Regular expression matching is a crucial step in traffic analysis. Many hardware-based architectures are proposed to improve the matching throughput, such as FPGA. To date, however, the existing FPGA-CPU architectures are difficult to implement in DPI systems due to the following two reasons. First, existing architectures use asynchronous workflows to interact data between FPGA and CPU, making them difficult to be compatible with synchronous DPI systems. Second, asynchronous architectures require batch input, which does not meet the requirements of real-time environments. In this paper, we concentrate on the real-time deployment of a regular expression matching architecture. To improve the deployment throughput, we propose an FPGA-CPU architecture with a parallel layer between the driver and DPI systems. Then, coroutines are introduced and proved to have significant advantages. Meanwhile, some optimization methods are proposed to address idle time, memory allocation, and MMIO control. Our experiments demonstrate that directly deploying an asynchronous architecture on a synchronous DPI would result in a throughput degradation of 3 orders of magnitude. Our approach enhances throughput by 2-3 orders of magnitude. This indicates that we reach a throughput in synchronous mode that is comparable to that in asynchronous mode, and it is over 10 times faster than the software solution, making the direct deployment of asynchronous architectures on mainstream DPI systems feasible. To the best of our knowledge, this is the first attempt to improve hardware-based regular expression matching under synchronous logic, achieving both high throughput and usability.

Network traffic research relies on large-scale, high-quality traffic data. However, obtaining such data remains difficult because of privacy constraints, collection costs, class imbalance, and continuous updates. These challenges have increased researchers' interest in traffic generation. Although many generation methods have been proposed, existing studies and surveys often overlook two key questions: what form of traffic is generated and what practical objectives it can support. Based on 113 candidate records published from 2019 to 2026, this survey provides a detailed analysis of 39 representative network traffic generation studies through the lenses of representation levels and objective consistency. We organize existing methods into four representation levels and analyze how generated data relate to usage scenarios. We find that many methods preserve information that is useful for downstream tasks such as classification and intrusion detection, but task usefulness does not guarantee replayability or usability in real network environments. High-level representations are easier to model, yet they often discard protocol semantics, packet dependencies, and communication logic. We therefore distinguish task consistency from protocol consistency and show that the latter remains underexplored. We further summarize evaluation practices, discuss level-specific metrics, and highlight future directions including controllable generation, protocol-aware state-consistent synthesis, and engineering-oriented evaluation.

Encrypted traffic classification is widely used for security monitoring and network management, yet most recent works still rely on an unrealistic assumption: an isolated flow or session always maps to a single label. In tunnel-world deployments (e.g., VPN- or Tor-like settings), this assumption often breaks. Multiple concurrent activities are multiplexed into one channel, and a tunnel connection may contain several network behaviors and substantial non-target interference. This paper advocates a shift from classification to presence detection: instead of assigning one label to a tunnel connection, the goal is to detect which monitored traffic types are present.We proposed Detect What Traffic Needs (DWTN), a unified single-model framework for multiplexed encrypted traffic detection. DWTN uses a shared feature extractor to encode a mixed flow into a channelized representation, and derives a label-specific Channel Modulation vector from pure single-label samples. Channel Modulation selectively activates or suppresses channels to construct label-specific representations from the original features. Using a shared classification head to identify all the label-specific representations changes multi-target detection to parallel binary detection, and can support low-cost onboarding of new targets without retraining the full model.Experiments on synthesized closed-world and open-world mixtures with different numbers of concurrent flows show that DWTN consistently outperforms strong baselines, improving open-world AUC by up to 13.0% and P @k by up to 15.8%, and improving detection mAP by up to 53.0% under target-extension scenarios.

