via a non-iterative, deterministic workflow: (1) Intent Disguise coupled with Hybrid Strategy Filtering generates and selects the optimal benign scenario to bypass intent detection, and (2) Malicious Reconstruction decouples the harmful logic from the benign response to restore the prohibited intent. Extensive evaluations on six state-of-the-art LLMs—including GPT-4o, DeepSeek-V3, and Qwen3-80B— demonstrate that DUA achieves a state-of-the-art Attack Success Rate (ASR) of 95.0%. Crucially, DUA eliminates the need for multi-turn optimization, strictly limiting the attack overhead to a fixed budget of two queries.

Packet classification underpins critical network functions such as access control and quality of service. While decision tree-based approaches offer efficiency and scalability, their classification performance is often bottlenecked by excessive memory accesses during tree traversal-primarily due to the use of pointer-based indexing structures necessitated by large node sizes. This paper proposes a general pointer-elimination paradigm via Extreme Node Compression (ENC). This enables indexing structures to store nodes directly rather than pointers, thereby eliminating one memory indirection per level and nearly halving the number of memory accesses per lookup. To validate this core idea, this paper designs TupleTree-Compress based on state-of-the-art hash-based decision tree scheme-TupleTree. TupleTree-Compress integrates three key techniques-a unified global hash table, fingerprint-based keys, and hash-based sibling linking-to achieve full node compression while preserving correctness and update support. Furthermore, to demonstrate the generality of our approach, we apply the same optimization paradigm to state-of-the-art classical decision tree scheme-CutSplit, resulting in CutSplit-Compress. Experimental results show that TupleTree-Compress achieves speedups of 2.24x-3.12x over TupleTree and 1.43x-1.91x over DBTable-the current best-performing scheme. Similarly, CutSplit-Compress achieves speedups of 3.19x-3.64x over CutSplit, with improvements up to 1.58x over DBTable. Our work demonstrates that aggressive node compression is a powerful and generalizable strategy for boosting packet classification performance, offering a promising direction for optimizing decision tree-based schemes.

Regular expression matching is a crucial step in traffic analysis. Many hardware-based architectures are proposed to improve the matching throughput, such as FPGA. To date, however, the existing FPGA-CPU architectures are difficult to implement in DPI systems due to the following two reasons. First, existing architectures use asynchronous workflows to interact data between FPGA and CPU, making them difficult to be compatible with synchronous DPI systems. Second, asynchronous architectures require batch input, which does not meet the requirements of real-time environments. In this paper, we concentrate on the real-time deployment of a regular expression matching architecture. To improve the deployment throughput, we propose an FPGA-CPU architecture with a parallel layer between the driver and DPI systems. Then, coroutines are introduced and proved to have significant advantages. Meanwhile, some optimization methods are proposed to address idle time, memory allocation, and MMIO control. Our experiments demonstrate that directly deploying an asynchronous architecture on a synchronous DPI would result in a throughput degradation of 3 orders of magnitude. Our approach enhances throughput by 2-3 orders of magnitude. This indicates that we reach a throughput in synchronous mode that is comparable to that in asynchronous mode, and it is over 10 times faster than the software solution, making the direct deployment of asynchronous architectures on mainstream DPI systems feasible. To the best of our knowledge, this is the first attempt to improve hardware-based regular expression matching under synchronous logic, achieving both high throughput and usability.

Network traffic research relies on large-scale, high-quality traffic data. However, obtaining such data remains difficult because of privacy constraints, collection costs, class imbalance, and continuous updates. These challenges have increased researchers' interest in traffic generation. Although many generation methods have been proposed, existing studies and surveys often overlook two key questions: what form of traffic is generated and what practical objectives it can support. Based on 113 candidate records published from 2019 to 2026, this survey provides a detailed analysis of 39 representative network traffic generation studies through the lenses of representation levels and objective consistency. We organize existing methods into four representation levels and analyze how generated data relate to usage scenarios. We find that many methods preserve information that is useful for downstream tasks such as classification and intrusion detection, but task usefulness does not guarantee replayability or usability in real network environments. High-level representations are easier to model, yet they often discard protocol semantics, packet dependencies, and communication logic. We therefore distinguish task consistency from protocol consistency and show that the latter remains underexplored. We further summarize evaluation practices, discuss level-specific metrics, and highlight future directions including controllable generation, protocol-aware state-consistent synthesis, and engineering-oriented evaluation.

