Across a diverse landscape of anonymity designs, the dominant paradigms-onion routing (e.g., Tor) and mix networks (e.g., Loopix)-carry intrinsic constraints: long-lived circuits invite traffic correlation, and mixnets often rely on a network-wide state, making it hard to reconcile anonymity and scalability. This paper presents Draughts, a fully decentralized system in which each packet follows an independent and dynamically determined transmission path. Built upon Jump routing, Draughts introduces three key innovations: (i) replacing global state O(N) with local two-hop neighborhood knowledge O(k2); (ii) supporting anonymous replies to enable real-time bidirectional communication; and (iii) proposing a path-length control mechanism that balances anonymity and transmission efficiency. Evaluation results show that Draughts achieves strong sender anonymity, resists predecessor and traffic analysis attacks, and reduces receiver buffer maintenance overhead, achieving a favorable trade-off between anonymity and performance.

Information-centric networking (ICN) separates the identifier and locator of network entities, providing a natural advantage in supporting mobility. To gain the advantage of ICN to support mobility, an urgent challenge is the problem of practical implementation with performance optimization. Software-defined networking (SDN) can be regarded as infrastructure to implement ICN mobility. However, it is difficult for the centralized SDN controller to quickly process mobile signaling. Therefore, this paper proposes enhanced programmable data plane supporting ICN mobility. By offloading mobility-related control plane functions from the controller to the data plane, the data plane can locally process mobile signaling without interacting with the controller. We propose an offloading mechanism for control plane functions, based on a rule table, where the controller authorizes the data plane to process the mobile signaling by loading the programmable rule table to data plane’s control element, and the control element intercepts the mobile signaling, matches the predefined rule table, and executes a series of application logic actions. In addition, we propose an improved SmartSplit algorithm to manage the rule table and speed up packets matching the rule table. Based on Intel’s Data Plane Development Kit (DPDK), we implement the enhanced programmable data plane. Our experimental results prove that the proposed enhanced programmable data plane has a stronger ability to process mobile signaling and reduce latency.

The imbalanced category of network traffic poses a challenge to the classification methods based on machine learning, because the unbalanced data structure affects the performance of machine learning algorithms. In this paper, we propose a multi-model coupling approach to address the imbalanced data problem in network traffic classification. We process the major class to some clusters by a clustering algorithm. Then, these clusters and the minor class are used to form the training dataset for training model respectively. During the test, the test dataset is input into the previously trained models respectively, and the classification results of respective models are coupled to obtain the final result. We tested our proposed method on two well-known network traffic datasets and the results showed that it could achieve better performance and less time consumption compared with recent proposed methods in the case where the ratio of minor to major classes is very small.

基于流量特征建模的网络异常行为检测技术通过对网络流量进行特征匹配与模式识别,进而检测出潜在的、恶意入侵的网络流量,是网络异常行为检测的有效手段.根据检测数据来源的不同,传统检测方法可以分为基于传输层信息、载荷信息、主机行为特征等三类,而近年来兴起的深度学习方法已经开始应用于这三类数据,并可以综合应用三类数据,本文从技术原理与特点、实验方式、取得的成果等方面对上述技术路线进行了综述,并分析了存在的主要问题和发展趋势.

The related protocol packets for Modbus/TCP security vulnerability mining are often generated in a random way,which is prone to generate excessive invalid packets and reduce the efficiency of vulnerability mining.To deal with this problem,a structural fuzzy algorithm named Fuzzy-RNN is proposed based on the concept of Recurrent Neural Networks(RNN).It learns the probability distribution of each part of the proptocol packet from the Modbus-TCP training set,and takes the corner cases into account,so as to realize the targeted fuzzy generation.Experimental results show that compared with the General Protocol Fuzzer(GPF),in a variety of simulation software such as Modbus Slave and xMasterSlave,the Fuzzy-RNN algorithm can achieve the fuzzy generation of legal protocol packets with a higher probability.The test time can be reduced by more than 50%,and its efficiency can be obviously improved.

Since the last decade of the 20th century, the Internet had become flourishing, which drew great interest in the detection of abnormal network traffic. Particular-ly, it’s impossible to manually detect the abnormal patterns from enormous traffic flow in real time. Therefore, multiple machine learning methods are adopted to solve this learning problem. Those methods differ in mathematical models, knowledge models, application scenarios and target flows. In recent years, as a consequence of the technological breakthrough of Web 3.0, the traditional types of traffic classifiers are getting outdated and people start to focus on deep learning methods. Deep learning provides the potential for end-to-end learning systems to automatically learn the abnormal patterns without massive feature engineering, saving plenty of detecting time. In this study, to further save both memory and times of learning systems, we propose a novel multi-task learning system based on convolutional neural network, which can simultaneously solve the tasks of malware detection, VPN-capsulation recognition and Trojan classification. To the best of our knowledge, it’s the first time to apply an end-to-end multi-task learn-ing system in traffic classification. In order to validate this method, we establish experiments on public malware dataset CTU-13 and VPN traffic dataset ISCX. Our system found a synergy among all these tasks and managed to achieve the state-of-the-art output for most of the experiments.

