Searcharxiv⌕ Search

arXiv subjects

Ying Wang

Publications and source records attributed to Ying Wang.

At least 307 records · Page 17Linked to original sources
arXiv2023

Formal-Guided Fuzz Testing: Targeting Security Assurance from Specification to Implementation for 5G and Beyond

Softwarization and virtualization in 5G and beyond necessitate thorough testing to ensure the security of critical infrastructure and networks, requiring the identification of vulnerabilities and unintended emergent behaviors from protocol designs to their software stack implementation. To provide an efficient and comprehensive solution, we propose a novel and first-of-its-kind approach that connects the strengths and coverage of formal and fuzzing methods to efficiently detect vulnerabilities across protocol logic and implementation stacks in a hierarchical manner. We design and implement formal verification to detect attack traces in critical protocols, which are used to guide subsequent fuzz testing and incorporate feedback from fuzz testing to broaden the scope of formal verification. This innovative approach significantly improves efficiency and enables the auto-discovery of vulnerabilities and unintended emergent behaviors from the 3GPP protocols to software stacks. Following this approach, we discover one identifier leakage model, one DoS attack model, and two eavesdrop attack models due to the absence of rudimentary MITM protection within the protocol, despite the existence of a Transport Layer Security (TLS) solution to this issue for over a decade. More remarkably, guided by the identified formal analysis and attack models, we exploit 61 vulnerabilities using fuzz testing demonstrated on srsRAN platforms. These identified vulnerabilities contribute to fortifying protocol-level assumptions and refining the search space. Compared to state-of-the-art fuzz testing, our united formal and fuzzing methodology enables auto-assurance by systematically discovering vulnerabilities. It significantly reduces computational complexity, transforming the non-practical exponential growth in computational cost into linear growth.

cs.CR↗
arXiv2023

Distributed 3D-Beam Reforming for Hovering-Tolerant UAVs Communication over Coexistence: A Deep-Q Learning for Intelligent Space-Air-Ground Integrated Networks

In this paper, we present a novel distributed UAVs beam reforming approach to dynamically form and reform a space-selective beam path in addressing the coexistence with satellite and terrestrial communications. Despite the unique advantage to support wider coverage in UAV-enabled cellular communications, the challenges reside in the array responses' sensitivity to random rotational motion and the hovering nature of the UAVs. A model-free reinforcement learning (RL) based unified UAV beam selection and tracking approach is presented to effectively realize the dynamic distributed and collaborative beamforming. The combined impact of the UAVs' hovering and rotational motions is considered while addressing the impairment due to the interference from the orbiting satellites and neighboring networks. The main objectives of this work are two-fold: first, to acquire the channel awareness to uncover its impairments; second, to overcome the beam distortion to meet the quality of service (QoS) requirements. To overcome the impact of the interference and to maximize the beamforming gain, we define and apply a new optimal UAV selection algorithm based on the brute force criteria. Results demonstrate that the detrimental effects of the channel fading and the interference from the orbiting satellites and neighboring networks can be overcome using the proposed approach. Subsequently, an RL algorithm based on Deep Q-Network (DQN) is developed for real-time beam tracking. By augmenting the system with the impairments due to hovering and rotational motion, we show that the proposed DQN algorithm can reform the beam in real-time with negligible error. It is demonstrated that the proposed DQN algorithm attains an exceptional performance improvement. We show that it requires a few iterations only for fine-tuning its parameters without observing any plateaus irrespective of the hovering tolerance.

eess.SP↗
arXiv2023

Formal and Fuzzing Amplification: Targeting Vulnerability Detection in 5G and Beyond

Softwarization and virtualization in 5G and beyond require rigorous testing against vulnerabilities and unintended emergent behaviors for critical infrastructure and network security assurance. Formal methods operates efficiently in protocol-level abstract specification models, and fuzz testing offers comprehensive experimental evaluation of system implementations. In this paper, we propose a novel framework that leverages the respective advantages and coverage of both formal and fuzzing methods to efficiently detect vulnerabilities from protocol logic to implementation stacks hierarchically. The detected attack traces from the formal verification results in critical protocols guide the case generation of fuzz testing, and the feedbacks from fuzz testing further broaden the scope of the formal verification. We examine the proposed framework with the 5G Non Standard-Alone (NSA) security processes, focusing on the Radio Resource Control (RRC) connection process. We first identify protocol-level vulnerabilities of user credentials via formal methods. Following this, we implement bit-level fuzzing to evaluate potential impacts and risks of integrity-vulnerable identifier variation. Concurrently, we conduct command-level mutation-based fuzzing by fixing the assumption identifier to assess the potential impacts and risks of confidentiality-vulnerable identifiers. During this approach, we established 1 attack model and detected 53 vulnerabilities. The vulnerabilities identified used to fortify protocol-level assumptions could further refine search space for the following detection cycles. Consequently, it addresses the prevalent scalability challenges in detecting vulnerabilities and unintended emergent behaviors in large-scale systems in 5G and beyond.

