Xiaoyan Hu

Southeast University

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Trends

Author Order

Document Type

Co-Authors

Guang Cheng

Southeast University

Hua Wu

Southeast University

Jian Gong

Northwestern Polytechnical University

Ruidong Li

Kanazawa University

Jie Xu

Jiangsu Police Officer College

Jian Gong

Guangxi University

Shaoqi Zheng

Northwestern Polytechnical University

Lixia Zhao

Southeast University

Wei Ding

Hefei University of Technology

Guang Cheng

Southeast University

Cooperative Institutions

Southeast University

Chinese Academy of Sciences

Central South University

National University of Defense Technology

Beijing University of Technology

Purple Mountain Laboratories

Huazhong University of Science and Technology

Ministry of Education of the People's Republic of China

IBM Research - Thomas J. Watson Research Center

IBM (United States)

Author Statistics

Papers

Citation

H-Index

i-10 index

Research Field

Real-time Identification of VPN Traffic based on Counting Bloom Filter and Chained Hash Table from Sampled Data in High-speed Networks

ICC 2022 - IEEE International Conference on Communications (2022)

Hua Wu Yujie Liu Guang Cheng Xiaoyan Hu

Virtual Private Network (VPN) can bypass censorship and access services that are geographically locked. Therefore, VPN traffic identification has become an urgent problem in traffic classification. The existing VPN traffic identification methods use complete traffic for analysis. However, massive data analysis in high-speed networks consumes many resources, limiting the real-time processing of traffic identification. The management of high-speed networks is mainly based on sampled traffic. As VPN traffic accounts for a relatively low proportion, it is particularly challenging to identify VPN traffic from sampled data. This paper proposes a real-time identification method for VPN traffic from sampled data in high-speed networks. In our method, we construct features that are still available after sampling and design a fast traffic processing structure based on Counting Bloom Filter and Chained Hash Table (CBCH). To validate the usability of our method, we use 900 seconds of traffic generated on a 10 Gbps link as background traffic, mixed with V2Ray traffic, which is increasingly common in VPN traffic. With the VPN traffic proportion of 0.03%, it takes only 50.79 seconds to complete the processing at the sampling ratio of 1/256. This time is significantly less than the traffic generation time. For the effective flows extracted from sampled backbone traffic, the identification results are maintained at a high level with 97% precision, 93% recall, and 95% F1 score. In addition, our method can achieve fine-grained VPN traffic identification of different V2Ray tools.

Bloom filter

Identification

Traffic classification

10.1109/icc45855.2022.9839256

Cite

Citations (3)

Two-Dimensional MXenes: Innovative Materials for Efficient Thermal Management and Safety Solutions

Research (2024)

Xiaoyan Hu Qi Fan Shengchao Wang Yanxin Chen Degao Wang

MXenes, a class of 2-dimensional transition metal carbides and nitrides, have garnered important attention due to their remarkable electrical and thermal conductivity, high photothermal conversion efficiency, and multifunctionality. This review explores the potential of MXene materials in various thermal applications, including thermal energy storage, heat dissipation in electronic devices, and the mitigation of electromagnetic interference in wearable technologies. Recent advancements in MXene composites, such as MXene/bacterial cellulose aerogel films and MXene/polymer composites, have demonstrated enhanced performance in phase change thermal storage and electromagnetic interference shielding, underscoring their versatility and effectiveness. Although notable progress has been made, challenges remain, including the need for a deeper understanding of photothermal conversion mechanisms, improvements in mechanical properties, exploration of diverse MXene types, and the development of sustainable synthesis methods. This paper discusses these aspects and outlines future research directions, emphasizing the growing importance of MXenes in addressing energy efficiency, health, and safety concerns in modern applications.

