Context: Modern Linux kernels face a critical security challenge due to the extended mitigation latency (averaging 100 days) for publicly disclosed vulnerabilities, which creates a prolonged attack window for privilege escalation. Existing defense mechanisms, including built-in security features and third-party kernel modules, are inadequate as they are often bypassed by advanced exploits, rely on historical vulnerability patterns, and require disruptive system reboots for deployment. Objective: This paper aims to design and implement a novel defense framework that overcomes the limitations of current solutions. The primary goals are to achieve technique-sensitive protection independent of specific vulnerabilities, eliminate the dependency on proof-of-concepts or kernel source code, and enable real-time deployment without system reboots. Method: We propose kShield, a lightweight runtime defense framework built on Extended Berkeley Packet Filter (eBPF) technology. Its design leverages the Compile Once-Run Everywhere (CO-RE) feature to ensure cross-kernel version compatibility. The core of our method is a vulnerability-agnostic architecture that focuses on mitigating general exploit techniques rather than patching specific vulnerabilities. The framework's effectiveness and performance were evaluated through comparative tests with the Linux Kernel Runtime Guard (LKRG). Result: The evaluation demonstrates that kShield successfully mitigates 91.3% of the tested real-world kernel exploits. In performance comparisons, kShield incurs comparable overhead to LKRG, a leading runtime guard solution, while providing significantly broader and more proactive protection against a wide range of vulnerability types. Conclusion: kShield establishes itself as a practical and generalizable solution for hardening production Linux systems. By leveraging eBPF, it provides comprehensive protection during critical vulnerability exposure windows seamlessly and without system interruptions, representing a fundamental shift from vulnerability-specific patching to technique-centric mitigation.

Temporal Graph Neural Networks (TGNNs) are widely used for learning from dynamic graphs in applications such as recommendation, social network analysis, and traffic forecasting. However, scaling TGNN training to large dynamic graphs remains challenging due to three intertwined bottlenecks: memory I/O, irregular computation, and temporal neighbor sampling. Existing systems often optimize these stages in isolation, leaving substantial performance headroom on the table. We present FAST, a holistic framework that accelerates end-to-end TGNN training by jointly optimizing sampling, memory I/O, and computation. FAST introduces SlimCache, which exploits within-batch compression and cross-batch caching to reduce host-device data movement under limited GPU memory budgets. It further designs thread-efficient graph operators tailored to sparse temporal subgraphs, improving GPU cache locality and reducing the latency of aggregation and edge softmax. In addition, FAST employs a topology-aware sampling strategy that improves CPU cache locality and accelerates temporal neighbor sampling. Extensive experiments on real-world large dynamic graphs show that FAST achieves an average of 2.1x (up to 4.7x) speedup over state-of-the-art systems without sacrificing model accuracy.

Memory disaggregation has become a major trend in cloud-native databases. However, most existing memory disaggregation solutions suffer from read/write amplification, limited bandwidth, inefficient recovery, and challenges in data sharing. Fortunately, the emerging CXL technology introduces new opportunities for memory disaggregation design in cloud-native databases. To overcome these challenges, we leverage the CXL switch to design PolarCXLMem, a CXL-switch-based disaggregated memory system for cloud-native databases. To the best of our knowledge, PolarCXLMem is the first CXL-switch-based disaggregated memory system. Building on PolarCXLMem, we propose a novel instant recovery scheme, PolarRecv, which enables instant recovery and fast buffer pool warm-up after a crash. To further support PolarCXLMem in multi-primary databases, we design a new cache coherency protocol that facilitates data sharing between database nodes based on PolarCXLMem. Finally, we evaluate PolarCXLMem with PolarDB, a widely deployed cloud-native database, under various workloads. This is the first study, to our knowledge, that investigates the performance of CXL-based disaggregated memory in a commercially deployed cloud-native database. Our evaluation shows that PolarCXLMem can improve throughput by up to 2.1x in pooling scenarios and 1.55x in sharing scenarios compared to RDMA-based systems.

