Lin He

Selected Publications

1. INFOCOM

   6Map: Enabling Fast Active IPv6 Address Discovery with Programmable Switches

   Jiasheng Zhou, Lin He^#, Yifan Yang, Xiaoyi Shi, Daguo Cheng, Jinlong E, Ying Liu, Dong Zhang

   In Proceedings of the 44th IEEE Conference on Computer Communications (INFOCOM 2025)
   London, United Kingdom, May 19–22, 2025

   Abs Bib HTML

   The vast address space of IPv6 makes it impractical to apply exhaustive scanning to survey the entire network. Existing studies that aim to quickly discover active IPv6 addresses by optimizing the scanning space face issues of poor scalability and high time complexity, which hinder a comprehensive understanding of the IPv6 network and impede the timely provision of security snapshots and the development of IPv6. Fortunately, the emergence of programmable switches provides an opportunity to address the above issues. To this end, we propose 6Map, a fast active IPv6 address discovery system based on programmable switches. We design a lightweight target generation algorithm running on the control plane of the programmable switch and implement fast scanning address generation on the switch ASIC. The experimental results show that IPv6 active address discovery efficiency is up to 40.1× compared to the state-of-the-art method at the 100M probe budget.

   @inproceedings{zhou20256map,
     title = {6Map: Enabling Fast Active IPv6 Address Discovery with Programmable Switches},
     author = {Zhou, Jiasheng and He, Lin and Yang, Yifan and Shi, Xiaoyi and Cheng, Daguo and E, Jinlong and Liu, Ying and Zhang, Dong},
     booktitle = {Proceedings of the 44th IEEE Conference on Computer Communications (INFOCOM 2025)},
     year = {2025},
     pages = {},
     doi = {},
     address = {London, United Kingdom},
     date = {May 19–22},
   }

2. WWW

   Miresga: Accelerating Layer-7 Load Balancing with Programmable Switches

   Xiaoyi Shi, Lin He^#, Jiasheng Zhou, Yifan Yang, Ying Liu

   In Proceedings of the 34th ACM Web Conference (WWW 2025)
   Sydney, Australia, April 28 – May 2, 2025

   Abs Bib HTML

   As online cloud services expand rapidly, layer-7 load balancing has become indispensable for maintaining service availability and performance. The emergence of programmable switches with both high performance and a certain degree of flexibility has made it possible to apply programmable switches to load balancing. Nevertheless, the meager memory capacity and the relatively sluggish speed of table entry insertion and deletion of programmable switches have severely constrained their performance. To this end, we introduce Miresga, a hybrid and high-performance layer-7 load balancing system by co-designing hardware and software. The core idea of Miresga is to maximize the utilization of hardware and software resources by rationally partitioning the layer-7 load balancing task, thereby improving performance. To achieve this, Miresga offloads the elephant flows, which account for the majority of traffic, to programmable switches that excel at packet processing, and Miresga utilizes general-purpose servers with stronger computational capabilities to parse application layer protocols and apply load balancing rules. To alleviate memory pressure on the programmable switch, Miresga employs a back-end agent to handle memory-intensive tasks, working in conjunction with the programmable switch to complete the offloaded tasks. This design leverages the performance advantages of the programmable switch while avoiding bottlenecks caused by its limited memory and table insertion speed. We implement the Miresga prototype with a 3.2 Tbps Intel Tofino switch and general-purpose servers. The evaluation results show that Miresga achieves 3.9x throughput and 0.4x latency compared to software load balancing solutions. Compared to state-of-the-art design employing programmable switches, Miresga achieves almost the same throughput and latency for delivering large objects and 5.0x throughput and 0.2x latency when transmitting small objects.