Encrypted traffic classification is widely used for security monitoring and network management, yet most recent works still rely on an unrealistic assumption: an isolated flow or session always maps to a single label. In tunnel-world deployments (e.g., VPN- or Tor-like settings), this assumption often breaks. Multiple concurrent activities are multiplexed into one channel, and a tunnel connection may contain several network behaviors and substantial non-target interference. This paper advocates a shift from classification to presence detection: instead of assigning one label to a tunnel connection, the goal is to detect which monitored traffic types are present.We proposed Detect What Traffic Needs (DWTN), a unified single-model framework for multiplexed encrypted traffic detection. DWTN uses a shared feature extractor to encode a mixed flow into a channelized representation, and derives a label-specific Channel Modulation vector from pure single-label samples. Channel Modulation selectively activates or suppresses channels to construct label-specific representations from the original features. Using a shared classification head to identify all the label-specific representations changes multi-target detection to parallel binary detection, and can support low-cost onboarding of new targets without retraining the full model.Experiments on synthesized closed-world and open-world mixtures with different numbers of concurrent flows show that DWTN consistently outperforms strong baselines, improving open-world AUC by up to 13.0% and P @k by up to 15.8%, and improving detection mAP by up to 53.0% under target-extension scenarios.

In recent years, AI-driven network traffic analysis has achieved a series of research results and demonstrated significant advantages. Existing network traffic analysis solutions usually take the acquisition or preservation of complete traffic data as their prerequisite, which is still challenging within the current network transmission model. It is foreseeable that incomplete traffic data will have a significant impact on their performance when these solutions are considered for deployment or application in real network environments. After investigating 55 of the latest network traffic analysis studies from seven representative conferences over the past five years, we found that only 10 of them had concerns about the impact of data incompleteness, indicating that this practical issue has not been emphasized in current research. To bridge the gap between theoretical advancements and practical deployment constraints, fostering awareness and innovation in handling incomplete traffic data, this paper surveys studies in the field of network traffic analysis that dealt with data incompleteness, including but not limited to the ones identified in our initial analysis about the seven representative conferences. In this paper, we analyze existing research from the following four perspectives: packet loss scenarios, packet loss mitigation methods, feature representations, and evaluation metrics. Specifically, packet loss scenarios are categorized into three distinct types: network performance management, network measurement, and traffic classification. For packet loss mitigation methods, we examine five primary approaches: packet loss recovery, packet loss prediction, data augmentation, classifier integration, and robust feature representation. The discussion of feature representations focuses on three levels of granularity: packet level, flow level, and other specialized data structures. Finally, evaluation metrics are analyzed across three dimensions: data recovery metrics, imputation error metrics, and traffic classification metrics. This review not only highlights the critical research gap in handling incomplete traffic data but also provides a structured framework for future studies.

Packet classification is fundamental to various network functions such as access control and intrusion detection. While FPGAs offer high-throughput processing, existing designs suffer from two major challenges: limited scalability due to constrained on-chip memory, and poor flexibility as switching between diverse rule-sets often requires costly hardware reconfiguration.To address these challenges, we propose a novel decision tree scheme, AdaptTree, a practical FPGA-based packet classifier that significantly improves memory efficiency and architectural flexibility. To enhance scalability, AdaptTree adopts a hashing-based indexing scheme that eliminates pointer storage in inner nodes, reducing memory overhead. In addition, a novel skewed kicking strategy concentrates most rules into first few trees, mitigating memory fragmentation across multiple trees. To enable flexibility, AdaptTree incorporates a novel pipelined hardware architecture inspired by the concept of “empty operation”, allowing uniform storage of nodes and rules across pipeline stages. This design supports diverse rule-set mappings without requiring hardware reconfiguration.Evaluations show that AdaptTree achieves over 290 MPPS throughput, classifies 100 K -scale rule-sets using only 4.5 MB of on-chip memory, and supports fast rule updates and ruleset switching without compromising deterministic latency and ordered output-offering a scalable and flexible solution for realworld deployment.

