Lin He

Selected Publications

1. NDSS

   Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels

   Long Pan, Jiahai Yang, Lin He^#, Zhiliang Wang, Leyao Nie, Guanglei Song, and Yaozhong Liu

   In Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS), 2023

   🏆 Distinguished Paper Award

   Abs Bib HTML PDF Code

   Active Internet measurements face challenges when some measurements require many remote vantage points. In this paper, we propose a novel technique for measuring remote IPv6 networks via side channels in ICMP rate limiting, a required function for IPv6 nodes to limit the rate at which ICMP error messages are generated. This technique, iVantage, can to some extent use 1.1M remote routers distributed in 9.5k autonomous systems and 182 countries as our “vantage points”.We apply iVantage to two different, but both challenging measurement tasks: 1) measuring the deployment of inbound source address validation (ISAV) and 2) measuring reachability between arbitrary Internet nodes. We accomplish these two tasks from only one local vantage point without controlling the targets or relying on other services within the target networks. Our large-scale ISAV measurements cover  50% of all IPv6 autonomous systems and find  79% of them are vulnerable to spoofing, which is the most large-scale measurement study of IPv6 ISAV to date. Our method for reachability measurements achieves over 80% precision and recall in our evaluation. Finally, we perform an Internet-wide measurement of the ICMP rate limiting implementations, present a detailed discussion on ICMP rate limiting, particularly the potential security and privacy risks in the mechanism of ICMP rate limiting, and provide possible mitigation measures. We make our code available to the community.

   @inproceedings{pan2023your,
     title = {Your Router is My Prober: Measuring IPv6 Networks via ICMP Rate Limiting Side Channels},
     author = {Pan, Long and Yang, Jiahai and He, Lin and Wang, Zhiliang and Nie, Leyao and Song, Guanglei and Liu, Yaozhong},
     booktitle = {Proceedings of the 30th Annual Network and Distributed System Security Symposium (NDSS)},
     year = {2023},
     publisher = {The Internet Society},
   }

2. USENIX ATC

   AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System

   Guanglei Song, Jiahai Yang^#, Lin He^#, Zhiliang Wang, Guo Li, Chenxin Duan, Yaozhong Liu, and Zhongxiang Sun

   In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC), Jul 2022

   Abs Bib HTML PDF Slides Video

   Fast Internet-wide scanning is essential for network situational awareness and asset evaluation. However, the vast IPv6 address space makes brute-force scanning infeasible. Although state-of-the-art techniques have made effective attempts, these methods do not work in seedless regions, while the detection efficiency is low in regions with seeds. Moreover, the constructed hitlists with low coverage cannot truly represent the active IPv6 address landscape of the Internet. This paper introduces AddrMiner, a global active IPv6 address probing system, making IPv6 active address probing systematic, comprehensive, and economical. We divide the IPv6 address space regions into three kinds according to the number of seed addresses and propose a probing algorithm for each of them. For the regions with no seeds, we propose AddrMiner-N, leveraging an organization association strategy to mine active addresses. It finds active addresses covering 86.4K BGP prefixes, accounting for 81.6% of the probed BGP prefixes. For the regions with few seeds, we propose AddrMiner-F, utilizing a similarity matching strategy to probe active addresses further. The hit rate of active address probing is improved by 70%-150% compared to existing algorithms. For the regions with sufficient seeds, we propose AddrMiner-S to generate target addresses based on reinforcement learning dynamically. It nearly doubles the hit rate compared to the state-of-the-art algorithms. Finally, we deploy AddrMiner and discover 2.1 billion active IPv6 addresses, including 1.7 billion de-aliased active addresses and 0.4 billion aliased addresses, through continuous probing for 13 months. We would like to further open the door of IPv6 measurement studies by publicly releasing AddrMiner and sharing our data.

