A host that engages in an unusually high level or significant change of distinct connectivities is recognized as a super host, which typically correlates with an abnormal event in the network. With the rapid expansion of network scale and traffic volume, accurately measuring host cardinalities to identify super hosts has become increasingly challenging. Sketch-based approaches, known for their efficient compressed recording structure and provable error bounds, emerge as a promising method for estimating host cardinalities. However, existing solutions encounter two challenges: 1) inefficient memory utilization of estimating host cardinalities with skewed distribution; 2) insufficient capacity and flexibility to simultaneously measure different types of host cardinalities. To address these problems, we propose a novel sketch, named UnivCar, to efficiently estimate skewed host cardinalities for identifying various super hosts among large-scale network traffic. UnivCar utilizes a hierarchical data structure that supports adaptive extensions to enable memory-efficient tracking on the highly skewed cardinality distribution. To ensure the cardinality estimation accuracy of various super hosts, we present a lossless extension algorithm that enables flexible switching between different estimation tasks. We provide a theoretical analysis and perform a series of evaluations on UnivCar based on real-world traffic traces. Experimental results show that UnivCar outperforms existing sketch-based approaches in both accuracy and performance for identifying various super hosts while consuming less memory.

Over the past decades, DDoS attacks have dramatically evolved in attack scale and patterns. However, state-of-the-art DDoS defenses encounter challenges in maintaining high performance while handling large-scale network traffic. Most require rerouting traffic to a centralized collector (or analyzer), introducing additional processing latency and cost. Emerging programmable switches have become a promising means for conducting flexible DDoS defense directly on the data plane. However, due to the limited resources on each device and the lack of monitoring statistics from a network-wide perspective, these works have not provided sufficient capabilities to detect and mitigate diverse DDoS attacks. In this paper, we propose CoDDoS, a Collaborative DDoS defense system that combines device-local and network-wide monitoring information to defend against diverse DDoS attacks with programmable switches. For device-local estimation, we propose a resource-efficient sketch DBMin, to recognize suspicious DDoS attack flows from tremendous ongoing traffic. It is fully deployed on the data plane and achieves much lower memory consumption than existing approaches. We further initiate an In-band Network Telemetry mechanism to perform the network-wide measurement on suspicious flows detected by DBMin sketch. To defend against diverse DDoS attacks, CoDDoS enables a comprehensive investigation of the collected statistics and sets appropriate mitigation strategies for different DDoS attacks. The experiment results show that CoDDoS can achieve high detection accuracy for endpoint-based DDoS defense referring to F1 score/FNR/FPR metrics and effectively detect and mitigate link-based DDoS attacks.

The question of whether an ideal network exists with global scalability in its full life cycle has always been a first-principles problem in the research of network systems and architectures. Thus far, it has not been possible to scientifically practice the design criteria of an ideal network in a unimorphic network system, making it difficult to adapt to known services with clear application scenarios while supporting the ever-growing future services with unexpected characteristics. Here, we theoretically prove that no unimorphic network system can simultaneously meet the scalability requirement in a full cycle in three dimensions—the service-level agreement (S), multiplexity (M), and variousness (V)—which we name as the “impossible SMV triangle” dilemma. It is only by transforming the current network development paradigm that the contradiction between global scalability and a unified network infrastructure can be resolved from the perspectives of thinking, methodology, and practice norms. In this paper, we propose a theoretical framework called the polymorphic network environment (PNE), the first principle of which is to separate or decouple application network systems from the infrastructure environment and, under the given resource conditions, use core technologies such as the elementization of network baselines, the dynamic aggregation of resources, and collaborative software and hardware arrangements to generate the capability of the “network of networks.” This makes it possible to construct an ideal network system that is designed for change and capable of symbiosis and coexistence with the generative network morpha in the spatiotemporal dimensions. An environment test for principle verification shows that the generated representative application network modalities can not only coexist without mutual influence but also independently match well-defined multimedia services or custom services under the constraints of technical and economic indicators.