Transaction performance in geo-replicated databases heavily relies on the request location: when not issued by the primary region, transactions are forced to involve costly wide-area communication. While existing systems distribute primary roles across regions, such assignment typically occurs at the shard level, making it difficult to align with geographically dispersed access to individual records. This paper introduces PolyBase, a pioneering architecture to address such misalignment, leveraging the widely adopted Paxosbased log replication mechanisms. It enables flexible row-level consensus group affiliation, which runs on an unchanged Paxos protocol, but dynamically re-assigns database rows between Paxos log replication groups, whose leaders become the primary region, enjoying faster writes and up-to-date versions for reads. With carefully designed data structures and protocols, PolyBase significantly reduces wide-area RTTs without compromising transaction or log replication consistency or reliability guarantees. We implemented PolyBase with optimized re-assignment policies and integrated it into two popular databases (RocksDB and MySQL). Our evaluation on AWS, using a production e-commerce workload and microbenchmarks confirms that PolyBase offers significantly higher transaction throughput and lower average/tail latency compared to baselines.

The security of web browsers, being fundamental to Internet access infrastructure, has garnered significant attention. Current approaches to identify browser vulnerabilities predominantly rely on code auditing and componentized unit testing. Fuzzing has emerged as an efficient technique for vulnerability discovery. However, adapting this method to browser security testing poses considerable challenges. Recent endeavors in browser vulnerability discovery primarily concentrate on the parsing engine, with limited solutions addressing the rendering engine. Moreover, coverage-guided mutation, a critical aspect, is not prevalent in existing fuzzing frameworks. In this paper, we present a coverage-guided fuzzing framework of DFL, which builds on Freedom and AFL to re-engineer various text generators based on DOM syntax and optimize the efficiency of sample generation. Additionally, serialization and deserialisation methods are developed for the implementation of generator text mutations and the seamless conversion between binary samples and the source DOM tree. When compared with three established DOM fuzzing frameworks in the latest Chromium kernel, DFL has demonstrated an ability to uncover 1.5–3 times more vulnerabilities within a short timeframe. Our research identifies potential avenues for further exploration in browser rendering engine security, specifically focusing on sample generation and path direction.

Graph Neural Networks (GNNs) have shown remarkable performance across a variety of graph-related tasks. Recent efforts indicate that GNN performance can be enhanced through more sophisticated strategies, such as employing advanced aggregators, increasing aggregation depth, and utilizing larger sampling rates, etc. While these strategies yield promising results, it also incurs a significantly larger memory footprint that can easily surpass the GPU memory capacity. Micro-batching has emerged as a promising method to mitigate GPU memory bottleneck while preserving model accuracy. Nevertheless, integrating micro-batches into GNN training presents two significant challenges: (1) achieving load balancing while minimizing node redundancy, and (2) managing the high overhead associated with data preparation. Current solutions struggle to effectively address both load balancing and node redundancy while also inducing prohibitively high data preparation overhead, hindering the practicality and performance of applying micro-batching techniques to GNN training. In this paper, we introduce Cherry, an efficient micro-batching method designed to make GNN training more accessible and scalable. The key enabling idea behind Cherry is to leverage an innovative combination of partitioning techniques aided by message-passing flow graphs and micro-batch based data loading mechanism, which collectively serve to reduce redundancy and load imbalance within the micro-batches and lower the overhead associated with data preparation in the training process. Our evaluation demonstrates that Cherry can enable billion-scale GNN training with sophisticated strategies on a single-GPU machine, significantly outperforming state-of-the-art baselines.

Modern memory management systems suffer from poor performance and subtle concurrency bugs, slowing down applications while introducing security vulnerabilities. We observe that both issues stem from the conventional design of memory management systems with two levels of abstraction: a software-level abstraction (e.g., VMA trees in Linux) and a hardware-level abstraction (typically, page tables). This design increases portability but requires correctly and efficiently synchronizing two drastically different and complex data structures, which is generally challenging. We present CORTENMM, a memory management system with a clean-slate design to achieve both high performance and synchronization correctness. Our key insight is that most OSes no longer need the software-level abstraction, since mainstream ISAs use nearly identical hardware MMU formats. Therefore, departing from prior designs, CORTENMM eliminates the software-level abstraction to achieve sweeping simplicity. Exploiting this simplicity, CORTENMM proposes a transactional interface with scalable locking protocols to program the MMU, achieving high performance by avoiding the extra contention in the software-level abstraction. The one-level design further enables us to formally verify the correctness of concurrent code operating on the MMU (correctness of basic operations and locking protocols), thereby offering strong correctness guarantees. Our evaluation shows that the formally verified CORTENMM outperforms Linux by 1.2x to 26x on real-world applications.