   @inproceedings{song2022addeminer,
     title = {AddrMiner: A Comprehensive Global Active IPv6 Address Discovery System},
     author = {Song, Guanglei and Yang, Jiahai and He, Lin and Wang, Zhiliang and Li, Guo and Duan, Chenxin and Liu, Yaozhong and Sun, Zhongxiang},
     booktitle = {Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC)},
     year = {2022},
     isbn = {978-1-939133-29-19},
     address = {Carlsbad, CA},
     pages = {309--326},
     url = {https://www.usenix.org/conference/atc22/presentation/song},
     publisher = {USENIX Association},
     month = jul,
   }

3. USENIX ATC

   Firebolt: Finding Bugs in Programmable Data Plane Generators

   Jiamin Cao, Yu Zhou, Chen Sun, Lin He, Zhaowei Xi, and Ying Liu

   In Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC), Jul 2022

   Abs Bib HTML PDF Slides Video

   Programmable data planes (DP) enable flexible customization of packet processing logic with domain-specific languages such as P4. To relieve developers from lengthy codes and tedious hardware details, many researches propose DP program generators that take high-level intents as input and automatically convert intents into DP programs. Generators must be correct, otherwise they may produce buggy programs or DP logic that is inconsistent with intents. Nevertheless, existing verification tools are designed to verify individual DP programs, not generators. They either cannot achieve high bug coverage or cannot debug generators with high scalability. This paper presents Firebolt, a blackbox testing tool designed to dig out faults in DP program generators, including security vulnerabilities, intent violations, and generator crash. Firebolt achieves high bug coverage by using syntax-guided intent generation to construct a comprehensive, syntactically correct, and semantically valid intent set. To avoid intent explosion, Firebolt designs an intent space pruning approach that eliminates redundant intents while preserving representative ones. For high scalability, Firebolt automatically formalizes DP programs and intents for verification. We apply Firebolt to three popular open-source DP generators. Evaluation results demonstrate that Firebolt can detect 2x bugs with 0.1% to 0.01% human efforts compared to existing tools.

   @inproceedings{cao2022firebolt,
     title = {Firebolt: Finding Bugs in Programmable Data Plane Generators},
     author = {Cao, Jiamin and Zhou, Yu and Sun, Chen and He, Lin and Xi, Zhaowei and Liu, Ying},
     booktitle = {Proceedings of the 2022 USENIX Annual Technical Conference (USENIX ATC)},
     year = {2022},
     isbn = {978-1-939133-29-32},
     address = {Carlsbad, CA},
     pages = {819--834},
     url = {https://www.usenix.org/conference/atc22/presentation/cao},
     publisher = {USENIX Association},
     month = jul,
   }

4. INFOCOM

   WiseCam: Wisely Tuning Wireless Pan-Tilt Cameras for Cost-Effective Moving Object Tracking

   Jinlong E, Lin He, Zhenhua Li, and Yunhao Liu

   In Proceedings of the 42nd IEEE Conference on Computer Communications (INFOCOM), Jul 2023

   Abs Bib

   With desired functionality of moving object tracking, wireless pan-tilt cameras are able to play critical roles in a growing diversity of surveillance environments. However, today’s pan-tilt cameras oftentimes underperform when tracking frequently moving objects like humans – they are prone to lose sight of objects and bring about excessive mechanical rotations that are especially detrimental to those energy-constrained outdoor scenarios. The ineffectiveness and high cost of state-of-the-art tracking approaches are rooted in their adherence to the industry’s simplicity principle, which leads to their stateless nature, performing gimbal rotations based only on the latest object detection. To address the issues, we design and implement WiseCam that wisely tunes the pan-tilt cameras to minimize mechanical rotation costs while maintaining long-term object tracking. We examine the performance of WiseCam by experiments on two types of pan-tilt cameras with different motors. Results show that WiseCam significantly outperforms the state-of-the-art tracking approaches on both tracking duration and power consumption.