cs.CR↗
arXiv2023

Prompt Tuning Pushes Farther, Contrastive Learning Pulls Closer: A Two-Stage Approach to Mitigate Social Biases

As the representation capability of Pre-trained Language Models (PLMs) improve, there is growing concern that they will inherit social biases from unprocessed corpora. Most previous debiasing techniques used Counterfactual Data Augmentation (CDA) to balance the training corpus. However, CDA slightly modifies the original corpus, limiting the representation distance between different demographic groups to a narrow range. As a result, the debiasing model easily fits the differences between counterfactual pairs, which affects its debiasing performance with limited text resources. In this paper, we propose an adversarial training-inspired two-stage debiasing model using Contrastive learning with Continuous Prompt Augmentation (named CCPA) to mitigate social biases in PLMs' encoding. In the first stage, we propose a data augmentation method based on continuous prompt tuning to push farther the representation distance between sample pairs along different demographic groups. In the second stage, we utilize contrastive learning to pull closer the representation distance between the augmented sample pairs and then fine-tune PLMs' parameters to get debiased encoding. Our approach guides the model to achieve stronger debiasing performance by adding difficulty to the training process. Extensive experiments show that CCPA outperforms baselines in terms of debiasing performance. Meanwhile, experimental results on the GLUE benchmark show that CCPA retains the language modeling capability of PLMs.

cs.CL↗
arXiv2023

Independent operation of two waveguide-integrated quantum emitters

We demonstrate the resonant excitation of two quantum dots in a photonic integrated circuit for on-chip single-photon generation in multiple spatial modes. The two quantum dots are electrically tuned to the same emission wavelength using a pair of isolated $p$-$i$-$n$ junctions and excited by a resonant pump laser via dual-mode waveguides. We demonstrate two-photon quantum interference visibility of $(79\pm2)\%$ under continuous-wave excitation of narrow-linewidth quantum dots. Our work solves an outstanding challenge in quantum photonics by realizing the key enabling functionality of how to scale-up deterministic single-photon sources.

quant-ph↗
arXiv2023

On-chip spin-photon entanglement based on single-photon scattering

The realization of on-chip quantum gates between photons and solid-state spins is a key building block for quantum-information processors, enabling, e.g., distributed quantum computing, where remote quantum registers are interconnected by flying photons. Self-assembled quantum dots integrated in nanostructures are one of the most promising systems for such an endeavor thanks to their near-unity photon-emitter coupling and fast spontaneous emission rate. Here we demonstrate an on-chip entangling gate between an incoming photon and a stationary quantum-dot spin qubit. The gate is based on sequential scattering of a time-bin encoded photon with a waveguide-embedded quantum dot and operates on sub-microsecond timescale; two orders of magnitude faster than other platforms. Heralding on detection of a reflected photon renders the gate fidelity fully immune to spectral wandering of the emitter. These results represent a major step in realizing a quantum node capable of both photonic entanglement generation and on-chip quantum logic, as demanded in quantum networks and quantum repeaters.

quant-ph↗
arXiv2023

Dynamical Stability of Polar Circumbinary Orbits and Planet-Formation in Planetary Disc of 99 Herculis

A possible polar-ring debris disc, the dynamics of which can be described by the outer hierarchical restricted three-body problem, has been detected in 99 Herculis. An empirical formula on the minimum radius beyond which test particles in polar orbits can keep stable within ${10^7}$ binary periods is provided through the numerical fitting, applying to the binary eccentricity $e_{1} \in \left[ {0,0.8} \right)$ and the mass ratio of binary $ λ\in \left[ {0.1,1} \right]$, where $ λ= m_0/m_1$ (${m_0}$ and ${m_1}$ represent the masses of the two binary stars). The polar planetary disc has the lowerest statistical accretion efficiency and moderate impact frequency of collisions among planetesimals (with a radius of 1-10km) compared to that in the circumbinary coplanar disc and the standard disc around the single host star. Colliding timescales in the circumbinary disk (both polar and coplanar configuration) are longer than $10^7$ yr exceeding the dissipation timescales of the gas disc. The stochastic simulations show that successive collisions cannot make planetesimal grow up which may explain the formation of the debris disc observed in 99 Herculis.