The ever-growing carbon emission of information infrastructure accounts for a significant proportion of the global carbon emissions. Existing studies reduce carbon consumption mainly by improving power efficiency on specific facilities or energy source structures. However, these methods do not jointly consider the impact of computation and network resource distribution on carbon emission. In this paper, we propose a data-driven scheme named EcoNet using reinforcement learning to reduce carbon emissions by jointly scheduling computation and network resources. We dynamically monitor the status of the computation and network facilities using cloud-edge collaboration and software-defined networking. Based on the collected status information, we formulate the resource scheduling problem as an optimization problem, which comprehensively considers the carbon emission, electricity price, and quality of service. The problem has high computation complexity, and we solve the problem with the proposed EcoNet to achieve efficient scheduling and near-optimal performance based on the collected network status information. The evaluation results show that EcoNet can maintain good Quality of Service and save at least 17% of the overall cost considering the electricity bills and carbon emissions.

Measuring flow cardinality is one of the fundamental problems in data stream mining, where a data stream is modeled as a sequence of items from different flows and the cardinality of a flow is the number of distinct items in the flow. Many existing sketches based on estimator sharing have been proposed to deal with huge flows in data streams. However, these sketches suffer from inefficient memory usage due to allocating the same memory size for each estimator without considering the skewed cardinality distribution. To address this issue, we propose SuperGuardian to improve the memory efficiency of existing sketches. SuperGuardian intelligently separates flows with high-cardinality from the data stream, and keeps the information of these flows with the large estimator, while using existing sketches with small estimators to record low-cardinality flows. We carry out a mathematical analysis for the cardinality estimation error of SuperGuardian. To validate our proposal, we have implemented SuperGuardian and conducted experimental evaluations using real traffic traces. The experimental results show that existing sketches using SuperGuardian reduce error by 79 % - 96 % and increase the throughput by 0.3–2.3 times.

Traffic Engineering (TE) is applied to optimize network transmission efficiency by managing the routing of complicated traffic. Emerging Deep Reinforcement Learning (DRL) and Software-Defined Networking (SDN) provide flexible ability for traffic management and congestion control. However, existing methods either cannot reroute the network-wide traffic in an accurate way or encounter too much calculation latency due to the inference of mathematical optimization techniques. In this paper, we propose a flexible and link-reconfigurable TE solution called EfficientTE that effectively adjusts the traffic routing based on real-time traffic demands. By analyzing the characteristics of network topology and traffic, EfficientTE selects a few links that are critical for congestion in the network. Then, we propose the idea of virtual capacity that helps the DRL algorithm adjust to different link bandwidths. Based on the traffic demand and topology information collected by the SDN controller, the DRL algorithm is used to dynamically adjust the virtual capacity of the critical links to reshape the network. To ensure network performance with low disturbance, we selectively reroute the Top-K critical flows using the weighted K-shortest path algorithm, while forwarding the major flows with default rerouting. Experiments show that EfficientTE optimizes maximum link utilization and outperforms existing TE solutions by improving the load-balancing performance ratio by at least 6.13%, 18.78%, 16.20%, and 22.81% respectively in four network topologies.

Collaborative cloud–edge computing has been systematically developed to balance the efficiency and cost of computing tasks for many emerging technologies. To improve the overall performance of cloud–edge system, existing works have made progress in task scheduling by dynamically distributing the tasks with different latency thresholds to edge and cloud nodes. However, the relationship of multi-resource queueing among different tasks within a node is not well studied, which leaves the merit of optimizing the multi-resource queueing unexplored. To fill this gap and improve the efficiency of cloud–edge system, we propose DeepMIC, a deep reinforcement learning (DRL)-based multi-resource interleaving scheme for task scheduling in cloud–edge system. First, we formulate a multi-resource queueing model aiming at minimizing the weighted-sum delay of the pending tasks. The proposed model jointly considers the requests for computation, caching, and forwarding resources within a node based on the network information collected through Software-Defined Networking (SDN) and the management framework of Mobile Edge Computing (MEC). Then, we customize a DRL algorithm to ensure a timely solution of the model, which caters to the high throughput of tasks. Finally, we demonstrate that through the flexible scheduling of the tasks, DeepMIC reduces the average task response time and achieves better resource utilization.

