Shuo Dai

Kun Qiu, Harry Chang, Ying Wang et al.

Sophisticated traffic analytics, such as the encrypted traffic analytics and unknown malware detection, emphasizes the need for advanced methods to analyze the network traffic. Traditional methods of using fixed patterns, signature matching, and rules to detect known patterns in network traffic are being replaced with AI (Artificial Intelligence) driven algorithms. However, the absence of a high-performance AI networking-specific framework makes deploying real-time AI-based processing within networking workloads impossible. In this paper, we describe the design of Traffic Analytics Development Kits (TADK), an industry-standard framework specific for AI-based networking workloads processing. TADK can provide real-time AI-based networking workload processing in networking equipment from the data center out to the edge without the need for specialized hardware (e.g., GPUs, Neural Processing Unit, and so on). We have deployed TADK in commodity WAF and 5G UPF, and the evaluation result shows that TADK can achieve a throughput up to 35.3Gbps per core on traffic feature extraction, 6.5Gbps per core on traffic classification, and can decrease SQLi/XSS detection down to 4.5us per request with higher accuracy than fixed pattern solution.

Yuxuan Chen, Haipeng Xie, Yichi Zhang et al.

Accurate distributed energy resources (DERs) forecasting is critical for downstream optimal operations. However, such forecast-based operation can be highly vulnerable to cyberattacks. While existing research mainly focuses on adversarial attacks, we pivot to a more controllable and persistent threat: backdoor attacks. In time series forecasting, a backdoored model generates an attacker-specified target pattern whenever a trigger is embedded in historical inputs. This paradigm naturally fits the entire DER forecast-optimization-operation chain. In this paper, we investigate whether and how backdoor attacks can compromise distribution network operations and propose GridTroj, a unified backdoor framework tailored for this scenario. Unlike standard time series backdoor approaches that train a poisoned model to match a predefined target only in terms of forecasting error, GridTroj explicitly incorporates the attacker's intention and optimizes the attack toward operational disruption. Specifically, GridTroj coordinates two key modules. The Intention Planner designs operation-damaging targets and poisoning strategies, while the Backdoor Realizer constructs the corresponding network architecture and training strategy to learn the trigger-target association. Experiments on three downstream optimization tasks demonstrate that GridTroj can effectively compromise grid operations and outperforms existing baselines. Our code is available at https://github.com/YuxuanCEE/GridTroj.