Searcharxiv⌕ Search

arXiv subjects

Xia Yin

Publications and source records attributed to Xia Yin.

17 recordsLinked to original sources
arXiv2026

TORCH: Characterizing Invalid Route Filtering via Tunnelled Observation

To mitigate BGP prefix hijacking, the Resource Public Key Infrastructure (RPKI) provides prefix origin authentication via Route Origin Validation (ROV). Despite extensive measurement efforts in IPv4, the protective impact of ROV in IPv6 has yet to be systematically assessed. Existing approaches suffer from limited observability into invalid route propagation: they often rely on a small set of controlled prefixes or cannot fully profile the filtering of in-the-wild RPKI-invalid routes, which undermines the accuracy of assessment. Furthermore, the inherent opacity of the IPv6 data plane exacerbates the difficulty of performing scalable and reliable active measurements. In this paper, we present TORCH, a novel framework for measuring invalid route filtering in IPv6. It repurposes open 6in4 tunnel endpoints as widely distributed vantage points for global measurement. At its core, we develop a cross-plane inference technique that determines reachability without requiring responsive targets. This method allows us to characterize whether and how traffic is steered to invalid origins across diverse routing scenarios, leading to an in-depth evaluation of the real-world impact of ROV. Our measurements reveal that about 27\% of ASes have achieved nearly full ROV protection. However, several permissive Tier-1 ASes still transit traffic towards invalid origins, maintaining a substantial attack surface. Through a prefix-centric analysis, we provide the first empirical evidence that the collateral damage of same-length prefix filtering can affect a significant fraction of the global Internet. Our findings pinpoint fundamental vulnerabilities in ROV deployment and underscore the urgent necessity for network operators to accelerate RPKI adoption. We make our datasets publicly available.

cs.NI↗
arXiv2026

Minimum-Cost Network Flow with Dual Predictions

Recent work has shown that machine-learned predictions can provably improve the performance of classic algorithms. In this work, we propose the first minimum-cost network flow algorithm augmented with a dual prediction. Our method is based on a classic minimum-cost flow algorithm, namely $\varepsilon$-relaxation. We provide time complexity bounds in terms of the infinity norm prediction error, which is both consistent and robust. We also prove sample complexity bounds for PAC-learning the prediction. We empirically validate our theoretical results on two applications of minimum-cost flow, i.e., traffic networks and chip escape routing, in which we learn a fixed prediction, and a feature-based neural network model to infer the prediction, respectively. Experimental results illustrate $12.74\times$ and $1.64\times$ average speedup on two applications.

cs.LG↗
arXiv2024

Centralized Network Utility Maximization with Accelerated Gradient Method

Network utility maximization (NUM) is a well-studied problem for network traffic management and resource allocation. Because of the inherent decentralization and complexity of networks, most researches develop decentralized NUM algorithms. In recent years, the Software Defined Networking (SDN) architecture has been widely used, especially in cloud networks and inter-datacenter networks managed by large enterprises, promoting the design of centralized NUM algorithms. To cope with the large and increasing number of flows in such SDN networks, existing researches about centralized NUM focus on the scalability of the algorithm with respect to the number of flows, however the efficiency is ignored. In this paper, we focus on the SDN scenario, and derive a centralized, efficient and scalable algorithm for the NUM problem. By the designing of a smooth utility function and a smooth penalty function, we formulate the NUM problem with a smooth objective function, which enables the use of Nesterov's accelerated gradient method. We prove that the proposed method has $O(d/t^2)$ convergence rate, which is the fastest with respect to the number of iterations $t$, and our method is scalable with respect to the number of flows $d$ in the network. Experiments show that our method obtains accurate solutions with less iterations, and achieves close-to-optimal network utility.

cs.NI↗
arXiv2024

E-DoH: Elegantly Detecting the Depths of Open DoH Service on the Internet

In recent years, DNS over Encrypted (DoE) methods have been regarded as a novel trend within the realm of the DNS ecosystem. In these DoE methods, DNS over HTTPS (DoH) provides encryption to protect data confidentiality while providing better obfuscation to avoid censorship by multiplexing port 443 with web services. This development introduced certain inconveniences in discovering publicly available DoH services. In this paper, we propose the E-DoH method for elegant and efficient DoH service detection. First, we optimized the probing mechanism to enable a single DoH connection to accomplish multiple tasks including service discovery, correctness validation and dependency construction. Second, we propose an efficient DoH detection tool. This tool can enhance probing efficiency while significantly reduce the required traffic volume. Third, based on the above optimization methods, we conducted an exploration of the IPv4 space and performed an in-depth analysis of DoH based on the collected information. Through experiments, our approach demonstrates a remarkable 80% improvement in time efficiency, and only requires 4%-20% traffic volume to complete the detection task. In wild detection, our approach discovered 46k DoH services, which nearly doubles the number discovered by the state-of-the-art. Based on the collected data, we present several intriguing conclusions about the current DoH service ecosystem.

