摘要:The encryption of network traffic has become an irreversible trend. While enhancing the baseline for user privacy and security, it also creates opportunities for malicious activities and censorship evasion. Encrypted tunneling technology, owing to its unique dual-use nature, has emerged as a focal point in the adversarial network landscape. This paper regards virtual private networks (VPNs) and encrypted proxies as representative encrypted tunneling technologies. It systematically elucidates their core communication mechanisms, typical protocol morphologies, and mainstream evasion strategies. Furthermore, a realistic threat model encompassing passive traffic monitoring and active probing capabilities is constructed to delineate the censor’s capability boundaries in connection-level identification, behavioral classification, and end-to-end correlation. Building upon this foundation, this paper presents an in-depth review and comparative analysis of the current research landscape regarding traffic analysis for VPNs and encrypted proxies. This analysis is structured across four dimensions: dataset construction, feature extraction methodologies, analytical algorithms, and research dynamics. First, the status of dataset construction is analyzed by categorizing datasets into public and self-collected types. The paper points out that public datasets suffer from issues such as timeliness lag and insufficient protocol coverage, whereas self-collected datasets, despite their targeted nature, face challenges related to singular collection environments and difficulties in reproducibility. Second, feature extraction methodologies are detailed across packet-level, flow-level, and host-level dimensions, and, in the deep learning domain, systematically summarized, ranging from microscopic sequence fingerprints to macroscopic behavioral graphs. Third, the evolutionary path of analytical algorithms is outlined, demonstrating the development trajectory from rule-based matching reliant on expert knowledge, to machine learning based on statistical laws, and finally to deep learning algorithms possessing powerful end-to-end representation capabilities. Additionally, major research dynamics, including traffic detection, service classification, fingerprint identification, and ecosystem auditing, are summarized. Finally, this paper distills the core challenges currently faced in confronting advanced evasion techniques such as protocol imitation. These challenges include concept drift triggered by rapid iteration of evasion protocols, flow-definition failures caused by multiplexing and quick UDP Internet connections (QUIC) connection migration, discrepancies between laboratory environments and real-world threat models, the lack of interpretability in deep learning models, and the base-rate fallacy under large-scale background traffic. Based on these challenges, future research directions include protocol-agnostic detection, the design of online deployment models, automated construction of benchmark datasets, and the exploration of generative steganography techniques.
摘要:With the rapid evolution of cybersecurity technologies, mainstream applications, social platforms, and content services have widely adopted encryption protocols to protect user privacy. This trend has made encrypted traffic the dominant form of modern network communication, but it has also rendered traditional deep packet inspection (DPI) techniques—which rely on plaintext payloads—completely ineffective. Against this backdrop, encrypted traffic analysis has emerged as a critical technology for safeguarding network infrastructure security, optimizing network resource allocation, and maintaining service quality, becoming a key research focus in the field of cyberspace security. Confronted with complex and dynamic encrypted traffic, traditional machine learning approaches heavily rely on expert-driven, cumbersome manual feature design, struggling to adapt to the dynamic obfuscation characteristics of modern encrypted traffic. While deep learning-based analysis methods excel in feature extraction, their high computational costs and requirements for large-scale labeled data limit deployment in resource-constrained scenarios. In recent years, large language models (LLMs) have emerged as a novel technical pathway to overcome these limitations, leveraging their exceptional self-supervised pre-training paradigms and robust long-sequence context modeling capabilities. LLMs treat unstructured traffic bytes or statistical features as a specialized network language, enabling a paradigm shift from specialized small models to universal foundational models. This paper systematically summarizes and deeply analyzes LLM-based cryptographic traffic analysis methods across four core downstream tasks: traffic classification, malicious traffic detection, traffic prediction, and traffic generation. First, it outlines the general technical workflow from traffic collection, data processing, feature extraction, model construction and fine-tuning, to inference evaluation. Second, for each downstream task, this paper delves into the technical evolution and architectural innovations across different studies: for traffic classification, it explores the progression from discriminative fine-tuning based on BERT to zero-shot reasoning using generative large models, demonstrating robust generalization capabilities across protocols and sparse data scenarios. For malicious traffic detection, we detail the multifaceted roles of LLMs as feature encoders, classifiers, and even explainable decision-makers, highlighting their superiority in capturing deep semantic patterns when confronting multi-stage covert attacks and unknown threats; For traffic prediction, we contrast traditional time-series models with large-model autoregressive generation in capturing high-dimensional spatiotemporal dependencies within networks. Regarding traffic generation, we summarize how models transcend mere statistical distribution fitting to achieve controlled, high-fidelity traffic generation that strictly adheres to protocol state machines. Finally, this paper summarizes key challenges facing the field, such as data distribution skew and constrained deployment resources, and outlines future research directions from dimensions including building a multimodal data ecosystem and enabling lightweight deployment through edge-cloud collaboration.
关键词:encrypted traffic analysis;large language models;traffic classification;malicious traffic detection;traffic generation;traffic forecasting
摘要:As is well known, network traffic has become increasingly massive and encrypted. Due to limitations in computational and storage resources, traffic analysis systems struggle to perform online modeling and full-volume storage of high-speed encrypted traffic. Existing systems typically adopt a “store-then-select” strategy, wherein all target encrypted traffic is fully retained before being selected for analysis. However, this strategy relies on manually defined retention targets (e.g., specific IP ranges), making it difficult to adapt to dynamic traffic evolution and resulting in a diminishing marginal value of retained data. Despite deliberate efforts to increase the diversity of retention targets, the absence of a systematic value evaluation framework hinders the accumulation of data value and precludes the feedback-driven optimization of retention strategies. To address these challenges, this paper proposes FreshHunter, a freshness modeling approach for encrypted traffic analysis. FreshHunter systematically models the freshness of encrypted traffic from three dimensions: temporal, spatial, and semantic. The temporal dimension adopts Newton’s law of cooling to describe the natural aging of encrypted traffic, whereas the spatial and semantic dimensions extract structural features that are universal across types and behaviors. In addition, FreshHunter constructs a freshness-aware contrastive learning framework that incorporates learnable class centers to enhance the consistency between traffic embeddings and their corresponding centers, preserve the diversity of traffic samples, and thereby enable a “select-while-storing” mechanism for retaining high-freshness samples. During retention, FreshHunter continuously aggregates the embeddings of high-freshness encrypted traffic into learnable class centers, thereby forming a unified representation of representative traffic features. Meanwhile, it employs feature drift detection and adaptive correction mechanisms to dynamically update these class centers and capture the temporal evolution of traffic features. Thus, FreshHunter captures high-value, representative encrypted traffic samples along with their temporal evolution, facilitating an upgrade from instantaneous data capture to sustained knowledge accumulation, while supporting forward knowledge consolidation and backward adaptive optimization for downstream encrypted traffic analysis. Comprehensive evaluations are conducted on real-world datasets covering three representative encrypted traffic analysis tasks (i.e., internet of things (IoT) device, mobile App, and website identification) across nine mainstream analysis algorithms. Experimental results show that FreshHunter improves the F1-score of downstream encrypted traffic analysis algorithms by approximately 15% to 60%, outperforming the three baseline traffic selection methods: Random, dynamic time warping (DTW), and tree shapley additive explanations (TreeSHAP). Even under traffic feature drift scenarios, FreshHunter maintains strong adaptability, improving algorithm performance by around 20%. Overall, this study offers a novel technical pathway for advancing data efficiency and model adaptability in encrypted traffic analysis under resource-constrained conditions.
摘要:With the rapid evolution of network communication technologies, adversaries extensively leverage traffic encryption techniques to conceal malicious behaviors. Consequently, the performance of traditional traffic analysis methods based on port matching and deep packet inspection (DPI) has declined significantly, rendering network security defense boundaries increasingly blurred. Although traffic classification methods based on deep learning and pre-training techniques have made significant progress in extracting deep features of network traffic, existing studies predominantly adopt dense Transformer architectures. These models necessitate the activation of all parameters during inference, resulting in a tight coupling between computational cost and model scale, thereby incurring high inference latency and memory overhead. In the face of demands for high throughput and real-time detection in modern network environments, this computational efficiency bottleneck tends to create critical defense vulnerabilities, severely constraining the deployment and application of large-scale deep learning models in practical network defense scenarios. To effectively resolve the contradiction between model capacity expansion and inference efficiency, this paper proposes Traffic-MoE, a sparse foundation model designed specifically for heterogeneous traffic classification. This model not only follows the “pre-training and fine-tuning” paradigm to address the challenge of labeled data scarcity in the security domain but also innovatively introduces a sparse mixture-of-experts (MoE) architecture to achieve decoupled modeling of general protocol features and domain-specific behaviors. Specifically, we first design the Traffic2Token heterogeneous traffic representation method. Addressing the complex cross-protocol and cross-device characteristics of raw traffic, this method integrates critical packet features with payloads and utilizes bigram tokenization to construct fine-grained token sequences, effectively suppressing underlying noise interference while preserving byte-level temporal dependencies. On this basis, we embed sparse MoE modules into the Transformer architecture to replace traditional dense feed-forward networks (FFN). By leveraging a learnable gating network to implement a dynamic routing strategy, the model activates only the top-k most relevant specialized experts for each input traffic token while retaining a shared expert to capture general protocol syntax, thereby significantly reducing inference overhead while substantially expanding total model capacity. Leveraging a self-constructed unlabeled pre-training corpus containing 2 million session flows, the model learns the state transition logic of network protocols through an autoregressive “next-token prediction” task, subsequently requiring only lightweight supervised fine-tuning to rapidly adapt to downstream tasks. To comprehensively evaluate model performance, we construct six typical downstream classification tasks across four authoritative public datasets, covering diverse scenarios such as IoT (Internet of Things) attack detection, encrypted service identification, and anonymous traffic analysis. Experimental results demonstrate that compared to existing state-of-the-art baselines such as ET-BERT and NetGPT, Traffic-MoE exhibits superior generalization ability and robustness, with an average improvement of 8.44% in overall detection performance. Crucially, benefiting from the computational advantages brought by the sparse activation mechanism, Traffic-MoE achieves a 37.45% increase in throughput, a 27.25% reduction in inference latency, and a 27.04% decrease in peak GPU memory consumption compared to traditional dense architectures with equivalent parameter scales, establishing a new paradigm for efficient network traffic analysis.
