arXiv subjects

Yuanjie Li

Publications and source records attributed to Yuanjie Li.

14 recordsLinked to original sources

arXiv2026

Can Large Language Models Automate the Refinement of Cellular Network Specifications?

Cellular networks, e.g., 4G/5G, rely on complex technical specifications to ensure correct functionality; however, these specifications often contain flaws or ambiguities. In this paper, we investigate the application of Large Language Models for automated cellular network specification refinement. We identify Change Requests, which record specification revisions, as a key source of domain-specific data and formulate specification refinement as three complementary sub-tasks. We introduce CR-Eval, a benchmark of 200 security-related test cases, and evaluate 17 open-source and 14 proprietary models. The best-performing model, GPT-o3-mini, identifies weaknesses in over 127 test cases within five trials. We further study LLM specialization, showing that fine-tuning an 8B model can outperform advanced LLMs such as DeepSeek-R1 and Qwen3-235B. Evaluations on 30 real-world cellular attacks demonstrate the practical impact and remaining challenges. The codebase and benchmark are available at https://github.com/jianshuod/CR-Eval.

cs.CR↗

arXiv2024

STARVERI: Efficient and Accurate Verification for Risk-Avoidance Routing in LEO Satellite Networks

Emerging satellite Internet constellations such as SpaceX's Starlink will deploy thousands of broadband satellites and construct Low-Earth Orbit(LEO) satellite networks(LSNs) in space, significantly expanding the boundaries of today's terrestrial Internet. However, due to the unique global LEO dynamics, satellite routers will inevitably pass through uncontrolled areas, suffering from security threats. It should be important for satellite network operators(SNOs) to enable verifiable risk-avoidance routing to identify path anomalies. In this paper, we present STARVERI, a novel network path verification framework tailored for emerging LSNs. STARVERI addresses the limitations of existing crypto-based and delay-based verification approaches and accomplishes efficient and accurate path verification by: (i) adopting a dynamic relay selection mechanism deployed in SNO's operation center to judiciously select verifiable relays for each communication pair over LSNs; and (ii) incorporating a lightweight path verification algorithm to dynamically verify each segment path split by distributed relays. We build an LSN simulator based on real constellation information and the results demonstrate that STARVERI can significantly improve the path verification accuracy and achieve lower router overhead compared with existing approaches.

cs.NI↗

arXiv2024

A Case for Application-Aware Space Radiation Tolerance in Orbital Computing

We are witnessing a surge in the use of commercial off-the-shelf (COTS) hardware for cost-effective in-orbit computing, such as deep neural network (DNN) based on-satellite sensor data processing, Earth object detection, and task decision.However, once exposed to harsh space environments, COTS hardware is vulnerable to cosmic radiation and suffers from exhaustive single-event upsets (SEUs) and multi-unit upsets (MCUs), both threatening the functionality and correctness of in-orbit computing.Existing hardware and system software protections against radiation are expensive for resource-constrained COTS nanosatellites and overwhelming for upper-layer applications due to their requirement for heavy resource redundancy and frequent reboots. Instead, we make a case for cost-effective space radiation tolerance using application domain knowledge. Our solution for the on-satellite DNN tasks, \name, exploits the uneven SEU/MCU sensitivity across DNN layers and MCUs' spatial correlation for lightweight radiation-tolerant in-orbit AI computing. Our extensive experiments using Chaohu-1 SAR satellite payloads and a hardware-in-the-loop, real data-driven space radiation emulator validate that RedNet can suppress the influence of radiation errors to $\approx$ 0 and accelerate the on-satellite DNN inference speed by 8.4%-33.0% at negligible extra costs.

cs.ET↗

arXiv2024

In-Orbit Processing or Not? Sunlight-Aware Task Scheduling for Energy-Efficient Space Edge Computing Networks