Passwords have been widely used for authentication, yet they face significant security risks due to the progress of modern targeted guessing attack methods. Understanding the risks of targeted password guessing is crucial for improving the security of many critical network systems. While current approaches can effectively utilize specific leaked data, they typically treat these sources in isolation. Failing to account for the combined effects of heterogeneous user-specific information and population-level password priors can lead to an underestimation of password vulnerability, highlighting the need for a more comprehensive targeted guessing framework. To this end, we propose MDIGuess, an autoregressive neural framework for targeted password guessing with explicit multi-dimensional information utilization. MDIGuess organizes exploitable information into three dimensions: historical passwords, personally identifiable information (PII), and general leaked-password data. Historical passwords capture reuse and modification behaviors, PII provides user-specific lexical cues, and general leaked passwords provide population-level priors through popular-list integration and autoregressive pre-training. Extensive experiments on eight attack scenarios built from nine large-scale password datasets show that MDIGuess achieves an average cracking success rate of 36.86% within 1,000 guesses, improving by 43.64% on average over four state-of-the-art targeted guessing baselines. Furthermore, analyses on representative scenarios show that targeted popular-list integration and autoregressive pre-training can further improve guessing performance, with additional Top-1,000 gains of 0.87%–1.39%. A PII-rich scenario also confirms that non-email attributes such as username, name, and birthday can provide useful personalized signals. Finally, we develop MDI-PSM, an attack-aware password strength meter that better reflects targeted guessing risks by incorporating multi-dimensional targeted-risk signals. These results provide a more realistic basis for evaluating password vulnerability under targeted guessing attacks.

Network traffic classification is a core technology for network monitoring, security analysis, and traffic management. However, most existing methods assume a closed-set setting in which all test classes are known during training. This assumption is unrealistic in dynamic networks where new applications, services, proxy traffic, and encryption configurations continuously emerge. Open-set traffic classification is therefore required to accurately classify known traffic while rejecting unknown samples. This problem involves two distinct objectives, namely learning discriminative features for known-class classification and modeling compact distributions of known traffic for unknown rejection, which impose different requirements on the representation space. To address this issue, we propose a dual-branch framework with a shared hierarchical encoder. The classification branch enhances angular separability among known classes by learning discriminative directions in the feature space via a cosine classifier, while the rejection branch employs Deep Support Vector Data Description (Deep SVDD) to characterize the distribution of known traffic for effective unknown detection. Experiments on three public datasets under six cross-dataset scenarios demonstrate that the proposed method achieves competitive known-class accuracy and strong open-set detection performance.

Abstract The HTTPS certificate ecosystem has long been a key topic in cybersecurity, yet the certificate landscape of Android applications remains insufficiently studied. In particular, while China has actively promoted the adoption of China’s national cryptographic algorithms in recent years, their actual deployment within the Chinese Android certificate ecosystem remains unclear. In this study, we analyzed TLS traffic from 19,980 applications in the Huawei App Market and extracted 131,933 certificate chains. While most certificates are properly configured, we identified 530 certificates with security risks, affecting 2043 applications. Notably, three SDK-related risk certificates were propagated across 1462 applications, substantially widening their security impact. Only 94 certificates using China’s national cryptographic algorithms were found, all within 89 financial applications, indicating deployment driven mainly by regulatory compliance. Furthermore, nearly 99% of leaf certificates chain back to foreign root Certificate Authorities, underscoring a strong dependency that may pose digital sovereignty risks under geopolitical uncertainty. This study highlights the existing challenges in the Chinese Android certificate ecosystem, particularly in terms of security and digital sovereignty, and offers relevant recommendations for improvement.

The Transport Layer Security (TLS) protocol has become the de-facto security standard for Internet communications. While its widespread deployment protects user privacy, it also provides threat actors with a channel to evade network inspection. As a widely adopted AEAD algorithm in TLS, AES-GCM couples encryption and authentication functions into a single key, creating an "all-or-nothing" authority dilemma. This paper presents AES-iGCM, an inspectable AES-GCM variant that splits the encryption and authentication keys to grant fine-grained read-only access. An authorized inspector receives only the decryption key, so it can read plaintext and detect malware, yet lacks the authentication key to modify data or forge valid tags, preserving end-to-end confidentiality and integrity while enabling compliant network oversight. This paper formally defines the AES-iGCM algorithm and discusses its integration scheme in the TLS protocol, and proves its practicality through performance evaluation.

