Lin He

Selected Publications

1. NDSS

   Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

   Long Pan, Jiahai Yang, Lin He^#, Zhiliang Wang, Leyao Nie, Guanglei Song, and Yaozhong Liu

   In Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS), 2023

   🏆 Distinguished Paper Award

   Abs Bib HTML PDF Code

   Active Internet measurements face challenges when some measurements require many remote vantage points. In this paper, we propose a novel technique for measuring remote IPv6 networks via side channels in ICMP rate limiting, a required function for IPv6 nodes to limit the rate at which ICMP error messages are generated. This technique, iVantage, can to some extent use 1.1M remote routers distributed in 9.5k autonomous systems and 182 countries as our “vantage points”.We apply iVantage to two different, but both challenging measurement tasks: 1) measuring the deployment of inbound source address validation (ISAV) and 2) measuring reachability between arbitrary Internet nodes. We accomplish these two tasks from only one local vantage point without controlling the targets or relying on other services within the target networks. Our large-scale ISAV measurements cover  50% of all IPv6 autonomous systems and find  79% of them are vulnerable to spoofing, which is the most large-scale measurement study of IPv6 ISAV to date. Our method for reachability measurements achieves over 80% precision and recall in our evaluation. Finally, we perform an Internet-wide measurement of the ICMP rate limiting implementations, present a detailed discussion on ICMP rate limiting, particularly the potential security and privacy risks in the mechanism of ICMP rate limiting, and provide possible mitigation measures. We make our code available to the community.

   @inproceedings{pan2023your,
     title = {Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels},
     author = {Pan, Long and Yang, Jiahai and He, Lin and Wang, Zhiliang and Nie, Leyao and Song, Guanglei and Liu, Yaozhong},
     booktitle = {Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS)},
     year = {2023},
     publisher = {The Internet Society},
   }

2. USENIX ATC

   AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System

   Guanglei Song, Jiahai Yang^#, Lin He^#, Zhiliang Wang, Guo Li, Chenxin Duan, Yaozhong Liu, and Zhongxiang Sun

   In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC), 2022

   Abs Bib HTML PDF Slides Video

   Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Although state-of-the-art techniques have made effective attempts, these methods do not work in seedless regions, while the detection efficiency is low in regions with seeds. Moreover, the constructed hitlists with low coverage cannot truly represent the active IPv6 address landscape of the Internet. This paper introduces AddrMiner, a global active IPv6 address probing system, making IPv6 active address probing systematic, comprehensive, and economical. We divide the IPv6 address space regions into three kinds according to the number of seed addresses and propose a probing algorithm for each of them. For the regions with no seeds, we propose AddrMiner-N, leveraging an organization association strategy to mine active addresses. It finds active addresses covering 86.4K BGP prefixes, accounting for 81.6% of the probed BGP prefixes. For the regions with few seeds, we propose AddrMiner-F, utilizing a similarity matching strategy to probe active addresses further. The hit rate of active address probing is improved by 70%-150% compared to existing algorithms. For the regions with sufficient seeds, we propose AddrMiner-S to generate target addresses based on reinforcement learning dynamically. It nearly doubles the hit rate compared to the state-of-the-art algorithms. Finally, we deploy AddrMiner and discover 2.1 billion active IPv6 addresses, including 1.7 billion de-aliased active addresses and 0.4 billion aliased addresses, through continuous probing for 13 months. We would like to further open the door of IPv6 measurement studies by publicly releasing AddrMiner and sharing our data.

   @inproceedings{song2022addeminer,
     title = {AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System},
     author = {Song, Guanglei and Yang, Jiahai and He, Lin and Wang, Zhiliang and Li, Guo and Duan, Chenxin and Liu, Yaozhong and Sun, Zhongxiang},
     booktitle = {Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC)},
     year = {2022},
     isbn = {978-1-939133-29-19},
     address = {Carlsbad, CA},
     pages = {309--326},
     url = {https://www.usenix.org/conference/atc22/presentation/song},
     publisher = {USENIX Association},
   }