摘要:With the widespread deployment of secure communication protocols such as hypertext transfer protocol secure (HTTPS) and transport layer security (TLS), while network traffic contents have been effectively protected, malicious traffic detection techniques that rely on plaintext analysis have become difficult to apply directly, posing new challenges to encrypted traffic detection. Existing detection schemes based on searchable encryption and related cryptographic techniques have facilitated the detection of malicious traffic over encrypted data through operations such as partial decryption. However, middleboxes in such schemes may infer detection rules during the detection process, correlate users’ communication behaviors, and further mine users’ private information, thereby causing severe privacy leakage risks. In addition, as the scale of detection rules and the number of traffic segmentation tokens continue to grow, the extensive use of high-overhead operations in existing schemes, such as bilinear pairings, multiple rounds of interaction, and complex preprocessing, significantly increases computational and communication burdens, making it difficult to meet the demands of real-time detection and large-scale deployment. To address these issues, this paper proposes CipherSight, a traceable encrypted malicious traffic detection scheme based on set pre-constrained encryption, which aims to construct an active detection mechanism for end-to-end communication scenarios that achieves both privacy preservation and efficient detection. Specifically, the scheme combines set pre-constrained encryption, lightweight cuckoo hashing, and symmetric encryption to protect detection rules and transmitted traffic, enabling malicious token matching without revealing traffic plaintext or rule semantics. It further uses a signing mechanism to commit and bind bidirectional session keys, allowing the receiver to quickly verify and filter ciphertext traffic intended for itself, thereby avoiding redundant decryption of non-target traffic and improving the efficiency and reliability of the decryption phase. Moreover, based on the Diffie-Hellman problem, sender identity information is implicitly embedded into traffic token ciphertexts, so that only when traffic matches malicious rules can the middlebox recover a valid identity tag and achieve precise traceability, while no useful information can be obtained from benign traffic. CipherSight realizes accurate encrypted malicious traffic detection and malicious sender tracing while preserving communication user anonymity and malicious rule privacy. Theoretical analysis shows that the proposed scheme satisfies traffic confidentiality based on a symmetric encryption being indistinguishable chosen plaintext attack (IND-CPA) security, that the scheme satisfies traffic unlinkability based on the existential unforgeability under chosen message attack (EUF-CMA) security of the session key signature, and that the confidentiality of detection rules inherits the element-hiding and set-hiding security properties of set pre-constrained encryption. Experimental results demonstrate that CipherSight achieves strong performance in key generation, rule generation, traffic detection, and traffic decryption: compared with BlindIDS, it improves detection and decryption efficiency by about 40 times and more than 15 times, respectively; compared with recent related schemes such as Pine and PrivBox, it improves both detection and decryption efficiency by about 5 times; and in large-scale rule and token scenarios, its detection time is insensitive to changes in rule size, showing better scalability and practicality. Overall, CipherSight provides a feasible new solution for achieving efficient, privacy-preserving active detection and traceability of malicious traffic in encrypted network environments.
摘要:For dynamic, protocol-diverse, and resource-constrained edge/internet of things (IoT) environments, this paper proposes a lightweight deep learning intrusion detection framework that unifies feature engineering, model construction, and knowledge distillation in an end-to-end manner, aiming to achieve an effective balance between detection accuracy, computational efficiency, and deployment feasibility. To address the strong heterogeneity of edge traffic, the severe class imbalance of attack categories, and the limited learnability of minority classes, the framework introduces adaptive feature engineering and dynamic class balancing at the data level, extracting domain-relevant features such as traffic directional asymmetry, protocol consistency, and session interaction characteristics to strengthen the representation of complex malicious behaviors while alleviating the adverse impact of long-tail distributions on model training. At the representation level, a dual-teacher architecture is designed to jointly model temporal and spatial dependencies in network traffic. The temporal branch employs an enhanced bidirectional long short-term memory (BiLSTM) network combined with multi-head attention to capture periodic patterns, bursty dependencies, and contextual correlations in traffic sequences, enabling the model to better characterize the dynamic evolution of attack behaviors over time. The spatial branch adopts multi-scale residual one-dimensional convolutions together with a lightweight gating mechanism to learn local feature interactions and cross-field co-occurrence structures, thereby improving the modeling of protocol semantics and hidden attack patterns across heterogeneous traffic attributes. At the decision level, an adaptive ensemble strategy is introduced, with concatenation-based fusion serving as the primary integration mechanism to combine the complementary outputs of the two teacher branches and enhance final classification performance. On this basis, the knowledge learned by the teacher ensemble is transferred to an ultra-lightweight student model through a joint distillation objective composed of temperature-scaled soft labels and ground-truth hard labels, so that the student model can preserve strong discriminative capability while substantially reducing parameter size and computational burden. Experiments conducted on a scenario-adapted CICIDS-2017 dataset demonstrate that the teacher ensemble achieves an accuracy of 96.5% and a macro-F1 score of 95.0%, while the student model still attains 93.91% accuracy and 90.34% macro-F1 with more than 70% parameter reduction. In addition, the student model yields over 98% accuracy on attack categories such as Patator, PortScan, and Heartbleed, and maintains stable recognition performance under imbalanced testing conditions, indicating strong robustness to class skew. The comparison results of different integration strategies show that concatenation integration achieves a macro-F1 score of 90.34%, which outperforms attention integration at 90.19%, temperature-weighted soft voting at 89.79% and the non-integrated scheme at 88.67%, verifying the effectiveness of this fusion method. Moreover, the model exhibits an edge-side single-inference latency of approximately 68 ms, satisfying the real-time requirements of practical edge deployment. Overall, the proposed framework reduces computational and deployment costs while maintaining high detection quality, and provides a practical technical solution for intrusion detection in edge/IoT scenarios where both accuracy and efficiency are critical.
关键词:Internet of Things;intrusion detection;deep learning;knowledge distillation;lightweight models
摘要:With the continuous growth of demand for anonymous communication, the Tor network has been widely adopted in privacy protection, censorship circumvention, and sensitive information transmission scenarios due to its multi-hop encrypted routing and decentralized architecture. However, the slow growth of relay nodes, uneven load distribution, and the lack of strict scrutiny in relay admission mechanisms have caused certain high-frequency relays involved in path construction to gradually become prime targets for adversarial control. Once these relays are maliciously compromised, the anonymity of the network will be significantly weakened, the security of circuit construction will be undermined, and the overall network stability will be severely affected. Therefore, accurately identifying critical relays in the Tor network has become a core issue for enhancing the security and reliability of anonymous communication systems. Existing critical node identification methods mainly rely on static topological metrics or single behavioral features, which fail to effectively capture complex implicit relationships and multidimensional semantic associations among relays, resulting in limited generalization ability and robustness when facing real dynamic network environments. To address these challenges, this paper proposes an unsupervised critical relay identification method based on heterogeneous graph modeling and relation-aware mechanisms. First, a multi-source heterogeneous graph model is constructed by integrating multidimensional attributes such as relay stability, path occurrence frequency, functional labels, and resource capabilities, enabling a fine-grained representation of the Tor network structure. Then, a relation-aware heterogeneous attention network is introduced to differentially model multiple types of relations, including family relations, autonomous system affiliation, geographic proximity, and path co-occurrence. An heterogeneous attention mechanism is further employed to adaptively fuse diverse relational semantics, significantly enhancing the discriminative power and robustness of relay representations. Finally, an unsupervised scoring mechanism is designed to rank and automatically identify critical relays. Extensive experiments conducted on real Tor consensus data and practical circuit construction data demonstrate that, under the Top-100 relay setting, the proposed method achieves a relay coverage rate of 85.0%, and the bandwidth of the identified relays is approximately 25.9% higher than the network average. Further experiments show that removing the identified critical relays leads to a significant degradation in overall network bandwidth and circuit coverage, validating the core role of these relays in network operation. The results indicate that the proposed method effectively captures the implicit relational structure among Tor relays, providing a novel modeling paradigm for critical relay identification in anonymous communication networks and offering important theoretical and practical implications for enhancing the security of Tor infrastructure.