With the rapid evolution of space-borne capabilities, space edge computing (SEC) is becoming a new computation paradigm for future integrated space and terrestrial networks. Satellite edges adopt advanced on-board hardware, which not only enables new opportunities to perform complex intelligent tasks in orbit, but also involves new challenges due to the additional energy consumption in power-constrained space environment. In this paper, we present PHOENIX, an energy-efficient task scheduling framework for emerging SEC networks. PHOENIX exploits a key insight that in the SEC network, there always exist a number of sunlit edges which are illuminated during the entire orbital period and have sufficient energy supplement from the sun. PHOENIX accomplishes energy-efficient in-orbit computing by judiciously offloading space tasks to "sunlight-sufficient" edges or to the ground. Specifically, PHOENIX first formulates the SEC battery energy optimizing (SBEO) problem which aims at minimizing the average battery energy consumption while satisfying various task completion constraints. Then PHOENIX incorporates a sunlight-aware scheduling mechanism to solve the SBEO problem and schedule SEC tasks efficiently. Finally, we implement a PHOENIX prototype and build an SEC testbed. Extensive data-driven evaluations demonstrate that as compared to other state-of-the-art solutions, PHOENIX can effectively reduce up to 54.8% SEC battery energy consumption and prolong battery lifetime to 2.9$\times$ while still completing tasks on time.

cs.NI↗

arXiv2024

SKYCASTLE: Taming LEO Mobility to Facilitate Seamless and Low-latency Satellite Internet Services

Emerging integrated space and terrestrial networks (ISTN) built upon low earth orbit (LEO) satellite constellations aim at providing planet-wide Internet services, not only for residential users, but also for mobile users (e.g., in airplane and cruise scenarios). Efficiently managing global mobility and keeping connections active for mobile users is critical for ISTN operators. However, our quantitative analysis identifies that existing mobility management (MM) schemes suffer from frequent connection interruptions and long latency in ISTN scenarios. The fundamental challenge stems from a unique characteristic of ISTNs: not only users are mobile, but also core network infrastructures (i.e., LEO satellites) are frequently changing their locations in the network. To facilitate seamless and low-latency satellite Internet services, this paper presents SKYCASTLE, a novel network-based global mobility management mechanism. SKYCASTLE incorporates two key techniques to address frequent connection interruptions in ISTNs. First, to reduce the interruption time, SKYCASTLE adopts distributed satellite anchors to track the location changes of mobile nodes, manage handovers and avoid routing convergence. Second, SKYCASTLE leverages an anchor manager to schedule MM functionalities at satellites to reduce deployment costs while guaranteeing low latency. Extensive evaluations combining real constellation information and mobile user trajectories show that: SKYCASTLE can improve up to 55.8% uninterrupted time and reduce 47.8% latency as compared to other existing MM solutions.

cs.NI↗

arXiv2024

Your Mega-Constellations Can Be Slim:A Cost-Effective Approach for Constructing Survivable and Performant LEO Satellite Networks

In this paper, we investigate an important research problem facing the upcoming satellite Internet: from a network perspective, how many satellites exactly do we need to construct a survivable and performant LSN? To answer this question, we first formulate the survivable and performant LSN design (SPLD) problem, which aims to find the minimum number of needed satellites to construct an LSN that can provide sufficient amount of redundant paths, required link capacity and acceptable latency for traffic carried by the LSN. Second, to efficiently solve the tricky SPLD problem, we propose MEGAREDUCE, a requirement-driven constellation optimization mechanism, which can calculate feasible solutions for SPLD in polynomial time. Finally, we conduct extensive trace-driven simulations to verify MEGAREDUCE's cost-effectiveness in constructing survivable and performant LSNs on demand, and showcase how MEGAREDUCE can help optimize the incremental deployment and long-term maintenance of future satellite Internet.

cs.NI↗

arXiv2024

Instability of Self-Driving Satellite Mega-Constellation: From Theory to Practical Impacts on Network Lifetime and Capacity

Low Earth Orbit (LEO) satellite mega-constellations aim to enable high-speed Internet for numerous users anywhere on Earth. To safeguard their network infrastructure in congested outer space, they perform automatic orbital maneuvers to avoid collisions with external debris and satellites. However, our control-theoretic analysis and empirical validation using Starlink's space situational awareness datasets discover that, these safety-oriented maneuvers themselves can threaten safety and networking via cascaded collision avoidance inside the mega-constellation. This domino effect forces a dilemma between long-term LEO network lifetime and short-term LEO network capacity. Its root cause is that, the decades-old local pairwise maneuver paradigm for standalone satellites is inherently unstable if scaled out to recent mega-constellation networks. We thus propose an alternative bilateral maneuver control that stabilizes self-driving mega-constellations for concurrent network lifetime and capacity boosts. Our operational trace-driven emulation shows a 8$\times$ network lifetime extension in Starlink without limiting its network capacity.

