Social media popularity prediction aims to forecast the future reach or influence of online content from early-stage observations. Accurate prediction enables key downstream applications, such as advertising optimization and strategic content planning by users, creators, and platforms. Despite substantial progress, existing popularity prediction works often fail to jointly consider multimodal content and temporal social interaction signals. Moreover, the literature remains highly fragmented across datasets, modalities, observation windows, prediction targets, and evaluation protocols. This fragmentation prevents fair comparison and obscures a systematic understanding of how textual, visual, temporal, and interaction-based signals jointly shape popularity dynamics. To address these challenges, we introduce MMG-Pop, a Multi-modal Graph-based Popularity Prediction benchmark, which unifies datasets, modalities, temporal interaction signals, and representative baselines under a standardized evaluation protocol. Furthermore, we propose MMG-PopNet, a unified multi-modal graph-based network that jointly models the aforementioned multi-modal signals and graph-structured social interactions. Extensive experiments on MMG-Pop, comprising four datasets across Bluesky and Reddit platforms, demonstrate the superior performance of MMG-PopNet and yield new insights into cross-platform training generalization, multi-task prediction benefits, multi-modality contributions, and LLM prediction limitation. These findings establish a unified foundation for future research on social dynamics modeling and intervention under heterogeneous modalities and socially-aware agentic ecosystem paradigms.

Influence Maximization (IM) is to identify the seed set to maximize information dissemination in a network. Elegant IM algorithms could naturally extend to cases where each node is equipped with a specific weight, reflecting individual gains to measure the node's importance. Prevailing literature typically assumes such individual gains remain constant throughout the cascade process and are solvable through explicit formulas based on the node's characteristics and network topology. However, this assumption is not always feasible for two reasons: 1)Unobservability: The individual gains of each node are primarily evaluated by the difference between the outputs in the activated and non-activated states. In practice, we can only observe one of these states, with the other remaining unobservable post-propagation. 2)Environmental sensitivity: In addition to the node's inherent properties, individual gains are also sensitive to the activation status of surrounding nodes, which is dynamic during iteration even when the network topology remains static. To address these challenges, we extend the consideration of IM to a broader scenario with dynamic node individual gains, leveraging causality techniques. In our paper, we introduce a Causal Influence Maximization (CauIM) framework and develop two algorithms, G-CauIM and A-CauIM, where the latter incorporates a novel acceleration technique. Theoretically, we establish the generalized lower bound of influence spread and provide robustness analysis. Empirically, in synthetic and real-world experiments, we demonstrate the effectiveness and robustness of our algorithms.

Access Control Lists (ACLs) are crucial for ensuring the security and integrity of modern cloud and carrier networks by regulating access to sensitive information and resources. However, previous software and hardware implementations no longer meet the requirements of modern datacenters. The emergence of FPGA-based SmartNICs presents an opportunity to offload ACL functions from the host CPU, leading to improved network performance in datacenter applications. However, previous FPGA-based ACL designs lacked the necessary flexibility to support different rulesets without hardware reconfiguration while maintaining high performance. In this paper, we propose HACL, a heterogeneous and adaptive architecture for decision-tree-based ACL engine on FPGA. By employing techniques such as tree decomposition and recirculated pipeline scheduling, HACL can accommodate various rulesets without reconfiguring the underlying architecture. To facilitate the efficient mapping of different decision trees to memory and optimize the throughput of a ruleset, we also introduce a heterogeneous framework with a compiler in CPU platform for HACL. We implement HACL on a typical SmartNIC and evaluate its performance. The results demonstrate that HACL achieves a throughput exceeding 260 Mpps when processing 100K-scale ACL rulesets, with low hardware resource utilization. By integrating more engines, HACL can achieve even higher throughput and support larger rulesets.