To deal with the difficulty of configuring Moving Target Defense (MTD) strategy under complexityattack scenarios in the cloud native environment, a deep reinforcement learning based moving target defensestrategy optimization scheme (SmartSCR) is proposed. First, the security threats together with the attackpaths are analyzed considering the characteristics of containerization and microservice. Then, in order toevaluate the defense efficiency of moving target defense under complexity attack scenarios in the cloud nativeenvironment, the microservice attack graph model is proposed to defense quantify efficiency. Finally, theoptimization of moving target defense strategy is modeled as a Markov decision process. A deep reinforcementlearning based strategy is proposed to handle the state space explosion under large scale cloud nativeapplications, thus to solve out the optimal configuration for moving target defense strategy. The experimentresults show that SmartSCR can quickly converge under large scale cloud native applications, and achieve nearoptimal defense efficiency

Cardinality estimation is the task of obtaining the number of distinct items in a data stream, which plays an important role in many application domains. However, when dealing with high-speed data streams, it remains a significant challenge to estimate cardinality considering record/query overhead and memory efficiency. This paper proposes a virtual self-adaptive bitmap estimator to support online cardinality estimation, which reduces the record overhead to one hash per item for the first time. By logically adding virtual bits, our estimator automatically adapts its sampling probability to different stream sizes. We evaluate the virtual self-adaptive bitmap theoretically and experimentally. The experimental results show that our estimator significantly improves over the existing work in terms of record throughput, query throughput and estimation accuracy.

Implementing defensive deception in the cloud is promising to proactively counter reconnaissance attack. This technique presents decoys to camouflage cloud assets and distracts attack resource. However, the major challenge is to develop an effective deception strategy to orchestrate digital decoys. To address this issue, we propose a deep reinforcement learning (DRL)-based defensive deception framework. First, we formulate a utility function, which mathematically models underlying threats associated with common vulnerabilities among virtual machines in the cloud. Then, we customize training interfaces and the neural networks for a DRL agent. The reward function reflects the effectiveness of asset concealment and the waste of attack resources, referring to a comprehensive defense goal. Finally, the well-trained DRL agent generates the optimal defense strategy. It specifies a more granular deception strategy than existing proposals. Simulation results show that the proposed framework leads to a 7.87% average advantage in realizing the comprehensive defense goal. Moreover, it can stably improve the concealment degree of cloud assets up to 20.58%, and increase the attack cost up to 40.40%. This study shows that it is promising to improve cloud security with deception defense and artificial intelligence techniques.

Traditional routing schemes usually use fixed models for routing policies and thus are not good at handling complicated and dynamic traffic, leading to performance degradation (e.g., poor quality of service). Emerging Deep Reinforcement Learning (DRL) coupled with Software-Defined Networking (SDN) provides new opportunities to improve network performance with automatic traffic analysis and policy generation. However, existing DRL-based routing solutions usually rely on all node information to make routing decisions for the network and hence are both hard to converge in large networks and vulnerable to topology changes. In this paper, we propose ScaleDeep, a scalable DRL-based routing scheme for SDN, which improves the routing performance and is resilient to topology changes. Essentially, ScaleDeep takes advantage of partial control on network nodes and DRL. We select a set of critical nodes from a network as driver nodes, which can simulate the entire network operation, based on the control theory. By observing the traffic variation on the driver nodes, DRL dynamically adjusts some link weights for a weighted shortest path algorithm to change the routing paths and improve the routing performance. Limiting the control on driver nodes improves the convergence ability of DRL and reduces the dependency of the DRL agent on the fixed network topology. To validate the performance of ScaleDeep, we conduct packet-level simulations on different topologies. The results show that ScaleDeep outperforms existing DRL-based schemes by reducing the average flow completion time by up to 36% and exhibiting better robustness against minor topology changes.