摘要:Traffic fingerprinting attacks can be applied to hidden services de-anonymization in the Tor (The Second Onion Router) network. Due to the limitations of the Tor network protocol, traffic on the hidden service-side is difficult to obtain. Therefore, traffic from other positions is used as a substitute for hidden service-side traffic to train remote fingerprinting models. However, fingerprinting models face structural changes in packet sequences caused by data caching, encryption/decryption, and repackaging at Tor relays, leading to performance degradation during position migration. Existing methods, whether at the model or data level, can partially mitigate random noise but struggle to accurately fit structural differences induced by protocol mechanisms. This paper delves into the forwarding mechanisms of Tor traffic and proposes a context-aware remote cell sequence estimator method, called remote cell estimator (RemoCellEst). This approach introduces a cross-packet residual compensation mechanism to dynamically adjust payload offsets at boundaries of each packet, thereby reconstructing consistent cell sequences across position and enhancing the model’s capability for positional migration. Experimental results demonstrate that remote fingerprinting attacks based on cell sequences reconstructed using the RemoCellEst method achieve an accuracy of 94.85%, representing a 6% to 16% improvement over which using bucket-based estimator methods or directly using TCP (Transmission Control Protocol)/TLS (Transport Layer Security Protocol) layer traffic. This paper attributes the position migration challange in remote fingerprinting attacks to interpretable and modelable structural differences in packet sequences, offering a novel perspective for subsequent research such as encrypted traffic analysis and flow correlation.
关键词:remote fingerprinting attack;cell-layer reconstruction;hidden service de-anonymization;website fingerprinting attack;traffic fingerprinting attack
摘要:Quick UDP internet connections (QUIC) protocol has been proposed to provide fast, stable and secure web services. Its encryption properties provide a protective shield for malicious websites. To detect malicious websites in QUIC traffic, website fingerprinting (WF) attacks have become a research hotspot. As the QUIC protocol is being gradually implemented, it is essential to conduct an early and rapid WF attack for new QUIC-enabled websites. Attackers must continuously monitor whether websites begin supporting the QUIC protocol, once QUIC is enabled, crawl a small amount of QUIC traffic for rapid training of new attack models. This type of attack may be termed an incremental few-shot website fingerprinting attack. However, the scarcity of training samples renders existing deep learning methods ineffective in constructing effective deep features. Moreover, current methods extract initial features from the transmission control protocol, which fail to capture the characteristics of the QUIC protocol and thus inadequately represent QUIC traffic. These limitations result in existing methods performing poorly when conducting incremental few-shot website fingerprinting attacks under QUIC traffic. To address the issues, we analyze QUIC-specific characteristics and their importance for WF attacks. The addition of QUIC-specific characteristics provides a more comprehensive representation of the QUIC-enabled websites. Meanwhile, a graph-based few-shot incremental website fingerprinting attack method is proposed to mine the potential characteristic relevance from a global perspective. It further improves the representation ability of the attack models. To simulate the emergence of new QUIC-enabled websites in the monitored list, we crawl the traffic of two groups of websites one-month apart. We conduct comprehensive experiments to evaluate the effectiveness of the proposed characteristics and method in the collected QUIC-enabled website traffic. Compared to the state-of-the-art method, the accuracy of the proposed method is improved by 1.01%~6.84%.
摘要:With the rapid development of artificial intelligence technology, traditional operating systems face new challenges in security, intelligence, and scenario adaptability. This survey systematically reviews the research progress and key technologies of secure and trustworthy AI-native operating systems (AIOS). First, it introduces the layered architecture of AIOS, including kernel components, resource management, general foundational services (covering both the intelligent service framework and the secure access framework), and domain-specific software stacks, highlighting the deep integration of artificial intelligence (AI) capabilities with operating systems. The secure access framework focuses on secure kernel architecture, software-hardware collaborative security and adaptation, and virtualization-based in-depth defense. Second, it summarizes the key AIOS technologies: edge-oriented operating systems emphasize model compression, inference optimization (e.g., key-value (KV) cache and PagedAttention), edge-cloud collaboration with heterogeneous resource scheduling, and hardware abstraction and driver adaptation; the memory management system centers on memory storage, retrieval, and management, combining short-term and long-term memory to support long context understanding and dynamic updates; the security and trust mechanisms cover memory safety and formal verification, automated analysis, trusted boot and remote attestation, and defense-in-depth via trusted execution environment (TEE)/confidential computing and virtualization isolation. Finally, by examining practical scenarios such as embodied intelligence, industrial internet of things (IoT), and mobile applications, it analyzes deployment paths, capability boundaries, and engineering trade-offs, and summarizes open issues and trends including architectural modularity, co-design of hardware and software, resource scheduling and security robustness in intelligent services, efficiency and privacy of memory systems, standardization and ecosystem building of domain stacks, and cross-platform/device collaboration and resource sharing. This survey aims to provide a structured perspective, clear terminology boundaries, and a technology map, offering references for AIOS research and engineering practice.
关键词:AIOS;AI-native;security and trustworthiness;kernel architecture;edge intelligence;intelligent agent applications
摘要:In ubiquitous operating systems for human-machine-object integrated scenarios, the stability and security of the kernel form the foundation for supporting diversified applications and heterogeneous resource integration. As one of the most representative operating system kernels today, the Linux kernel is prone to defects due to its large scale and complex logic. Running at the highest privilege level, any exploited vulnerability could seriously threaten system security and application reliability in ubiquitous computing environments. Fuzzing, as the most mainstream method for discovering kernel vulnerabilities, typically uses sequences of system calls as test case inputs. These test cases can be randomly generated or derived by mutating existing sequences. However, random combinations not only easily lead to state space explosion but also result in low testing efficiency and limited vulnerability discovery capability. Although existing studies have attempted to improve the effectiveness of test cases, issues remain in system call dependency analysis, including incomplete information, coarse granularity, low utilization, and high overhead, which in turn limit the effectiveness of fuzzing. To enhance the effectiveness of kernel fuzzing, this paper introduces a testing framework that fuses dependency inference with weight optimization. The core idea of this approach is to conduct static analysis on the Linux kernel source code to identify the resources accessed by each system call and characterize their access patterns. Based on this information, potential dependency relationships among system calls are inferred, and a corresponding dependency graph is constructed. The fuzzing process is then guided by this graph to generate more effective test cases. In addition, feedback collected during runtime is used to continuously update the weights of the graph’s edges, enabling the dependency graph to increasingly reflect accurate call relationships and thereby further improving the overall fuzzing performance. Based on this method, a prototype tool named SDKernelFuzzing was implemented, and experiments were conducted on four different versions of the Linux kernel. Compared with Moonshine, the proposed approach can generate system-call dependency information that is both more comprehensive and richer in content, while incurring only minimal additional overhead, thereby enabling the construction of a more complete dependency graph. In addition, relative to Syzkaller and other state-of-the-art techniques, our method demonstrates significant advantages in both code coverage and bug-finding capability. Under identical experimental conditions, the average code coverage achieved by our method exceeds the best baseline by 7.69%, and the average number of detected bugs increases by 15.77%. Ablation experiment results show that different construction strategies of system call dependence graph have a significant impact on fuzzing performance.
摘要:In ubiquitous computing scenarios, systems encompass large, medium, and small-scale models, as well as diverse computing resources spanning edge-side, device-side, and cloud-side infrastructures. Efficient scheduling of model inference services, driven by quality-of-service requirements, is critical to optimizing system performance. Accurate prediction of output length during model inference plays a pivotal role in enabling fine-grained resource management. However, this task remains challenging due to the high variability and strong semantic dependence of generated outputs. To address this, we propose a lightweight training framework, which is output length prediction model (OLPM) to predict the output length range of requests based solely on the input prompt. Our framework employs a DistilBERT architecture to ensure computational efficiency, enhanced with two key innovations: (1) a normal-distribution-based filtering strategy that improves training stability by mitigating the impact of outliers, and (2) a semantic prompt augmentation method that enhances the model’s sensitivity to linguistic cues indicative of output length. The evaluation results show that OLPM achieves state-of-the-art prediction accuracy, with a maximum accuracy of up to 96.8%. Compared to existing models, OLPM not only significantly improves prediction accuracy but also greatly reduces model convergence time, achieving a synergistic optimization of precision and efficiency. Experimental results further show that the method converges rapidly and performs stably, enabling accurate and efficient output length prediction. By maintaining high prediction accuracy while featuring low model complexity and computational overhead, OLPM significantly outperforms existing approaches. It effectively meets the demands for fine-grained resource scheduling in ubiquitous computing environments, demonstrating outstanding practicality, scalability, and generalization capability. OLPM provides an advanced technical pathway for realizing efficient and intelligent model inference services in ubiquitous computing scenarios.
