internet service providers

Abstract: Protecting Internet services from attacks such as TLS/HTTP floods requires rate limiting, yet identifying users to enforce these limits can compromise their privacy. Anonymous rate limiting promises to reconcile these goals, but existing schemes either struggle to scale or assume that services and authorities do not collude. We present STAR, which uses server-side trusted execution environments (TEEs) to overcome these limitations. By enabling lightweight cryptographic operations, TEEs make authentication efficient, but introduce a privacy challenge: malicious services can observe memory-access patterns to infer user secrets. We address this threat through countermeasures against secret-dependent memory accesses and assess our implementation using dynamic analysis. To extend these efficiency gains across servers, we also design a secure sharding mechanism that distributes client requests. We demonstrate that strong privacy guarantees can coexist with efficient authentication at scale; STAR processes authentication requests in tens of microseconds and handles approximately 13.9K requests per second per CPU core.

Abstract: Low Earth Orbit (LEO) satellite mega-constellations such as Starlink require frequent handovers due to high orbital velocities, resulting in substantial Round-Trip Time (RTT) fluctuations. Accurate RTT prediction can mitigate these fluctuations, yet it fundamentally relies on continuously updated serving- satellite information. Existing serving-satellite identification methods typically complete identification only at the end of each scheduling cycle, creating an identification blind zone that limits real-time prediction. To overcome this limitation, we develop StarRTT, an end-to-end real-time framework that eliminates the blind zone by integrating per-second serving-satellite identification with RTT prediction. Within this framework, we propose Real-Time Long Short-Term Memory (RT-LSTM), an LSTM-based RTT prediction model designed to capture both non-stationary RTT evolution and time-varying geometric relationships among the serving satellite, user terminal, and gateways. Specifically, a historical LSTM encodes historical RTT observations and real-time serving-satellite and gateway-relative features, while a future LSTM processes Two-Line Element (TLE)-propagated future features of the identified serving satellite up to the next scheduling instant. Under strict real-time back-testing, RT-LSTM achieves a Mean Absolute Error (MAE) of 1.405 ms averaged over all 15 prediction horizons and 15 reference time-slot indices, reducing the error by 4.3 %, 11.6 %, and 22.1 % compared with the existing baseline models, LSTM, StarNet, and Attention-based Spatiotemporal Model (ASTM), respectively. Notably, the reduction over LSTM reaches 12.5 % at the scheduling instant, highlighting the benefit of real-time serving-satellite information when recent RTT observations are limited.

Abstract: Carpet bombing attacks distribute malicious traffic across many destinations within a network prefix, while operational monitoring commonly provides destination-specific telemetry for only a subset of those targets. This creates an attack-conditional observability problem that is not captured by address utilization or nominal monitoring coverage. We introduce the Prefix Visibility Ratio (PVR), defined as the fraction of attacked destinations for which the telemetry required by the host-level evidence plane is available, and argue that PVR should be treated as an explicit evaluation dimension for carpet bombing detection. We then present VANTA (Visibility-Aware Network Threat Analysis) as one concrete way to operationalize this principle. VANTA combines host-level and prefix-level anomaly scores, estimates PVR online from router-side destination evidence and the monitored-destination inventory, and adjusts evidence fusion according to both estimated visibility and estimator confidence. Across a validated campaign of 2,160 Mininet runs, VANTA achieves 99.18% precision, 93.46% recall, a global F1-score of 96.24%, and a 1.54% false-positive rate. In a separate matched-observability study using task-adapted feature-level reference implementations, VANTA reaches 95.89% pooled F1 and 92.39% recall for configured PVR<=10%, with its largest advantage appearing at configured PVR=1%. These reference comparisons are intended to isolate observability effects under a common binary detection task rather than to reproduce the original end-to-end objectives of the referenced systems. The results establish attacked-destination visibility as a measurable factor that can materially change detector behavior and should be reported explicitly in future carpet bombing evaluations.

Abstract: Looking Glass servers (LGs) allow users and network operators to debug issues or measure performance to/from arbitrary, external IP addresses, making LGs a valuable tool in a variety of analyses. To assess the reliability of LGs as an independent and free set of vantage points, we perform an analysis of 4487 LG servers across 144 countries. We analyze LGs by comparing them to six different geolocation databases from four providers, and by conducting active measurements on LGs. In our RTT measurements we find 9 of 18 LG providers have at least one server with an RTT-disconfirmed location. We also find substantial differences between geolocation databases' ability to locate LGs, with IPinfo showing the closest distance to LGs.