   @inproceedings{shi2025miresga,
     title = {Miresga: Accelerating Layer-7 Load Balancing with Programmable Switches},
     author = {Shi, Xiaoyi and He, Lin and Zhou, Jiasheng and Yang, Yifan and Liu, Ying},
     booktitle = {Proceedings of the 34th ACM Web Conference (WWW 2025)},
     year = {2025},
     pages = {},
     doi = {},
     address = {Sydney, Australia},
     date = {April 28 – May 2},
   }

3. SIGCOMM

   P4runpro: Enabling Runtime Programmability for RMT Programmable Switches

   Yifan Yang, Lin He^#, Jiasheng Zhou, Xiaoyi Shi, Jiamin Cao, Ying Liu

   In Proceedings of the 38th Annual Conference of the ACM Special Interest Group on Data Communication (SIGCOMM 2024)
   Sydney, Australia, August 4-8, 2024

   Abs Bib HTML PDF Code Video

   Programmable switches have revolutionized network operations by enabling the flexible customization of packet processing logic using language like P4. However, changing the programs running on the switch requires disturbing traffic and suspending other unrelated programs. In this paper, we present P4runpro, enabling runtime data plane updates with dynamic resource allocation. The P4runpro data plane abstracts hardware resources and defines dynamically reconfigurable atomic operations that form packet processing logic. P4runpro provides runtime programming interfaces called P4runpro primitives for the operator to write high-level programs. We have designed the P4runpro compiler to automatically and consistently link the P4runpro programs to the running data plane. We implement our prototype on a Tofino switch. We implement 15 example runtime programs using P4runpro to demonstrate its generality and expressiveness. Our evaluation results show that compared to the state-of-the-art, P4runpro can respond within hundreds of milliseconds, achieve an average of 60% to 80% dynamic resource utilization, concurrently run ≈0.6K to ≈2.8K programs, and introduce lower overhead. Our case studies illustrate the benefit of runtime programming and prove the same functionality between P4runpro and conventional P4 programs.

   @inproceedings{yang2024p4runpro,
     title = {P4runpro: Enabling Runtime Programmability for RMT Programmable Switches},
     author = {Yang, Yifan and He, Lin and Zhou, Jiasheng and Shi, Xiaoyi and Cao, Jiamin and Liu, Ying},
     booktitle = {Proceedings of the 38th Annual Conference of the ACM Special Interest Group on Data Communication (SIGCOMM 2024)},
     year = {2024},
     pages = {921-937},
     doi = {10.1145/3651890.3672230},
     address = {Sydney, Australia},
     date = {August 4-8},
   }

4. NDSS

   Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

   Long Pan, Jiahai Yang, Lin He^#, Zhiliang Wang, Leyao Nie, Guanglei Song, Yaozhong Liu

   In Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS 2023)
   San Diego, California, USA, February 27 – March 3, 2023

   🏆 Distinguished Paper Award

   Abs Bib HTML PDF Code

   Active Internet measurements face challenges when some measurements require many remote vantage points. In this paper, we propose a novel technique for measuring remote IPv6 networks via side channels in ICMP rate limiting, a required function for IPv6 nodes to limit the rate at which ICMP error messages are generated. This technique, iVantage, can to some extent use 1.1M remote routers distributed in 9.5k autonomous systems and 182 countries as our “vantage points”.We apply iVantage to two different, but both challenging measurement tasks: 1) measuring the deployment of inbound source address validation (ISAV) and 2) measuring reachability between arbitrary Internet nodes. We accomplish these two tasks from only one local vantage point without controlling the targets or relying on other services within the target networks. Our large-scale ISAV measurements cover  50% of all IPv6 autonomous systems and find  79% of them are vulnerable to spoofing, which is the most large-scale measurement study of IPv6 ISAV to date. Our method for reachability measurements achieves over 80% precision and recall in our evaluation. Finally, we perform an Internet-wide measurement of the ICMP rate limiting implementations, present a detailed discussion on ICMP rate limiting, particularly the potential security and privacy risks in the mechanism of ICMP rate limiting, and provide possible mitigation measures. We make our code available to the community.