The rapid proliferation of Internet of Things (IoT) devices has introduced significant challenges in securing network infrastructure, stemming from device heterogeneity, dynamic communication patterns, and constrained computational resources. Traditional approaches to IoT network anomaly detection often rely on deep learning models that are too resourceintensive for edge deployment, while conventional Neural Architecture Search (NAS) techniques remain computationally prohibitive. To address these limitations, we propose a novel Graph-based Neural Architecture Search (GNAS) framework for efficient and adaptable model generation in IoT environments. By representing the search space as a graph, GNAS enables subgraph reuse and reduces redundant computation, significantly lowering training time compared to standard NAS methods. Models discovered through GNAS can be deployed at the edge, offering improved scalability and responsiveness. Experimental results on the NF-TON_IoT dataset demonstrate the effectiveness of our approach, with the best-performing subgraph model achieving 97% accuracy, 96% precision, 97% recall, and a 97% F1-score.

Online social networks are easily exploited by social bots. Although the current models for detecting social bots show promising results, they mainly rely on Graph Neural Networks (GNNs), which have been proven to have vulnerabilities in robustness and these detection models likely have similar robustness vulnerabilities. Therefore, it is crucial to evaluate and improve their robustness. This paper proposes a robustness evaluation method: Attribute Random Iteration-Fast Gradient Sign Method (ARI-FGSM) and uses a simplified adversarial training to improve the robustness of social bot detection. Specifically, this study performs robustness evaluations of five bot detection models on two datasets under both black-box and white-box scenarios. The white-box experiments achieve a minimum attack success rate of 86.23

With the exponential growth of user-generated on-line videos, multimodal sarcasm detection has recently attracted widespread attention. Despite making significant progress, there are still two main challenges: 1) previous works primarily relied on word-level feature interactions to establish relationships between inter-modality and intra-modality, which could potentially lead to the loss of fundamental emotional information. 2) they obtained the incongruity information only interacted with textual modality, which may lead to the neglect of incongruities. To address these challenges, we propose a novel utterance-level incongruity learning network (ULIL) for multimodal sarcasm detection, where the multimodal utterance-level attention (M-ULA) and incongruity learning network (ILN) are the two core modules. First, we present M-ULA to interact with utterance-level multimodal information, complementing word-level features. Furthermore, ILN selects primary modality and auxiliary modality automatically, and leverages cross-attention and self-attention to learning incongruity representations. We conduct extensive experiments on public datasets, and the results indicate that our proposed model achieves state-of-the-art performance in multimodal sarcasm detection.

Launched from numerous end-hosts throughout the Internet, a distributed denial-of-service (DDoS) attack can exhaust the network bandwidth or other resources of a victim, cripple its service, and make it unavailable to legitimate clients. Recently many learning-based approaches attempt to detect DDoS attacks, but their results are often hardly explainable to users and their models are seldom adaptable to new environments. In this paper, we propose a new learning-based DDoS detection approach. It detects DDoS attacks via an enhanced k-nearest neighbors (KNN) algorithm, which utilizes a k-dimensional (KD) tree to speed up the detection process, and classifies DDoS sources at a fine granularity according to each IP's risk level. Compared to previous DDoS detection approaches, this approach outputs explanatory information that enables network administrators to easily inspect detection results and make necessary interventions. Moreover, this approach is adaptable in that users do not need to retrain the detection model to have it fit with a new network environment. We evaluated this approach in both simulated environments and the real world, achieving more than 95.6% accuracy in detecting DDoS attacks at line speed. In addition, we carried out a human subject study on its explainability, demonstrating that the outputs can help people better understand the attack and make interventions precisely and promptly.

In this paper, we study a defense against poisoned encoders in SSL called distillation, which is a defense used in supervised learning originally. Distillation aims to distill knowledge from a given model (a.k.a the teacher net) and transfer it to another (a.k.a the student net). Now, we use it to distill benign knowledge from poisoned pre-trained encoders and transfer it to a new encoder, resulting in a clean pre-trained encoder. In particular, we conduct an empirical study on the effectiveness and performance of distillation against poisoned encoders. Using two state-of-the-art backdoor attacks against pre-trained image encoders and four commonly used image classification datasets, our experimental results show that distillation can reduce attack success rate from 80.87% to 27.51% while suffering a 6.35% loss in accuracy. Moreover, we investigate the impact of three core components of distillation on performance: teacher net, student net, and distillation loss. By comparing 4 different teacher nets, 3 student nets, and 6 distillation losses, we find that fine-tuned teacher nets, warm-up-training-based student nets, and attention-based distillation loss perform best, respectively.