Web vulnerabilities represent critical attack vectors, yet rapid CVE growth has outpaced manual validation capabilities. Existing automated approaches—template-based systems, direct LLM prompting, and standard RAG—suffer from knowledge staleness, hallucinations, and semantic retrieval limitations when addressing emerging vulnerabilities with complex dependencies. We present KAWVE (Knowledge-Augmented Web Vulnerability Exploit), a DeepSeek-powered framework integrating structured domain knowledge with autonomous reasoning for automated vulnerability validation. The system features three core innovations: (1) a multi-source vulnerability knowledge graph from NVD, Exploit-DB, and GitHub that captures vulnerability entities and exploitation dependencies; (2) a ReAct-based generation agent executing iterative "query-detect-generate-execute" cycles with dynamic self-correction through environment feedback; and (3) a comprehensive validation engine employing vulnerability-type-specific strategies (HTTP response analysis, out-of-band detection, system monitoring) with LLM-powered evidence interpretation. Evaluation on 30 high-severity web CVEs from the past five years (spanning SSRF, path traversal, SQL injection, and RCE) demonstrates 100% validation success, substantially outperforming vanilla DeepSeek (3.3%) and DeepSeek with ReAct (13.3%). For SSRF vulnerabilities, KAWVE achieved 100% success versus SSRFMap’s 40%, validating the efficacy of coupling structured vulnerability knowledge with agent-based reasoning for reliable automated vulnerability assessment.

In digital forensics practice, the precise determination of file fragment types serves as an essential prerequisite for successful file carving. Recent advancements in neural network-based methods have shown promise in this area, though challenges remain regarding temporal pattern capture in byte data and feature representation scalability within individual architectures. We propose ByteGT, the first hybrid neural network that integrates sequential modeling and attention mechanisms to further enhance the classification performance for file fragments. The model operates end-to-end on raw byte data without manual preprocessing through two novel components. The first component is a deep sequence perception module combining byte embeddings with bidirectional GRU to capture comprehensive temporal dependencies, and the second component is a fine-grained feature enhancement module using convolution-based attention layers to amplify discriminative features. Extensive evaluations on standard datasets demonstrate ByteGT’s superiority. Specifically, in most complex classification scenarios, we achieve 6.9% and 7% accuracy gains over state-of-the-art methods for 512-byte and 4096-byte sector sizes, respectively. When tested in other scenarios, ByteGT exhibits strong generalizability and robustness.

Identity privacy leakage through the wireless interface in mobile networks represents a persistent security challenge and a long-standing concern that network designers have aimed to address. Despite the remediation introduced in 5G standards, identity privacy attacks targeting the wireless interface continue to pose a potential threat. In this paper, we present an identity mapping attack based on time series similarity in 4G and 5G networks. This attack enables an adversary with no privileges to map a victim's social media account to their RNTI by sending a single image message to the victim and measuring the similarity of time series extracted from the generated downlink traffic. To improve the attack success rate, we specifically design an elastic similarity measure for time series, tailored to the properties of the data collected during the attack. We investigate the feasibility of the attack under various scenarios, achieving a success rate of 83% for a single attempt and nearly 100% when conducting two or three attempts. Our work provides new insights into the vulnerability of 4G/5G standards to identity privacy attacks.

Encrypted traffic identification plays a crucial role in improving service quality, optimizing network management, and maintaining network security. Various machine learning and deep learning based methods have proposed to address the challenge of identifying encrypted traffic. However, existing methods face two challenges. First, they are easily affected by interfering traffic, which reduces the accuracy of identifying traffic. Second, they rely on expert annotations to identify unknown applications. In this paper, we propose multi-flow based method, namely MFSI, for identifying the service of encrypted network traffic. MFSI multiple flows as the classification unit to reduce the impact of interfering flows and constructs a robust structure Multi-Flow Multi-Relational Graph (MMRG), based on three types of relationships. Then, it introduces Relational Graph Convolutional Networks to update vertex features in MMRG and generates global graph representations for multi-flow classification. We conduct experiments on raw network traffic. The results that MFSI can achieve a classification accuracy of 98.58% without filtering or deleting any traffic, surpassing state-of-the-art schemes. It also performs well in identifying the type of services of unknown encrypted

In recent years, web tracking has raised concerns about privacy during web browsing. This paper introduces SEQ-Track, a novel method for detecting web tracking behaviors by leveraging length and time information in encrypted traffic. SEQ-Track extracts the packet length sequences and time interval sequences of packets from network traffic flows and utilizes feature extractors based on the Convolutional Neural Network (CNN) and Transformer to perform web tracking detection. Our experimental results demonstrate that SEQ-Track performs well with over 90