   @inproceedings{pan2023your,
     title = {Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels},
     author = {Pan, Long and Yang, Jiahai and He, Lin and Wang, Zhiliang and Nie, Leyao and Song, Guanglei and Liu, Yaozhong},
     booktitle = {Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS 2023)},
     year = {2023},
     publisher = {The Internet Society},
     address = {San Diego, California, USA},
     date = {February 27 – March 3},
   }

5. USENIX ATC

   AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System

   Guanglei Song, Jiahai Yang^#, Lin He^#, Zhiliang Wang, Guo Li, Chenxin Duan, Yaozhong Liu, Zhongxiang Sun

   In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC 2022)
   Carlsbad, CA, USA, July 11–13, 2022

   Abs Bib HTML PDF Code Slides Website Video

   Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Although state-of-the-art techniques have made effective attempts, these methods do not work in seedless regions, while the detection efficiency is low in regions with seeds. Moreover, the constructed hitlists with low coverage cannot truly represent the active IPv6 address landscape of the Internet. This paper introduces AddrMiner, a global active IPv6 address probing system, making IPv6 active address probing systematic, comprehensive, and economical. We divide the IPv6 address space regions into three kinds according to the number of seed addresses and propose a probing algorithm for each of them. For the regions with no seeds, we propose AddrMiner-N, leveraging an organization association strategy to mine active addresses. It finds active addresses covering 86.4K BGP prefixes, accounting for 81.6% of the probed BGP prefixes. For the regions with few seeds, we propose AddrMiner-F, utilizing a similarity matching strategy to probe active addresses further. The hit rate of active address probing is improved by 70%-150% compared to existing algorithms. For the regions with sufficient seeds, we propose AddrMiner-S to generate target addresses based on reinforcement learning dynamically. It nearly doubles the hit rate compared to the state-of-the-art algorithms. Finally, we deploy AddrMiner and discover 2.1 billion active IPv6 addresses, including 1.7 billion de-aliased active addresses and 0.4 billion aliased addresses, through continuous probing for 13 months. We would like to further open the door of IPv6 measurement studies by publicly releasing AddrMiner and sharing our data.

   @inproceedings{song2022addeminer,
     title = {AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System},
     author = {Song, Guanglei and Yang, Jiahai and He, Lin and Wang, Zhiliang and Li, Guo and Duan, Chenxin and Liu, Yaozhong and Sun, Zhongxiang},
     booktitle = {Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC 2022)},
     year = {2022},
     isbn = {978-1-939133-29-19},
     address = {Carlsbad, CA, USA},
     date = {July 11–13},
     pages = {309--326},
     url = {https://www.usenix.org/conference/atc22/presentation/song},
     publisher = {USENIX Association},
   }

6. INFOCOM

   Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch

   Lin He, Gang Ren, Ying Liu

   In Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM 2019)
   Paris, France, April 29 - May 2, 2019

   Abs Bib HTML Slides

   Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

   @inproceedings{he2019bootstrapping,
     title = {Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch},
     author = {He, Lin and Ren, Gang and Liu, Ying},
     booktitle = {Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM 2019)},
     year = {2019},
     pages = {1486-1494},
     doi = {10.1109/INFOCOM.2019.8737453},
     address = {Paris, France},
     date = {April 29 - May 2},
   }

1. TON

   AddrMiner: A Fast, Efficient, and Comprehensive Global Active IPv6 Address Detection System

   Guanglei Song, Lin He^#, Feiyu Zhu, Jinlei Lin, Wenjian Zhang, Lina Fan, Chenglong Li, Zhiliang Wang, Jiahai Yang^#