With the growth of the Internet of Things (IoT), the number of cyber attacks on the Internet is on the rise. However, the resource-constrained nature of IoT devices and their networks makes many classical security systems ineffective or inapplicable. We introduce TWINKLE, a two-mode, adaptive security framework that allows an IoT network to be in regular mode for most of the time, which incurs a low resource consumption rate, and to switch to vigilant mode only when suspicious behavior is detected, which potentially incurs a higher overhead. Compared to the early version of this work, this article presents a more comprehensive design and architecture of TWINKLE, describes challenges and details in implementing TWINKLE, and reports evaluations of TWINKLE based on real-world IoT testbeds with more metrics. We show the efficacy of TWINKLE in two case studies where we examine two existing intrusion detection and prevention systems and transform both into new, improved systems using TWINKLE. Our evaluations show that TWINKLE is not only effective at securing resource-constrained IoT networks, but can also successfully detect and prevent attacks with a significantly lower overhead and detection latency than existing solutions.

While mitigating link-flooding attacks on the Internet has become an essential task, little research has been done on how an attacker can further attack and abuse the mitigation solutions themselves. In this paper, we propose a two-wave attack with collateral damage of millions (or Carom), a new link-flooding attack that poses a mitigation dilemma for multiple simultaneously attacked networks, which must either endure the flooding attack or suffer unwanted side effects in mitigating the attack. Composed of practical components, the Carom attack aims to maximize the burden on attack mitigation systems and the collateral damage to defending networks, thereby wreaking havoc on large swaths of the Internet. After modeling real-world mitigation solutions, we evaluated the attack against the mitigation solutions with real-world datasets, showing the feasibility of the attack and quantifying the amount of damage it can inflict on today's Internet. We hope that this work can motivate the improvement of existing link-flooding mitigation solutions.

Distributed denial-of-service (DDoS) attacks are becoming more frequent and powerful. Traditional edge defense solutions can no longer keep up, and in-network defense solutions are needed that involve multiple Internet Service Providers (ISPs) to collaboratively defend against the attacks. While collaborative defense solutions are technically more effective at stopping large-scale attacks, the incentives for ISPs to deploy these solutions remain unexplored. In this study, we develop a game theoretic model to capture the economic benefits and costs of deployment for ISPs competing for customers. Through large-scale simulations at the Internet level, we find that the majority of ISPs on the Internet have an economic incentive to participate in DDoS defense, driven by competition; and that the severity of DDoS attacks and the level of competition affect an ISP's charge for filtering DDoS traffic for its customers.

Traffic flow forecasting plays a crucial role in applications such as intelligent transportation systems. Despite significant research in this field, the current methods have limitations that hinder the realization of highly accurate predictions. Existing GCN-based approaches typically rely on a definite graph structure derived from a physical topology or learned from node features, which is insufficient for building intricate spatial relationships among nodes. To address this challenge, we propose an adaptive spatial–temporal graph convolutional network for traffic forecasting. Our approach exploits a multi-head attention mechanism to construct multi-view feature graphs. We then introduce an adaptive graph convolution method to dynamically aggregate and propagate information from both the topology graph and multi-view feature graphs, which are capable of capturing complex spatial correlations across diverse proximity ranges. Furthermore, we designed a cascaded structural framework that combines temporal information with node features using gated dilated causal convolution to ensure the integrated modeling of spatial–temporal dynamics in traffic flow. Experiments on real-world datasets demonstrate that our proposed method outperforms the current mainstream methods, achieving better performance in traffic flow forecasting. The code is available at https://github.com/dhxdla/AdpSTGCN.git.

