Malicious traffic classification is crucial for Intrusion Detection Systems (IDS). However, traditional Machine Learning approaches necessitate expert knowledge and a significant amount of well-labeled data. Although recent studies have employed pre-training models from the Natural Language Processing domain, such as ET-BERT, for traffic classification, their effectiveness is impeded by limited input length and fixed Byte Pair Encoding. To address these challenges, this paper presents Flow-MAE, a pre-training model that employs Masked AutoEncoders (MAE) from the Computer Vision domain to achieve accurate, efficient, and robust malicious network traffic classification. Flow-MAE overcomes these challenges by utilizing burst (a generic representation of network traffic) and patch embedding to accommodate extensive traffic length. Moreover, Flow-MAE introduces a self-supervised pre-training task, the Masked Patch Model, which captures unbiased representations from bursts with varying lengths and patterns. Experimental results from six datasets reveal that Flow-MAE achieves new state-of-the-art accuracy (>0.99), efficiency (>900 samples/s), and robustness across diverse network traffic types. In comparison to the state-of-the-art ET-BERT, Flow-MAE exhibits improvements in accuracy and speed by 0.41%-1.93% and 7.8x-10.3x, respectively, while necessitating only 0.2% FLOPs and 44% memory overhead. The efficacy of the core designs is validated through few-shot learning and ablation experiments. The code is publicly available at https://github.com/NLear/Flow-MAE.

Correctly measuring the importance of nodes in a complex network is critical for studying the robustness of the network, and designing a network security policy based on these highly important nodes can effectively improve security aspects of the network, such as the security of important data nodes on the Internet or the hardening of critical traffic hubs. Currently included are degree centrality, closeness centrality, clustering coefficient, and H-index. Although these indicators can identify important nodes to some extent, they are influenced by a single evaluation perspective and have limitations, so most of the existing evaluation methods cannot fully reflect the node importance information. In this paper, we propose a multi-attribute critic network decision indicator (MCNDI) based on the CRITIC method, considering the H-index, closeness centrality, k-shell indicator, and network constraint coefficient. This method integrates the information of network attributes from multiple perspectives and provides a more comprehensive measure of node importance. An experimental analysis of the Chesapeake Bay network and the contiguous USA network shows that MCNDI has better ranking monotonicity, more stable metric results, and is highly adaptable to network topology. Additionally, deliberate attack simulations on real networks showed that the method exhibits high convergence speed in attacks on USAir97 networks and technology routes networks.

Network algorithms are building blocks of network applications. They are inspired by emerging commodity programmable switches and the Programming Protocol-Independent Packet Processors (P4) language. P4 aims to provide target-independent programming neglecting the architecture of underlying infrastructure. However, commodity programmable switches have tight programming restrictions due to limited resources and latency. In addition, manufacturers tailor P4 according to their architecture, putting more restrictions on it. These intrinsic and extrinsic restrictions dilute the goal of P4. This paper proposes P4 high-level programming (P4HLP) framework, a suite of toolchains that simplifies P4 programming. The paper highlights three aspects: (i) E-Domino, a high-level programming language that defines both stateless and stateful processing of data plane in C-style codes; (ii) P4HLPc, a compiler that automatically generates P4 programs from E-Domino programs, which removes the barrier between high-level programming and low-level P4 primitives; (iii) modular programming that organizes programs into reusable modules, to enable fast reconfiguration of commodity switches. Results show that P4HLPc is efficient and robust, thus is suitable for data plane high-level programming. Compared with P4, E-Domino saves at least 5.5× codes to express the data plane algorithm. P4HLPc is robust to policy change and topology change. The generated P4 programs achieve line-rate processing.

In large-scale network topology discovery, due to the complex network structure and dynamic change characteristics, it is always the focus of network topology measurement to obtain as many network paths as possible in a short time. In this paper, we propose a large-scale network path probing approach in order to solve the problems of low probing efficiency and high probing redundancy commonly found in current research. By improving the packet delivery order and the update strategy of time-to-live field values, we redesigned and implemented an efficient large-scale network path probing tool. The experimental results show that the method-derived tool can complete path probing for a sample of 12 million/24 network address segments worldwide within 1 hour, which greatly improves the efficiency of network path probing. Meanwhile, compared to existing methods, the proposed method can reduce the number of packets sent by about 10% with the same number of network addresses found, which effectively reduces probing redundancy and alleviates the network load.

Network measurement is indispensable to network management. This paper focuses on three fundamental network measurement tasks: membership query, frequency query, and heavy hitter query. Existing solutions, such as sketches, sliding window algorithms, and the Sliding Sketch framework, struggle to simultaneously achieve memory efficiency, accuracy, real-time operation, and generic application. Accordingly, this paper proposes the Half Sliding Sketch (HSS), an improvement over the state-of-the-art Sliding Sketch framework. The HSS framework is applied to five contemporary sketches for the three aforementioned query tasks. Theoretical analysis reveals that our framework is faster, more memory-efficient and more accurate than the state-of-the-art Sliding Sketch while still being generic. Extensive experimental results reveal that HSS significantly enhances the accuracy for the three query tasks, achieving improvements of 2x to 28.7x, 1.5x to 9x, and 2.4x to 3.6x, respectively. Moreover, in terms of speed, HSS is 1.2x to 1.5x faster than the Sliding Sketch.