arXiv subjects

Hyojoon Kim

Publications and source records attributed to Hyojoon Kim.

8 recordsLinked to original sources

arXiv2026

Effective Pivot Attack Detection via System and Network Information

Perimeter-based security appliances, such as firewalls or Intrusion Detection Systems, are ineffective against modern attacks that use pivoting, wherein attackers "pivot" traffic through compromised hosts to gain access to additional targets that would otherwise be inaccessible. Due to the legitimate appearance of the relayed traffic, pivoting is extremely difficult to detect. Although the consequences of these attacks are known to be severe, existing defenses suffer from drawbacks such as high processing delays, low accuracy, or reliance on network-wide participation, making them inconvenient or even ineffective. This work presents Stitch, a host-based system that uses the programmable kernel to detect pivoting in real time. By observing host-traversing flows, Stitch uses process tracing to effectively combine system and network-level information, connecting incoming and outgoing communications and identifying pivoting characteristics between them. Showing 31% gains in accuracy over state-of-the-art pivoting defenses and a maximum false positive rate of 0.006% over two separate real-world deployments, Stitch covers the gap in current pivot detection solutions by providing accurate, lightweight, and independent coverage for vulnerable hosts in a network.

cs.CR↗

arXiv2025

Towards Practical and Usable In-network Classification

In-network machine learning enables real-time classification directly on network hardware, offering consistently low inference latency. However, current solutions are limited by strict hardware constraints, scarce on-device resources, and poor usability, making them impractical for ML developers and cloud operators. To this end, we propose ACORN, an end-to-end system that automates the distributed deployment of practical machine learning models across the network. ACORN provides a fully automated pipeline that loads and deploys Python ML models on network devices using an optimized deployment plan from an ILP planner. To support larger models under hardware constraints and allow runtime programmability, ACORN adopts a novel data plane representation for Decision Tree, Random Forest, and Support Vector Machine models. We implement ACORN prototype in P4 and run it on real programmable hardware. Our evaluation shows ACORN can deploy classification ML models with 2-4x more features than state-of-the-art solutions, while imposing negligible overhead on network performance and traffic. We will make our data plane program, model translator, optimizer, and all related scripts publicly available.

cs.NI↗

arXiv2025

Data-Plane Telemetry to Mitigate Long-Distance BGP Hijacks

Poor security of Internet routing enables adversaries to divert user data through unintended infrastructures (hijack). Of particular concern -- and the focus of this paper -- are cases where attackers reroute domestic traffic through foreign countries, exposing it to surveillance, bypassing legal privacy protections, and posing national security threats. Efforts to detect and mitigate such attacks have focused primarily on the control plane while data-plane signals remain largely overlooked. In particular, change in propagation delay caused by rerouting offers a promising signal: the change is unavoidable and the increased propagation delay is directly observable from the affected networks. In this paper, we explore the practicality of using delay variations for hijack detection, addressing two key questions: (1) What coverage can this provide, given its heavy dependence on the geolocations of the sender, receiver, and adversary? and (2) Can an always-on latency-based detection system be deployed without disrupting normal network operations? We observe that for 86% of victim-attacker country pairs in the world, mid-attack delays exceed pre-attack delays by at least 25% in real deployments, making delay-based hijack detection promising. To demonstrate practicality, we design HiDe, which reliably detects delay surges from long-distance hijacks at line rate. We measure HiDe's accuracy and false-positive rate on real-world data and validate it with ethically conducted hijacks.

cs.NI↗

arXiv2025

Scalable Video Conferencing Using SDN Principles

Video-conferencing applications face an unwavering surge in traffic, stressing their underlying infrastructure in unprecedented ways. This paper rethinks the key building block for conferencing infrastructures -- selective forwarding units (SFUs). SFUs relay and adapt media streams between participants and, today, run in software on general-purpose servers. Our main insight, discerned from dissecting the operation of production SFU servers, is that SFUs largely mimic traditional packet-processing operations such as dropping and forwarding. Guided by this, we present Scallop, an SDN-inspired SFU that decouples video-conferencing applications into a hardware-based data plane for latency-sensitive and frequent media operations, and a software control plane for the (infrequent) remaining tasks, such as analyzing feedback signals. Our Tofino-based implementation fully supports WebRTC and delivers 7-210 times improved scaling over a 32-core commodity server, while reaping performance improvements by cutting forwarding-induced latency by 26 times.