Despite various distributed denial-of-service (DDoS) filtering solutions proposed and deployed throughout the Internet, DDoS attacks continue to evolve and successfully overwhelm the victims with DDoS traffic. While current DDoS solutions in general employ a fixed filtering granularity (e.g., IP address, 4-tuple flow, or service requests) with a specific goal (e.g., maximum coverage of DDoS traffic), in this paper we investigate adaptive DDoS filtering. We design and experiment algorithms that can generate and deploy DDoS-filtering rules that not only adapt to the most suitable and effective filtering granularity (e.g., IP source address and a port number vs. an individual IP address vs. IP prefixes at different lengths), but also adapt to the first priorities of victims (e.g., maximum coverage of DDoS traffic vs. minimum collateral damage from dropping legitimate traffic vs. minimum number of rules). We evaluated our approach through both large-scale simulations based on real-world DDoS attack traces and pilot studies. Our evaluations confirm that our algorithms can generate rules that adapt to every distinct filtering objective and achieve optimal results.

Despite the proliferation of traffic filtering capabilities throughout the Internet, attackers continue to launch distributed denial-of-service (DDoS) attacks to successfully overwhelm the victims with DDoS traffic. In this paper, we introduce a distributed filtering system that leverages nodes distributed along the paths of DDoS traffic to filter the DDoS traffic. In particular, we focus on adaptive distributed filtering, a new direction in filtering DDoS traffic. In our design, a subscriber to the distributed filtering service can act on behalf of a DDoS victim and generate filtering rules that not only adapt to the most suitable and effective filtering granularity (e.g., IP source address and a port number vs. an individual IP address vs. IP prefixes at different lengths), but also adapt to the preferences of the subscriber (e.g., maximum coverage of DDoS traffic vs. minimum collateral damage from dropping legitimate traffic vs. minimum number of rules). We design an efficient algorithm that can generate rules adaptive toward filtering granularities and objectives, which can further help determine where to deploy generated rules for the best efficacy. We evaluated our system through both large-scale simulations based on real-world DDoS attack traces and pilot studies. Our evaluations confirm that our algorithm can generate rules that adapt to every distinct filtering objective and achieve optimal results. We studied the success rate and distribution of rule deployment under different Internet-scale rule deployment profiles, and found a small number of autonomous systems can contribute disproportionately to the defense. Our pilot studies also show our adaptive distributed filtering system can effectively defend against real-world DDoS attack traces in real time.

In order to cope with the current situation of low self-discipline of enterprises, frequent violations and difficult government supervision in the internet environment, a Two-layer ensemble residual prediction Neural Network（TenrepNN） model was proposed to evaluate the self-discipline of enterprises. Integrating the ideas of Stacking and Bagging ensemble learning, a new paradigm of integrated learning was designed, namely Adjusting. TenrepNN model had a two-layer structure. In the first layer, three base learners were used to preliminarily predict the enterprise score. In the second layer, the idea of residual correction was adopted and residual prediction neural network was devised to predict the output deviation of each base learner. Finally, the final output was obtained by adding the deviation with the base learner score. In the enterprise self-discipline score dataset, compared with the vanilla neural network, the root mean square error of the proposed model is reduced by 2.7%, and the classification accuracy in the self-discipline level reached 94.5%. By integrating base learners trained from different subdatasets to diminish the variance and using residual prediction neural network to decrease the bias explicitly, the model can accurately evaluate enterprise self-discipline to achieve differentiated dynamic supervision.

In recent years, Information-Centric Networking (ICN) has been widely considered as an ideal architecture for the Internet of Things (IoT) due to the fact that ICN's in-network caching can enhance the efficiency of content delivery and friendly to resource-constrained IoT devices. Meanwhile, on the whole, the major factors considered by current ICN-IoT caching schemes involve content popularity, network topology and content freshness. However, current methods mainly focus on some of them, lack of overall consideration. To this end, we propose a comprehensive solution by considering all three factors. Specifically, we define cache benefit by considering content popularity, network topology and content freshness simultaneously, and let routers cache contents in order of their cache benefits. We also devise a prediction method to make routers obtain cache benefits of new contents early. Extensive evaluations reveal that PTF can effectively improve the response latency, average hop reduction and cache hit ratio, compared with other representative strategies.