Abstract: Early-stage encrypted traffic classifiers make decisions from only the first few packets of a connection, enabling low-latency classification but raising robustness concerns under realistic traffic morphing. Existing adversarial traffic generation methods often assume complete flows, feature-level perturbations, or iterative runtime feedback, which do not match the constraints of early-stage execution. We present NetGuise, a target-conditioned traffic morphing framework that generates packet-level padding and non-negative delay actions while preserving packet direction, ordering, and packet count and respecting MTU, bandwidth, and latency constraints. We evaluate NetGuise for censorship evasion under two observation interfaces, i) a history-only causal interface for online packet-by-packet execution, ii) and a full-window oracle interface that provides an upper-bound characterization of early-stage morphability. On VANT, NetGuise achieves 33.2% mean targeted evasion under the causal interface versus 82.0% under the oracle interface; on UTMobileNet, the corresponding results are 5.6% and 81.8%. NetGuise outperforms the strongest causal baseline, BAP, on both datasets and, on VANT, reduces bandwidth overhead from 19.80% to 3.02% and generation latency from 37.42 ms/flow to 1.16 ms/flow. Under the oracle interface, it achieves up to 85.7% targeted evasion, retains 43.5% after four rounds of adaptive censor retraining, and maintains 48% under zero-shot cross-environment transfer. Our results show that early-stage classifiers can remain morphable despite high clean accuracy and that robustness evaluation should account for targeted morphability, observation constraints, defender adaptation, and operational network conditions.

Abstract: The threat of quantum computers breaking classical cryptographic is accelerating the adoption of quantum- resistant cryptographic algorithms. Several government agencies have set a tight time-line for upgradation of all system to support post quantum cryptographs. We study post-quantum migration of IPSec protocols and their impact on network performance. The large key lengths in Post-Quantum Cryptography (PQC) cannot fit in a single IP packet leading to IP fragmentation. This can cause failure of security associations and degrade performance of IKEv2 under poor network conditions. To tackle this problem, we study a new key- sharing mechanism for IKEv2 and evaluate its performance. Unlike current hybrid key-sharing approaches, which send the classical and quantum keys sequentially over UDP or TCP (as in RFC 9370), the new approach concatenates them into a single composite key and transport them over TCP to ensure a reliable handshake. We implement and benchmark the new composite key-sharing handshake mechanism against existing hybrid algorithms that use either UDP or TCP. Extensive experiments under various network conditions demonstrate that the new approach significantly improves handshake time and energy consumption by avoiding the severe retransmission penalties of the Hybrid handshake mechanism. At 1% packet loss, the handshake time of composite key sharing mechanism is better by atleast 20% than hybrid mechanisms, and the improve- ment get better with higher packet loss reaching 30% at 10% packet loss. Energy consumption follows the same pattern achieving reduction of 29% at 10% packet loss

Abstract: HTTP(S) DDoS attacks have surged in frequency and scale, posing a significant threat to network security. Flow-based detection is a promising solution for large-scale HTTP(S) DDoS detection due to its decryption-free operation and scalability. However, the coarse-grained numerical statistics in flow data limit accurate attack detection and lack robustness when benign and attack traffic patterns drift over time. In this paper, we present Tanchun, a drift-aware flow-based HTTP(S) DDoS detection system that relies solely on decryption-free flow data. Specifically, Tanchun groups flows by IP-pair and aggregates them over consecutive time slots into behavior sequences, capturing temporal access patterns to compensate for the limited information in individual flows. It further abstracts these sequences into human-understandable behavioral attributes that capture stable behavioral semantics. Tanchun then aligns behavior sequences with their corresponding behavioral attributes to guide representation learning, enabling robust detection under traffic drift. We evaluate Tanchun across diverse HTTP(S) DDoS scenarios. Tanchun achieves the best overall performance, with an average F1-score of 0.988, and outperforms the second-best method by 5.3\% and 9.6\% under benign-traffic and attack-traffic drift, respectively. Experiments on real-world traffic traces further demonstrate its practical effectiveness.

Abstract: Encrypted traffic classification is commonly evaluated under a range of experimental protocols, with classification performance reported as the primary measure. However, the reported performance may be influenced by shortcuts left uncontrolled in the evaluation protocol, such as shortcut features and cross-partition sharing, rather than reflect generalizable traffic patterns. And test-only feature transformations may further introduce train-test mismatch. In this paper, we study how current evaluation protocols are affected by shortcut-related factors, including field-level shortcuts, cross-partition sharing, and train-test processing. We compare feature importance, retrained feature removal, and field-only split sensitivity. We also vary Source-IP overlap and packets per flow, compare test-only IP transformations with matched train-test transformations. Experiments on three public datasets show that the performance of existing methods are affected by both cross-partition sharing and the consistency of train-test transformations. Specifically, increasing Source-IP overlap from 0% to 100% raises accuracy by about 32-33 points before identifier masking, compared with only about 8 points after masking. For two state-of-the-art pretrained models (i.e., YaTC and NetMamba), the 11-13 points loss caused by test-only IP zeroing is almost fully recovered when the same transformation is applied during both training and testing.

