network traffic analysis

This work addresses the limitations of traditional passive network measurement, which primarily focuses on inbound traffic and struggles to detect stealthy internal anomalies. The paper presents the first systematic approach that leverages erroneous outbound traffic—such as unanswered requests and ICMP error messages—as a lightweight yet highly informative data source. By conducting large-scale passive monitoring and correlation analysis, the method effectively identifies misconfigurations, deprecated services, and potentially compromised hosts within internal networks. Deployed in large-scale operational environments, this technique has uncovered a variety of previously undetected internal anomalies, substantially enhancing visibility into and detection capabilities for internal threats.

Detecting and reproducing boundary-case vulnerabilities—especially those arising from state machine logic flaws in network protocols—remains challenging for conventional fuzzing due to inadequate coverage and poor reproducibility. Method: This paper proposes the first closed-loop approach integrating formal protocol specification inference, lightweight symbolic execution, and controllable vulnerability trace generation. It leverages SMT-driven state modeling, automatic synthesis of protocol interaction constraints, and automated proof-of-concept (PoC) generation to achieve end-to-end automation from vulnerability discovery to precise reproduction. Contribution/Results: Evaluated on 12 mainstream protocol stacks, the method discovers 17 previously unknown vulnerabilities—including 6 assigned CVEs—with an average reproduction time under 8 seconds and a false positive rate below 3%. It significantly improves accuracy, interpretability, and reproducibility in deep protocol vulnerability detection.

Traditional traffic analysis has become ineffective due to the widespread adoption of encryption and privacy-enhancing technologies. Existing machine learning approaches often rely on protocol-specific features, require large amounts of labeled data, and exhibit poor generalization across domains. To address these limitations, this work proposes the first purely metadata-driven, protocol-agnostic framework for encrypted traffic analysis. By modeling network flows as multivariate time series and integrating meta-learning, embedding optimization, and self-attention mechanisms, the framework enables rapid cross-scenario adaptation under few-shot conditions. Evaluated across nine public datasets on tasks including application identification, VPN traffic classification, IoT device fingerprinting, and attack detection, the method consistently outperforms state-of-the-art approaches, demonstrating strong generality, robustness, and practical utility.

IP geolocation suffers from systematic inaccuracies in traceroute analysis due to network mechanisms such as MPLS encapsulation and multi-homed interfaces. To address this, we propose GeoTrace—the first lightweight, causality-driven geographic correction framework for traceroute paths. GeoTrace requires no additional probing; instead, it parses real-world traceroute measurements, cross-references multiple IP geolocation databases, detects anomalous geolocation patterns, and applies heuristic repositioning algorithms to automatically classify and rectify erroneous location annotations. Its key innovation lies in the first systematic identification and causal attribution of underlying network mechanisms responsible for traceroute-induced geolocation bias, enabling interpretable, causality-guided correction. Evaluated on real-world datasets, GeoTrace reduces geolocation error rates by 37%, significantly enhancing the reliability of network cartography, path analysis, and censorship detection.

This study addresses the forensic challenge posed by proprietary surveillance device file systems, which lack public documentation and hinder video data recovery after deletion. Focusing on Honeywell’s private file system, this work presents the first systematic analysis of three deletion mechanisms—formatting, data expiration, and overwriting—by integrating binary comparison, file system reverse engineering, metadata analysis, and data recovery techniques. The investigation reveals distinct residual characteristics of video data under each deletion method and demonstrates the practical feasibility of recovering deleted footage. Furthermore, the research establishes a reusable methodological framework for digital forensics on similar proprietary file systems, significantly enhancing both the efficiency and accuracy of forensic investigations.

This work addresses a critical privacy vulnerability in the Model Context Protocol (MCP), where design flaws can lead to unintended leakage of sensitive information—such as credentials, API keys, and personally identifiable information (PII)—without explicit outbound requests. To tackle this issue, we propose MCPPrivacyDetector, the first context-sensitive, cross-language static analysis framework specifically designed to detect implicit privacy leaks in MCP implementations. Our approach unifies multi-language program representations, employs semantic filtering to identify sensitive data, models MCP-specific implicit taint sinks, and performs context-sensitive taint analysis. Evaluation on 10,655 real-world MCP servers reveals that over 10% are susceptible to privacy leaks, with confirmed cases involving exposed Bearer tokens, API keys, and plaintext credentials.

This study demonstrates that low-privilege adversaries can exploit volunteer servers in the NTP Pool to harvest active IPv6 client addresses for subsequent scanning and reconnaissance, thereby compromising user privacy and network security. Through a year-long global active probing campaign—deploying unique IPv6 addresses and monitoring subsequent access patterns—the authors systematically uncover, for the first time, the abuse of NTP Pool infrastructure for IPv6 address reconnaissance. By integrating traffic correlation analysis with cross-temporal behavioral modeling, they identify 22 malicious servers belonging to four distinct clusters. These findings prompted the NTP Pool project to integrate detection mechanisms and decommission the implicated nodes, and further influenced a cybersecurity insurance provider to revise its policies by introducing an explicit opt-out mechanism.

This study addresses the lack of systematic evaluation of mainstream security logging standards in terms of their effectiveness for threat detection. The authors propose a scalable and reproducible assessment methodology based on an automated Security Exploit Telemetry Collection (SETC) framework, which reproduces 50 remote code execution vulnerabilities in containerized environments. Using this approach, they comparatively evaluate the telemetry completeness and attack detectability of widely adopted standards—including Common Information Model (CIM), Open Cybersecurity Schema Framework (OCSF), and Elastic Common Schema (ECS). The experiments quantitatively measure each standard’s detection efficacy, revealing significant disparities in coverage of critical attack indicators and identifying notable gaps. These findings provide empirical guidance for security practitioners in selecting appropriate logging standards to enhance threat detection capabilities.

This study addresses critical security deficiencies in widely adopted healthcare protocols—HL7, FHIR, and DICOM—which commonly lack authentication, employ insufficient transport encryption, and harbor known high-severity vulnerabilities, thereby exposing vast amounts of patient data to breach risks. Conducting the first large-scale security assessment of HL7 and FHIR alongside an extended analysis of DICOM, the research deployed low-interaction honeypots over nine months and performed Internet-wide scans across both IPv4 and IPv6 address spaces. By integrating TLS configuration audits, CVE matching, and coordinated vulnerability disclosure, the investigation systematically identified protocol-level security flaws. Findings reveal tens of thousands of medical endpoints without authentication, over half lacking encrypted transport, and thousands of systems affected by vulnerabilities with CVSS scores as high as 9.8, prompting remediation efforts by relevant stakeholders.

This work addresses the security risks posed by bidirectional data flows in the Model Context Protocol (MCP), which connects large language models to external tools—a threat poorly handled by existing analysis tools. The paper introduces MCP-BiFlow, the first framework to systematically model bidirectional vulnerabilities in MCP. It enables static detection of unsafe data flows on both request and response sides through protocol-aware entry-point recovery, customized taint propagation rules, and path-sensitive interprocedural analysis. Evaluated on 32 known vulnerabilities, MCP-BiFlow achieves a recall rate of 93.8% (30 out of 32), substantially outperforming mainstream tools such as CodeQL. Furthermore, it uncovers 118 confirmed vulnerable paths across 15,452 real-world repositories, demonstrating the widespread prevalence of such risks.