cs.CR↗
arXiv2024

Unveiling a Novel Metal-to-Metal Transition in LuH2: Critically Challenging Superconductivity Claims in Lutetium Hydrides

Following the recent report by Dasenbrock-Gammon et al. (2023) of near-ambient superconductivity in nitrogen-doped lutetium trihydride (LuH3-δNε), significant debate has emerged surrounding the composition and interpretation of the observed sharp resistance drop. Here, we meticulously revisit these claims through comprehensive characterization and investigations. We definitively identify the reported material as lutetium dihydride (LuH2), resolving the ambiguity surrounding its composition. Under similar conditions (270-295 K and 1-2 GPa), we replicate the reported sharp decrease in electrical resistance with a 30% success rate, aligning with Dasenbrock-Gammon et al.'s observations. However, our extensive investigations reveal this phenomenon to be a novel, pressure-induced metal-to-metal transition intrinsic to LuH2, distinct from superconductivity. Intriguingly, nitrogen doping exerts minimal impact on this transition. Our work not only elucidates the fundamental properties of LuH2 and LuH3 but also critically challenges the notion of superconductivity in these lutetium hydride systems. These findings pave the way for future research on lutetium hydride systems while emphasizing the crucial importance of rigorous verification in claims of ambient temperature superconductivity.

cond-mat.supr-con↗
arXiv2023

Universal Anomaly of Dynamics at Phase Transition Points Induced by Pancharatnam-Berry Phase

Recently, dynamical anomalies more than critical slowing down are often observed near both the continuous and first-order phase transition points. We propose that the universal anomalies could originate from the geometric phase effects. A Pancharatnam-Berry phase is accumulated continuously in quantum states with the variation of tuning parameters. Phase transitions are supposed to induce a abrupt shift of the geometric phase. In our multi-level quantum model, the quantum interference induced by the geometric phase could prolong or shorten the relaxation times of excited states at phase transition points, which agrees with the experiments, models under sudden quenches and our semi-classical model. Furthermore, we find that by setting a phase shift of \text{\ensuremathπ}, the excited state could be decoupled from the ground state by quantum cancellation so that the relaxation time even could diverge to infinity. Our work introduces the geometric phase to the study of conventional phase transitions and quantum phase transition, and could substantially extend the dephasing time of qubits for quantum computing.

cond-mat.stat-mech↗
arXiv2022

Novel Valence Transition in Elemental Metal Europium around 80 GPa

Valence transition could induce structural, insulator-metal, nonmagnetic-magnetic and superconducting transitions in rare-earth metals and compounds, while the underlying physics remains unclear due to the complex interaction of localized 4f electrons as well as their coupling with itinerant electrons. The valence transition in the elemental metal europium (Eu) still has remained as a matter of debate. Using resonant x-ray emission scattering and x-ray diffraction, we pressurize the states of 4f electrons in Eu and study its valence and structure transitions up to 160 GPa. We provide compelling evidence for a valence transition around 80 GPa, which coincides with a structural transition from a monoclinic (C2/c) to an orthorhombic phase (Pnma). We show that the valence transition occurs when the pressure-dependent energy gap between 4f and 5d electrons approaches the Coulomb interaction. Our discovery is critical for understanding the electrodynamics of Eu, including magnetism and high-pressure superconductivity.

cond-mat.str-el↗
arXiv2021

threaTrace: Detecting and Tracing Host-based Threats in Node Level Through Provenance Graph Learning

Host-based threats such as Program Attack, Malware Implantation, and Advanced Persistent Threats (APT), are commonly adopted by modern attackers. Recent studies propose leveraging the rich contextual information in data provenance to detect threats in a host. Data provenance is a directed acyclic graph constructed from system audit data. Nodes in a provenance graph represent system entities (e.g., $processes$ and $files$) and edges represent system calls in the direction of information flow. However, previous studies, which extract features of the whole provenance graph, are not sensitive to the small number of threat-related entities and thus result in low performance when hunting stealthy threats. We present threaTrace, an anomaly-based detector that detects host-based threats at system entity level without prior knowledge of attack patterns. We tailor GraphSAGE, an inductive graph neural network, to learn every benign entity's role in a provenance graph. threaTrace is a real-time system, which is scalable of monitoring a long-term running host and capable of detecting host-based intrusion in their early phase. We evaluate threaTrace on three public datasets. The results show that threaTrace outperforms three state-of-the-art host intrusion detection systems.