The scale of modern information networks continues to expand, which puts forward higher requirements for inter-domain data communication on the Internet. Existing inter-domain routing protocols such as Border Gateway Protocol（BGP） cannot make intelligent routing decisions based on network performance, which easily leads to network congestion and reduces network transmission performance. This paper proposes a scalable inter-domain multi-link routing optimization mechanism based on multi-agent reinforcement learning. It can dynamically adjust the inter-domain routing strategy by sensing the network traffic distribution on multiple links between domains in real-time, thus maximizing the network traffic passing through each autonomous system and improving the overall throughput of the network. Experimental results show that, compared with the random algorithm and the SPF algorithm, the proposed algorithm can increase the network throughput by up to 26.1% and 16.4%, respectively, and achieves traffic balance on multiple links between domains.

Defensive deception is emerging to reveal stealthy attackers by presenting intentionally falsified information. To implement it in the increasing dynamic and complex cloud, major concerns remain about the establishment of precise adversarial model and the adaptive decoy placement strategy. However, existing studies do not fulfil both issues because of (1) the insufficiency on extracting potential threats in virtualisation technique, (2) the inadequate learning on the agility of target environment, and (3) the lack of measurement for placement strategy. In this study, an optimal defensive deception framework is proposed for the container based-cloud. The System Risk Graph (SRG) is formalised to depict an updatable adversarial model with the automatic orchestration platform. Afterwards, a Deep Reinforcement Learning (DRL) model is trained based on SRG. The well-trained DRL agent generates optimal placement strategies for the orchestration platform to distribute decoys and deceptive routings. Lastly, the coefficient of deception, C, is defined to evaluate the effectiveness of placement strategy. Simulation results show that the proposed method increases C by 30.22%, and increase the detection ratio on the random walker attacker and persistent attacker by 30.69% and 51.10%, respectively.

As modern communication networks are growing more complicated and dynamic, designing a good Traffic Engineering (TE) policy becomes difficult due to the complexity of solving the optimal traffic scheduling problem. Deep Reinforcement Learning (DRL) provides us with a chance to design a model-free TE scheme through machine learning. However, existing DRL-based TE solutions cannot be applied to large networks. In this article, we propose to combine the control theory and DRL to design a TE scheme. Our proposed scheme ScaleDRL employs the idea from the pinning control theory to select a subset of links in the network and name them critical links. Based on the traffic distribution information, we use a DRL algorithm to dynamically adjust the link weights for the critical links. Through a weighted shortest path algorithm, the forwarding paths of the flows can be dynamically adjusted. The packet-level simulation shows that ScaleDRL reduces the average end-to-end transmission delay by up to 39% compared to the state-of-the-art in different network topologies.

Segment Routing (SR) is a new routing paradigm based on source routing and provide traffic engineering (TE) capabilities in IP network. By extending interior gateway protocol(IGP), SR can be easily applied to IP network. However, upgrading current IP network to a full SR one can be costly and difficult. Hybrid IP/SR network will last for some time. Aiming at the low flexibility problem of static TE policies in the current SR networks, this paper proposes a Deep Reinforcement Learning (DRL) based TE scheme. The proposed scheme employs multi-path transmission and use DRL to dynamically adjust the traffic splitting ratio among different paths based on the network traffic distribution. As a result, the network congestion can be mitigated and the performance of the network is improved. Simulation results show that our proposed scheme can improve the throughput of the network by up to 9% than existing schemes.