Primary-secondary databases often have limited write throughput as they rely on a single primary node. To improve this, some systems use a shared-nothing architecture for scalable multi-primary clusters. However, these face performance issues due to distributed transaction overheads. Recently, shared-storage-based multi-primary cloud-native databases have emerged to avoid these issues, but they still struggle with performance in high-conflict scenarios, often due to expensive conflict resolution and inefficient data fusion. This paper proposes PolarDB-MP, an innovative multi-primary cloud-native database that leverages both disaggregated shared memory and storage. In PolarDB-MP, each node has equal access to all data, enabling transactions to be processed on individual nodes without the need for distributed transactions. At the core of PolarDB-MP is the Polar Multi-Primary Fusion Server (PMFS), built on disaggregated shared memory. PMFS plays a critical role in facilitating global transaction coordination and enhancing buffer fusion, seamlessly integrated with RDMA for minimal latency. Its three main functionalities include Transaction Fusion for transaction ordering and visibility, Buffer Fusion providing a distributed shared buffer, and Lock Fusion for cross-node concurrency control. Moreover, PolarDB-MP introduces an LLSN design, establishing a partial order for write-ahead logs generated across different nodes, accompanied by a tailored recovery policy. Our evaluations of PolarDB- MP demonstrate its superior performance when compared to the state-of-the-art solutions. Notably, PolarDB-MP is already in production and undergoing commercial trials at Alibaba Cloud. To our knowledge, PolarDB-MP is the first multi-primary cloud-native database that utilizes disaggregated shared memory and shared storage for transaction coordination and buffer fusion.

The serverless database has recently attracted increasing attention both in industry and academia due to its high elasticity and the “pay-as-you-go” model. This paper delivers a thorough review of current shared-storage-based commercial serverless databases, pinpointing two major challenges: (1) they either experience difficulties with instance migration during scaling up or restrict the resource usage within a single physical host to avoid potential migration. (2) they lack the ability to scale out secondary nodes due to the absence of strong consistency support in secondary nodes. Based on our experience in building serverless databases, this paper proposes two fundamental requirements to address these two issues: seamless and instant migration and read scale-out. The former allows for instance migration when there are insufficient resources on the resident host during scaling up without application disruption, whereas the latter necessitates strong consistency on secondary nodes to process read requests. To fulfill these fundamental requirements, we propose PolarDB Serverless, a shared-storage-based serverless database achieving seamless scale-up and read scale-out. It supports read scale-out by inheriting the strong consistency feature from PolarDB, making it possible to process strongly consistent reads on secondary nodes. In the pursuit of achieving seamless migration, PolarDB Serverless introduces a transaction migration policy. It ensures there is no interruption to the application during migrations, allowing transactions to continue on the new instance without any disruptions. It also minimizes the overhead of migration, achieving a fast migration. In our evaluation, especially in the context of database migration scenarios, it's noteworthy that the migration of a database instance takes just half a second without causing any exceptions for applications. PolarDB Serverless is the first shared-storage-based serverless database supporting both seamless scale-up and read scale-out and is already commercially available at Alibaba Cloud.

System call sequences representing the runtime behavior of an application is particularly useful for anomaly detection in mobile applications. However, one of the main obstacles in this area is the lack of publicly available high-quality datasets. Because of the low computational power and storage constraints of mobile application platforms, a single mobile device cannot accomplish the task of massively installing applications and extracting interaction details with the operating system, making it extremely challenging to build large-scale fine-grained system call datasets. In this paper, we present the MaDroid dataset. It is the first comprehensive dataset and benchmark for anomaly detection in mobile applications using high-dimensional feature sequence data and maliciousness, and the first to incorporate virus total rating (VT) values into dataset features. It is constructed based on an automated collection framework that collects system call sequences from simulation environments at a fine-grained level for both normal and malicious mobile applications. The dataset is 457 GB in size and consists of 50,429 labeled system call sequences. The dataset covers mobile applications released at different times over the past 14 years, and the selected applications span across 10 major mainstream APP markets. We extract different feature subsets from the dataset and perform evaluations using RF, MLP, and GBDT to show the effectiveness and accuracy in detecting malicious mobile APPs. Our dataset can be a useful resource for security and machine learning community.