摘要:With the advent of the era of human-cyber-physical ternary integration, ubiquitous operating systems (UOS) impose stringent requirements for elasticity and adaptability on memory management within resource-constrained edge nodes handling variable workloads. However, most existing memory management strategies rely on predefined static rules and struggle to perceive dynamic workload characteristics at runtime. Consequently, when facing bursty and multi-modal tasks, systems often suffer from severe memory fragmentation and degraded real-time response performance, which has become a critical bottleneck restricting the practical deployment of ubiquitous computing capabilities. To address these challenges, this paper proposes AIMO, a memory layout optimization framework based on deep reinforcement learning. This framework aims to achieve intelligent and dynamic management of memory resources through a closed-loop mechanism of “perception-decision-execution”. First, a multi-dimensional state perception module captures hardware-level metrics (e.g., cache miss rate, media wear), object-level behaviors (e.g., access frequency, coldness/hotness), and system-level context (e.g., memory fragmentation rate, application scenario types) in real-time via the processor’s performance monitoring unit (PMU) and kernel instrumentation, encoding them into high-dimensional state vectors. Second, a reinforcement learning intelligent decision module models the memory layout problem as a markov decision process (MDP) and utilizes the proximal policy optimization (PPO) algorithm to generate optimal decisions online. To accommodate the resource constraints of embedded environments, this module adopts a strategy of “offline pre-training and lightweight online fine-tuning”, which significantly reduces computational overhead while ensuring decision determinism. Finally, a policy execution module implements mechanisms such as allocation interception, object relocation, policy-driven object placement, and proactive defragmentation by establishing lightweight hook functions in the kernel space, thereby completing the closed-loop adaptive control of the memory layout. We implemented the AIMO framework in the OpenHarmony kernel and conducted an empirical evaluation based on the Raspberry Pi Zero 2W platform. Experimental results demonstrate that, compared to the real-time performance benchmark TLSF, AIMO significantly reduces the large-block memory allocation failure rate from 3.4% to 0.9% and increases the maximum available contiguous free block from 318 KB to 476 KB, while maintaining an equivalent worst-case allocation time. Furthermore, it reduces the preloading latency of upper-layer applications by 15.8%. In addition, the framework exhibits a highly lightweight nature; the average CPU utilization of its decision module is only 1.9%, and the metadata storage overhead accounts for less than 0.001% of the 512 MB total system memory. This study verifies the effectiveness of reinforcement learning in operating system kernel memory management, providing a novel approach for constructing efficient and adaptive UOS kernels.
摘要:In ubiquitous computing environments, operating systems are required to provide unified support across heterogeneous hardware and dynamic applications in diverse computational scenarios, thereby ensuring system continuity and security. Formal verification, as a key technique for guaranteeing the correctness of operating system kernels, has played an essential role in building high-assurance systems. Among various approaches, interactive theorem proving offers the most rigorous and reliable correctness guarantees. The verification of the seL4 microkernel demonstrates that, although formal methods can ensure strong correctness, they incur extremely high verification costs. The seL4 team has spent nearly two decades constructing over one million lines of formal proofs, with verification costs far exceeding those of system development. Moreover, the verification process lacks sufficient portability across different computational scenarios. When the system is ported to a new hardware platform, verification engineers are often required to redo large-scale proofs, which severely limits the applicability of formal methods in ubiquitous computing environments. To mitigate this issue, the seL4 team proposed decomposing proofs into scenario-independent and scenario-dependent components, enabling partial reuse of verification results. However, this decomposition heavily relies on expert knowledge, making it difficult to perform efficiently and prone to human error. To address these challenges, this paper proposes ArchiDistill, an automated method based on knowledge distillation. The proposed method aims to identify key semantic components in interactive theorems that are related to computational scenarios, thereby facilitating structured decomposition of verification tasks and cross-scenario transfer. ArchiDistill transfers semantic and pattern knowledge from large-scale pretrained models to a lightweight model, and enhances its performance through multi-task distillation, auxiliary tasks, and curriculum learning strategies. This enables accurate identification of scenario-related characteristics and improves cross-platform generalization capability. In the experimental evaluation, we construct a multi-scenario verification dataset based on the seL4 kernel, consisting of 16 975 samples, and conduct a comprehensive assessment of the proposed method. The results show that ArchiDistill achieves superior performance on the task of scenario-related theorem identification, with an accuracy of 0.736 2, precision of 0.707 6, recall of 0.720 0, and F1-score of 0.712 0. These results outperform both the traditional model TextRNN with an accuracy of 0.664 7 and the open-source large language model Qwen3-32B with an accuracy of 0.709 6 and an F1-score of 0.630 2. While maintaining a lightweight architecture, ArchiDistill achieves an effective balance between performance and efficiency. Furthermore, we construct a new dataset based on the CompCert project to evaluate the generalization capability of the proposed method. Experimental results demonstrate that ArchiDistill maintains strong stability and applicability in cross-task scenarios.
摘要:The multiple dynamic supply voltage (MDSV) design paradigm partitions a chip into multiple voltage domains, enabling modules to operate with differentiated supply voltages while meeting performance and timing requirements, thereby reducing overall power consumption and improving energy efficiency. However, existing studies on the Steiner minimum tree (SMT) problem have not yet taken into account the new constraints and optimization objectives introduced by the MDSV design paradigm. Consequently, these methods are unable to effectively handle variable length restriction under the MDSV environment and fail to account for the additional overhead introduced by level shifters (LSs). To address these issues, this paper proposes a variable length-restricted X-architecture SMT algorithm considering cluster reduction (VLRXSMT-CR). First, in order to effectively solve the discrete multi-objective optimization problem of the SMT under the MDSV design paradigm, discrete forward learning operators and mutation operators are proposed. In addition, a competitive selection mechanism and a congestion-based external archive update mechanism are introduced to achieve multi-objective optimization of the number of LSs and routing wirelength. Second, to avoid premature convergence of the algorithm to local optima and to enhance local search capability in the later stages of iteration, thereby further improving solution quality, a diversified sparrow proportion adjustment strategy is proposed. Then, to improve the diversity of learning targets during the algorithm update stage, a hierarchical learning mechanism is introduced into the update process of the discrete sparrow search algorithm (SSA). Finally, in order to satisfy MDSV design constraints and further optimize routing structures, adjustment and hybrid refinement strategies are introduced to adjust routing edges that violate constraint conditions in candidate solutions, while optimizing non-optimal local topological structures in candidate solutions. Compared with existing methods, the proposed algorithm achieves certain improvements in routing wirelength, while obtaining a significant improvement of 38.60% to 51.91% in the number of LSs, which is a key performance metric under the MDSV design paradigm.
关键词:variable length-restricted Steiner minimum tree (SMT);voltage cluster;hierarchical learning-based sparrow search;multiple dynamic supply voltage (MDSV) design paradigm;multi-objective optimization
摘要:To address the issues of excessive peripheral components, large volume, and high cost in the two-stage topology used in conventional alternating current-direct current (AC-DC) power conversion solutions, this paper proposes a single-stage AC-DC BUCK converter with high integration and multi-mode control, which realizes direct conversion from high-voltage AC to low-voltage DC. Compared with traditional two-stage schemes or flyback topologies, the proposed solution effectively reduces the usage of peripheral components, significantly improves system integration, and lowers both system volume and application cost. To enhance the conversion efficiency of the converter across the full load range, this paper systematically analyzes the static loss, conduction loss, and dynamic loss of the BUCK converter, clarifies the relationships between power loss and peak inductor current as well as switching frequency, and establishes a loss model. Based on the derived loss model, the control curves of peak current and switching frequency that adaptively vary with load conditions are determined, and a multi-mode control strategy combining pulse width modulation (PWM) and pulse frequency modulation (PFM) is adopted. The converter operates in a hybrid PWM/PFM mode under heavy load to balance load response speed and output ripple suppression; switches to fixed-frequency PWM mode at medium load for optimized conversion efficiency; and operates in PFM mode under light load to substantially reduce switching loss, thereby achieving high-efficiency control under various load conditions. Meanwhile, to break the dependence of conventional drive circuits on off-chip VDD capacitors, a high-voltage self-powered drive circuit without off-chip capacitors is designed. The circuit utilizes a depletion-mode junction field-effect transistor (JFET) to realize chip self-power supply and provides drive current for the gate of the power MOSFET through its parasitic capacitance, requiring only an integrated 220 pF on-chip VDD capacitor, which further reduces the number of peripheral devices and improves system integration. The proposed BUCK controller is designed and fabricated based on the BCD process (0.25 μm, 700 V) . The chip integrates a power metal-oxide-semiconductor field effect transistor (MOSFET) and an on-chip VDD capacitor, with a core controller area of only 0.88 mm² excluding the power MOSFET. To further minimize peripheral components, the chip is co-packaged with a feedback diode and freewheeling diode, leaving only an energy-storage inductor and an output capacitor as peripheral devices besides the bridge rectifier. In addition, the converter mainly operates in discontinuous conduction mode (DCM) and enters continuous conduction mode (CCM) at full load, effectively reducing the volume of the output inductor. To verify the feasibility and performance of the proposed scheme, a dedicated test platform is built for comprehensive measurements. The test results show that the converter achieves a peak conversion efficiency of 78.4% at an input of 85 Vac and an output power of 1.5 W under extremely simple application conditions. It supports a wide input voltage range of 85-265 Vac with a stable 5 V output voltage. The load regulation is better than ±1.5%, the line regulation is better than 2.4%, and the maximum output current reaches 300 mA.