Passwords have been widely used for authentication, yet they face significant security risks due to the progress of modern targeted guessing attack methods. Understanding the risks of targeted password guessing is crucial for improving the security of many critical network systems. While current approaches can effectively utilize specific leaked data, they typically treat these sources in isolation. Failing to account for the combined effects of heterogeneous user-specific information and population-level password priors can lead to an underestimation of password vulnerability, highlighting the need for a more comprehensive targeted guessing framework. To this end, we propose MDIGuess, an autoregressive neural framework for targeted password guessing with explicit multi-dimensional information utilization. MDIGuess organizes exploitable information into three dimensions: historical passwords, personally identifiable information (PII), and general leaked-password data. Historical passwords capture reuse and modification behaviors, PII provides user-specific lexical cues, and general leaked passwords provide population-level priors through popular-list integration and autoregressive pre-training. Extensive experiments on eight attack scenarios built from nine large-scale password datasets show that MDIGuess achieves an average cracking success rate of 36.86% within 1,000 guesses, improving by 43.64% on average over four state-of-the-art targeted guessing baselines. Furthermore, analyses on representative scenarios show that targeted popular-list integration and autoregressive pre-training can further improve guessing performance, with additional Top-1,000 gains of 0.87%–1.39%. A PII-rich scenario also confirms that non-email attributes such as username, name, and birthday can provide useful personalized signals. Finally, we develop MDI-PSM, an attack-aware password strength meter that better reflects targeted guessing risks by incorporating multi-dimensional targeted-risk signals. These results provide a more realistic basis for evaluating password vulnerability under targeted guessing attacks.

Large Language Models (LLMs) are increasingly vulnerable to sophisticated jailbreaking attacks. Conventional defense mechanisms, such as single-pass filtering and preset refusal, often fail to provide robust protection against nuanced adversarial prompts while also degrading user experience. Motivated by the concept of LLM self-defense and representation-level analysis, we propose the Iterative Safety Defense Pipeline (ISDP) to enhance both the robustness and usability of LLMs. ISDP employs a dual-model architecture decoupling content generation from security analysis. Unlike conventional single-pass filtering, ISDP introduces a conditional iterative refinement mechanism driven by intent recognition to effectively enhance detection accuracy. The guard model first distinguishes underlying malice from superficial adversarial noise; subsequently, a purification cycle is triggered only upon detecting harm or contamination to neutralize threats and strip noise for restored usability, while safe responses are passed directly to minimize latency. Experimental evaluation across three open-source LLMs (Llama2, Mistral, Qwen2.5) demonstrates that ISDP achieves an average true positive rate (TPR) of 95.5% for harmful prompts and reduces the false positive rate (FPR) to 5.5% for benign prompts. With an additional average latency of only 2.95s, ISDP offers an efficient, reliable, and user-friendly framework for secure LLM deployment.

Abstract The HTTPS certificate ecosystem has long been a key topic in cybersecurity, yet the certificate landscape of Android applications remains insufficiently studied. In particular, while China has actively promoted the adoption of China’s national cryptographic algorithms in recent years, their actual deployment within the Chinese Android certificate ecosystem remains unclear. In this study, we analyzed TLS traffic from 19,980 applications in the Huawei App Market and extracted 131,933 certificate chains. While most certificates are properly configured, we identified 530 certificates with security risks, affecting 2043 applications. Notably, three SDK-related risk certificates were propagated across 1462 applications, substantially widening their security impact. Only 94 certificates using China’s national cryptographic algorithms were found, all within 89 financial applications, indicating deployment driven mainly by regulatory compliance. Furthermore, nearly 99% of leaf certificates chain back to foreign root Certificate Authorities, underscoring a strong dependency that may pose digital sovereignty risks under geopolitical uncertainty. This study highlights the existing challenges in the Chinese Android certificate ecosystem, particularly in terms of security and digital sovereignty, and offers relevant recommendations for improvement.