   @inproceedings{e2023wisecam,
     title = {WiseCam: Wisely Tuning Wireless Pan-Tilt Cameras for Cost-Effective Moving Object Tracking},
     author = {E, Jinlong and He, Lin and Li, Zhenhua and Liu, Yunhao},
     booktitle = {Proceedings of the 42nd IEEE Conference on Computer Communications (INFOCOM)},
     year = {2023},
     volume = {},
     number = {},
     pages = {},
     doi = {},
   }

5. INFOCOM

   Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch

   Lin He, Gang Ren, and Ying Liu

   In Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM), Jul 2019

   Abs Bib HTML Slides

   Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

   @inproceedings{he2019bootstrapping,
     title = {Bootstrapping Accountability and Privacy to IPv6 Internet without Starting from Scratch},
     author = {He, Lin and Ren, Gang and Liu, Ying},
     booktitle = {Proceedings of the 38th IEEE Conference on Computer Communications (INFOCOM)},
     year = {2019},
     volume = {},
     number = {},
     pages = {1486-1494},
     doi = {10.1109/INFOCOM.2019.8737453},
   }

6. TMC

   AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning

   Linna Fan, Lin He^#, Yichao Wu, Shize Zhang, Zhiliang Wang, Jia Li, Jiahai Yang^#, Chaocan Xiang, and Xiaoqian Ma

   IEEE Transactions on Mobile Computing, Jul 2022

   Abs Bib HTML

   IoT devices bring great convenience to a person’s life and industrial production. However, their rapid proliferation also troubles device management and network security. Network administrators usually need to know how many IoT devices are in the network and whether they behave normally. IoT device identification is the first step to achieving these goals. Previous IoT device identification methods reach high accuracy in a closed environment. But they are not applicable in the continuously changing environment. When new types of devices are plugged in, they cannot update themselves automatically. Besides, they usually rely on supervised learning and need lots of labeled data, which is costly. To solve these problems, we propose a novel IoT device identification model named AutoIoT, updating itself automatically when new types of devices are plugged in. Besides, it only needs a few labeled data and identifies IoT devices with high accuracy. The evaluation on two public datasets shows that AutoIoT can identify new device types only using 1.5∼2.5 hours’ traffic and still have high accuracy after updating. Moreover, it has a better performance than other works when there are only a few labeled data, especially in an environment with scanning traffic.

   @article{fan2022autoiot,
     title = {AutoIoT: Automatically Updated IoT Device Identification with Semi-supervised Learning},
     author = {Fan, Linna and He, Lin and Wu, Yichao and Zhang, Shize and Wang, Zhiliang and Li, Jia and Yang, Jiahai and Xiang, Chaocan and Ma, Xiaoqian},
     journal = {IEEE Transactions on Mobile Computing},
     year = {2022},
     volume = {},
     number = {},
     pages = {},
     publisher = {IEEE},
     doi = {10.1109/TMC.2022.3183118},
   }

7. TON

   DET: Enabling Efficient Probing of IPv6 Active Addresses

   Guanglei Song, Jiahai Yang, Zhiliang Wang, Lin He^#, Jinlei Lin, Long Pan, Chenxin Duan, and Xiaowen Quan

   IEEE/ACM Transactions on Networking, Jul 2022

   Abs Bib HTML Code

   Fast IPv4 scanning significantly improves network measurement and security research. Nevertheless, it is infeasible to perform brute-force scanning of the IPv6 address space. Alternatively, one can find active IPv6 addresses through scanning the candidate addresses generated by state-of-the-art algorithms. However, the probing efficiency of such algorithms is often very low. In this paper, our objective is to improve the probing efficiency of IPv6 addresses. We first perform a longitudinal active measurement study and build a high-quality dataset, hitlist, including more than 1.95,B IPv6 addresses distributed in 58.2,K BGP prefixes and collected over 17 months period. Different from the previous works, we probe the announced BGP prefixes using a pattern-based algorithm. This results in a dataset without uneven address distribution and low active rates. Further, we propose an efficient address generation algorithm, DET, which builds a density space tree to learn high-density address regions of the seed addresses with linear time complexity and improves the active addresses’ probing efficiency. We then compare our algorithm DET against state-of-the-art algorithms on the public hitlist and our hitlist by scanning 50,M addresses. Our analysis shows that DET increases the de-aliased active address ratio and active address (including aliased addresses) ratio by 10%, and 14%, respectively. Furthermore, we develop a fingerprint-based method to detect aliased prefixes. The proposed method for the first time directly verifies whether the prefix is aliased or not. Our method finds that 10.64% of the public aliased prefixes are false positive.