cs.NI↗

arXiv2023

One-bit Flip is All You Need: When Bit-flip Attack Meets Model Training

Deep neural networks (DNNs) are widely deployed on real-world devices. Concerns regarding their security have gained great attention from researchers. Recently, a new weight modification attack called bit flip attack (BFA) was proposed, which exploits memory fault inject techniques such as row hammer to attack quantized models in the deployment stage. With only a few bit flips, the target model can be rendered useless as a random guesser or even be implanted with malicious functionalities. In this work, we seek to further reduce the number of bit flips. We propose a training-assisted bit flip attack, in which the adversary is involved in the training stage to build a high-risk model to release. This high-risk model, obtained coupled with a corresponding malicious model, behaves normally and can escape various detection methods. The results on benchmark datasets show that an adversary can easily convert this high-risk but normal model to a malicious one on victim's side by \textbf{flipping only one critical bit} on average in the deployment stage. Moreover, our attack still poses a significant threat even when defenses are employed. The codes for reproducing main experiments are available at \url{https://github.com/jianshuod/TBA}.

cs.CR↗

arXiv2021

Fractal Rosette: A Stable Space-Ground Network Structure in Mega-Constellation

We present F-Rosette, a stable space-ground network structure for low-earth orbit (LEO) satellite mega-constellations at scale. Due to the dynamic many-to-many space-ground mapping in high mobility, existing LEO mega-constellations with IP protocol stack suffer from frequent user IP address changes (every 133~510s per user) and network routing re-convergence (<20% network usability). To provably stabilize the space-ground network under high mobility and many-to-many dynamics, F-Rosette adopts a recursive structure over the Rosette constellation, derives a hierarchical and time-invariant network address space from a new geographical coordinate system, and ensures efficient and stable routing via geographical-to-topological routing embedding without re-convergence. Our hardware-in-the-loop, trace-driven emulations validate F-Rosette's stability, near-optimal routing (<1.4% additional delays), and marginal overhead (<1% CPU, <2MB memory) for resource-constrained satellites.

cs.NI↗

arXiv2020

Bandit Policies for Reliable Cellular Network Handovers in Extreme Mobility

The demand for seamless Internet access under extreme user mobility, such as on high-speed trains and vehicles, has become a norm rather than an exception. However, the 4G/5G mobile network is not always reliable to meet this demand, with non-negligible failures during the handover between base stations. A fundamental challenge of reliability is to balance the exploration of more measurements for satisfactory handover, and exploitation for timely handover (before the fast-moving user leaves the serving base station's radio coverage). This paper formulates this trade-off in extreme mobility as a composition of two distinct multi-armed bandit problems. We propose Bandit and Threshold Tuning (BATT) to minimize the regret of handover failures in extreme mobility. BATT uses $ε$-binary-search to optimize the threshold of the serving cell's signal strength to initiate the handover procedure with $\mathcal{O}(\log J \log T)$ regret.It further devises opportunistic Thompson sampling, which optimizes the sequence of the target cells to measure for reliable handover with $\mathcal{O}(\log T)$ regret.Our experiment over a real LTE dataset from Chinese high-speed rails validates significant regret reduction and a 29.1% handover failure reduction.

cs.LG↗

arXiv2018

An Active-Passive Measurement Study of TCP Performance over LTE on High-speed Rails