The Transport Layer Security (TLS) protocol has become the de-facto security standard for Internet communications. While its widespread deployment protects user privacy, it also provides threat actors with a channel to evade network inspection. As a widely adopted AEAD algorithm in TLS, AES-GCM couples encryption and authentication functions into a single key, creating an "all-or-nothing" authority dilemma. This paper presents AES-iGCM, an inspectable AES-GCM variant that splits the encryption and authentication keys to grant fine-grained read-only access. An authorized inspector receives only the decryption key, so it can read plaintext and detect malware, yet lacks the authentication key to modify data or forge valid tags, preserving end-to-end confidentiality and integrity while enabling compliant network oversight. This paper formally defines the AES-iGCM algorithm and discusses its integration scheme in the TLS protocol, and proves its practicality through performance evaluation.

Web vulnerabilities represent critical attack vectors, yet rapid CVE growth has outpaced manual validation capabilities. Existing automated approaches—template-based systems, direct LLM prompting, and standard RAG—suffer from knowledge staleness, hallucinations, and semantic retrieval limitations when addressing emerging vulnerabilities with complex dependencies. We present KAWVE (Knowledge-Augmented Web Vulnerability Exploit), a DeepSeek-powered framework integrating structured domain knowledge with autonomous reasoning for automated vulnerability validation. The system features three core innovations: (1) a multi-source vulnerability knowledge graph from NVD, Exploit-DB, and GitHub that captures vulnerability entities and exploitation dependencies; (2) a ReAct-based generation agent executing iterative "query-detect-generate-execute" cycles with dynamic self-correction through environment feedback; and (3) a comprehensive validation engine employing vulnerability-type-specific strategies (HTTP response analysis, out-of-band detection, system monitoring) with LLM-powered evidence interpretation. Evaluation on 30 high-severity web CVEs from the past five years (spanning SSRF, path traversal, SQL injection, and RCE) demonstrates 100% validation success, substantially outperforming vanilla DeepSeek (3.3%) and DeepSeek with ReAct (13.3%). For SSRF vulnerabilities, KAWVE achieved 100% success versus SSRFMap’s 40%, validating the efficacy of coupling structured vulnerability knowledge with agent-based reasoning for reliable automated vulnerability assessment.

In digital forensics practice, the precise determination of file fragment types serves as an essential prerequisite for successful file carving. Recent advancements in neural network-based methods have shown promise in this area, though challenges remain regarding temporal pattern capture in byte data and feature representation scalability within individual architectures. We propose ByteGT, the first hybrid neural network that integrates sequential modeling and attention mechanisms to further enhance the classification performance for file fragments. The model operates end-to-end on raw byte data without manual preprocessing through two novel components. The first component is a deep sequence perception module combining byte embeddings with bidirectional GRU to capture comprehensive temporal dependencies, and the second component is a fine-grained feature enhancement module using convolution-based attention layers to amplify discriminative features. Extensive evaluations on standard datasets demonstrate ByteGT’s superiority. Specifically, in most complex classification scenarios, we achieve 6.9% and 7% accuracy gains over state-of-the-art methods for 512-byte and 4096-byte sector sizes, respectively. When tested in other scenarios, ByteGT exhibits strong generalizability and robustness.

With the rising penetration of smartphones and mobile applications (apps), mobile apps provide a perspective to interpret and profile their users. Considering that privacy concerns make it increasingly difficult to obtain rich data on users’ app usage, user profiling is implemented solely based on the list of apps installed by the user in this paper. For existing methods, most of them only conduct simple feature engineering and ignore the latent relationships that exist in the installed app list. In this paper, novel multichannel features are proposed to represent users. In addition to mining the app property, the proposed multichannel features exploit the relationships between apps, users, and user attributes. Combined with a 2-dimensional convolutional neural network, the prediction of four user attributes is realized in this paper. Experimental results show that the proposed feature can effectively infer user attributes with the best accuracy of 79.85%, 52.34%, 69.76%, and 69.95% for gender, age, the device’s screen size, and the device’s price, which is 12.39%, 11.75%, 17.61%, and 29.23% higher than the guess based on maximum probability, respectively. Besides, the proposed prediction method has better prediction performance compared to the existing methods and can handle features with high dimensionality well.