Abstract: Multiple approaches have been implemented for identities that associate meaningful identifiers, such as domain names, with self-authenticating identifiers, such as onion addresses. While these approaches offer various advantages both from identifier meaningfulness and from identifier self-authentication, identifier association itself is subject to blocking, hijack, fingerprinting, and other forms of surveillance and manipulation. So too are the resources associated with an identity comprising a meaningful identifier and a self-authenticating identifier. This paper describes ongoing work on two such approaches to self-authenticating meaningful identity (SAMI): associating a registered domain name with an onion address (onion association) and associating an atproto handle with a decentralized identifier (DID association). We present both the application of already implemented and published means of secure onion association to DID association and the combination of both in a single identity. Finally, we describe grounding identity association and integrity in contextual trust, wherein trusting attestations of identity relies on contextual relevance of an attestor to the identity rather than relying only on structural authority, for example as embodied in the traditional centralized infrastructure.

Abstract: Geo-restricted content is increasingly common on the Internet, forcing users to rely on circumvention techniques, such as VPNs, to access the web from a seemingly different location. However, these often come with a financial cost and can degrade performance. The rise in popularity of the QUIC protocol, which allows connections to migrate between paths, opens opportunities to circumvent such restrictions. We scan web servers and find that a large portion of geo- blocked content is enforced on the server, at the application layer, rather than on-path. This check is performed once, when the request arrives, and is not repeated as the connection continues. This allows a client to issue its request from a whitelisted IP address and, once the server has accepted it, migrate the connection to an otherwise unauthorized address for the rest of the transfer (post-header migration). It bypasses the block while maximizing direct traffic, thereby reducing eventual circumvention-related costs. Building on this insight, we introduce Stork, an HTTP/2-to-HTTP/3 web proxy that bypasses geo-blocking while introducing negligible additional latency. We demonstrate that our solution is compatible with popular clients and servers. In controlled experiments with 2 MB requests, our proxy migrates 99% of the transferred data onto the unauthorized path. Across real-world targets that support QUIC migration, it migrates at least 75% of the data for more than 52% of them. On real geo-blocked content, post-header migration bypasses the block for 90% of domains, whereas post-handshake migration, as used by prior work, succeeds for only 60%.

Abstract: Large low-earth orbit (LEO) satellite constellations are revolutionizing network access globally by delivering potential high-capacity, low-latency communication, fueling innovation and accelerating research in advanced space-based non-terrestrial network architectures. Consequently, a research testbed that allows flexibility in designing realistic network routing schemes, traffic load balancing and inter-shell communication methods to emulate real-world multi-shell network becomes an important tool for industry developers and academic researchers. This study broadens the scope of the SpaceNet testbed, now including emulation of multi-shell constellations and computation of routes with the existing global web of terrestrial terminals. Furthermore, the testbed produces accurate trends in return trip time (RTT) and throughput metrics due to its support of high-level congestion modeling and the necessary local and global congestion routing. To evaluate the efficacy of the testbed, the network performance of emulated results for the Starlink constellation is evaluated and compared with data from real Ping and iPerf tests between Starlink terminals. Two important communication scenarios have been discussed that highlight the testbed's potential for realistic multi-shell topology generation and handling various types of traffic distribution with well-informed congestion routing. Predictions of network performance using SpaceNet accurately addresses temporal behaviors for different traffic levels with strong temporal predictability in its throughput and RTT time-series, as well as enhanced ground truth coverage within a 95% confidence interval.