High-speed rail (HSR) systems potentially provide a more efficient way of door-to-door transportation than airplane. However, they also pose unprecedented challenges in delivering seamless Internet service for on-board passengers. In this paper, we conduct a large-scale active-passive measurement study of TCP performance over LTE on HSR. Our measurement targets the HSR routes in China operating at above 300 km/h. We performed extensive data collection through both controlled setting and passive monitoring, obtaining 1732.9 GB data collected over 135719 km of trips. Leveraging such a unique dataset, we measure important performance metrics such as TCP goodput, latency, loss rate, as well as key characteristics of TCP flows, application breakdown, and users' behaviors. We further quantitatively study the impact of frequent cellular handover on HSR networking performance, and conduct in-depth examination of the performance of two widely deployed transport-layer protocols: TCP CUBIC and TCP BBR. Our findings reveal the performance of today's commercial HSR networks "in the wild", as well as identify several performance inefficiencies, which motivate us to design a simple yet effective congestion control algorithm based on BBR to further boost the throughput by up to 36.5%. They together highlight the need to develop dedicated protocol mechanisms that are friendly to extreme mobility.

cs.NI↗

arXiv2017

cniCloud: Querying the Cellular Network Information at Scale

This paper presents cniCloud, a cloud-based platform for mobile devices to share and query the fine-grained cellular information at scale. cniCloud extends the single-device cellular analytics via crowdsourcing: It collects the fine-grained cellular network data from massive mobile devices, aggregates them in a cloud-based database, and provides interfaces for end users to run an SQL-like query over the cellular data. It offers efficient and responsive processing by optimizing the database storage and adopting the domain-specific optimizations. Our preliminary deployments and experiments validate its feasibility in performing crowdsourced analytics.

cs.NI↗

arXiv2015

New Threats to SMS-Assisted Mobile Internet Services from 4G LTE: Lessons Learnt from Distributed Mobile-Initiated Attacks towards Facebook and Other Services

Mobile Internet is becoming the norm. With more personalized mobile devices in hand, many services choose to offer alternative, usually more convenient, approaches to authenticating and delivering the content between mobile users and service providers. One main option is to use SMS (i.e., short messaging service). Such carrier-grade text service has been widely used to assist versatile mobile services, including social networking, banking, to name a few. Though the text service can be spoofed via certain Internet text service providers which cooperated with carriers, such attacks haven well studied and defended by industry due to the efforts of research community. However, as cellular network technology advances to the latest IP-based 4G LTE, we find that these mobile services are somehow exposed to new threats raised by this change, particularly on 4G LTE Text service (via brand-new distributed Mobile-Initiated Spoofed SMS attack which is not available in legacy 2G/3G systems). The reason is that messaging service over LTE shifts from the circuit-switched (CS) design to the packet-switched (PS) paradigm as 4G LTE supports PS only. Due to this change, 4G LTE Text Service becomes open to access. However, its shields to messaging integrity and user authentication are not in place. As a consequence, such weaknesses can be exploited to launch attacks (e.g., hijack Facebook accounts) against a targeted individual, a large scale of mobile users and even service providers, from mobile devices. Current defenses for Internet-Initiated Spoofed SMS attacks cannot defend the unprecedented attack. Our study shows that 53 of 64 mobile services over 27 industries are vulnerable to at least one threat. We validate these proof-of-concept attacks in one major US carrier which supports more than 100 million users. We finally propose quick fixes and discuss security insights and lessons we have learnt.

cs.CR↗

arXiv2015

iCellular: Define Your Own Cellular Network Access on Commodity Smartphones

Leveraging multi-carrier access offers a promising approach to boosting access quality in mobile networks. However, our experiments show that the potential benefits are hard to fulfill due to fundamental limitations in the network-controlled design. To overcome these limitations, we propose iCellular, which allows users to define and intelligently select their own cellular network access from multiple carriers. iCellular reuses the existing device-side mechanisms and the standard cellular network procedure, but leverages the end device's intelligence to be proactive and adaptive in multi-carrier selection. It performs adaptive monitoring to ensure responsive selection and minimal service disruption, and enhances carrier selection with online learning and runtime decision fault prevention. It is deployable on commodity phones without any infrastructure/hardware change. We implement iCellular on commodity Nexus 6 phones and leverage Google Project-Fi's efforts to test multi-carrier access among two top US carriers: T-Mobile and Sprint. Our experiments confirm that iCellular helps users with up to 3.74x throughput improvement (7x suspension and 1.9x latency reduction) over the state-of-art selection. Moreover, iCellular locates the best-quality carrier in most cases, with negligible overhead on CPU, memory and energy consumption.

cs.NI↗