Traffic identification, as a crucial measure in network management and security, has garnered significant attention from the public for an extended period. Machine learning methods have emerged as promising and effective solutions for identification of encrypted traffic. However, the intricate and ever-changing nature of the network environment often leads to subpar performance of conventional machine learning approaches. In this paper, we conduct a meticulous analysis of the characteristics of network traffic identification tasks, along with a examination of the limitations of previous methods based on experimental evidence. Moreover, we present EACIS, a highly adaptable and comprehensive system that aims to perform traffic identification in open world network scenarios. EACIS incorporates semi-supervised learning and innovative novelty detection techniques for online identification and differentiation of known traffic, unrelated traffic, and zero-day traffic. Experimental assessments performed on NUDT MobileTraffic dataset, which comprises actual traffic data, illustrate the benefits of our proposed approaches.

Significance Clock synchronization serves as the cornerstone of modern information infrastructure, where its precision and reliability directly impact the performance of critical systems such as financial transactions, smart grids, communication networks, and satellite navigation. These include high-frequency financial transactions requiring microsecond alignment, smart grids dependent on sub-microsecond level coordination for stability across continental-scale power networks, communication networks demanding precise phase synchronization for 5G/6G deployment, and satellite navigation systems whose positioning accuracy hinges on timing integrity. With the emergence of advanced technologies like gravitational wave detection, deep-space exploration, and distributed quantum networks, the demand for picosecond-to femtosecond-level synchronization has surged. Traditional classical synchronization methods, fundamentally constrained by the shot noise limit (SNL), face fundamental physical barriers that limit further precision improvements. Leveraging the properties of quantum entanglement, quantum clock synchronization (QCS) offers revolutionary advantages: it surpasses the standard quantum limit to approach the Heisenberg limit (HL), inherently resists signal spoofing, and provides physical-layer intrinsic security through the quantum no-cloning theorem. As a pivotal application of quantum information technology, this paper provides a comprehensive review of the current state of quantum clock synchronization research, detailing its theoretical foundations, key technical principles, implementation methods, and experimental advancements, while also discussing the potential future development and application scenarios of quantum clock synchronization networks. Progress We review the progress in quantum clock synchronization technology, beginning with its foundational theoretical principles, including entangled photon sources utilizing spontaneous parametric down-conversion or four-wave mixing effect (Fig. 1), coincidence events implemented with a coincidence measurement setup (Fig. 2), and second-order quantum interference manifests through Hong-Ou-Mandel (HOM) interference dip (Fig. 3). The study systematically reviews four pivotal quantum clock synchronization methodologies. One-way clock synchronization (Fig. 4) operates through unidirectional transmission of quantum signals from an entangled photon source to remote receivers, leveraging quantum correlations to establish temporal alignment. This approach offers implementation simplicity and excels in long-haul transmission scenarios, making it suitable for satellite-to-ground time dissemination. Two-way quantum time-transfer (Q-TWTT) (Fig. 5) employs dual entangled sources transmitting photons bidirectionally between nodes, enabling precise cancellation of the transmission path through coincidence measurements. HOM interference-based scheme (Fig. 6) capitalizes on second-order quantum interference phenomena, where photon indistinguishability enables high-precision temporal resolution through high-visibility dip measurements. Round-trip clock synchronization protocols (Fig. 7) reflect part of the quantum signal back to the user through a loopback method. It synchronizes by using the time difference of the returned signal and applies to quantum entanglement distribution networks based on wavelength division multiplexing. This architecture makes the user device simple and easy to expand for multiple users. These methodologies have undergone rigorous experimental validation across diverse operational environments. Coincidence event-based protocols, encompassing both two-way and round-trip architectures (Tables 2 and 3), have yielded unprecedented precision- achieving 0.6 ps stability over 250 km optical fiber links (Figs. 8 and 9) and demonstrating robust picosecond precision in multi-user network configurations with 4-node network validation under different channel loss conditions (Fig. 10). Second-order quantum interference methods (Figs. 11-13), particularly HOM-based schemes, have achieved 150 fs stability on 22 km optical fiber. Free-space quantum synchronization has expanded the technology's horizons, with satellite-based demonstrations achieving less than 30 ps accuracy and ground-to-space quantum-limited time transfer via frequency comb pairs reaching 35 as stability at 300 km transmission distance (Fig. 14). These experimental breakthroughs, supported by security analyses and multiparty synchronization protocols (Figs. 15 - 18), collectively establish quantum clock synchronization as a viable solution for next-generation time-frequency networks. The technology's evolution from laboratory demonstrations to prototype systems and field deployments across metropolitan-scale testbeds underscores its potential to revolutionize precision timing. Conclusions and Prospects Quantum clock synchronization has emerged as a groundbreaking solution to overcome the fundamental limitations inherent in classical synchronization methods, which remain constrained by the shot noise limit. By exploiting quantum entanglement's unique properties, quantum clock synchronization achieves unprecedented precision, theoretically approaching the Heisenberg limit, while providing inherent physical-layer security against signal spoofing through quantum no-cloning principles. Various quantum clock synchronization techniques, including those based on coincidence measurement events and second-order quantum interference, have been extensively experimentally validated over fiber and free-space channels, consistently demonstrating ps-to fs-level synchronization capabilities. These advancements not only pave the way for ultra-precise clock synchronization in scientific and technological applications but also herald the realization of robust quantum clock synchronization networks with scalable architectures. Future research will focus on scaling these networks for large-scale deployment and optimizing resource efficiency to create secure, next-generation technology for global timekeeping and distributed quantum technologies.