cs.CR↗
arXiv2021

DeepAID: Interpreting and Improving Deep Learning-based Anomaly Detection in Security Applications

Unsupervised Deep Learning (DL) techniques have been widely used in various security-related anomaly detection applications, owing to the great promise of being able to detect unforeseen threats and superior performance provided by Deep Neural Networks (DNN). However, the lack of interpretability creates key barriers to the adoption of DL models in practice. Unfortunately, existing interpretation approaches are proposed for supervised learning models and/or non-security domains, which are unadaptable for unsupervised DL models and fail to satisfy special requirements in security domains. In this paper, we propose DeepAID, a general framework aiming to (1) interpret DL-based anomaly detection systems in security domains, and (2) improve the practicality of these systems based on the interpretations. We first propose a novel interpretation method for unsupervised DNNs by formulating and solving well-designed optimization problems with special constraints for security domains. Then, we provide several applications based on our Interpreter as well as a model-based extension Distiller to improve security systems by solving domain-specific problems. We apply DeepAID over three types of security-related anomaly detection systems and extensively evaluate our Interpreter with representative prior works. Experimental results show that DeepAID can provide high-quality interpretations for unsupervised DL models while meeting the special requirements of security domains. We also provide several use cases to show that DeepAID can help security operators to understand model decisions, diagnose system mistakes, give feedback to models, and reduce false positives.

cs.CR↗
arXiv2021

Evaluating and Improving Adversarial Robustness of Machine Learning-Based Network Intrusion Detectors

Machine learning (ML), especially deep learning (DL) techniques have been increasingly used in anomaly-based network intrusion detection systems (NIDS). However, ML/DL has shown to be extremely vulnerable to adversarial attacks, especially in such security-sensitive systems. Many adversarial attacks have been proposed to evaluate the robustness of ML-based NIDSs. Unfortunately, existing attacks mostly focused on feature-space and/or white-box attacks, which make impractical assumptions in real-world scenarios, leaving the study on practical gray/black-box attacks largely unexplored. To bridge this gap, we conduct the first systematic study of the gray/black-box traffic-space adversarial attacks to evaluate the robustness of ML-based NIDSs. Our work outperforms previous ones in the following aspects: (i) practical-the proposed attack can automatically mutate original traffic with extremely limited knowledge and affordable overhead while preserving its functionality; (ii) generic-the proposed attack is effective for evaluating the robustness of various NIDSs using diverse ML/DL models and non-payload-based features; (iii) explainable-we propose an explanation method for the fragile robustness of ML-based NIDSs. Based on this, we also propose a defense scheme against adversarial attacks to improve system robustness. We extensively evaluate the robustness of various NIDSs using diverse feature sets and ML/DL models. Experimental results show our attack is effective (e.g., >97% evasion rate in half cases for Kitsune, a state-of-the-art NIDS) with affordable execution cost and the proposed defense method can effectively mitigate such attacks (evasion rate is reduced by >50% in most cases).

cs.CR↗
arXiv2020

Giant pressure-enhancement of multiferroicity in CuBr2

Type-II multiferroic materials, in which ferroelectric polarization is induced by inversion non-symmetric magnetic order, promise new and highly efficient multifunctional applications based on the mutual control of magnetic and electric properties. Although this phenomenon has to date been limited to low temperatures, here we report a giant pressure-dependence of the multiferroic critical temperature in CuBr$_2$. At 4.5 GPa, $T_\mathrm{C}$ is enhanced from 73.5 to 162 K, to our knowledge the highest value yet reported for a non-oxide type-II multiferroic. This growth shows no sign of saturating and the dielectric loss remains small under these high pressures. We establish the structure under pressure and demonstrate a 60\% increase in the two-magnon Raman energy scale up to 3.6 GPa. First-principles structural and magnetic energy calculations provide a quantitative explanation in terms of dramatically pressure-enhanced interactions between CuBr$_2$ chains. These large, pressure-tuned magnetic interactions motivate structural control in cuprous halides as a route to applied high-temperature multiferroicity.

cond-mat.mtrl-sci↗
arXiv2019

Placement and Routing Optimization Problem for Service Function Chain: State of Art and Future Opportunities

Network Functions Virtualization (NFV) allows implantation of network functions to be independent of dedicated hardware devices. Any series of services can be represented by a service function chain which contains a set of virtualized network functions in a specified order. From the perspective of network performance optimization, the challenges of deploying service chain in network is twofold: 1) the location of placing virtualized network functions and resources allocation scheme; and 2) routing policy for traffic flow among different instances of network function. This article introduces service function chain related optimization problems, summarizes the optimization motivation and mainstream algorithm of virtualized network functions deployment and traffic routing. We hope it can help readers to learn about the current research progress and make further innovation in this field.