With the rapid development of wireless communication technologies and the proliferation of the urban Internet of Things (IoT), the paradigm of mobile computing has been shifting from centralized clouds to edge networks. As an enabling paradigm for computation-intensive and latency-sensitive computation tasks, mobile edge computing (MEC) can provide in-proximity computing services for resource-constrained IoT devices. Nevertheless, it remains challenging to optimize computation offloading from IoT devices to heterogeneous edge servers, considering complex intertask dependency, limited bandwidth, and dynamic networks. In this paper, we address the above challenges in MEC with TPD, that is, temporal and positional computation offloading with dynamic-dependent tasks. In particular, we investigate channel interference and intertask dependency by considering the position and moment of computation offloading simultaneously. We define a novel criterion for assessing the criticality of each task, and we identify the critical path based on a directed acyclic graph of all tasks. Furthermore, we propose an online algorithm for finding the optimal computation offloading strategy with intertask dependency and adjusting the strategy in real-time when facing dynamic tasks. Extensive simulation results show that our algorithm reduces significantly the time to complete all tasks by 30–60% in different scenarios and takes less time to adjust the offloading strategy in dynamic MEC systems.

Estimating the frequency of each distinct item in data streams is a fundamental problem in data mining. The speed of existing algorithms is not fast enough, and at the same time, some algorithms improve accuracy through complex configuration, which is a heavy burden for users. To address this issue, we propose a new sketch, OrderSketch, which has a simple structure and operation that is effortless to understand and use. The OrderSketch is significantly faster than existing algorithms while maintaining high accuracy. We theoretically prove that OrderSketch can provide unbiased estimation and then give an error bound of our algorithm. To verify the effectiveness and efficiency of OrderSketch, we compare it with five other widely used and excellent performance algorithms. Experimental results show that OrderSketch has 3 times higher insertion speed compared with the state-of-the-art work. We have released our source codes at Github [1].

Network Function Virtualization (NFV) technology utilizes software to implement network function as virtual instances, which reduces the cost on various middlebox hardware. A Virtual Network Function (VNF) instance requires multiple resource types in the network (e.g., CPU, memory). Therefore, an efficient VNF placement policy should consider both the resource utilization problem and the Quality of Service (QoS) of flows, which is proved NP-hard. Recent studies employ Deep Reinforcement Learning (DRL) to solve the VNF placement problem, but existing DRL-based solutions cannot generalize well to different topologies. In this letter, we propose to combine the advantage of DRL and Graph Neural Network (GNN) to design our VNF placement scheme DeepOpt. Simulation results show that DeepOpt outperforms the state-of-the-art VNF placement schemes and shows a much better generalization ability in different network topologies.

As modern communication networks become more complicated and dynamic, designing a good Traffic Engineering (TE) policy becomes difficult due to the complexity of solving the optimal traffic scheduling problem. Traditional methods usually design a fixed model of the network traffic and solve an objective function to get a TE policy, which cannot ensure the solution efficiency. The emerging Deep Reinforcement Learning (DRL) together with the Software-Defined Networking (SDN) technologies provide us with a chance to design a model-free TE scheme through Machine Learning (ML). However, existing DRL-based TE solutions are all faced with a scalability problem, i.e., the solution cannot be applied to large networks. In this paper, we propose to combine the control theory and DRL technology to achieve an efficient network control scheme for TE. The proposed scheme ScaleDRL employs the idea from the pinning control theory to select a subset of links in the network and name them critical links. Based on the traffic distribution information collected by the SDN controller, we use a DRL algorithm to dynamically adjust a set of link weights for the critical links. Through a weighted shortest path algorithm, the forwarding paths of the network flows can be dynamically adjusted using the dynamic link weights. The packet-level simulation shows that ScaleDRL reduces the average end-to-end transmission delay by up to 39% compared to the state-of-the-art DRL-based TE scheme in different network topologies.

当前网络规模的高速增长带来网络流量复杂度的日益提高,增加了对流量特征精确建模的难度.近年来业界提出使用深度强化学习技术实现网络路由的智能化生成,一定程度上克服了人工进行流量分析和建模的缺点.然而,目前提出的解决方案普遍存在可扩展性差等问题.对此,提出了一种基于牵引控制理论的深度强化学习路由策略生成技术Hierar-DRL,通过引入牵 控制理论并结合深度强化学习的自动策略搜索能力,提高了智能路由算法可扩展性.仿真实验结果表明:所提方案相比当前最优方案的端到端时延最多降低了 28.5％,证明了所提智能路由方案的有效性.