The secure sockets layer (SSL) protocol as a means of protecting the security of data transmission has been widely used. In this paper, to reduce the impact of poor network transmission on the overall delay of SSL transmission in an unstable network environment, a novel SSL transmission delay optimization algorithm based on network path delay prediction is introduced. We propose a locally weighted linear regression prediction algorithm based on sliding window and singular spectrum analysis to better adapt to the characteristics of network time-delay sequence. In an unstable network transmission environment, when the predicted TCP transmission delay fluctuates beyond a certain threshold, the optimization algorithm will calculate a new parallel degree of SSL data encryption and compression to make sure of an optimized overall delay of SSL transmission. But, in a stable network transmission environment, the TCP transmission delay slightly fluctuates and the parallel process takes no effect. It is significant, especially for a heavy-duty server, that it can dynamically and reasonably use the multi-core resources. The final SSL transmission experiment verifies the effectiveness of the proposed optimization algorithm.

针对嵌入式网络设备的服务可靠性问题,现有的网口容错主要采用双网卡冗余设计,研究针对单网卡多网口的情况,提出了一种网口容错方法,该方法能有效利用系统带宽资源。提出的网口容错方法包括一种网口状态检测机制和故障网口服务数据迁移方法,并设计了相应的功能模块。故障检测模块实现基于Loopback的检测方法,容错处理模块则实现在检测到故障后,可将故障网口的服务负载数据根据迁移策略迁移到其余正常网口。所提出的方法实现了对网口工作状态的快速检测和负载数据的有效容错。该方法具有应用无关性、资源占用率低的特点,通过测试验证了该方法的可行性。

提出了基于请求迁移的任务调度策略(Request migration based task scheduling,RMTS)算法,当有新请求到达系统时,运行RMTS算法的调度器根据当前负载状态和迁移路径长度决定是否对请求进行迁移,并选择最优迁移路径.当某个媒体服务器出现故障无法提供服务时,调度器将该服务器正在服务的请求迁移到其他存储有相应内容的媒体服务器以保障点播服务不间断.采用请求成功率和服务时延度量系统的性能,仿真结果表明:RMTS算法优于传统迁移算法和REM(Random early migration)算法,服务时延和请求成功率分别提高了14％和15％.

研究了多核网络处理器上流媒体应用的软件架构,在混合流水线(HPL)模型的基础了提出了虚拟流水线(VPL)模型,该模型能够克服HPL负载难以均匀分配的问题.VPL模型将功能逻辑设计和资源分配相分离,增强了应用开发阶段的灵活性.为VPL提出了AF和NAF两种数据流映射策略,并对两种策略的性能进行了理论分析和实验测试,探讨了二者之间如何选取.作为VPL的应用实例,基于VPL模型在Cavium OCTEON处理器上设计了流媒体网关应用HiliMG.对HiliMG的实验结果证明了VPL相对于HPL模型的性能优势,VPL使得吞吐率提升13％以上.

某些流媒体服务器需要对HTTP Chunked编码数据流进行并发解析,朴素静态解析算法难以应用于高效灵活的事件驱动并发模型,且会造成长延迟和多次数据拷贝,导致内存和计算资源开销都较高。针对上述问题,提出一种基于有限状态机的解析策略。将一次接收和一次解析操作构成一个任务片,从而适应事件驱动模型,对收到的数据包进行即时处理和释放,不需要缓存整个HTTP报文,减少一次内存拷贝开销。在数据处理过程中,通过有限状态机保存解析状态,能够在任务片退出后恢复之前的解析状态,从而解决事件驱动模型下的字段断裂问题。实验结果表明,相比于静态解析算法,该策略能够明显地降低解析过程的处理时间和占用的内存。

To effectively utilize storage space of edge streaming media servers, cache policies are being studied. Unlike traditional work that focused on hit ratio and overall system bandwidth cost, this paper recognize different significance of users and propose the concept of caching utility as a new metric to evaluate caching strategies. A user based caching algorithm, USCS, involving differentiated service is designed is put forward oriented to this metric. Simulation results show that this strategy can effectively improve caching utility while still keeping hit ratio in a high level.