MXenes

10.34133/research.0542

Cite

Citations (0)

Multipath inter-domain routing for named data networking

Xiaoyan Hu

To facilitate content retrieval among NDN domains, a multipath inter-domain routing for named data networking(MIRNDN) was proposed. Under MIRNDN, an AS(autonomous system) maintained merely the routing state of content reachable from its own network or from its customers' networks and aggregated routing information to mitigate routing scalability issue; valley free routing policy was applied to guide Interest packets that solicit content unreachable from the AS's own network nor from its customers' networks to explore matching data packets via multiple paths, and NDN's requests aggregation, in-network caching and adaptive forwarding optimized such exploration; the reachability information of content from multiple paths was collected to support Interest multipath forwarding. The properties of FIB size and the convergence time and communication cost of routing update under MIRNDN were analyzed in theory. The experimental results in the AS level topology of current Internet validates that MIRNDN mitigates the scalability issue of NDN inter-domain routing, has relative short convergence time and moderate communication cost for routing update, and effectively reduces unnecessary Interest forwarding.

Multipath routing

Policy-based routing

Equal-cost multi-path routing

Routing domain

Cite

Citations (0)

Real-time Packet Loss Detection for TCP and UDP Based on Feature-Sketch

IEEE INFOCOM 2022 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS) (2021)

Hua Wu Liu Ya Guang Cheng Xiaoyan Hu

Nowadays, networks are often impaired by cyber attacks, which leads to network quality of service degradation. Packet loss is one of the essential and concerning symptoms during these attacks. And thus the real-time detection of packet loss is conducive to network anomaly monitoring. Existing passive packet loss detection methods mainly study the packet loss for TCP using header information and few focus on that of UDP due to its limited header information. Besides, such Deep Packet Inspection (DPI) based packet loss detection is resource consuming and impractical for high-speed network. To address these problems, we propose a novel framework called LossDetection based on packet sampling and Feature-Sketch to detect packet loss in real-time for both TCP and UDP. The Feature-Sketch analyzes ongoing packet flow to extract bidirectional packet-type-based and payload-length-based features using 13 counters for TCP and 8 counters for UDP with constant memory consumption. The feature set was trained on Random Forest (RF) model and eXtreme Gradient Boosting (XGB) model to construct the relationship between these features and the packet loss pattern. The result shows that our methodology can detect packet loss in real-time with an accuracy of 95%-97% even at a sampling rate of 1/256.

Packet loss

Packet analyzer

End-to-end delay

Header

10.1109/infocomwkshps51825.2021.9484593

Cite

Citations (5)

An Insightful Experimental Study of a Sophisticated Interest Flooding Attack in NDN

Lixia Zhao Guang Cheng Xiaoyan Hu Hua Wu Jian Gong

NDN (Named Data Networking), a promising next-generation architecture, puts named content in the first place of the network and is resilient to many existing DDoS attacks. However, Interest Flooding Attack (IFA), a typical NDN-specific DDoS attack, has been widely recognized as a serious threat to the development of NDN. The existing countermeasures against IFA mainly aim at the scenario that attackers send spoofed Interests at a fairly high rate and intermediate routers near the attackers can timely detect the attack by themselves. Instead, this work focuses on a more sophisticated scenario that carefully-crafted attackers send Interests at a respectively lower rate at the beginning but gradually speed up to keep the victims’ PIT sizes increasing to eventually deplete the PIT resource for legitimate users. We conduct an insightful experimental study of such sophisticated IFAs on a real-world network topology and our experimental results demonstrate that the statistics of intermediate routers near the attackers change more gradually and slightly in such an attack, which makes it more difficult for an intermediate router near the attackers to detect by itself. Based on the analytical results of this study, we discuss a potential detection and countermeasure mechanism against such a sophisticated IFA in which a central controller monitors the network from a global view.