   @article{song2022det,
     title = {DET: Enabling Efficient Probing of IPv6 Active Addresses},
     author = {Song, Guanglei and Yang, Jiahai and Wang, Zhiliang and He, Lin and Lin, Jinlei and Pan, Long and Duan, Chenxin and Quan, Xiaowen},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {4},
     pages = {1629-1643},
     doi = {10.1109/TNET.2022.3145040},
   }

8. TON

   TurboNet: Faithfully Emulating Networks with Programmable Switches

   Jiamin Cao, Ying Liu, Yu Zhou, Lin He^#, and Mingwei Xu

   IEEE/ACM Transactions on Networking, Jul 2022

   Abs Bib HTML Code

   Faithfully emulating networks is critical for verifying the correctness and effectiveness of new networking-related designs. Existing network experiment platforms either cannot faithfully emulate the functionality and performance of production networks or cannot scale well due to cost constraints. In this paper, we propose TurboNet, a new network emulator that utilizes one or more programmable switches to achieve faithful emulation of the network data plane and control plane. For data plane emulation, we propose a series of key designs, such as port mapper, queue mapper, and delayed queue, to emulate network topologies and performance metrics with high flexibility and accuracy. For control pl ane emulation, we support static routing configurations, distributed routing agents, and the centralized routing controllers. Meanwhile, we provide APIs for operators to simplify network emulation tasks. We implement TurboNet on Tofino switches. Evaluation results show that: (1) On the data plane, TurboNet can flexibly emulate various topologies, such as an 8-ary fat-tree with only one programmable switch and a 10-ary fat-tree with four programmable switches; (2) On the control plane, TurboNet supports about 200 BGP agents on a single programmable switch with a CPU usage of 25%; (3) TurboNet can accurately emulate different network performance metrics such as 10⁻⁸ link loss, and microsecond to millisecond link delay.

   @article{cao2022turbonet,
     title = {TurboNet: Faithfully Emulating Networks with Programmable Switches},
     author = {Cao, Jiamin and Liu, Ying and Zhou, Yu and He, Lin and Xu, Mingwei},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2022},
     volume = {30},
     number = {3},
     pages = {1395-1409},
     doi = {10.1109/TNET.2022.3142126},
   }

9. TON

   PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet

   Lin He, Gang Ren, Ying Liu, and Jiahai Yang

   IEEE/ACM Transactions on Networking, Jul 2021

   Abs Bib HTML

   Accountability and privacy are considered valuable but conflicting properties in the Internet, which at present does not provide native support for either. Past efforts to balance accountability and privacy in the Internet have unsatisfactory deployability due to the introduction of new communication identifiers, and because of large-scale modifications to fully deployed infrastructures and protocols. The IPv6 is being deployed around the world and this trend will accelerate. In this paper, we propose a private and accountable proposal based on IPv6 called PAVI that seeks to bootstrap accountability and privacy to the IPv6 Internet without introducing new communication identifiers and large-scale modifications to the deployed base. A dedicated quantitative analysis shows that the proposed PAVI achieves satisfactory levels of accountability and privacy. The results of the evaluation of a PAVI prototype show that it incurs little performance overhead, and is widely deployable.

   @article{he2021pavi,
     title = {PAVI: Bootstrapping Accountability and Privacy to IPv6 Internet},
     author = {He, Lin and Ren, Gang and Liu, Ying and Yang, Jiahai},
     journal = {IEEE/ACM Transactions on Networking},
     year = {2021},
     volume = {29},
     number = {2},
     pages = {695-708},
     doi = {10.1109/TNET.2020.3047667},
   }