3. USENIX ATC

   Firebolt: Finding Bugs in Programmable Data Plane Generators

   Jiamin Cao, Yu Zhou, Chen Sun, Lin He, Zhaowei Xi, and Ying Liu

   In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC), 2022

   Abs Bib HTML PDF Slides Video

   Programmable data planes (DP) enable flexible customization of packet processing logic with domain-specific languages such as P4. To relieve developers from lengthy codes and tedious hardware details, many researches propose DP program generators that take high-level intents as input and automatically convert intents into DP programs. Generators must be correct, otherwise they may produce buggy programs or DP logic that is inconsistent with intents. Nevertheless, existing verification tools are designed to verify individual DP programs, not generators. They either cannot achieve high bug coverage or cannot debug generators with high scalability. This paper presents Firebolt, a blackbox testing tool designed to dig out faults in DP program generators, including security vulnerabilities, intent violations, and generator crash. Firebolt achieves high bug coverage by using syntax-guided intent generation to construct a comprehensive, syntactically correct, and semantically valid intent set. To avoid intent explosion, Firebolt designs an intent space pruning approach that eliminates redundant intents while preserving representative ones. For high scalability, Firebolt automatically formalizes DP programs and intents for verification. We apply Firebolt to three popular open-source DP generators. Evaluation results demonstrate that Firebolt can detect 2x bugs with 0.1% to 0.01% human efforts compared to existing tools.

   @inproceedings{cao2022firebolt,
     title = {Firebolt: Finding Bugs in Programmable Data Plane Generators},
     author = {Cao, Jiamin and Zhou, Yu and Sun, Chen and He, Lin and Xi, Zhaowei and Liu, Ying},
     booktitle = {Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC)},
     year = {2022},
     isbn = {978-1-939133-29-32},
     address = {Carlsbad, CA},
     pages = {819--834},
     url = {https://www.usenix.org/conference/atc22/presentation/cao},
     publisher = {USENIX Association},
   }

4. INFOCOM

   AggDeliv: Aggregating Multiple Wireless Links for Efficient Mobile Live Video Delivery

   Jinlong E, Lin He, Zongyi Zhao, Yachen Wang, Gonglong Chen, and Wei Chen

   In Proceedings of the 43nd IEEE Conference on Computer Communications (INFOCOM), 2024

   Abs Bib

   Mobile live-streaming applications with stringent latency and bandwidth requirements have gained tremendous attention in recent years. Encountered with bandwidth insufficiency and congestion instability of the wireless uplinks, multi-access networking provides opportunities to achieve fast and robust connectivity. However, the state-of-the-art multi-path transmission solutions are lack of adaptivity to the heterogeneous and dynamic nature of wireless networks. Meanwhile, the indispensable video coding and transformation bring about extra latency and make the video delivery vulnerable to network throughput fluctuation. This paper presents AggDeliv, a framework that provides efficient and robust multi-path transmission for mobile live video delivery. The key idea is to relate multi-path packet scheduling to congestion control optimization over diverse wireless links and adapt it to the mobile video characteristics. This is achieved by probabilistic packet allocation based on links’ congestion windows, wireless-oriented delay and loss aware congestion control, as well as lightweight video frame coding and networkadaptive frame-packet transformation. Real-world evaluations demonstrate that our framework significantly outperforms the state-of-the-art solutions on aggregate goodput and streaming video bitrate.

   @inproceedings{e2024aggdeliv,
     title = {AggDeliv: Aggregating Multiple Wireless Links for Efficient Mobile Live Video Delivery},
     author = {E, Jinlong and He, Lin and Zhao, Zongyi and Wang, Yachen and Chen, Gonglong and Chen, Wei},
     booktitle = {Proceedings of the 43nd IEEE Conference on Computer Communications (INFOCOM)},
     year = {2024},
     pages = {1-10},
     doi = {},
   }

5. INFOCOM

   WiseCam: Wisely Tuning Wireless Pan-Tilt Cameras for Cost-Effective Moving Object Tracking

   Jinlong E, Lin He, Zhenhua Li, and Yunhao Liu

   In Proceedings of the 42nd IEEE Conference on Computer Communications (INFOCOM), 2023

   Abs Bib HTML Slides

   With desired functionality of moving object tracking, wireless pan-tilt cameras are able to play critical roles in a growing diversity of surveillance environments. However, today’s pan-tilt cameras oftentimes underperform when tracking frequently moving objects like humans – they are prone to lose sight of objects and bring about excessive mechanical rotations that are especially detrimental to those energy-constrained outdoor scenarios. The ineffectiveness and high cost of state-of-the-art tracking approaches are rooted in their adherence to the industry’s simplicity principle, which leads to their stateless nature, performing gimbal rotations based only on the latest object detection. To address the issues, we design and implement WiseCam that wisely tunes the pan-tilt cameras to minimize mechanical rotation costs while maintaining long-term object tracking. We examine the performance of WiseCam by experiments on two types of pan-tilt cameras with different motors. Results show that WiseCam significantly outperforms the state-of-the-art tracking approaches on both tracking duration and power consumption.