关键词:BUCK;pulse frequency modulation;pulse width modulation;on-chip VDD capacitors;high integration
摘要:In intelligent parking management systems, achieving high-precision parking space perception in complex environments is a core technology for automated guidance and resource optimization. Traditional detection methods suffer from high costs, difficult maintenance, and limited parking status information. Although vision-based approaches can provide rich information, they face challenges in underground parking lots, such as dim illumination, strong light interference, complex backgrounds, and severe vehicle occlusion. To address these issues, this paper proposes a lightweight real-time underground parking space occupancy detection network integrating vision and geometric reasoning, termed real-time underground parking space occupancy detection transformer (RT-UPSO-DETR). First, a lightweight residual F-DBlock (Fusion DBlock) module with dilated spatial attention is designed, which expands the receptive field to capture global blurred features while significantly reducing redundant computation. Second, a multi-mechanism Transformer encoder layer, cognitive spatial attention layer (CSAL), is constructed to replace the original AIFI module in RT-DETR-R18, significantly enhancing the model’s feature discrimination ability in low-light and blurred images. Furthermore, to address the missed detection of rear parking spaces caused by mutual vehicle occlusion, a geometric reasoning perspective topology completion module (PTCM) is devised, which uses the detected front parking spaces as geometric anchors to estimate the vanishing point and then infers the approximate positions of occluded spaces via radial projection, effectively recovering missing bounding boxes. To validate the effectiveness of the proposed algorithm, we construct an underground parking space detection dataset and a dedicated occlusion completion test set, and conduct generalization experiments on the public low-light dataset ExDark. Experimental results on the self-built dataset show that compared with the baseline RT-DETR-R18, RT-UPSO-DETR improves precision, recall, mAP@0.5, and mAP@0.5-0.95 by 1.5%, 3.3%, 0.7%, and 0.9%, respectively. Meanwhile, the number of parameters is reduced by 22.1%, GFLOPs by 18.8%, and the inference speed reaches 52.4 FPS, satisfying real-time detection requirements. On the ExDark dataset, compared with RT-DETR-R18, the proposed model improves precision, recall, mAP@0.5, and mAP@0.5-0.95 by 2.1%, 1.3%, 2.1%, and 1.0%, respectively, verifying its robustness under low-light conditions. For parking space completion, the PTCM achieves a missed recall rate of 82.48%, a completion accuracy of 74.83%, and a mean center error of 23.27 pixels, demonstrating its effectiveness in reducing missed detections. The proposed RT-UPSO-DETR network, through lightweight design and multi-mechanism attention fusion, effectively addresses the challenges of parking space detection in underground parking lots with low illumination, complex backgrounds, and occlusions. The perspective topology completion module further enhances the system’s robustness to occlusions, providing a feasible vision-based solution for practical intelligent parking systems.
关键词:RT-DETR network;fusing vision;geometric reasoning;parking space detection;CSAL module;F-DBlock module;occlusion completion
摘要:Deep learning-based pathological image classification is a key technical foundation for efficient and reliable computer-aided pathological analysis, which is of great significance for intelligent analysis of pathological images, accurate identification of lesion regions and automatic discrimination of tissue types. Current mainstream pathological image classification methods mostly rely on static feature extraction at a single time point, which makes it difficult to effectively represent the continuous evolution process of pathological states from normal, developmental abnormalities to malignant transformation, and cannot fully model the complex hierarchical structure and spatial distribution features at the tissue level. As a result, the recognition ability for similar pathological regions and subtle lesion structures is obviously limited, and the discrimination accuracy and generalization performance of the model are difficult to further improve. To address the above issues, this paper proposes a dynamic temporal-guided diffusion model for pathology (DT-DPath), which constructs a unified classification framework for pathological images. Based on the diffusion model, this framework simulates the forward noise addition and reverse denoising processes as the degradation and reconstruction of tissue morphology. By aggregating temporal dynamic features at different noise levels during the diffusion process, it constructs discriminative representations that depict the pathological evolution process, accurately captures subtle structural differences at the cellular level, and effectively models the complex hierarchical and spatial distribution relationships within tissues. In the feature extraction stage, this paper designs a temporal dynamic channel attention (TDCA) mechanism, which extends channel attention to the temporal dimension and adaptively focuses on feature responses at key temporal stages to enhance the model’s ability to represent temporal evolution information. To optimize training efficiency, a non-uniform importance sampling strategy based on temporal contribution is adopted, which dynamically constructs the sampling distribution according to the classification saliency and information density of each time step, and preferentially retains intermediate denoising stages with high discriminative power. This strategy significantly improves training speed and stability while maintaining classification performance. Experiments are conducted on a variety of public pathological image datasets including colorectal cancer, breast cancer and lymph node metastasis. Compared with state-of-the-art methods such as CNN, Transformer, diffusion model classifiers and pathological foundation models, the results show that DT-DPath achieves comprehensive superiority in accuracy, precision, recall and F1-score, with performance improvements ranging from 0.65~3.59 percentage points. Ablation experiments verify the effectiveness of temporal dynamic channel attention and non-uniform importance sampling, and visualization analysis shows that the model can accurately focus on key regions for pathological discrimination, with significantly better feature clustering effects than traditional methods. The proposed method realizes the paradigm shift from static feature modeling to dynamic temporal evolution representation, provides a new technical path for intelligent classification of pathological images, and also offers an interpretable research idea for the application of diffusion models in the field of pathological image analysis.
摘要:RGB cameras often suffer from image quality degradation in challenging scenarios such as motion blur and extreme lighting conditions, which limits the performance of existing RGB-based tracker. Event cameras, with their advantages of high temporal resolution, high dynamic range, and low latency, can effectively compensate for the shortcomings of RGB sensors, making RGB-Event object tracking a gradually emerging research focus. However, existing methods heavily rely on the imaging quality of event cameras. When the object is stationary or moving at low speeds, event signals fail to provide effective discriminative information due to the lack of intensity changes, thereby constraining the robustness of trackers in complex scenarios. To address the above issues, this paper proposes an RGB-Event object tracking method guided by geometric priors. Considering that both event signals and corner/edge signals are sensitive to object edge regions, and that RGB images can provide stable spatial geometric structure information in the absence of event signals, this paper employs corners and edges as geometric prior guidance signals to enhance the representational capability of the event modality. To achieve effective fusion, two geometric prior guidance strategies are designed: 1) a pixel-level guidance strategy, which concatenates the extracted corner/edge grayscale maps with event images along the channel dimension as direct input to the tracking model; and 2) a feature-level guidance strategy, which separately extracts high-level features from event images and corner/edge maps, and adaptively learns fusion weights through a signal quality assessment module to achieve dynamic weighted fusion of features. Both strategies offer good compatibility, can be conveniently integrated into existing RGB-Event trackers, enhancing tracking robustness under poor event modality imaging quality with low computational overhead. The proposed method is integrated into three advanced RGB-Event trackers, namely TENet, ViPT, and SDSTrack, and experimental validation is conducted on three public datasets: VisEvent, COESOT, and FE240hz. The results demonstrate that the geometric prior guidance strategy significantly improves tracking accuracy, particularly in challenging scenarios such as object stationary, deformation, and partial occlusion. Taking TENet as an example, the success rate(SUC) and precision rate(PRE) on the FE240hz dataset are improved by 1.6% and 2.3%, respectively; on the COESOT dataset, which covers various tracking scenarios, the two metrics are improved by 0.8% and 1.2%, respectively; and on the VisEvent dataset, gains of 0.4% and 0.5% are achieved, respectively. In summary, the proposed geometric prior guidance method effectively alleviates the information deficiency problem of event cameras in low-dynamic scenarios by introducing corner/edge information as a complement to event signals, providing an efficient and robust solution for RGB-Event object tracking. Our codes are athttps://github.com/LLLzw444/Enhancement-strategy-of-TENet.
摘要:Graph neural networks (GNNs) have achieved outstanding performance in various graph learning tasks owing to their powerful representation capabilities. However, the predictive performance of GNNs degrades significantly when data distribution shifts occur between the training and test sets. Existing studies generally treat distribution shift as a single holistic perturbation and lack differentiated modeling of covariate shift and concept shift. Such coarse-grained processing fails to characterize the distinct impacts of these two types of shifts on model performance, thereby restricting the pertinence and effectiveness of traditional GNN generalization methods in distribution shift scenarios. To address this issue, starting from the characteristics of covariate shift and concept shift, this work proposes a prototype-guided test-time adaptation method named ProGTA (Prototype-Guided Test-time Adaptation). This method breaks through the limitations of traditional static domain adaptation, mainly consisting of a prototype graph contrastive learning module and a multi-level alignment module, which enables adaptive updating prior to model inference. Specifically, the prototype graph contrastive learning module introduces a learnable class prototype layer after the encoder, leverages source domain priors to guide the soft assignment of target domain nodes, models the class semantic structure of graph data, and further constructs homogeneity-enhanced views with higher semantic reliability. Meanwhile, this module jointly optimizes node representations and class prototypes by combining prototype contrastive loss and prototype clustering loss, elevating local view consistency to class semantic consistency and providing reliable semantic anchors for subsequent class prototype alignment. The multi-level alignment module mitigates feature distribution variations caused by covariate shift by aligning the first-order and second-order statistics of embedding representations between the source and target domains during the test-time training phase, and addresses class semantic variations induced by concept shift by aligning the class prototype distributions of the source and target domains. To verify the effectiveness of the proposed method, this work conducts comprehensive experimental evaluations on multiple benchmark datasets for graph distribution shift, covering synthetic shift, temporal evolution, and cross-domain shift scenarios. Experimental results demonstrate that ProGTA significantly outperforms representative methods such as Tent, EERM, and GTrans in terms of out-of-distribution generalization performance. Furthermore, this study analyzes the consistency of adversarial attacks and concept shift in disrupting the model’s decision boundaries from the domain adaptation perspective, formulates the adversarial attack problem as a special case of out-of-distribution shift, and confirms that the proposed method can simultaneously improve the model’s out-of-distribution generalization and adversarial robustness.