This article is concerned with the globally exponentially mean-square stabilization problem for uncertain disturbed networked switched systems (NSSs) subject to mixed network attacks and multiple asynchronous switching by exploring an optimized event-triggered scheme. First, we consider a new challenge of multiple asynchronous switching stemmed from the varying switching delays within the event-triggered scheme and controller. Second, assume that the data transmission network is subject to attacks consisting of deception attacks and aperiodic DoS attacks. Third, an optimized resilient dynamic event-triggered scheme (ORD-ETS) with switching behavior and external noises is proposed to intelligently reduce the inessential released data. For further improving the system performance, the updated ORD-ETS (UORD-ETS) is designed by introducing some fixed signals-released points. Then, based on the mode-dependent multiple Lyapunov functionals, integral inequality, incorporated switching signal technique and proposed asynchronous analysis method, some criteria are attained to ensure the globally exponentially mean-square stable of the uncertain disturbed NSSs with a weighted H(infinity )performance. Further, the co-design of the desired controller and the event-triggered scheme is achieved. Ultimately, a numerical simulation with comparative analysis and a practical simulation are conducted to substantiate the validity of the obtained results.

In this paper, we present the design and implementation of ZBTree, a hotness-aware B $^+$ -Tree for persistent memory (PMem). ZBTree leverages the PMem+DRAM architecture, which is featured with a volatile operation layer to accelerate data access and an order-preserving persistent layer to achieve fast recovery and low-overhead consistency and persistence guarantees. The operation layer contains inner nodes for indexing and compacted leaf nodes (DLeaves) that hold metadata. Based on leaf node compaction, we present a data lodging method, which supports to load hot data into fast DRAM dynamically, avoiding PMem accesses for subsequent reads of hot data and achieving improved read performance without incurring extra DRAM usage. In addition, we present a lightweight node splitting mechanism with constant persistence overhead that does not vary with node size. Our extensive evaluations show that ZBTree achieves higher throughput by a factor of 1.4x-6.3x compared to state-of-the-art tree indexes under a wide range of workloads. Meanwhile, ZBTree achieves comparable or faster recovery speed compared to existing designs.

The transmission optimization of VR video streaming can improve the quality of user experience, which includes content prediction optimization and caching strategy optimization. Existing work either focuses on content prediction or on caching strategy. However, in the end-edge-cloud system, prediction and caching should be considered together. In this paper, we jointly optimize the four stages of prediction, caching, computing and transmission in mobile edge caching system, aimed to maximize the user’s quality of experience. In terms of caching strategy, we design a caching algorithm VIE with unknown future request content, which can efficiently improve the content hit rate, as well as the durations for prediction, computing and transmission. The VIE caching algorithm is proved to be ahead of other algorithms in terms of delay. We optimize the four stages under arbitrary resource allocation and obtain the optimal results. Finally, under the real scenario, the proposed caching algorithm is verified by comparing with several other caching algorithms, simulation results show that the user’s QoE is improved under the proposed caching algorithm.

Graph pooling is a commonly used operation in graph neural networks to reduce the size of graph representation. To extract key information, pooling and representation need to be coupled. We propose a graph pooling method for weighted graphs called WGDPool (Weighted Graph Dual Pooling). Unlike traditional graph representation learning methods, the weight information of edges is also fed into convolutional graph neural networks (ConvGNN) to obtain graph representations. Dual branch convolutional graph neural networks is designed to learn the nodes’ and edges’ embeddings independently, and they are fused into a comprehensive representation of graph data. Pooling, as a tool of feature extraction and scale reduction of graph representation, adopts a differentiable version of k-means clustering and a multi-item parameterized loss function. Cut loss, orthogonality loss, clustering loss, and reconstruction loss are simultaneously considered. By parameterization, WGDPool is competent for diverse graph tasks. WGDPool outperformed other graph pooling methods in such common supervised and unsupervised tasks as biological or chemical classification, bibliography clustering and integrated circuit partition, demonstrating the effectiveness of our proposed pooling method.

This work tackles the cross-domain object detection problem which aims to generalize a pre-trained object detector to different domains (driving scenes) without labels. An uncertainty-aware and class-balanced domain adaptation method is proposed based on two motivations: 1) estimation and exploitation of model uncertainty in a new domain is critical for reliable domain adaptation; and 2) in domain adaptation the distribution alignment of two domains as well as the maintaining of category discriminability are both important. In particular, we compose a Bayesian CNN-based framework for uncertainty estimation in object detection. We propose an algorithm for generating uncertainty-aware pseudo-labels, which are then used in uncertainty-guided self-training and category-aware feature alignment. We further devise a scheme with class-balanced memory banks to address the long-tail distribution problem in category-aware feature alignment. Experiments on multiple cross-domain object detection benchmarks show that our proposed method achieves state-of-the-art performance.