cs.NI↗

arXiv2021

Traffic Refinery: Cost-Aware Data Representation for Machine Learning on Network Traffic

Network management often relies on machine learning to make predictions about performance and security from network traffic. Often, the representation of the traffic is as important as the choice of the model. The features that the model relies on, and the representation of those features, ultimately determine model accuracy, as well as where and whether the model can be deployed in practice. Thus, the design and evaluation of these models ultimately requires understanding not only model accuracy but also the systems costs associated with deploying the model in an operational network. Towards this goal, this paper develops a new framework and system that enables a joint evaluation of both the conventional notions of machine learning performance (e.g., model accuracy) and the systems-level costs of different representations of network traffic. We highlight these two dimensions for two practical network management tasks, video streaming quality inference and malware detection, to demonstrate the importance of exploring different representations to find the appropriate operating point. We demonstrate the benefit of exploring a range of representations of network traffic and present Traffic Refinery, a proof-of-concept implementation that both monitors network traffic at 10 Gbps and transforms traffic in real time to produce a variety of feature representations for machine learning. Traffic Refinery both highlights this design space and makes it possible to explore different representations for learning, balancing systems costs related to feature extraction and model training against model accuracy.

cs.NI↗

arXiv2020

Programmable In-Network Obfuscation of Traffic

Recent advances in programmable switch hardware offer a fresh opportunity to protect user privacy. This paper presents PINOT, a lightweight in-network anonymity solution that runs at line rate within the memory and processing constraints of hardware switches. PINOT encrypts a client's IPv4 address with an efficient encryption scheme to hide the address from downstream ASes and the destination server. PINOT is readily deployable, requiring no end-user software or cooperation from networks other than the trusted network where it runs. We implement a PINOT prototype on the Barefoot Tofino switch, deploy PINOT in a campus network, and present results on protecting user identity against public DNS, NTP, and WireGuard VPN services.

cs.NI↗

arXiv2009

Quantum-Classical Liouville Dynamics in the Mapping Basis

The quantum-classical Liouville equation describes the dynamics of a quantum subsystem coupled to a classical environment. It has been simulated using various methods, notably, surface-hopping schemes. A representation of this equation in the mapping Hamiltonian basis for the quantum subsystem is derived. The resulting equation of motion, in conjunction with expressions for quantum expectation values in the mapping basis, provide another route to the computation of the nonadiabatic dynamics of observables that does not involve surface-hopping dynamics. The quantum-classical Liouville equation is exact for the spin-boson system. This well-known model is simulated using an approximation to the evolution equation in the mapping basis and close agreement with exact quantum results is found.

cond-mat.other↗

arXiv2008

Surface-hopping dynamics and decoherence with quantum equilibrium structure

In open quantum systems decoherence occurs through interaction of a quantum subsystem with its environment. The computation of expectation values requires a knowledge of the quantum dynamics of operators and sampling from initial states of the density matrix describing the subsystem and bath. We consider situations where the quantum evolution can be approximated by quantum-classical Liouville dynamics and examine the circumstances under which the evolution can be reduced to surface-hopping dynamics, where the evolution consists of trajectory segments evolving exclusively on single adiabatic surfaces, with probabilistic hops between these surfaces. The justification for the reduction depends on the validity of a Markovian approximation on a bath averaged memory kernel that accounts for quantum coherence in the system. We show that such a reduction is often possible when initial sampling is from either the quantum or classical bath initial distributions. If the average is taken only over the quantum dispersion that broadens the classical distribution, then such a reduction is not always possible.

cond-mat.stat-mech↗