   IEEE/ACM Transactions on Networking, 2024

   Abs Bib HTML Code Website

   Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Despite advancements in state-of-the-art methods, they do not work in seedless regions and suffer low detection efficiency and speed in regions with seed addresses. Moreover, the collected active address list (i.e., IPv6 hitlist) with low coverage cannot truly represent the active IPv6 address landscape of the Internet. This paper introduces AddrMiner, a fast, efficient, and comprehensive global active IPv6 address detection system. We design a systematic active IPv6 address detection strategy that divides the IPv6 space into two detection scenarios based on the presence or absence of seed addresses to discover active IPv6 addresses from scratch and from few to many. In the seedless regions, we present AddrMiner-N, leveraging a multi-level association policy to probe active addresses. It fills the gap of address detection in seedless regions and successfully discovers active addresses in 39,899 BGP prefixes without seed addresses, with a 1.03X higher hit rate, 30∼911X higher speed, and 2.7X broader coverage, compared to existing solutions. In the regions with seed addresses, our method AddrMiner-S dynamically generates target addresses using reinforcement learning. Compared to state-of-the-art methods, AddrMiner-S achieves an impressive 56.3% hit rate and a discovery speed of 839.0/s, which is 1.9∼2153X and 1.5∼755X of existing works, respectively. Finally, we deploy AddrMiner and discover 2.1B active IPv6 addresses, including 1.7B de-aliased active addresses and 0.4B aliased addresses, through continuous probing for three years.

   @article{song2024addrminer,
     title = {AddrMiner: A Fast, Efficient, and Comprehensive Global Active IPv6 Address Detection System},
     author = {Song, Guanglei and He, Lin and Zhu, Feiyu and Lin, Jinlei and Zhang, Wenjian and Fan, Lina and Li, Chenglong and Wang, Zhiliang and Yang, Jiahai},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2024},
     volume = {32},
     number = {5},
     pages = {3870-3887},
     publisher = {IEEE},
     doi = {10.1109/TNET.2024.3406508},
   }

2. TMC

   AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning

   Linna Fan, Lin He^#, Yichao Wu, Shize Zhang, Zhiliang Wang, Jia Li, Jiahai Yang^#, Chaocan Xiang, Xiaoqian Ma

   IEEE Transactions on Mobile Computing, 2023

   Abs Bib HTML

   IoT devices bring great convenience to a person’s life and industrial production. However, their rapid proliferation also troubles device management and network security. Network administrators usually need to know how many IoT devices are in the network and whether they behave normally. IoT device identification is the first step to achieving these goals. Previous IoT device identification methods reach high accuracy in a closed environment. But they are not applicable in the continuously changing environment. When new types of devices are plugged in, they cannot update themselves automatically. Besides, they usually rely on supervised learning and need lots of labeled data, which is costly. To solve these problems, we propose a novel IoT device identification model named AutoIoT, updating itself automatically when new types of devices are plugged in. Besides, it only needs a few labeled data and identifies IoT devices with high accuracy. The evaluation on two public datasets shows that AutoIoT can identify new device types only using 1.5∼2.5 hours’ traffic and still have high accuracy after updating. Moreover, it has a better performance than other works when there are only a few labeled data, especially in an environment with scanning traffic.

   @article{fan2022autoiot,
     title = {AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning},
     author = {Fan, Linna and He, Lin and Wu, Yichao and Zhang, Shize and Wang, Zhiliang and Li, Jia and Yang, Jiahai and Xiang, Chaocan and Ma, Xiaoqian},
     journal = {IEEE Transactions on Mobile Computing},
     year = {2023},
     volume = {22},
     number = {10},
     pages = {5769-5786},
     publisher = {IEEE},
     doi = {10.1109/TMC.2022.3183118},
   }

3. TON

   DET: Enabling Efficient Probing of IPv6 Active Addresses

   Guanglei Song, Jiahai Yang, Zhiliang Wang, Lin He^#, Jinlei Lin, Long Pan, Chenxin Duan, Xiaowen Quan