astro-ph.EP↗
arXiv2023

Violation of Bell inequality by photon scattering on a two-level emitter

Entanglement, the non-local correlations present in multipartite quantum systems, is a curious feature of quantum mechanics and the fuel of quantum technology. It is therefore a major priority to develop energy-conserving and simple methods for generating high-fidelity entangled states. In the case of light, entanglement can be realized by interactions with matter, although the required nonlinear interaction is typically weak, thereby limiting its applicability. Here, we show how a single two-level emitter deterministically coupled to light in a nanophotonic waveguide is used to realize genuine photonic quantum entanglement for excitation at the single photon level. By virtue of the efficient optical coupling, two-photon interactions are strongly mediated by the emitter realizing a giant nonlinearity that leads to entanglement. We experimentally generate and verify energy-time entanglement by violating a Bell inequality (Clauder-Horne-Shimony-Holt Bell parameter of $S=2.67(16)>2$) in an interferometric measurement of the two-photon scattering response. As an attractive feature of this approach, the two-level emitter acts as a passive scatterer initially prepared in the ground state, i.e., no advanced spin control is required. This experiment is a fundamental advancement that may pave a new route for ultra-low energy-consuming synthesis of photonic entangled states for quantum simulators or metrology.

quant-ph↗
arXiv2023

Balancing Utility and Fairness in Submodular Maximization (Technical Report)

Submodular function maximization is a fundamental combinatorial optimization problem with plenty of applications -- including data summarization, influence maximization, and recommendation. In many of these problems, the goal is to find a solution that maximizes the average utility over all users, for each of whom the utility is defined by a monotone submodular function. However, when the population of users is composed of several demographic groups, another critical problem is whether the utility is fairly distributed across different groups. Although the \emph{utility} and \emph{fairness} objectives are both desirable, they might contradict each other, and, to the best of our knowledge, little attention has been paid to optimizing them jointly. To fill this gap, we propose a new problem called \emph{Bicriteria Submodular Maximization} (BSM) to balance utility and fairness. Specifically, it requires finding a fixed-size solution to maximize the utility function, subject to the value of the fairness function not being below a threshold. Since BSM is inapproximable within any constant factor, we focus on designing efficient instance-dependent approximation schemes. Our algorithmic proposal comprises two methods, with different approximation factors, obtained by converting a BSM instance into other submodular optimization problem instances. Using real-world and synthetic datasets, we showcase applications of our proposed methods in three submodular maximization problems: maximum coverage, influence maximization, and facility location.

cs.DS↗
arXiv2023

A sufficient condition for $(α, β)$ Somos $4$ Hankel determinants

By using Sulanke-Xin continued fractions method, Xin proposed a recursion system to solve the Somos 4 Hankel determinant conjecture. We find Xin's recursion system indeed give a sufficient condition for $(α, β)$ Somos $4$ sequences. This allows us to prove 4 conjectures of Barry on $(α, β)$ Somos $4$ sequences in a unified way.

math.CO↗
arXiv2023

NLP-based Cross-Layer 5G Vulnerabilities Detection via Fuzzing Generated Run-Time Profiling

The effectiveness and efficiency of 5G software stack vulnerability and unintended behavior detection are essential for 5G assurance, especially for its applications in critical infrastructures. Scalability and automation are the main challenges in testing approaches and cybersecurity research. In this paper, we propose an innovative approach for automatically detecting vulnerabilities, unintended emergent behaviors, and performance degradation in 5G stacks via run-time profiling documents corresponding to fuzz testing in code repositories. Piloting on srsRAN, we map the run-time profiling via Logging Information (LogInfo) generated by fuzzing test to a high dimensional metric space first and then construct feature spaces based on their timestamp information. Lastly, we further leverage machine learning-based classification algorithms, including Logistic Regression, K-Nearest Neighbors, and Random Forest to categorize the impacts on performance and security attributes. The performance of the proposed approach has high accuracy, ranging from $ 93.4 \% $ to $ 95.9 \% $, in detecting the fuzzing impacts. In addition, the proof of concept could identify and prioritize real-time vulnerabilities on 5G infrastructures and critical applications in various verticals.

cs.CR↗
arXiv2023

Direct observation of non-linear optical phase shift induced by a single quantum emitter in a waveguide