10. TPDS

    CoFilter: High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers

    Jiamin Cao, Ying Liu, Yu Zhou, Lin He, Chen Sun, Yangyang Wang, and Mingwei Xu

    IEEE Transactions on Parallel and Distributed Systems, Jul 2022

    Abs Bib HTML

    As one of the most critical cloud services, Bare-Metal Servers (BMS) introduce stringent performance requirements on data center networks (DCN). Stateful packet filter is an integral DCN component of ensuring connection security for BMS. However, the off-the-shelf stateful packet filters either are costly for cloud DCNs or introduce significant performance bottlenecks. In this article, we present CoFilter , which leverages low-cost programmable switches to accelerate the stateful packet filter for BMS. CoFilter uses (1) stateful process partition to enable complex stateful packet filtering logic on programmability-limited switching ASICs, (2) state compression to track tens of millions of connections with constrained hardware memory, and (3) per-tenant packet rate limit and tenant-aware flow migration to achieve efficient performance isolation among different tenants. Overall, CoFilter implements a high-performance stateful packet filter via the co-design of programmable switching ASIC and CPU. We evaluate CoFilter under various data center traffic traces with real-world flow distributions. The evaluation results show that CoFilter remarkably outperforms NetFilter, i.e., forwarding packets at line rate (13x throughput of NetFilter), keeping packet delay within 1us, and freeing a significant quantity of CPU cores, with rather small memory usage, i.e., accommodating over 107 connections with only 16MB SRAM.

    @article{cao2021cofilter,
      title = {CoFilter: High-Performance Switch-Accelerated Stateful Packet Filter for Bare-Metal Servers},
      author = {Cao, Jiamin and Liu, Ying and Zhou, Yu and He, Lin and Sun, Chen and Wang, Yangyang and Xu, Mingwei},
      journal = {IEEE Transactions on Parallel and Distributed Systems},
      year = {2022},
      volume = {33},
      number = {9},
      pages = {2249-2262},
      doi = {10.1109/TPDS.2021.3136575},
    }

11. IEEE Netw.

    SAV6: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

    Lin He, Gang Ren, Ying Liu, Guanglei Song, Jinlong E, Jiahai Yang, and Mingwei Xu

    IEEE Network, Jul 2023

    Abs Bib HTML

    IP spoofing is prevalently used for anonymity and reflection attacks, e.g., distributed denial of service (DDoS) attacks, which have shown increasingly destructive power in recent years because today’s Internet lacks validation on source addresses. Moreover, the fast deployment of IPv6 on the Internet may further aggravate the damages of DDoS attacks. This paper proposes a novel source address validation mechanism called SAV6, which leverages the huge IPv6 address space to validate source addresses at an inter-autonomous system (AS) granularity. In SAV6, each IPv6 address contains an AS number (ASN), whose corresponding AS announces the prefix of the address to other ASes. An AS can determine the authenticity of the source address by whether the ASN in the address matches the corresponding prefix after receiving an incoming packet. The performance evaluation of a SAV6 prototype shows that it adds little performance overhead to the deployed infrastructures and is a lightweight and deployable protocol.

    @article{he2023sav6,
      title = {SAV6: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet},
      author = {He, Lin and Ren, Gang and Liu, Ying and Song, Guanglei and E, Jinlong and Yang, Jiahai and Xu, Mingwei},
      journal = {IEEE Network},
      year = {2023},
      volume = {},
      number = {},
      pages = {},
      publisher = {IEEE},
      doi = {},
    }

12. IEEE Netw.

    Enabling Application-aware Traffic Engineering in IPv6 Networks

    Lin He, Shicheng Wang, Yichi Xu, Peng Kuang, Jiamin Cao, Ying Liu, Xing Li, and Shuping Peng

    IEEE Network, Jul 2022

    Abs Bib HTML

    The Internet hosts numerous applications with different requirements for network delay, bandwidth, jitter, packet loss, and so on. However, in the TCP/IP network architecture, the network and application layers are decoupled, which means that the network does not have a fine-grained understanding of the application requirements. Therefore, it is not easy to provide truly fine-grained traffic operations for applications and guarantee their corresponding service level agreement requirements. In this article, we propose ATE6, which is an application-aware traffic engineering (TE) framework. For the control plane, we define a request language that can be used by applications to express their requirements, which allows networks to associate IPv6 addresses with the communication requirements of applications. We also devise an efficient path selection algorithm that allows the network operator to deploy an optimal TE path for an application. For the data plane, ATE6 uses segment routing over the IPv6 data plane to enforce and control network paths based on network policies. We implemented a prototype, and evaluation results show that ATE6 is a flexible, privacy-preserving, lightweight, and cost-efficient application-aware TE framework.