摘要:Accurate and efficient trajectory prediction is pivotal for safe navigation in autonomous driving systems. Existing methods typically employ graph neural networks (GNNs) or attention mechanisms to jointly model the spatio-temporal dependencies between agents and high-definition maps. Despite notable gains in accuracy, the coupled spatio-temporal modeling incurs excessive computational complexity, severely limiting deployment on embedded vehicular platforms. Moreover, prevailing decoders apply a uniform parameterized paradigm to all agents, overlooking the distinct requirements of different agents in terms of prediction accuracy and multimodality, which leads to inefficient resource allocation. To address these challenges, we propose a lightweight trajectory prediction model based on spatio-temporal dimension decomposition and heterogeneous decoding (MAM-M). In the encoding stage, we design a temporal dual-stream Mamba network that processes historical trajectories through parallel forward and reverse streams, enabling each time step to capture both past and future context. This effectively mitigates the long-range forgetting problem while maintaining linear computational complexity along the temporal dimension. A self-attention mechanism is then employed along the spatial dimension to capture global interactions between agents and map elements, realizing a “temporal-first, spatial-second” decoupled encoding strategy that significantly reduces redundant computations. In the decoding stage, we propose a heterogeneous decoder tailored to different agents: for the target agent with complex motion and high behavioral uncertainty, a mode-query decoder with learnable queries retrieves scene context via cross-attention to accurately capture multimodal trajectory distributions; for the more numerous non-target agents with relatively regular motion, a neural-Bézier decoder predicts Bézier control points through a neural network and generates trajectories via mathematical formulation, substantially reducing inference latency while preserving accuracy and enabling efficient end-to-end training. Experiments on the Argoverse and Argoverse 2 datasets demonstrate that our model, with only 2.7×106 parameters and 18.6 ms inference latency, achieves superior prediction accuracy compared to mainstream lightweight models, attaining an optimal balance among accuracy, model size, and inference speed, and exhibiting excellent potential for practical deployment.
摘要:Neural architecture search (NAS), a core technology for automated deep learning model construction, aims to discover task-specific optimal network architectures. However, existing methods suffer from three critical limitations: coupled convolution and pooling operations in search spaces generate redundant solution spaces; holistically optimized high-dimensional encodings lack inter-module collaboration and easily fall into local optima; evaluation strategies relying on single or limited metrics fail to accurately reflect true architecture performance, biasing search directions. These intertwined issues eliminate high-potential architectures, create performance gaps between searched and optimal architectures, and restrict NAS deployment in resource-constrained and high-reliability scenarios. To address these deficiencies, this paper presents a progressive collaborative neural architecture search method. This method consists of three modules: a progressive representation dimensionality reduction separable architecture search space is designed at the search space level, where convolution and pooling are decoupled by their functional properties to reduce the solution space scale and retain feature representations, thus supplying input for subsequent search and evaluation. A high-dimensional decoupled unit-adaptive search strategy is proposed at the search strategy level, which decomposes high-dimensional architecture encodings into convolution segments, pooling segments and depth segments, and applies unit-level directed genetic operations including two-point crossover, single-point crossover and adaptive mutation to different modules separately. A multi-dimensional low-cost model performance evaluation strategy is constructed at the evaluation strategy level to assess candidate architectures from four dimensions, namely robustness, isotropy, uncertainty and regularity, and merges multi-dimensional scores into a comprehensive indicator through a rank-driven nonlinear geometric fusion mechanism. The three modules connect sequentially to form a progressive collaborative framework. Experimental results demonstrate that on the NAS-Bench-201 benchmark search space, the proposed method yields Kendall correlation coefficients of 0.712 0, 0.705 2 and 0.698 1 on CIFAR-10, CIFAR-100 and ImageNet16-120 datasets respectively, with a 20.13% relative gain over NASWOT on CIFAR-10. For industrial weld defect detection and APTOS-2019 medical retinopathy grading, the derived optimal architecture boosts average accuracy by approximately 18.67% and 6.12% respectively over existing training-free NAS methods including NASWOT, ZiCo and MSTF-NAS, with search time of 227.97 s and 559.34 s, and inference latency of 0.41 ms and 0.46 ms correspondingly. This work provides a reference for developing efficient, low-cost automated model design techniques with strong cross-domain generalization.
关键词:neural architecture search;automated model design;evolutionary algorithm;progressive search;low-cost evaluation
摘要:In real-world applications, data commonly suffer from missing values, which can substantially degrade the performance of machine learning models. A widely adopted approach to handling missing data is data imputation, where missing entries are estimated from observed data and models are subsequently trained on the completed dataset. However, imputation inevitably introduces estimation errors, and inaccurate imputations may inject additional noise that hinders effective learning. In particular, low-quality imputations often exhibit systematic bias, distorting the true underlying data distribution. When models are trained on such biased samples, they struggle to capture the intrinsic data-generating patterns, resulting in a pronounced decline in generalization performance. To address this issue, we propose a novel framework for learning with missing data, termed selective learning for incomplete data (SLID), which aims to more effectively exploit incomplete data during model training. SLID is designed as a reliable learning paradigm that dynamically accounts for data quality. Specifically, it introduces a dynamic assessment mechanism that transforms the conventional passive reliance on imputed data into an active selection process. Imputed samples with high confidence are treated as reliable and are fully leveraged for learning, whereas low-confidence samples are regarded as unreliable and are accordingly smoothed through regularization strategies. Through this selective learning mechanism, retaining informative components while suppressing misleading ones, SLID effectively avoids overfitting to biased distributions and substantially enhances generalization performance. Extensive experimental results on multiple datasets demonstrate that, compared with existing approaches, SLID achieves significant improvements in both accuracy and reliability.
摘要:Differential meet-in-the-middle cryptanalysis (DMC), proposed by Boura et al. at CRYPTO 2023, is a novel method to mount differential attacks based on the meet-in-the-middle idea. Benefiting from the advantages of the probabilistic extension (PE), imposed condition (IC) and parallel partition (PP) techniques in reducing time and data complexities and extending attack rounds, differential meet-in-the-middle attacks have achieved significantly improved results on many block ciphers employing linear key schedules. However, two limitations of the existing DMC remain. Firstly, the probability of the differential distinguisher under PE, denoted by , is often below (where n is the block size), causing the IC technique to fail to maintain the non-full-codebook data complexity—a scenario usually deemed invalid for attacks. Although the plaintext structure technique has been adopted in some studies as a mitigation, its integration with the PP technique remains inadequate. Secondly, owing to the nonlinear key schedule of the SIMECK cipher, recent DMC attacks have been unable to recover the master key effectively. Specifically, these attacks only recover round keys with scattered round numbers, making the cost of deriving the master key unacceptable. Motivated by the two issues above, this paper introduces a new DMC model based on the tail-jointing technique. Rather than partitioning the key bits to be enumerated according to position, this model treats some tail key bits as head key bits, yielding fewer head rounds and more tail rounds, thereby offering three advantages. First, fewer head rounds cause insufficient differential diffusion, enabling the use of plaintext structures to reduce data complexity. Second, more key bits concentrated in consecutive tail rounds significantly lowers the cost of master key derivation. Third, more explicit constraints between adjacent tail key bits enable early elimination of impossible enumerations. Based on the above model, this paper effectively integrates the plaintext structure technique with the PP technique to achieve non-full-codebook data complexity when , and strengthens DMC’s effectiveness in analyzing ciphers that adopt a nonlinear key schedule. As an application, this paper proposes master key recovery attacks on 23-round SIMECK32, 31-round SIMECK48, and 41-round SIMECK64, respectively. As far as we know, among all differential attacks capable of recovering master keys, our attacks on the three versions of SIMECK achieve the longest rounds.