cs.NI↗
arXiv2019

Lattice frustration in spin-orbit Mott insulator Sr3Ir2O7 at high pressure

The intertwined charge, spin, orbital, and lattice degrees of freedom could endow 5d compounds with exotic properties. Current interest is focused on electromagnetic interactions in these materials, whereas the important role of lattice geometry remains to be fully recognized. For this sake, we investigate pressure-induced phase transitions in the spin-orbit Mott insulator Sr3Ir2O7 with Raman, electrical resistance, and x-ray diffraction measurements. We reveal an interesting magnetic transition coinciding with a structural transition at 14.4 GPa, but without a concurrent insulator-metal transition. The conventional correlation between magnetic and Mott insulating states is thereby absent. The observed softening of the one-magnon mode can be explained by a reduced tetragonal distortion, while the actual magnetic transition is associated with tilting of the IrO6 octahedra. This work highlights the critical role of lattice frustration in determining the high-pressure phases of Sr3Ir2O7. The ability to control electromagnetic properties via manipulating the crystal structure with pressure promises a new way to explore new quantum states in spin-orbit Mott insulators.

cond-mat.str-el↗
arXiv2018

PriMe: Per-Flow Network Measurement by Combining SRAM with DRAM

Network measurement is necessary to obtain an understanding of the network traffic and keep the network healthy. Flow-level measurement is widely used because it provides rich enough information while being resource efficient, in contrast to the traffic-level solutions like SNMP and packet-level solutions like tcpdump. Flow-level measurement requires to maintain a TFR for each active flow, and update the corresponding TFR when a packet arrives. In the scenario of high-speed networks, the processing time for each packet is only several or tens of nanoseconds, and there may be up to millions of concurrent active flows. Two requirements have to be met to be able to do flow-level measurement in this scenario, i.e., the memory size have to be large enough to maintain a TFR for each flow, and the access time of the memory have to be small enough to be able to update the TFR for each packet. Unfortunately, SRAM, which is fast enough, is expensive and there are limited amount available for the measurement tasks, while DRAM, which is large in capacity, is slow and cannot support the per-packet access. In this paper, we proposed a solution, PriMe, by combining SRAM with DRAM, overcoming the resource limitation by exporting TFRs to the DRAM when necessary, while enjoying the fast access of SRAM. We designed a peculiar algorithm to reduce the frequency of exporting TFRs to DRAM, as well as an algorithm to reduce the accesses of DRAM in aggregating the TFRs exported from SRAM.

cs.NI↗
arXiv2018

HashFlow For Better Flow Record Collection

Collecting flow records is a common practice of network operators and researchers for monitoring, diagnosing and understanding a network. Traditional tools like NetFlow face great challenges when both the speed and the complexity of the network traffic increase. To keep pace up, we propose HashFlow, a tool for more efficient and accurate collection and analysis of flow records. The central idea of HashFlow is to maintain accurate records for elephant flows, but summarized records for mice flows, by applying a novel collision resolution and record promotion strategy to hash tables. The performance bound can be analyzed with a probabilistic model, and with this strategy, HashFlow achieves a better utilization of space, and also more accurate flow records, without bringing extra complexity. We have implemented HashFlow, as well as several latest flow measurement algorithms such as FlowRadar, HashPipe and ElasticSketch, in a P4 software switch. Then we use traces from different operational networks to evaluate them. In these experiments, for various types of traffic analysis applications, HashFlow consistently demonstrates a clearly better performance against its state-of-the-art competitors. For example, using a small memory of 1 MB, HashFlow can accurately record around 55K flows, which is often 12.5% higher than the others. For estimating the sizes of 50K flows, HashFlow achieves a relative error of around 11.6%, while the estimation error of the best competitor is 42.9% higher. It detects 96.1% of the heavy hitters out of 250K flows with a size estimation error of 5.6%, which is 11.3% and 73.7% better than the best competitor respectively. At last, we show these merits of HashFlow come with almost no degradation of throughput.

cs.NI↗
arXiv2017

Finite groups with permutable Hall subgroups

Let $σ=\{σ_{i} | i\in I\}$ be a partition of the set of all primes $\Bbb{P}$ and $G$ a finite group. A set ${\cal H}$ of subgroups of $G$ is said to be a \emph{complete Hall $σ$-set} of $G$ if every member $\ne 1$ of ${\cal H}$ is a Hall $σ_{i}$-subgroup of $G$ for some $i\in I$ and $\cal H$ contains exactly one Hall $σ_{i}$-subgroup of $G$ for every $i$ such that $σ_{i}\cap π(G)\ne \emptyset$. In this paper, we study the structure of $G$ assuming that some subgroups of $G$ permutes with all members of ${\cal H}$.

math.GR↗