   @inproceedings{e2023wisecam,
     title = {WiseCam: Wisely Tuning Wireless Pan-Tilt Cameras for Cost-Effective Moving Object Tracking},
     author = {E, Jinlong and He, Lin and Li, Zhenhua and Liu, Yunhao},
     booktitle = {Proceedings of the 42nd IEEE Conference on Computer Communications (INFOCOM)},
     year = {2023},
     pages = {1-10},
     doi = {10.1109/INFOCOM53939.2023.10228926},
   }

6. INFOCOM

   Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch

   Lin He, Gang Ren, and Ying Liu

   In Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM), 2019

   Abs Bib HTML Slides

   Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

   @inproceedings{he2019bootstrapping,
     title = {Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch},
     author = {He, Lin and Ren, Gang and Liu, Ying},
     booktitle = {Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM)},
     year = {2019},
     pages = {1486-1494},
     doi = {10.1109/INFOCOM.2019.8737453},
   }

7. TMC

   AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning

   Linna Fan, Lin He^#, Yichao Wu, Shize Zhang, Zhiliang Wang, Jia Li, Jiahai Yang^#, Chaocan Xiang, and Xiaoqian Ma

   IEEE Transactions on Mobile Computing, 2023

   Abs Bib HTML

   IoT devices bring great convenience to a person’s life and industrial production. However, their rapid proliferation also troubles device management and network security. Network administrators usually need to know how many IoT devices are in the network and whether they behave normally. IoT device identification is the first step to achieving these goals. Previous IoT device identification methods reach high accuracy in a closed environment. But they are not applicable in the continuously changing environment. When new types of devices are plugged in, they cannot update themselves automatically. Besides, they usually rely on supervised learning and need lots of labeled data, which is costly. To solve these problems, we propose a novel IoT device identification model named AutoIoT, updating itself automatically when new types of devices are plugged in. Besides, it only needs a few labeled data and identifies IoT devices with high accuracy. The evaluation on two public datasets shows that AutoIoT can identify new device types only using 1.5∼2.5 hours’ traffic and still have high accuracy after updating. Moreover, it has a better performance than other works when there are only a few labeled data, especially in an environment with scanning traffic.

   @article{fan2022autoiot,
     title = {AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning},
     author = {Fan, Linna and He, Lin and Wu, Yichao and Zhang, Shize and Wang, Zhiliang and Li, Jia and Yang, Jiahai and Xiang, Chaocan and Ma, Xiaoqian},
     journal = {IEEE Transactions on Mobile Computing},
     year = {2023},
     volume = {22},
     number = {10},
     pages = {5769-5786},
     publisher = {IEEE},
     doi = {10.1109/TMC.2022.3183118},
   }

8. TON

   DET: Enabling Efficient Probing of IPv6 Active Addresses

   Guanglei Song, Jiahai Yang, Zhiliang Wang, Lin He^#, Jinlei Lin, Long Pan, Chenxin Duan, and Xiaowen Quan

   IEEE/ACM Transactions on Networking, 2022

   Abs Bib HTML Code

   Fast IPv4 scanning significantly improves network measurement and security research. Nevertheless, it is infeasible to perform brute-force scanning of the IPv6 address space. Alternatively, one can find active IPv6 addresses through scanning the candidate addresses generated by state-of-the-art algorithms. However, the probing efficiency of such algorithms is often very low. In this paper, our objective is to improve the probing efficiency of IPv6 addresses. We first perform a longitudinal active measurement study and build a high-quality dataset, hitlist, including more than 1.95,B IPv6 addresses distributed in 58.2,K BGP prefixes and collected over 17 months period. Different from the previous works, we probe the announced BGP prefixes using a pattern-based algorithm. This results in a dataset without uneven address distribution and low active rates. Further, we propose an efficient address generation algorithm, DET, which builds a density space tree to learn high-density address regions of the seed addresses with linear time complexity and improves the active addresses’ probing efficiency. We then compare our algorithm DET against state-of-the-art algorithms on the public hitlist and our hitlist by scanning 50,M addresses. Our analysis shows that DET increases the de-aliased active address ratio and active address (including aliased addresses) ratio by 10%, and 14%, respectively. Furthermore, we develop a fingerprint-based method to detect aliased prefixes. The proposed method for the first time directly verifies whether the prefix is aliased or not. Our method finds that 10.64% of the public aliased prefixes are false positive.