Realizing a sensitive photon-number-dependent phase shift on a light beam is required both in classical and quantum photonics. It may lead to new applications for classical and quantum photonics machine learning or pave the way for realizing photon-photon gate operations. Non-linear phase-shifts require efficient light-matter interaction, and recently quantum dots coupled to nanophotonic devices have enabled near-deterministic single-photon coupling. We experimentally realize an optical phase shift of $0.19 π\pm 0.03$ radians ($\approx 34$ degrees) using a weak coherent state interacting with a single quantum dot in a planar nanophotonic waveguide. The phase shift is probed by interferometric measurements of the light scattered from the quantum dot in the waveguide. The nonlinear process is sensitive at the single-photon level and can be made compatible with scalable photonic integrated circuitry. The work may open new prospects for realizing high-efficiency optical switching or be applied for proof-of-concept quantum machine learning or quantum simulation demonstrations.

quant-ph↗
arXiv2023

Radar Altimeter Redesign for Multi-Stage Interference Risk Mitigation in 5G and Beyond

The radar altimeter is installed on most 14 CFR Pt 25 category aircraft, which are applicable to passenger travel and represent most airline traffic. The radar altimeter system is highly accurate and reports the height above the terrain. It plays a significant role in the take-off, approach, and landing phases of the applicable aircraft. In critical conditions, including reduced visibility, proximity to terrain, collision avoidance, and autoland procedures, the accuracy of radar altimeters is crucial to the safety of aircraft. This study aims to address the inappropriate behavior of the susceptible system that may cause essential safety concerns with unknown interoperability and operational impacts. We design and verify a strategic approach to mitigate the risks of potential airborne interference to a radar altimeter due to the coexistence of a 5G and future G signal, especially with the growing demand for the Space Air Ground Integrated Network (SAGIN). This study details a design change to a pre-existing radar altimeter system, and the process necessary to gain certification approval following this change is analyzed. We address the certification aspects from a TSO perspective resulting from changes made to a system post-certification. Artifacts, as defined in the FAA Project Specific Certification Plan template, including the Change Impact Analysis, Means of Compliance, and Test Plans, which are mandated by the certification authorities and requested by aircraft manufacturers and operators to ensure a level of compliance during the engineering cycle, have been adhered to.

eess.SP↗
arXiv2023

Location Tracking for Reconfigurable Intelligent Surfaces Aided Vehicle Platoons: Diverse Sparsities Inspired Approaches

In this paper, we investigate the employment of reconfigurable intelligent surfaces (RISs) into vehicle platoons, functioning in tandem with a base station (BS) in support of the high-precision location tracking. In particular, the use of a RIS imposes additional structured sparsity that, when paired with the initial sparse line-of-sight (LoS) channels of the BS, facilitates beneficial group sparsity. The resultant group sparsity significantly enriches the energies of the original direct-only channel, enabling a greater concentration of the LoS channel energies emanated from the same vehicle location index. Furthermore, the burst sparsity is exposed by representing the non-line-of-sight (NLoS) channels as their sparse copies. This thus constitutes the philosophy of the diverse sparsities of interest. Then, a diverse dynamic layered structured sparsity (DiLuS) framework is customized for capturing different priors for this pair of sparsities, based upon which the location tracking problem is formulated as a maximum a posterior (MAP) estimate of the location. Nevertheless, the tracking issue is highly intractable due to the ill-conditioned sensing matrix, intricately coupled latent variables associated with the BS and RIS, and the spatialtemporal correlations among the vehicle platoon. To circumvent these hurdles, we propose an efficient algorithm, namely DiLuS enabled spatial-temporal platoon localization (DiLuS-STPL), which incorporates both variational Bayesian inference (VBI) and message passing techniques for recursively achieving parameter updates in a turbo-like way. Finally, we demonstrate through extensive simulation results that the localization relying exclusively upon a BS and a RIS may achieve the comparable precision performance obtained by the two individual BSs, along with the robustness and superiority of our proposed algorithm as compared to various benchmark schemes.

eess.SP↗
arXiv2023

Ground-to-UAV Integrated Network: Low Latency Communication over Interference Channel

We present a novel and first-of-its-kind information-theoretic framework for the key design consideration and implementation of a ground-to-UAV (G2U) communication network to minimize end-to-end transmission delay in the presence of interference. The proposed framework is useful as it describes the minimum transmission latency for an uplink ground-to-UAV communication must satisfy while achieving a given level of reliability. To characterize the transmission delay, we utilize Fano's inequality and derive the tight upper bound for the capacity for the G2U uplink channel in the presence of interference, noise, and potential jamming. Subsequently, given the reliability constraint, the error exponent is obtained for the given channel. Furthermore, a relay UAV in the dual-hop relay mode, with amplify-and-forward (AF) protocol, is considered, for which we jointly obtain the optimal positions of the relay and the receiver UAVs in the presence of interference. Interestingly, in our study, we find that for both the point-to-point and relayed links, increasing the transmit power may not always be an optimal solution for delay minimization problems. Moreover, we prove that there exists an optimal height that minimizes the end-to-end transmission delay in the presence of interference. The proposed framework can be used in practice by a network controller as a system parameters selection criteria, where among a set of parameters, the parameters leading to the lowest transmission latency can be incorporated into the transmission. The based analysis further set the baseline assessment when applying Command and Control (C2) standards to mission-critical G2U and UAV-to-UAV(U2U) services.