   IEEE/ACM Transactions on Networking, 2022

   Abs Bib HTML Code Website

   Fast IPv4 scanning significantly improves network measurement and security research. Nevertheless, it is infeasible to perform brute-force scanning of the IPv6 address space. Alternatively, one can find active IPv6 addresses through scanning the candidate addresses generated by state-of-the-art algorithms. However, the probing efficiency of such algorithms is often very low. In this paper, our objective is to improve the probing efficiency of IPv6 addresses. We first perform a longitudinal active measurement study and build a high-quality dataset, hitlist, including more than 1.95,B IPv6 addresses distributed in 58.2,K BGP prefixes and collected over 17 months period. Different from the previous works, we probe the announced BGP prefixes using a pattern-based algorithm. This results in a dataset without uneven address distribution and low active rates. Further, we propose an efficient address generation algorithm, DET, which builds a density space tree to learn high-density address regions of the seed addresses with linear time complexity and improves the active addresses’ probing efficiency. We then compare our algorithm DET against state-of-the-art algorithms on the public hitlist and our hitlist by scanning 50,M addresses. Our analysis shows that DET increases the de-aliased active address ratio and active address (including aliased addresses) ratio by 10%, and 14%, respectively. Furthermore, we develop a fingerprint-based method to detect aliased prefixes. The proposed method for the first time directly verifies whether the prefix is aliased or not. Our method finds that 10.64% of the public aliased prefixes are false positive.

   @article{song2022det,
     title = {DET: Enabling Efficient Probing of IPv6 Active Addresses},
     author = {Song, Guanglei and Yang, Jiahai and Wang, Zhiliang and He, Lin and Lin, Jinlei and Pan, Long and Duan, Chenxin and Quan, Xiaowen},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {4},
     pages = {1629-1643},
     doi = {10.1109/TNET.2022.3145040},
   }

4. TON

   TurboNet: Faithfully Emulating Networks with Programmable Switches

   Jiamin Cao, Ying Liu, Yu Zhou, Lin He^#, Mingwei Xu

   IEEE/ACM Transactions on Networking, 2022

   Abs Bib HTML Code

   Faithfully emulating networks is critical for verifying the correctness and effectiveness of new networking-related designs. Existing network experiment platforms either cannot faithfully emulate the functionality and performance of production networks or cannot scale well due to cost constraints. In this paper, we propose TurboNet, a new network emulator that utilizes one or more programmable switches to achieve faithful emulation of the network data plane and control plane. For data plane emulation, we propose a series of key designs, such as port mapper, queue mapper, and delayed queue, to emulate network topologies and performance metrics with high flexibility and accuracy. For control plane emulation, we support static routing configurations, distributed routing agents, and the centralized routing controllers. Meanwhile, we provide APIs for operators to simplify network emulation tasks. We implement TurboNet on Tofino switches. Evaluation results show that: (1) On the data plane, TurboNet can flexibly emulate various topologies, such as an 8-ary fat-tree with only one programmable switch and a 10-ary fat-tree with four programmable switches; (2) On the control plane, TurboNet supports about 200 BGP agents on a single programmable switch with a CPU usage of 25%; (3) TurboNet can accurately emulate different network performance metrics such as 10⁻⁸ link loss, and microsecond to millisecond link delay.

   @article{cao2022turbonet,
     title = {TurboNet: Faithfully Emulating Networks with Programmable Switches},
     author = {Cao, Jiamin and Liu, Ying and Zhou, Yu and He, Lin and Xu, Mingwei},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {3},
     pages = {1395-1409},
     doi = {10.1109/TNET.2022.3142126},
   }

5. TON

   PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet

   Lin He, Gang Ren, Ying Liu, Jiahai Yang

   IEEE/ACM Transactions on Networking, 2021

   Abs Bib HTML

   Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of the evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

   @article{he2021pavi,
     title = {PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet},
     author = {He, Lin and Ren, Gang and Liu, Ying and Yang, Jiahai},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2021},
     volume = {29},
     number = {2},
     pages = {695-708},
     doi = {10.1109/TNET.2020.3047667},
   }