   @article{song2022det,
     title = {DET: Enabling Efficient Probing of IPv6 Active Addresses},
     author = {Song, Guanglei and Yang, Jiahai and Wang, Zhiliang and He, Lin and Lin, Jinlei and Pan, Long and Duan, Chenxin and Quan, Xiaowen},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {4},
     pages = {1629-1643},
     doi = {10.1109/TNET.2022.3145040},
   }

9. TON

   TurboNet: Faithfully Emulating Networks with Programmable Switches

   Jiamin Cao, Ying Liu, Yu Zhou, Lin He^#, and Mingwei Xu

   IEEE/ACM Transactions on Networking, 2022

   Abs Bib HTML Code

   Faithfully emulating networks is critical for verifying the correctness and effectiveness of new networking-related designs. Existing network experiment platforms either cannot faithfully emulate the functionality and performance of production networks or cannot scale well due to cost constraints. In this paper, we propose TurboNet, a new network emulator that utilizes one or more programmable switches to achieve faithful emulation of the network data plane and control plane. For data plane emulation, we propose a series of key designs, such as port mapper, queue mapper, and delayed queue, to emulate network topologies and performance metrics with high flexibility and accuracy. For control pl ane emulation, we support static routing configurations, distributed routing agents, and the centralized routing controllers. Meanwhile, we provide APIs for operators to simplify network emulation tasks. We implement TurboNet on Tofino switches. Evaluation results show that: (1) On the data plane, TurboNet can flexibly emulate various topologies, such as an 8-ary fat-tree with only one programmable switch and a 10-ary fat-tree with four programmable switches; (2) On the control plane, TurboNet supports about 200 BGP agents on a single programmable switch with a CPU usage of 25%; (3) TurboNet can accurately emulate different network performance metrics such as 10⁻⁸ link loss, and microsecond to millisecond link delay.

   @article{cao2022turbonet,
     title = {TurboNet: Faithfully Emulating Networks with Programmable Switches},
     author = {Cao, Jiamin and Liu, Ying and Zhou, Yu and He, Lin and Xu, Mingwei},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {3},
     pages = {1395-1409},
     doi = {10.1109/TNET.2022.3142126},
   }

10. TON

    PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet

    Lin He, Gang Ren, Ying Liu, and Jiahai Yang

    IEEE/ACM Transactions on Networking, 2021

    Abs Bib HTML

    Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of the evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

    @article{he2021pavi,
      title = {PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet},
      author = {He, Lin and Ren, Gang and Liu, Ying and Yang, Jiahai},
      journal = {IEEE/ACM Transactions on Networking},
      year = {2021},
      volume = {29},
      number = {2},
      pages = {695-708},
      doi = {10.1109/TNET.2020.3047667},
    }

11. TPDS

    CoFilter: High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers

    Jiamin Cao, Ying Liu, Yu Zhou, Lin He, Chen Sun, Yangyang Wang, and Mingwei Xu

    IEEE Transactions on Parallel and Distributed Systems, 2022

    Abs Bib HTML

    As one of the most critical cloud services, Bare-Metal Servers (BMS) introduce stringent performance requirements on data center networks (DCN). Stateful packet filter is an integral DCN component of ensuring connection security for BMS. However, the off-the-shelf stateful packet filters either are costly for cloud DCNs or introduce significant performance bottlenecks. In this article, we present CoFilter , which leverages low-cost programmable switches to accelerate the stateful packet filter for BMS. CoFilter uses (1) stateful process partition to enable complex stateful packet filtering logic on programmability-limited switching ASICs, (2) state compression to track tens of millions of connections with constrained hardware memory, and (3) per-tenant packet rate limit and tenant-aware flow migration to achieve efficient performance isolation among different tenants. Overall, CoFilter implements a high-performance stateful packet filter via the co-design of programmable switching ASIC and CPU. We evaluate CoFilter under various data center traffic traces with real-world flow distributions. The evaluation results show that CoFilter remarkably outperforms NetFilter, i.e., forwarding packets at line rate (13x throughput of NetFilter), keeping packet delay within 1us, and freeing a significant quantity of CPU cores, with rather small memory usage, i.e., accommodating over 107 connections with only 16MB SRAM.

    @article{cao2021cofilter,
      title = {CoFilter: High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers},
      author = {Cao, Jiamin and Liu, Ying and Zhou, Yu and He, Lin and Sun, Chen and Wang, Yangyang and Xu, Mingwei},
      journal = {IEEE Transactions on Parallel and Distributed Systems},
      year = {2022},
      volume = {33},
      number = {9},
      pages = {2249-2262},
      doi = {10.1109/TPDS.2021.3136575},
    }