摘要:The automated generation of proof-of-concept (PoC) code for vulnerability verification plays a pivotal role in cybersecurity assessment, patch validation, and the construction of automated defense systems. Despite their success in general coding, LLMs still struggle with complex “unseen” PoCs due to limited domain-specific reasoning and the inherent difficulty of high-risk exploits. This paper focuses on code generation within vertical domains and proposes MASTER (mastering automated synthesis of targeted exploits via reinforcement), an automated PoC generation framework. MASTER overcomes the generalization bottlenecks of LLMs in complex PoC synthesis through a synergistic mechanism of domain knowledge injection and intent reinforcement. Specifically, we first construct ExploitDB-CVE-CoT, a domain-specific vulnerability dataset enhanced with chain-of-thought (CoT) reasoning. Subsequently, deep domain knowledge injection is achieved via full-parameter supervised fine-tuning (SFT), enabling the model to master fundamental exploit capabilities. Furthermore, we innovatively introduce reinforcement learning from AI feedback (RLAIF) utilizing the group relative policy optimization (GRPO) algorithm. This approach employs external expert LLMs as dynamic evaluators to deeply reinforce the model’s logical reasoning and code generation proficiency for complex vulnerabilities. Empirical results demonstrate that while SFT alone significantly improves the generation success rate for common vulnerabilities and exposures (CVE) scenarios to a range of 57.5%~76%, it suffers from catastrophic forgetting in non-target domains and generalization deficiencies. The RLAIF mechanism effectively mitigates these weaknesses and enhances overall performance. Ultimately, the MASTER framework elevates the automated PoC generation success rate for high-risk vulnerabilities to 88.8%~95.6% on mainstream models such as Qwen2.5 and Llama-3.1, exhibiting robust generalization across out-of-distribution vulnerability scenarios. This research provides potent technical support for automated penetration testing and defense evaluation, effectively extending the application boundaries of LLMs in high-logic, highly specialized cybersecurity tasks.
关键词:large language models;code generation;vulnerability proof-of-concept (PoC);reinforcement learning from AI feedback;automated security testing
摘要:The cloud-edge collaborative network is widely applied in key fields such as 6G communication and industrial internet. Its open and distributed characteristics are facing continuous evolving network attack threats. Network deception defense uses resources such as honeypots and decoys to interfere with the attacker’s cognition, but its effectiveness highly depends on the timing of the rotation of deception resources. However, in actual offensive and defensive processes, there are unignorable state transition delays in the deployment of deception assets and the spread of attack penetration, and both the attacker and defender have continuous strategic interactions. Existing methods or assumptions that the state transition is instantaneous or adopt static mechanisms such as fixed cycles ignore the state transition delays and the dynamic interaction between the attacker and defender in the actual offensive and defensive process, making it impossible to accurately depict the temporal characteristics of the evolution of the offensive and defensive states, resulting in insufficient adaptability of the strategies in the real high-dynamic environment. To address these issues, this paper proposes a deception defense timing selection method based on time-delay FlipIt game and multi-agent reinforcement learning. Firstly, it analyzes the evolution characteristics of network security states and introduces six transfer paths between four node states (normal, protected, infected, and damaged) into corresponding time-delay parameters to construct a time-delay differential equation system that integrates state transition time delays, forming a network state evolution model that is closer to the actual physical process and compensates for the shortcomings of traditional SIS, SIR, etc. dynamic models that ignore time-delay factors. Secondly, it establishes models for the attacker and defender, formalizes the offensive and defensive confrontation as a game process with temporal characteristics, and proposes a time-delay FlipIt game model to explicitly depict the delay mechanism between the strategy being issued and taking effect in the state, and gives the utility functions of both the attacker and defender under the time-delay constraints. Then, using the multi-agent proximal policy optimization (MAPPO) algorithm, a centralized training and distributed execution reinforcement learning framework is constructed, designing the state space, action space, and reward function, and solving the optimal deception defense timing rotation strategy through the continuous interaction and strategy evolution of the offensive and defensive agents. Experiments are conducted in the Mininet simulation environment and a small-scale real testbed. The results show that the proposed method can effectively optimize the selection of defense timing, maintaining a stable protection state node ratio of 83.2%, reducing the attacker’s utility value by 44.85% compared to the MFD-PPO method, increasing the attack interception success rate by 38.4% compared to the FP method, and significantly reducing the IP hop frequency compared to the comparison method under the same protection state node ratio, verifying the comprehensive advantages of the proposed method in ensuring defense effectiveness and reducing resource overhead.
摘要:Network traffic representation and classification plays an important role in network security and management. Due to local convolution operations, traditional convolutional neural networks (CNN) are insufficient to handle the complexity and variability of modern network traffic. Although Transformer-based methods have achieved certain results in traffic sequence processing, the quadratic computational complexity of their self-attention mechanisms leads to high resource consumption and low efficiency when processing long sequences. Meanwhile, this architecture does not prioritize time dependencies, leading to a loss of local sequence consistency. The recently introduced state-space model (SSM) Mamba achieves computational efficiency that scales linearly with sequence length, showing advantages in local dynamic perception and long-sequence processing. However, because it compresses historical information into a fixed-dimensional hidden state, its ability to capture long-range dependencies and global traffic features is limited. To address these issues, this paper proposes encrypted traffic pre-trained model with long-range dependency and dynamic perception (ET-LDP), an encrypted network traffic pre-trained model based on long-range dependency and local dynamic perception. Instead of traditional architecture concatenation, the model integrates multiple types of modules from the perspective of traffic characteristics. Based on the multi-granularity nature of network traffic, which includes flow-level global statistical patterns and byte-level local semantics, a cross-architecture collaborative structure is constructed. ET-LDP introduces the mixture-of-experts (MoE) mechanism inside the Mamba layer. Through a routing strategy combining shared parameters and private gating, the model dynamically allocates tokens with different semantics to specific experts, which improves model capacity and local feature perception capabilities while maintaining a low computational overhead. For extracting global long-range dependencies, the model designs a mixed attention module. It first utilizes Agent Attention to aggregate local information and reduce redundant computation via agent tokens, and then combines softmax self-attention to complete fine-grained context association extraction. To solve the differences in information flow and feature space between the Mamba module and the attention module, this paper further designs cross-architecture bridging components, realizing structural alignment and mutual complementation of the two heterogeneous features through an information interaction mechanism. This flexible architecture allows configuration for specific resources and targets. Considering the diversity of network traffic and tasks, ET-LDP adopts a self-supervised learning mechanism to pre-train generalized representations from large-scale unlabeled traffic data. Evaluations on 7 public network traffic datasets, covering virtual private network (VPN), the onion router (Tor), malware, and cross-platform applications, indicate that the proposed ET-LDP model outperforms state of the art (SOTA) methods in classification performance. On the China science and technology network-TLS 1.3 (CSTNET-TLS 1.3) dataset using new encryption protocols, the accuracy is improved by 0.013 2 compared to the best-performing counterpart. In efficiency tests, at a batch size of 64, the inference memory consumption of the model is 0.6 times that of similar Transformer models, showing a good balance in throughput and computational latency.
摘要:With the rapid development of mega low earth orbit (LEO) satellite constellations, an abundance of signals of opportunity have emerged as potential solutions for assisting global navigation satellite system (GNSS) navigation in GNSS-denied environments. Taking Starlink signals as a representative example, accurate time-frequency estimation and reliable demodulation are essential prerequisites for navigation applications. However, the high dynamics of LEO satellites introduce severe Doppler effects, which challenge the accuracy and robustness of time-frequency estimation and the reliability of demodulation. To address the lack of robustness of existing time-frequency estimation algorithms under low signal-to-noise ratio (SNR) conditions and the instability of traditional methods in high-dynamic environments, this paper proposes a demodulation method for Starlink signals based on correlation and clustering, and validates it through both simulation analysis and real captured downlink signals. By exploiting the unique synchronization sequence structure of Starlink signals, a delayed autocorrelation method with enhanced correlation structure and an improved intra-symbol phase difference algorithm are designed to achieve synchronization sequence detection and coarse Doppler estimation. A symbol-by-symbol fine time-frequency estimation method based on K-means clustering is proposed. Under a non-data-aided condition, constellation clustering statistics are extracted, and the residual time-frequency errors are estimated by maximizing the empirical signal-to-noise ratio (ESNR). Simulation scenarios are constructed to analyze the convergence behavior and estimation accuracy of the proposed method. Furthermore, real captured Starlink downlink signals are employed to evaluate the algorithm performance in terms of bit error rate (BER). Experimental results demonstrate robust convergence and improved estimation accuracy under high-dynamic conditions. For real captured downlink data at 7.3 dB SNR, the proposed method reduces BER by 55.10% compared with baseline methods, enabling more reliable demodulation and supporting Starlink-based assisted navigation.