Identity privacy leakage through the wireless interface in mobile networks represents a persistent security challenge and a long-standing concern that network designers have aimed to address. Despite the remediation introduced in 5G standards, identity privacy attacks targeting the wireless interface continue to pose a potential threat. In this paper, we present an identity mapping attack based on time series similarity in 4G and 5G networks. This attack enables an adversary with no privileges to map a victim's social media account to their RNTI by sending a single image message to the victim and measuring the similarity of time series extracted from the generated downlink traffic. To improve the attack success rate, we specifically design an elastic similarity measure for time series, tailored to the properties of the data collected during the attack. We investigate the feasibility of the attack under various scenarios, achieving a success rate of 83% for a single attempt and nearly 100% when conducting two or three attempts. Our work provides new insights into the vulnerability of 4G/5G standards to identity privacy attacks.

In recent years, network traffic analysis solutions that are driven by artificial intelligence models have achieved impressive performance. The “magic spells” of these solutions come from the knowledge that they learn from large amounts of network traffic data. However, these solutions neglect the impact of the real-world network's complexity on data quality, which makes the knowledge they learn from regular network traffic data difficult to be effective on low-quality data. Considering the packet loss in real-world network environments, this paper presents TFMana to calibrate the inaccurate packet length features extracted from incomplete network traffic data. TFMana utilizes an encoder-based masked language model to predict features of lost packets, incorporating network traffic feature embeddings to enhance prediction accuracy. This approach enables the calibrated features to approximate those extracted from loss-free network traffic asymptotically. Comprehensive experiments are conducted to verify the effectiveness of the proposed method. The evaluation demonstrates that TFMana's calibration achieves recovery accuracy between 83.94 % and 85.66 %, with minimal sensitivity to packet loss rates. Integrated with four benchmark application identification models, TFMana significantly improves classification accuracy under packet loss conditions. Notably, the analysis models maintains reliable performance even at high packet loss rates of 30 %.

In recent years, web tracking has raised concerns about privacy during web browsing. This paper introduces SEQ-Track, a novel method for detecting web tracking behaviors by leveraging length and time information in encrypted traffic. SEQ-Track extracts the packet length sequences and time interval sequences of packets from network traffic flows and utilizes feature extractors based on the Convolutional Neural Network (CNN) and Transformer to perform web tracking detection. Our experimental results demonstrate that SEQ-Track performs well with over 90