Han Zhang张 晗

Internet Service Providers are uniquely positioned to deliver intrusion detection at the network's choke points, but operating an IDS at carrier scale faces stringent throughput, accuracy, and robustness constraints that conventional middlebox or host-based solutions cannot meet. This work proposes an ISP-centric IDS architecture built on programmable switches: it co-designs lightweight feature extraction in the data plane with adaptive learning in the control plane to sustain Tbps-class detection while remaining robust to traffic drift and adversarial evasion. The system has been validated in real ISP backbones and demonstrates orders-of-magnitude resource savings over CPU/GPU baselines without sacrificing detection quality.

Distributed tracing is a cornerstone for diagnosing performance issues in modern microservice architectures, yet existing solutions either incur prohibitive instrumentation overhead or sacrifice accuracy in production. DeepTrace proposes a non-intrusive, dual-path observation framework that parses protocol semantics at both kernel and user space, achieving accurate method-level delay estimation with negligible runtime cost. Large-scale evaluation in real production clusters shows DeepTrace reduces tracing overhead by an order of magnitude while preserving end-to-end causal accuracy.

Detecting anomalies in line-rate encrypted traffic has long been hindered by the conflict between deep-learning accuracy and switch ASIC constraints. We present a programmable-switch-based pipeline that offloads lightweight feature extraction to the data plane while retaining robust classification in the control plane, enabling Tbps-class anomaly detection. The system has been deployed in real ISP backbones with sustained accuracy under concept drift and adversarial perturbations.

DeepFlow rethinks distributed tracing from a network-centric viewpoint: by hooking eBPF probes at protocol boundaries, it reconstructs causal traces across heterogeneous services without any application code change. Deployed at large cloud operators, DeepFlow has become an open-source de-facto standard, achieving zero-code observability across Kubernetes, service mesh, and serverless platforms.

Serverless platforms charge per invocation, making them uniquely vulnerable to internal Denial-of-Wallet attacks where compromised functions burn the tenant's budget. Gringotts performs fast cost-anomaly detection inside the function runtime, combining causal call-graph analysis with adaptive billing-aware thresholds to detect attacks in milliseconds with sub-1% false positive rate.

Inter-datacenter WANs trade off bandwidth utilization against fault tolerance, often leaving large capacity stranded. This paper proposes a traffic-engineering primitive that jointly schedules elephant and mice flows under probabilistic failure models, lifting effective inter-DC bandwidth availability by 1.4–2.1× on real Tencent and China Telecom topologies, while preserving SLA guarantees during link failures.

Pinpointing latency culprits inside complex microservice call graphs traditionally requires invasive code instrumentation. This work introduces a fully non-intrusive tracing technique that infers method-level delays from network-side observations and lightweight runtime hints, eliminating the need to modify application code. Evaluation on production-scale microservice deployments demonstrates fault-localization accuracy on par with intrusive baselines at a fraction of the engineering cost.

Looking Glass (LG) services expose a fragmented but invaluable view of the global Internet's routing fabric, yet their heterogeneous interfaces and free-form output have long resisted automated analysis. GlassMiner proposes a structure-semantics fusion approach that jointly models the DOM-level layout and natural-language hints of LG portals to extract structured measurements at scale. The system enables continent-wide BGP path observability and uncovers previously hidden routing anomalies across thousands of operator portals.

Forward Error Correction (FEC) is essential for low-latency video, AR/VR, and cloud gaming, but software FEC encoders cap end-host throughput. NNetFEC offloads encoding to programmable switches, exploiting tensor-style P4 templates to sustain line-rate FEC across 100GbE links while reducing 99-th percentile tail latency by 4–6× in real-world streaming workloads.

Existing latency-diagnosis tools for SRv6 either flood the data plane with probes or return probabilistic verdicts. SRmesh embeds deterministic in-band telemetry into segment-routing headers, enabling per-link latency attribution with bounded measurement overhead. It has been validated in a multi-vendor SRv6 testbed and identifies bottleneck links in seconds with 100% recall.