    @article{he2022enabling,
      title = {Enabling Application-aware Traffic Engineering in IPv6 Networks},
      author = {He, Lin and Wang, Shicheng and Xu, Yichi and Kuang, Peng and Cao, Jiamin and Liu, Ying and Li, Xing and Peng, Shuping},
      journal = {IEEE Network},
      year = {2022},
      volume = {36},
      number = {2},
      pages = {42-49},
      publisher = {IEEE},
      doi = {10.1109/MNET.005.2100440},
    }

13. CN

    EvoIoT: An Evolutionary IoT and Non-IoT Classification Model in Open Environments

    Linna Fan, Lin He^#, Enhuan Dong, Jiahai Yang^#, Chenglong Li, Jinlei Lin, and Zhiliang Wang

    Computer Networks, Jul 2022

    Abs Bib HTML

    IoT device identification is essential for both device asset management and security management. IoT device identification in open environments is the key to its application in real environments, where IoT and non-IoT device identification is the first and critical step. However, existing methods are either not applicable to open environments or have poor scalability and sustainability for IoT and non-IoT device identification. This paper presents EvoIoT, an IoT and non-IoT identification model designed to apply in open environments with high scalability and the ability to run sustainably and effectively. EvoIoT achieves high scalability by applying a unified model for all devices. To mine discriminative features from encrypted traffic, EvoIoT extracts original features from packet headers and judges feature importance in the entire model update process. For sustainability, EvoIoT proposes a representative device choosing method and model update method to address the concept drift caused by new types of devices. EvoIoT is the first high-performance model that systematically addresses the IoT and non-IoT device classification problem. We evaluate EvoIoT on two public datasets and a private dataset collected from a laboratory setting. The evaluation results show that EvoIoT is on average 6.27% 48.89% more accurate than state-of-the-art methods.

    @article{fan2022evoiot,
      title = {EvoIoT: An Evolutionary IoT and Non-IoT Classification Model in Open Environments},
      author = {Fan, Linna and He, Lin and Dong, Enhuan and Yang, Jiahai and Li, Chenglong and Lin, Jinlei and Wang, Zhiliang},
      journal = {Computer Networks},
      year = {2022},
      volume = {219},
      pages = {109450},
      publisher = {Elsevier},
      doi = {10.1016/j.comnet.2022.109450},
    }

14. CN

    Towards Securing Duplicate Address Detection using P4

    Lin He, Peng Kuang, Ying Liu, Gang Ren, and Jiahai Yang

    Computer Networks, Jul 2021

    Abs Bib HTML

    Duplicate Address Detection (DAD) is one of the functions of the Neighbor Discovery Protocol (NDP), which determines whether the IPv6 address of a node conflicts with those of other nodes. However, due to the lack of verification of NDP messages, DAD is vulnerable to Denial of Service (DoS) attacks. Existing solutions suffer from high complexity and low security, need to modify the NDP, or have a single point of failure, which renders them infeasible to be deployed. To solve the above problems, we propose P4DAD, which is a secure DAD mechanism based on P4. By creating and maintaining a binding entry between an IPv6 address and a link-layer property of a host’s network attachment, P4DAD can filter spoofed NDP messages in an in-network manner to prevent DoS attacks on DAD without modification to the NDP or host stack. We implement a prototype of P4DAD and evaluate it in terms of functionality, performance, and scalability. Evaluation results show that P4DAD can prevent DoS attacks on DAD successfully with negligible overhead and has satisfactory scalability.

    @article{he2021towards,
      author = {He, Lin and Kuang, Peng and Liu, Ying and Ren, Gang and Yang, Jiahai},
      title = {Towards Securing Duplicate Address Detection using {P4}},
      journal = {Computer Networks},
      volume = {198},
      pages = {108323},
      year = {2021},
      url = {https://doi.org/10.1016/j.comnet.2021.108323},
      doi = {10.1016/j.comnet.2021.108323},
    }