Mobile application fingerprinting attacks pose serious privacy threats by identifying the applications used by victims, thereby revealing personal preferences and lifestyle habits. In this paper, we present Cellular-Snooper, the first general and real-time mobile application fingerprinting attack in LTE networks. Cellular-Snooper leverages three novel approaches to improve generality and real-time performance: (1) Using a trace segmentation method to reduce the data collection time. (2) Combining active and passive identity mapping attacks to achieve continuous monitoring. (3) Utilizing a modified GAN to augment the training data. We investigate the feasibility of Cellular-Snooper in a commercial LTE network and achieve an accuracy rate of 90.7

Since the release of the Fifth Generation (5G) Stand-alone (SA) standard in 2018, there is a swift and widespread global adoption of 5G SA mobile network. For the present and foreseeable future, 5G technology will remain the core of mobile networks. Like previous generations of mobile networks, 5G networks have encountered numerous security issues during actual deployment and service provision, which have led to various serious impacts. Based on this, this paper systematically analyzes existing attacks targeting the User Equipment (UE), Radio Access Network (RAN), and core network of 5G networks. We propose a simple and effective method to investigate attacks on various parts of 5G networks, classify these attacks, and discuss their implications, causes, and defense solutions in detail. We find that most security issues have been theoretically addressed through defense solutions proposed in academic literature and 3rd Generation Partnership Project (3GPP) specifications. However, whether these solutions have been implemented in existing 5G networks remains to be verified. Through a deep analysis of existing 5G network security issues, this paper also proposes potential directions for future 5G security research, aiming to promote further research in the field of 5G security and enhance the overall security of future mobile networks.

Finding persistent sparse (PS) flow is critical to early warning of various threats. Previous works have predominantly focused on either heavy or persistent flows, with limited attention given to PS flows. Although some recent studies pay attention to PS flows, they struggle to establish an objective criterion due to insufficient data-driven observations, resulting in reduced accuracy. In this paper, we define a new criterion ''anomaly boundary'' to distinguish PS flows from regular flows. Specifically, a flow whose persistence exceeds a threshold will be protected, while a protected flow with a density lower than a threshold is reported as a PS flow. We then introduce PSSketch, a high-precision layered sketch, to find PS flows. PSSketch employs variable-length bitwise counters, where the first layer tracks the frequency and persistence of all flows, and the second layer protects potential PS flows and records overflow counts from the first layer. Some optimizations have also been implemented to reduce memory consumption further and improve accuracy. The experiments show that PSSketch reduces memory consumption by 1-2 orders of magnitude compared to the strawman solution combined with existing work. Compared with SOTA solutions for finding PS flows, it outperforms up to 2.94x higher in F1 score and reduces ARE by 1-2 orders of magnitude. Meanwhile, PSSketch achieves a higher throughput than these solutions.

Website fingerprinting is emerging as a technique capable of compromising anonymous communication (such as Tor), which provides a way for forensic investigation of illegal activities in anonymous networks. However, current research makes critical assumptions about data collection, where the digital investigator needs to collect extensive user traffic data, and the data are required in the same domain. In this paper, we propose a cross-domain few-shot method KP-WF, a Knowledge Fusion-based Two-Branch Prototypical Network Website Fingerprinting method, to realize accurate website fingerprinting in a realistic scenario. With the proposed method, we reduce the digital investigators’ dependence on auxiliary and target datasets through a prototypical network, addressing its inherent limitations in cross-domain scenarios by designing a novel knowledge fusion-based two-branch architecture. Additionally, the knowledge fusion module in the sub-branch empowers investigators to establish an advantage in targeted tasks. We conduct extensive experiments on 14 datasets to demonstrate the superiority of the proposed method in different scenarios. Experimental results show that in the most challenging 1-shot scenario, KP-WF achieves an accuracy improvement of more than 10