Abstract: Carpet-bombing attacks spread traffic uniformly across one or more destination IP prefixes, keeping every host in the prefix below alarm thresholds while exhausting prefix-level defenses. Existing carpet-bombing detectors run at seconds-to-minutes latency, too slow to respond within the attack window. Sketches support per-packet processing in fixed-width memory, a natural fit for cutting latency, yet no sketch-based detector exists for carpet bombing. Because source addresses can be spoofed, and attacks can be launched through reflection, source-side evidence is structurally unavailable and detection must anchor at the destination side. We present SweepSketch, the first sketch-based detection model for carpet bombing: it anchors at the destination, keeps no source state, and compresses a tagged self-cleaning T-HLL primitive, per-packet CUSUM decisions, and dual-EWMA change gates into 44-byte fixed-width buckets deployable on the Tofino2 programmable switch. Its design is supported by six theorems, including verifiable detection lower bounds. Under the same memory budget, SweepSketch leads all 10 baselines across the sketch, entropy, and sequential-testing classes in F1 (0.991). Its median alarm latency is 186--627 ms, and it has structural immunity to source spoofing. On 30 real/synthetic multi-prefix samples held out from parameter design, it detects all 140 victim prefixes.

Abstract: Long-tailed encrypted traffic classification requires accurate recognition of infrequent classes under limited computational budgets. We propose Curv-Tail, a lightweight, end-to-end packet--byte framework trained without a separate pretraining stage. Mixed-resolution tokenization preserves exact packet-length identities within a bounded range and coarsens larger values to limit the vocabulary. An auxiliary objective predicts observed length tokens from contextual packet features before pooling, encouraging length-token retention beyond flow-level supervision. Compact temporal encoders process packet sequences and directional byte patches, and Lorentz prototypes with a shared learnable curvature magnitude classify their fused representation. On NUDT-Mobile and DataCon-Website under natural class frequencies, Curv-Tail achieves three-seed mean Tail-F1 scores of 85.70% and 46.30%, exceeding the strongest evaluated baselines by 2.91 and 1.89 percentage points, respectively. In 300-class profiling on an RTX 4090 with FP32 and batch size 256, Curv-Tail uses 98.48% fewer parameters and achieves 10.2 times the batch inference throughput of MM4Flow.

Abstract: Automated and highly usable Quality-of-Service (QoS) enforcement requires translating high-level service intents into deployable traffic-management policies. Although intent-based networking (IBN) has simplified policy specification, bridging the gap between business-level intents and executable network configurations remains complex, error-prone, and difficult to automate. This paper presents Intent2Tc, a closed-loop language-model-driven framework that translates business-level traffic-shaping intents into declarative sub-intents and subsequently into validated, executable Linux traffic control (tc) configurations. The framework integrates an Active Queue Management (AQM)-based digital twin (DT) semantic model, automated metadata extraction, critique-driven refinement, and Retrieval-Augmented Generation (RAG)-based knowledge reuse to improve semantic consistency and configuration reliability. We evaluate multiple open-source large language models (LLMs) and small language models (SLMs), together with Claude Sonnet-4.6, on 100 Request for Comments (RFC) 9315-compliant traffic-shaping intents. Across both translation stages, Intent2Tc achieves high semantic fidelity, configuration accuracy, and deployment readiness, with Claude Sonnet-4.6 reaching 0.98 semantic similarity, 1.0 semantic unit coverage, and 0.045 normalized edit distance. Furthermore, RAG reduces token consumption and inference latency while enabling compact models such as Phi-4-mini to approach the performance of substantially larger models. Linux tc serves as the target configuration platform, demonstrating the practical applicability of the proposed framework.

Abstract: Proxy-based Internet censorship circumvention tools like Snowflake rely on large, dynamic pools of third-party proxies to resist IP-based blocking. We focus on two assumptions underpinning the security of Snowflake: that adversaries cannot easily enumerate proxy IPs, and that blocking those proxies would incur unacceptable collateral damage. In this paper, we test these assumptions by studying practical enumeration and blocking attacks against Snowflake conducted by malicious clients. We combine bounded, ethical real-world measurements with large-scale simulation to evaluate both present-day enumeration and blocking risk and broader attacker capabilities. Over 48 days of real-world measurements from May--June 2025, our attack enumerated over 21,000 unique proxy IP addresses belonging to almost 1,000 autonomous systems. Despite this high number, we find that proxy churn limits the overall effectiveness of enumeration over time, and reduces the impact on clients of individual proxy addresses being blocked. However, at the network level, blocking the top 1% of observed autonomous systems blocks more than 30% of observed Snowflakes while affecting 0% of Tranco Top 100 domains and ~2.5% of Top 1M domains. We discover that the broker's load-aware matching reveals stable, high-capacity proxies to attackers early, especially during periods of elevated demand such as the censorship even in Iran of June 2025, subsequently exposing the networks that contribute disproportionately to system connectivity. In simulation, increasing attacker scale sharply improves both enumeration and blocking success, while higher proxy churn significantly reduces blocking effectiveness. We conclude by discussing and evaluating practical mitigations, some of which have been integrated into Snowflake.