Countermeasure

Spoofing attack

10.1109/hoticn.2018.8605965

Cite

Citations (7)

ReplaceDGA: BiLSTM-Based Adversarial DGA With High Anti-Detection Ability

IEEE Transactions on Information Forensics and Security (2023)

Xiaoyan Hu Hao Chen Miao Li Guang Cheng Ruidong Li

Botnets extensively leverage Domain Generation Algorithms (DGAs) to establish reliable communication channels between bots and Command and Control (C&C) servers. Numerous character-level DGA classifiers have been extensively studied to detect and classify domain names generated by DGAs. Meanwhile, a series of adversarial domain generation algorithms have been proposed to evade DGA classifiers. Although the existing domain name generation algorithms have progressed against DGA classifier, their anti-detection abilities are still weak. This paper proposes a Bidirectional Long Short-Term Memory (BiLSTM) network-based adversarial DGA with high anti-detection ability, referred to as ReplaceDGA. ReplaceDGA requires no knowledge of the targeted DGA classifiers. It first builds a prediction model for benign domain names using the BiLSTM network to model the semantic relationship hidden within benign domain names and then replaces two characters of each input benign domain name based on the prediction model to maximize the similarity between the benign and generated domain names. Our experimental results validate that ReplaceDGA successfully evades various character-level DGA classifiers even after they are retrained by domain names generated by ReplaceDGA and outperforms the state-of-the-art adversarial DGAs in anti-detection ability, repetition rate, and collision rate. Our study of ReplaceDGA promotes the urgent need for developing more comprehensive and robust DGA classifiers that consider other factors besides character-level information of domain names.

Botnet

Leverage (statistics)

10.1109/tifs.2023.3293956

Cite

Citations (9)

An overview of coronavirus and progress in its detection and treatment

Zhonghua weishengwuxue he mianyixue zazhi (2020)

Xiaoyan Hu Doudou Ren Chunxia Qi Lingling Lu Min Wei

Coronavirus

2019-20 coronavirus outbreak

Source

Cite

Citations (0)

BCAC: Batch Classifier based on Agglomerative Clustering for traffic classification in a backbone network

Hua Wu Xiying Chen Guang Cheng Xiaoyan Hu Youqiong Zhuang

Backbone network is the core part of the Internet. Due to the high transmission speed of traffic in the backbone network, Quality of Service (QoS) monitoring of services in the backbone network becomes a highly important and challenging issue. Traffic classification is the basis of QoS monitoring. The existing traffic classification is based on full traffic, which is impractical in high-speed backbone network traffic. This paper presents a method to classify the sampled traffic and gives an example of its application in QoS monitoring. Specifically, we design the Multiple Counter Sketch (MC Sketch) to quickly extract features from the sampled data stream in a backbone, propose the Batch Classifier based on Agglomerative Clustering (BCAC) for unsupervised clustering of traffic, and combine with the supervised machine learning method to train the labeled data in the clustering results to get the classification model. The experimental results of sampled traffic collected on a 10Gbps link show that even when the sampling ratio is 1:1024, the accuracy of our classification model reaches 96.3%. When different block sizes are set, the average clustering time of BCAC is only about one-third of the traditional agglomerative classifier. Moreover, we give an example of applying our traffic classification method to monitor the QoS, and the results show that our method can efficiently and accurately monitor the QoS dynamics of backbone network traffic.

Traffic classification

Backbone network

Hierarchical clustering

Spectral Clustering

10.1109/iwqos52092.2021.9521310

Cite

Citations (3)

MicroNet-MIMRF: A Microbial Network Inference Approach Based on Mutual Information and Markov Random Fields

Bioinformatics Advances (2024)

Chenqionglu Feng Huiqun Jia Hui Wang Jiaojiao Wang Mengxuan Lin

The human microbiome, comprises complex associations and communication networks among microbial communities, which are crucial for maintaining health. The construction of microbial networks is vital for elucidating these associations. However, existing microbial networks inference methods cannot solve the issues of zero-inflation and non-linear associations. Therefore, necessitating novel methods to improve the accuracy of microbial networks inference.

Markov random field

10.1093/bioadv/vbae167

Cite

Citations (0)

An on-demand off-path cache exploration based multipath forwarding strategy

Computer Networks (2019)

Xiaoyan Hu Shaoqi Zheng Guoqiang Zhang Lixia Zhao Guang Cheng

Information-Centric Networking

Cache coherence

Packet forwarding

10.1016/j.comnet.2019.107032

Cite

Citations (17)