Network traffic classification is critical for ensuring network quality, security, and stability. However, the increasing complexity of network environments and the growth of encrypted traffic bring significant challenges. Traditional rule-based, machine learning-based, and deep learning-based approaches are limited by the scarcity of plaintext, reliance on handcrafted features, and the need for large labeled datasets. Pre-training methods have alleviated these issues, but existing models mainly focus on payload semantics and lack dedicated learning of traffic behavior patterns essential for encrypted traffic characterization. Motivated by this, we propose TrafficBM, a dual-modality pre-training framework that jointly models semantic features and traffic behavior patterns. Our approach extracts dualmodality features from network traffic and applies modalityspecific data augmentation to mitigate data imbalance and scarcity. During pre-training, BERT leverages masked bigram modeling (MBM) to capture semantic information, while Mamba uses a masked autoencoder (MAE) architecture to learn traffic behavior patterns. An adaptive gating network, together with a parameter-preserving warm-up strategy, fuses features from both pre-trained models during fine-tuning to improve downstream classification performance. TrafficBM achieves state-of-the-art results on six tasks across eight datasets, including over 0.99 accuracy on five datasets and a 10 % improvement over the best baseline on Datacon2021 Part 2, demonstrating strong generalization and robustness in network traffic classification.

Website fingerprinting (WF) attacks can reveal the users' online privacy by the traffic analysis technique, even with the protection of the Tor anonymity network. Recent WF attacks tend to leverage the deep learning (DL) models, which require a large number of traffic samples for training. In this case, it is impractical for low-resource adversaries in reality. Thus, we propose a lightweight WF attack to tackle this challenge, i.e., Deep Quadruplet Fingerprinting (DQF), which only needs one training sample to obtain an accuracy of 87.1%. Regarding the overall design, DQF first combines the metric learning and meta-learning schemes. To improve the generalization ability of the trained model, DQF leverages the quadruplet networks as the architecture and modifies the quadruplet loss function. Besides, by taking the deep local fingerprinting features (DLFFs), DQF avoids losing a lot of discriminative information, which is a problem with previous attacks. To evaluate DQF, we use multiple typical datasets and conduct 11 different experiments. In closed-world settings, the accuracy of DQF can exceed the best baseline attack by 10%. In open-world settings, DQF steadily performs the best even in the most challenging scenario, namely, 1-shot learning, where previous attacks significantly degrade the performance or even fail.

Web tracking has become a key tool for service providers to collect online data and analyze user behaviors, raising concerns about the privacy of Internet users. In this paper, we propose a new web tracking detection method, namely AST-Trans, which detects and removes web tracking behavior using Transformer-based deep learning with abstract syntax trees. In the method, the abstract syntax tree is built for the detected website codes. Then, a sequence generation algorithm is proposed to convert tree-like code structures into one-dimensional sequences for deep models. To enhance training efficiency, we devise a reduction strategy to simplify the code tree structure by introducing equivalent nodes. After that, a Transformer-based deep learning algorithm is introduced to realize web tracking detection. By the proposed method, the exact tracking code blocks can be identified, and thus, we can implement the tracking code removal with minimum website breakage. To verify the effectiveness of the proposed method, an HTTPS proxy with AST-Trans on it is implemented to detect and remove tracking codes. We evaluate AST-Trans with the TrackSign-labeled dataset. The results show that the proposed method can detect the tracking behavior with high precision. In addition, we validate the feasibility of the method by measuring the website page breakage.

With Internet access shifting from desktop-driven to mobile-driven, application-level mobile traffic identification has become a research hotspot. Although considerable progress has been made in this research field, two obstacles are hindering its further development. Firstly, there is a lack of sharable labeled mobile traffic datasets. Although it is easy to capture mobile traffic, labeling traffic at the application level is non-trivial. Besides, researchers usually hold a conservative attitude toward publishing their datasets for privacy concerns. Secondly, most of the datasets used by existing studies are inadequate to evaluate the proposed methods, since they usually have the problems of inaccurate labels, small scale and simple collection configurations. To tackle these two obstacles, a mobile traffic collection is carried out in this paper. The collected traffic has the advantages of large-scale data size, accurate application-level labels and diverse collection configurations. Then, the collected traffic is anonymized carefully to make it public. Several mobile traffic identification methods are compared based on our anonymized dataset, which proves the applicability of our dataset.