DongTing is the first large-scale dataset dedicated to Linux kernel anomaly detection. The dataset covers Linux kernels released in the last five years and includes a total of 18,966 well-labeled normal and attack sequences. The entire dataset is 85 GB in size (after decompression). The attack data covers 26 major kernel releases and contains a total of 12,116 system call sequences collected from running 17,855 bug-triggering programs. The normal data comes from 6,850 normal programs in four kernel regression test suites. We maintain the dataset and source code in Zenodo and Github, respectively, and back up the dataset and code in Baidu netdisk. Dataset The dataset is stored at http://doi.org/10.5281/zenodo.6627050 The data includes `abnormal_data`, `normal_data`, `models`, `npz` and baseline data, with a total volume of nearly 87 GB (including 85 GB for abnormal data and normal data, it's after decompression files size). The `Abnormal_data` directory contains 12,116 files containing system call sequence for 26 kernel releases, and the `Normal_data` directory contains 6,850 files containing system call sequences collected from four regression test suites. All of which are raw sequences. CNN/RNN, LSTM, and Wavenet (three sets of hyperparameters per model) machine learning models are selected, the ECOD model (without hyperparameters) was also chosen for the evaluation of DT. DT_abnormal, DT_normal, ADFA-LD, and PLAID are used for training respectively. The results of DT training models are stored in the directory `Models-DongTing`, and the results of ADFA-LD and PLAID training models are stored in the directory `Models-Comparison`. The directory `npz `stores the encoded dataset of DongTing, ADFA-LD, and PLAID (sequence length varies from 8 to 4495), according to syscall_64.tbl in Linux kernel 5.17, including the training set, validation set, and test set. The file `Baseline.xlsx` contains all the information about DongTing dataset, which can be used in training machine learning models. For example, the whole dataset is randomly divided into three sets with the ratio of 80%:10%:10% (training: validation: test). The implementation of dataset division can be found in the source code. Source Code The source code for dataset development is stored at https://github.com/HNUSystemsLab/DongTing and the following is a brief introduction. The source code contains three folders, i.e., `Source Code Files`, `Documents` and `DB`, where `Documents `stores the detailed documents related to development, `DB` stores samples data, and `Source Code Files` stores the source code related to the development of our dataset. The detailed description about the source code can be found in `Documents/Documentation.pdf`. The document consists of four parts: environment requirements, database, program structure and working steps, model training and evaluation (including training and evaluation). It details the preparation of the environment, data import method, functional description of each file in the source code directory, how model training and evaluation work and other related contents. We additionally maintain the dataset and source code on Baidu.com https://pan.baidu.com/s/1vu1WGZpf2DqMIoyGayNu3w?pwd=dtds to facilitate the access from China. Tips: If the DongTing dataset has been helpful to your research, please cite the article in your work. @article{DUAN2023111745, title = {DongTing: A large-scale dataset for anomaly detection of the Linux kernel}, journal = {Journal of Systems and Software}, volume = {203}, pages = {111745}, year = {2023}, issn = {0164-1212}, doi = {https://doi.org/10.1016/j.jss.2023.111745 url = {https://www.sciencedirect.com/science/article/pii/S0164121223001401}, author = {Guoyun Duan and Yuanzhi Fu and Minjie Cai and Hao Chen and Jianhua Sun}, keywords = {Anomaly detection, Dataset, Linux kernel, System calls, Kernel BUG, Deep learning}, }

This work aims to temporally localize events that are both audible and visible in video. Previous methods mainly focused on temporal modeling of events with simple fusion of audio and visual features. In natural scenes, a video records not only the events of interest but also ambient acoustic noise and visual background, resulting in redundant information in the raw audio and visual features. Thus, direct fusion of the two features often causes false localization of the events. In this paper, we propose a co-attention model to exploit the spatial and semantic correlations between the audio and visual features, which helps guide the extraction of discriminative features for better event localization. Our assumption is that in an audio-visual event, shared semantic information between audio and visual features exists and can be extracted by attention learning. Specifically, the proposed co-attention model is composed of a co-spatial attention module and a co-semantic attention module that are used to model the spatial and semantic correlations, respectively. The proposed co-attention model can be applied to various event localization tasks, such as cross-modality localization and multimodal event localization. Experiments on the public audio-visual event (AVE) dataset demonstrate that the proposed method achieves state-of-the-art performance by learning spatial and semantic co-attention.