Distributed Denial of Service (DDoS) attacks have caused continuous critical threats to the Internet services. DDoS attacks are generally conducted at the network layer. Many DDoS attack detection methods are focused on the IP and TCP layers. However, they are not suitable for detecting the application layer DDoS attacks. In this paper, we propose a scheme based on web user browsing behaviors to detect the application layer DDoS attacks (app-DDoS). A clustering method is applied to extract the access features of the web objects. Based on the access features, an extended hidden semi-Markov model is proposed to describe the browsing behaviors of web user. The deviation from the entropy of the training data set fitting to the hidden semi-Markov model can be considered as the abnormality of the observed data set. Finally experiments are conducted to demonstrate the effectiveness of our model and algorithm.

Abstract:The performance and stability related issues in WEB applications were studied and the results showed that some application layer protocol (such as HTTP, SSDP, etc.) structures have attributes like limited field, fixed number of field name, obvious position for field values and unstructured. A general application protocol parsing acceleration algorithm was proposed to prompt signaling handle efficiency. The key idea is the protocol field extended tree. The proposed algorithm was demonstrated and analyzed, and its time complexity only grows with not protocol content length but the sum of each field length in protocol format. The comparion with the algorithms used for existed protocol parsing methods in well-known WEB applications proved this algorithm outperformance 16.5% in throughput than compared methods under the same test conditions. Besides, the proposed algorithm could be applied to both ASCII and binary application protocols with good scalability.

Many network devices undertake tasks that involve extracting HTTP payload from a high concurrent number of data streams.In order to model such tasks and thus develop feasible approaches,this paper analyzes action characteristics of network byte stream reading and grammar of HTTP response message encoding.Based on this analysis, we propose a parsing algorithm for concurrent HTTP response streams,built upon stack buffer peeking operations and a extended finite state machine model.Implementation issues on parallel platforms are also studied in this paper.Our scheme is event-driven, does not require full buffering of the whole HTTP message, and reduces one memory copy compared to naive static parsing method.Test results from a Linux host show that our method achieves better performance in terms of CPU and memory consumption.

For solving the issues of efficiency,balance,reliability and scalability encountered in organizing a mass of crawler node to form a fully distributed crawler cluster,we proposed a fully distributed crawler cluster method based on kademlia.The method establishes the underlying communication mechanism between crawler nodes by improving the method of kademlia technology.On this basis,we designed and implemented a distributed crawler cluster model with task partitioning,exception handling,node join and exit process and load balance,based on the XOR characteristics in kademlia and available resources of the node.Experiments in the actual system show that this method can take advantages of computing,storage,and bandwidth resources of massive weak terminal to successfully build a fully distributed crawler cluster with efficient,balanced,reliable,and has large-scale development properties.

Web caching is a well-known strategy for improving the performance of web systems. The key to better web caching performance is an efficient replacing policy that keeps in the cache popular documents and replaces rarely used ones. When coupled with web log mining, the replacing policy can more accurately decide which documents should be cached. In this paper, we present a PLSA based prediction model to predict the user access patterns and interest to extend the well-known NGRAM-GDSF caching policy. Extensive experiments are conducted on the publicly available web logs datasets. The result shows that our approach gets better web-access performance.

针对高码率视频直播系统中轻量级签名认证方案开销过大的问题,提出一种非均匀认证保护方法.利用视频编码的帧间依赖关系量化数据包的认证重要性,以数据包保密级别和证据取值范围为约束条件,差异化不同重要性和密钥周期阶段下数据包的证据份额,减少了认证证据的消耗和认证异常的损失.仿真分析表明,在预设数据包保密级别为2112时,认证信息的通信和计算开销分别下降了67.0％和68.3％,可以满足10 Mbps视频组播认证的安全和性能需求.

In this paper, we focused on the architecture of video streaming based on multi-core processor. Compared with traditional video streaming server, multi-core architecture has a number of advantages: (1) according to system requirements, its flexible to add or remove executing core, (2) modules or units which consume much CPU resources can be configured to run concurrently on several cores, (3) multi-core architecture is fault-tolerant, and (4) the multi-core architecture fits well to future process technologies, more cores will be available in advanced process technologies, meanwhile the complexity per core does not increase. In order to improve the efficiency of video streaming and promote the concurrence number of tasks, we proposed a pipeline-parallel hybrid multi-core architecture on multi-core processor. We implemented the video streaming system with proposed architecture, and provided evidences of 48% outperformance based on Cavium OCTEON CN5860 multi-core processor than full parallel architecture.