为解决命名数据网络拥塞控制算法普遍存在的瓶颈链路缓存队列积压问题,提出一种基于多指标感知的命名数据网络自适应拥塞控制(MACC)算法.在网内节点,根据实时监测的接收端数据接收速率、数据包排队时延、链路带宽等多个指标估计链路负载程度,并通告终端节点.在终端节点,根据Data包携带的链路负载信息,自适应地调整发送窗口,以实现高吞吐、低时延目标.基于ndnSIM的仿真结果表明,该算法能有效实现终端高吞吐量、瓶颈链路低队列,并在实现流间公平性方面具有显著优势.

Self-propagating worms can infect millions of computers on the Internet in just several minutes. As witnessed by the recent Mirai and WannaCry worms, worm attacks are real, destructive, and continue to persist. Although many worm detectors exist, most that we studied suffer from three drawbacks: none systematically consider countermeasures from worm authors, potentially causing low effectiveness against evasive worms; all focus on outbound worms leaving a network, leaving their efficacy against inbound worms entering a network unanswered; and many require bi-directional traffic to detect worms, making their placement on the Internet inflexible. We therefore revisit worm detection in this paper, while avoiding the aforementioned drawbacks of existing work. We describe our design of SWORD, a new worm detector that focuses on the fundamental behavior of worms. It includes two complementary modules to monitor connections from and to a protected network, with one module monitoring burst durations and the other ensuring quiescent periods. Via extensive experiments using both simulated worm traffic and a real-world Mirai worm trace, we demonstrate that SWORD is superior to existing detectors at not only detecting both classic and evasive outbound worms, but also inbound worms, especially those that are superspreading or surreptitious.

Intrusion detection is an effective means to deal with network attacks. Currently, the commonly used detection methods are based on machine learning. However, traditional machine learning-based methods are centralized architectures that require uploading data to cloud servers, which face serious latency and data security issues. Federated learning (FL) can collaboratively train a machine learning model with good performance while the data is kept locally on the client, which can effectively make up for the shortcomings of the centralized architecture. Most of the current research on using FL methods in machine learning-based intrusion detection ideally consider the data to be independent and identically distributed (IID), which doesn't conform to real scenarios. In the real world, due to the different environment of the client, the types of attacks contained in the data owned by each client may be different. Therefore, we study the effects of various non-independent and identically distribution (non-IID) settings on FL in detail and give specific partitioning methods. In addition, we also propose a FL data rebalancing method based on auxiliary classifier generative adversarial networks (ACGAN), which is experimentally validated on the UNSW-NB15 dataset. Experiments show that the proposed data augmentation method can well improve the impact of non-IID data on FL.

As one of the emerging technologies that have attracted much attention, blockchain has a wide range of application prospects. However, one prominent issue restricting its development is the limited transaction throughput. Take the well-known open-source system Hyperledger Fabric as an example. In the solution of parallel transaction processing, it follows the processing method of MVCC in the database, which is not compatible with blockchain features, resulting in a sharp drop in throughput and wastes of storage space in high concurrency scenarios. In this paper, we propose a high-throughput optimization scheme FabricETP that can effectively solve concurrency conflicts. According to the different causes of conflicts, FabricETP proposes optimization ideas from two dimensions. For transaction conflicts within a block, FabricETP proposes a scheduling algorithm to minimize the number of conflicting transactions by rearranging the transaction execution order. For transaction conflicts between blocks, FabricETP has established a cache-based conflict transaction avoidance mechanism, so that invalid transactions are aborted early. With the help of general blockchain performance testing tools, we carry out experiments under various workload scenarios. The results show that the throughput of FabricETP can reach up to 9.51 × that of the benchmark blockchain system Fabric and 1.26 × of the optimized version of Fabric + + under high concurrency scenarios. Compared with Fabric + + , the space utilization is increased by 20