Despite being widely used in network intrusion detection systems (NIDSs), machine learning (ML) has proven to be vulnerable to adversarial attacks. White-box and black-box adversarial ML attacks of NIDS have been explored in several studies. However, white-box attacks unrealistically assume that the attackers have full knowledge of the target NIDSs. Meanwhile, existing black-box attacks can not achieve high attack success rate due to the weak adversarial transferability between models (e.g., neural networks and tree models). Additionally, neither of them explains why adversarial examples exist and why they can transfer across models. To address these challenges, this paper introduces ETA, an Explainable Transfer-based Black-Box Adversarial Attack framework. ETA aims to achieve two primary objectives: 1) create transferable adversarial examples applicable to various ML detectors and 2) provide insights into the existence of adversarial examples and their transferability within NIDSs. Specifically, we first provide a general transfer-based adversarial attack method applicable across the entire ML space. Following that, we exploit a unique insight based on cooperative game theory and perturbation interpretations to explain adversarial examples and adversarial transferability. On this basis, we propose an Important-Sensitive Feature Selection (ISFS) method to guide the search for adversarial examples, achieving stronger transferability and ensuring traffic-space constraints. Finally, the experimental results on three NIDSs datasets show that our method performs significantly effectively against several classical and state-of-the-art ML classifiers, outperforming the latest baselines. We conduct three interpretation experiments and two cases to verify our interpretation method's correctness. Meanwhile, we uncover two major misconceptions about applying machine learning to NIDSs systems.

The rapid growth of Internet of Things (IoT) devices has expanded the cyber attack surface, posing a challenge to IoT security. Some deep-learning-based detection methods have been designed to detect malicious attacks in the IoT by analyzing network traffic. However, the algorithm computational complexity of existing methods is usually high due to having a large number of parameters and iterative training inference, making them difficult to implement on IoT gateways which have limited computational and storage resources. To this end, this article proposes a lightweight malicious traffic detection model for IoT based on lightweight residual block (LRB) modules, named LightGuard. Specifically, the LRB module designs a unique residual structure based on the construction idea of ShuffleNetV2, which enables LightGuard to achieve high detection performance while reducing the parameters, computations, and inference time of the model. In addition, the LRB module replaces the traditional convolution with a lightweight convolutional module called the ghost module to generate feature maps at low cost while without compromising detection performance. We evaluate the effectiveness of LightGuard by comparing it with seven advanced baseline models on four generic data sets. The experimental results show that LightGuard achieves more than 99.6% accuracy on all four data sets, while exhibits significant advantages with low computational complexity.

Through offloading computing tasks to visible satellites for execution, the satellite edge computing architecture effectively issues the high-delay problem in remote grids (e.g., mountain and desert) when tasks are offloaded to the urban terrestrial cloud (TC). However, existing works are usually limited to offloading tasks in pure satellite networks and make offloading decisions based on the predefined models. Additionally, runtime consumption for offloading decisions is rather high. Furthermore, privacy information may be maliciously sniffed since computing tasks are transmitted via vulnerable satellite networks. In this paper, we study the task-offloading problem in satellite–terrestrial edge computing networks, where tasks can be executed by satellite or urban TC. A privacy leakage scenario is described, and we consider preserving privacy by sending extra random dummy tasks to confuse adversaries. Then, the offloading cost with privacy protection consideration is modeled, and the offloading decision that minimizes the offloading cost is formulated as a mixed-integer programming (MIP) problem. To speed up solving the MIP problem, we propose a deep reinforcement learning-based task-offloading (DRTO) algorithm. In this case, offloading location and bandwidth allocation only depend on the current channel states. Simulation results show that the offloading overhead is reduced by 17.5% and 23.6% compared with pure TC computing and pure SatEC computing, while the runtime consumption of DRTO is reduced by at least 42.6%. The dummy tasks are exhibited to effectively mitigate privacy leakage during offloading.

With the rapid development of cloud computing, network architectures are moving towards distributed computing, which performs data processing at edge nodes to reduce latency, enabling more efficient and scalable network services. Nevertheless, this shift introduces significant security challenges due to the heterogeneity of communications protocols and the vulnerabilities of edge devices. To effectively secure these distributed networks, it is essential to perform multiple traffic analysis tasks, e.g. Network Intrusion Detection, Encrypted Traffic Classification, and Application Traffic Classification. However, existing methods have limited generic feature extraction and require the deployment of multiple models to solve multiple tasks, which exceeds the resource capacity of edge nodes. To address these challenges, we introduce a Lightweight Multitask Traffic Analysis Framework LiMTa, which novelly proposes a traffic pre-training method, FreqRec, and a lightweight multi-task model fine-tune method, MT-Adapter. FreqRec enables high-level semantic feature extraction by reconstructing the frequency features of traffic samples, and MT-Adapter efficiently performs multiple tasks by computing the pre-trained model only once. Experimental results demonstrate that our approach achieves state-of-the-art (SOTA) performance on six traffic analysis tasks. Moreover, the MT-Adapter module only fine-tunes a small number of parameters, accounting for only 6.37% of the pre-trained model’s parameters, and achieves the same result as the full fine-tuning. Compared to full fine-tuning, LiMTa reduces the time cost by 50.9% and the space cost by 57.4% in six edge traffic analysis tasks.