cs.IT↗
arXiv2023

Multivariate Intrinsic Local Polynomial Regression on Isometric Riemannian Manifolds: Applications to Positive Definite Data

The paper introduces a novel non-parametric Riemannian regression method using Isometric Riemannian Manifolds (IRMs). The proposed technique, Intrinsic Local Polynomial Regression on IRMs (ILPR-IRMs), enables global data mapping between Riemannian manifolds while preserving underlying geometries. The ILPR method is generalized to handle multivariate covariates on any Riemannian manifold and isometry. Specifically, for manifolds equipped with Euclidean Pullback Metrics (EPMs), a closed analytical formula is derived for the multivariate ILPR (ILPR-EPM). Asymptotic statistical properties of the ILPR-EPM for the multivariate local linear case are established, including a formula for the asymptotic bias, establishing estimator consistency. The paper showcases possible applications of the method by focusing on a group of Riemannian metrics on the Symmetric Positive Definite (SPD) manifold, which arises in machine learning and neuroscience. It is demonstrated that several metrics on the SPD manifold are EPMs, resulting in a closed analytical expression for the multivariate ILPR estimator on the SPD manifold. The paper evaluates the ILPR estimator's performance under two specific EPMs, Log-Cholesky and Log-Euclidean, on simulated data on the SPD manifold and compares it with extrinsic LPR using the Affine-Invariant when scaling the manifold and covariate dimension. The results show that the ILPR using the Log-Cholesky metric is computationally faster and provides a better trade-off between error and time than other metrics. Finally, the Log-Cholesky metric on the SPD manifold is employed to implement an efficient and intrinsic version of Rie-SNE for visualizing high-dimensional SPD data. The code for implementing ILPR-EPMs and other relevant calculations is available on the GitHub page.

stat.ME↗
arXiv2023

Quantum Key Distribution using Deterministic Single-Photon Sources over a Field-Installed Fibre Link

Quantum-dot-based single-photon sources are key assets for quantum information technology, supplying on-demand scalable quantum resources for computing and communication. However, longlasting issues such as limited long-term stability and source brightness have traditionally impeded their adoption in real-world applications. Here, we realize a quantum key distribution field trial using true single photons across an 18-km-long dark fibre, located in the Copenhagen metropolitan area, using an optimized, state-of-the-art, quantum-dot single-photon source frequency-converted to the telecom wavelength. A secret key generation rate of >2 kbits/s realized over a 9.6 dB channel loss is achieved with a polarization-encoded BB84 scheme, showing remarkable stability for more than 24 hours of continuous operation. Our results highlight the maturity of deterministic single-photon source technology while paving the way for advanced single-photon-based communication protocols, including fully device-independent quantum key distribution, towards the goal of a quantum internet.

quant-ph↗
arXiv2023

Valley-dependent topological edge states in plasma photonic crystals

Plasma photonic crystals designed in this paper are composed of gas discharge tubes to control the flow of electromagnetic waves. The band structures calculated by the finite element method are consistent with the experimental results in that two distinct attenuation peaks appear in the ranges of 1 GHz to 2.5 GHz and 5 GHz to 6 GHz. Electromagnetic parameters of the plasma are extracted by the Nicolson-Ross-Weir method and effective medium theory. The measured electron density is between 1e11 cm-3 and 1e12 cm-3, which verifies the correctness of the parameter used in the simulation, and the collision frequency is near 1.5e10 Hz. As the band structures are corroborated by the measured scattering parameters, we introduce the concept of photonic topological insulator based on the quantum Valley Hall effect into the plasma photonic crystal. A valley-dependent plasma photonic crystal with hexagonal lattice is constructed, and the phase transition of the valley K(K') occurs by breaking the spatial inversion symmetry. Valley-spin locked topological edge states are generated and excited by chiral sources. The frequency of the non-bulk state can be dynamically regulated by the electron density. This concept paves the way for novel, tunable topological edge states. More interestingly, the Dirac cone is broken when the electron density increases to 3.1e12 cm-3, which distinguishes from the methods of applying a magnetic field and changing the symmetry of the point group.

physics.plasm-ph↗