Yuan-Cheng Lai’s research while affiliated with National Taiwan University of Science and Technology and other places

In an IoT (Internet of Things) system where each IoT device has one/many RFID tags, there might be many RFID tags. However, when multiple tags respond to the reader’s interrogation at the same time, their signals collide. Due to the collision, the reader must request the colliding tags to retransmit their IDs, resulting in higher communication overhead and longer identification time. Therefore, this paper presents a Bit-tracking Knowledge-based Query Tree (BKQT), which uses two techniques: knowledge, which stores all the tag IDs that can possibly occur, and bit tracking, which allows the reader to detect the locations of the collided bits in a collision slot. BKQT constructs a query tree for all possible tags, called a k-tree, by using knowledge while it constructs bit-collision cases and the corresponding actions for each node in this k-tree by using bit tracking. In the identification process, BKQT traverses this constructed k-tree and thus identifies the colliding tags faster by taking the actions according to the happening bit-collision cases. From the simulation results, BKQT can improve the identification time by 44.3%, 46.4%, and 25.1%, compared with the previous knowledge-based protocols, Knowledge Query Tree (KQT), Heuristic Query Tree (H-QT), Query Tree with Shortcutting and Couple Resolution (QTSC), respectively.

The Deterministic Network (DetNet) is becoming a major feature for 5G and 6G networks to cope with the issue that conventional IT infrastructure cannot efficiently handle latency-sensitive data. The DetNet applies flow virtualization to satisfy time-critical flow requirements, but inevitably, DetNet flows and conventional flows interact/interfere with each other when sharing the same physical resources. This subsequently raises the hybrid DDoS security issue that high malicious traffic not only attacks the DetNet centralized controller itself but also attacks the links that DetNet flows pass through. Previous research focused on either the DDoS type of the centralized controller side or the link side. As DDoS attack techniques are evolving, Hybrid DDoS attacks can attack multiple targets (controllers or links) simultaneously, which are difficultly detected by previous DDoS detection methodologies. This study, therefore, proposes a Flow Differentiation Detector (FDD), a novel approach to detect Hybrid DDoS attacks. The FDD first applies a fuzzy-based mechanism, Target Link Selection, to determine the most valuable links for the DDoS link/server attacker and then statistically evaluates the traffic pattern flowing through these links. Furthermore, the contribution of this study is to deploy the FDD in the SDN controller OpenDayLight to implement a Hybrid DDoS attack detection system. The experimental results show that the FDD has superior detection accuracy (above 90%) than traditional methods under the situation of different ratios of Hybrid DDoS attacks and different types and scales of topology.

In software‐defined networks, the switch forwards incoming packets according to forwarding rules recorded in the flow entries. When a switch receives a table‐miss packet, meaning no match with any flow entry, it sends this packet as a Packet‐In message to the controller for its further processing. Many Packet‐In messages will cause large overhead and long packet delay. This paper proposes a novel method, Packet‐In Buffering and Prioritization (PIBP), which buffers Packet‐In messages and prioritizes these messages to reduce the number of Packet‐In messages and accelerate their processing, respectively. The concept of PIBP is sending only the first table‐miss packet of each flow to the controller. The other table‐miss packets belonging to the same flow are temporarily stored in the switch. Moreover, these messages have a higher priority. That is, after the packet sent from the controller has been forwarded from the switch, the buffered packets belonging to the same flow are also immediately forwarded. We formally analyze the performance of PIBP with queuing theory. The analytical and simulation results show that PIBP can decrease the average delay of table‐miss packets compared with two typical methods, Priority Queue and Mismatched Packets Table. PIBP can achieve a better performance in comparison with the PQ method, no matter what value of packet arrival rate in each flow and flow arrival rate. When the controller is more congested, PIBP can get larger improvements compared with PQ. On the other hand, PIBP can outperform MPT when the switch does not have enough capacity to process packets soon. Finally, the accuracy of the proposed analytical model for PIBP has been validated through simulation.

(1) Background: Link flooding attacks (LFA) are a spatiotemporal attack pattern of distributed denial-of-service (DDoS) that arranges bots to send low-speed traffic to backbone links and paralyze servers in the target area. (2) Problem: The traditional methods to defend against LFA are heuristic and cannot reflect the changing characteristics of LFA over time; the AI-based methods only detect the presence of LFA without considering the spatiotemporal series attack pattern and defense suggestion. (3) Methods: This study designs a deep ensemble learning model (Stacking-based integrated Convolutional neural network–Long short term memory model, SCL) to defend against LFA: (a) combining continuous network status as an input to represent “continuous/combination attacking action” and to help CNN operation to extract features of spatiotemporal attack pattern; (b) applying LSTM to periodically review the current evolved LFA patterns and drop the obsolete ones to ensure decision accuracy and confidence; (c) stacking System Detector and LFA Mitigator module instead of only one module to couple with LFA detection and mediation at the same time. (4) Results: The simulation results show that the accuracy rate of SCL successfully blocking LFA is 92.95%, which is 60.81% higher than the traditional method. (5) Outcomes: This study demonstrates the potential and suggested development trait of deep ensemble learning on network security.

In Radio Frequency Identification (RFID) systems, the reader identifies tags through communications over a shared wireless channel. However, when multiple tags transmit their IDs simultaneously, their signals collide, thereby prolonging the identification delay. However, in some applications, the RFID system has the availability of a database containing the IDs of all the tags that may possibly appear. The present study proposes a novel knowledge-based Query Tree with Shortcutting and Couple Resolution (QTSC) protocol for reducing the identification delay in RFID systems with such a database. In the proposed protocol, a knowledge-based query tree is first constructed to store the queries required to identify all the possible tags in the database. Then, at identifying appearing tags, the tags actually appear among possible tags, shortcutting and couple-resolution techniques are employed to skip redundant queries in the query tree and transmit two ID prefixes simultaneously within the same slot, respectively. The simulation results show that compared to the existing knowledge-based protocols, Knowledge Query Tree (KQT) and Heuristic Query Tree (HQT) protocols, QTSC reduces the identification delay by 60.5% and 39.0%, respectively.