摘要:Compared with conventional second-order PLL (Phase-Locked Loop), the self-biased PLL stands out with its remarkable capability to maintain consistent loop stability and response speed across an extensive dynamic range, while also delivering superior frequency stability. These inherent advantages enable it to satisfy the demanding requirements of various high-precision frequency control applications, rendering it an ideal candidate for serving as the clock source of SerDes (Serializer/Deserializer) PHY (Physical Layer) circuits that are compliant with multiple protocol standards. What is more, the self-biased PLL can provide stable loop characteristics not only over a broad frequency range but also within a specific voltage range, which further expands its applicability in complex electronic systems. In traditional self-biased PLL architectures, two separate charge pumps are typically utilized to generate symmetric auxiliary voltages, namely Vfs1 and Vfs2. However, this dual-charge-pump configuration inevitably leads to increased system power consumption and a larger chip area footprint, which are critical drawbacks in modern high-density, low-power integrated circuit designs. Additionally, layout mismatches during the manufacturing process can introduce static offsets between Vfs1 and Vfs2. To make matters worse, power supply voltage drops and local noise interference that occur during circuit operation will give rise to dynamic mismatches between these two auxiliary voltages. Both static and dynamic mismatches can significantly degrade the performance of the VCO (Voltage-Controlled Oscillator ), manifesting as increased phase noise and clock jitter, which are detrimental to the overall signal integrity of the SerDes PHY system. To tackle the aforementioned issues comprehensively, this paper presents a novel low-power, low-mismatch charge pump structure that is capable of generating both Vfs1 and Vfs2 using a single charge pump circuit. The core innovation of this design lies in the sharing of the current bias section among the two output voltage branches, which effectively reduces the number of active components and thus cuts down the overall system power consumption substantially. Furthermore, targeted design improvements, such as symmetric circuit layout optimization and precision current mirror calibration, are implemented to minimize the output mismatches between Vfs1 and Vfs2 , thereby mitigating the adverse impacts of static and dynamic offsets on the VCO performance. In practical operation scenarios, the proposed self-biased PLL design can simultaneously act as the clock source for SerDes PHY circuits adhering to a diverse set of mainstream protocols, including PCIe (Peripheral Component Interconnect express) 1.0/2.0/3.0, USB (Universal Serial Bus) 3.0, and SATA (Serial Advanced Technology Attachment) 1/2/3. A key feature of its application in SerDes systems is that every four data units share one dedicated clock unit, and each of these four data units can be independently configured to operate at any data rate specified by the PCIe protocol, or alternatively, be set to run at any rate supported by the USB and SATA protocols respectively. This high degree of configurability makes the PLL highly adaptable to the heterogeneous communication requirements of modern electronic devices. The full integrated circuit of the proposed PLL operates at a low supply voltage of 0.9 V, which is conducive to low-power operation in battery-powered devices. The chip area occupied by the PLL core is merely 0.055 3 mm², demonstrating excellent area efficiency that is essential for integration into compact SerDes PHY chips. The PLL achieves a wide frequency tuning range spanning from 3 GHz to 5 GHz for VCO, covering the frequency bands required by most of the targeted protocols. The loop divider supports division ratios from 6 to 511, and the output divider supports ratios from 1 to 255, resulting in an output frequency range of 11.76 MHz to 5 GHz. Post-layout simulation results validate the superior performance of the design: the PLL exhibits a fast locking time of 2 μs, a low phase noise of -110 dBc/Hz at an offset frequency of 1 MHz, and a total power consumption of only 5.54 mW, all of which outperform many conventional self-biased PLL designs. Experimental test results further confirm the robustness and reliability of the proposed PLL. Specifically, the yield rate of 2 000 fabricated PLL chips exceeds 99% when operating within the extreme temperature range from -40 °C to 125 °C, indicating excellent manufacturing compatibility and environmental adaptability. Moreover, the jitter test results of the high-speed clock signals transmitted on-chip and output by the SerDes transmitter are significantly larger than the simulation predictions. At an operating frequency of 2.5 GHz, the measured RJ (Random Jitter) is 2.41 ps and the PJ (Period Jitter) is 10.8 ps; when the frequency is increased to 4 GHz, the random jitter is reduced to 1.8 ps and the period jitter is 9.28 ps. The aforementioned high-speed clock incurs significant jitter due to transmission through a complex path. In contrast, the 100 MHz reference clock for the PCIe slot generated by the PLL features an extremely short transmission path to the output PAD, the jitter introduced by the test path is minimal and can be directly measured. A dedicated PCIe reference clock test software embedded in the oscilloscope was adopted to characterize the reference clock at the PCIe slot, with the worst-case RMS (Root-Mean-Square) jitter measured at 0.776 8 ps. To verify the suitability of the proposed PLL structure for SerDes PHY applications, rigorous compliance tests were conducted at PCIe PHY Gen2 and Gen3 data rates. All test metrics not only meet the stringent requirements specified in the corresponding protocol standards but also exhibit ample margins, which provide a solid guarantee for the stable operation of the SerDes system in real-world applications.
摘要:The reliable deployment of autonomous vehicles on real-world open roads is highly dependent on their trajectory prediction generalization ability in unknown traffic scenarios. Accurate vehicle trajectory prediction serves as a key bridge between the autonomous driving environment perception and decision-making and planning modules, which directly determines the operational safety and environmental adaptability of autonomous driving system. The existing prediction methods based on deep learning mainly rely on the statistical correlation between historical and future trajectories, and their performance is severely limited by the basic assumption that training and test data are independent and identically distributed (IID). However, in complex real-world traffic environments, significant variations in map geometry and road topology lead to distribution shifts, making the IID assumption difficult to hold. Consequently, various prediction models suffer from substantial performance degradation in out-of-distribution (OOD) scenarios, which has become a critical technical bottleneck for the deployment of autonomous driving systems on open roads. To address these challenges, this paper proposes a plug-and-play vehicle trajectory prediction framework based on a causal model (CMVTP). The framework can be flexibly integrated into existing mainstream trajectory prediction models without requiring complex modifications or retraining, demonstrating strong generality and adaptability. By constructing a traffic scene-oriented structural causal model (SCM), CMVTP explicitly characterizes the intrinsic relationships between domain-invariant and domain-variant causal features, accurately reveals the underlying causal relationships in trajectory data, and effectively extracts domain-invariant features such as driving style and social interactions. Meanwhile, a causal feature learning module is designed to explicitly disentangle domain-invariant and domain-variant features, and a dual-path invariant feature transfer module is proposed. The hidden layer feature alignment and output distribution alignment enhance the model’s ability to extract domain-invariant features and reduce its reliance on domain-variant features such as map characteristics. The experimental results show that CMVTP can effectively improve the out-of-distribution generalization performance of various mainstream prediction models. In various unseen scenarios, prediction accuracy is significantly improved, with gains of up to 12.75%. The CMVTP framework proposed in this paper breaks through the performance limitations of traditional trajectory prediction methods based on statistical correlations in out-of-distribution scenarios, provides important technical support for improving the adaptability and safety of autonomous driving systems in open dynamic environments, and offering new insights and methodologies for generalization modeling in vehicle trajectory prediction.
关键词:autonomous driving;vehicle trajectory prediction;causal model;social interaction;out-of-distribution generalization;domain-invariant features
摘要:As silicon-based complementary metal oxide semiconductor (CMOS) integrated circuits gradually approach their physical limits, traditional silicon-based devices are facing insurmountable technical bottlenecks such as quantum tunneling and Joule heating loss. The development of novel information storage and logic devices with the combined characteristics of low power consumption, high speed and high integration density has become the core demand for the advancement of microelectronics technology in the post-Moore’s Law era. Spintronic devices, which take electron spin as the information carrier, have emerged as a pivotal research direction to break through the technical barriers of traditional semiconductor technology, by virtue of their prominent advantages including non-volatility, low power consumption and high radiation resistance. Among them, magnetic vortex, as a typical topological magnetic structure, possesses two fully decoupled intrinsic degrees of freedom, namely polarity and chirality. These two degrees of freedom together form a four-fold degenerate state, which can inherently realize four-state multivalue storage. Meanwhile, it has inherent advantages such as abundant spin wave excitation modes, no requirement for complex material systems containing Dzyaloshinskii-Moriya interaction (DMI), and no displacement deviation caused by the skyrmion Hall effect during transport, thus exhibiting broad application prospects in the fields of high-density storage, GHz-band high-frequency devices, and low-power logic operation. This paper systematically reviews the multi-dimensional modulation mechanisms of magnetic vortex polarity and chirality, combs through and constructs a complete research logic framework of mainstream modulation methods, and focuses on analyzing the physical mechanisms, research progress and performance limitations of typical modulation methods including spin transfer torque (STT), spin-orbit torque (SOT), strain-mediated modulation, and surface acoustic wave (SAW). STT and SOT modulation have fast responses, and can realize selective switching of polarity and chirality through precise control of current density, but suffer from problems such as thermal loss and interface damage caused by high current density. Strain-mediated modulation achieves ultra-low power manipulation without Joule heating via the inverse magnetostrictive effect, which has evolved from early mechanical torsion drive to a piezoelectric heterojunction scheme suitable for on-chip integration, and can realize nanosecond-scale deterministic switching of polarity and chirality. SAW modulation realizes non-contact long-range manipulation of magnetic vortices through the magnetoacoustic coupling effect, and its high-order harmonic drive provides a novel low-power path for the switching of both polarity and chirality. Meanwhile, taking the modulation logic of magnetic vortices as a reference, this paper conducts a horizontal comparative analysis on the topological state modulation of skyrmions, a homologous topological magnetic structure, and clarifies the core differences between the two types of structures in terms of topological essence, coupling characteristics of degrees of freedom, modulation window and device applicability, which provides new ideas and references for the optimization of magnetic vortex modulation mechanisms. On this basis, this paper thoroughly discusses the research evolution process of the magnetization dynamic properties of magnetic vortices, and analyzes their application potential in GHz-band devices around key directions including the regulation of vortex core gyrotropic motion, high-frequency spin wave excitation, and nonlinear frequency multiplication effect. Aiming at the core bottlenecks of frequency mismatch and low excitation efficiency existing in current strain-mediated modulation, this paper proposes a resonance excitation path of high-frequency spin waves based on the nonlinear frequency multiplication effect, as well as the design idea of reconfigurable magnetoelectric heterojunction devices. This paper systematically integrates the full-chain research context of magnetic vortices from basic physical mechanisms to device-oriented applications, and provides a systematic theoretical basis and technical reference for the development of next-generation low-power, high-frequency spintronic devices.