MadeYouReset is a new HTTP2 vulnerability that exploits a common design flaw in HTTP2 implementation, enabling attackers to launch massive DoS attacks. The flaw has been assigned multiple CVEs, and corresponding patches have been released by many vendors.

MadeYouReset is comparable in power and core problem to the notorious Rapid Reset zero-day vulnerability which was exploited in 2023 and ultimately crashed large-scale services.  DoS attacks are among the most serious threats to the Internet, overwhelming systems until legitimate users are denied access and causing significant disruption and losses.

HTTP2 powers much of today’s web, with over 60% of top sites using it and carrying about a third of global HTTP traffic. Its central role makes HTTP2 servers prime targets for DoS attacks.

Operationally, MadeYouReset bypasses the typical server-imposed limit of 100 concurrent HTTP2 requests per TCP connection from a client. This limit is intended to mitigate DoS attacks by restricting the number of simultaneous requests a client can send. With MadeYouReset, an attacker can send many thousands of requests, creating a denial-of-service condition for legitimate users and, in some vendor implementations, escalating into out-of-memory crashes.

This work highlights the importance of collaboration between the cybersecurity academic and industry communities. The discovery is part of research conducted at Tel-Aviv University. We thank CERT/CC for managing the disclosure process and the vendors for helpful feedback. This research is partly supported by Imperva.

Amplification Reflection Distributed Denial-of-Service (AR-DDoS) attacks remain a formidable threat, exploiting stateless protocols to flood victims with illegitimate traffic.
Recent advances have enabled data-plane defenses against such attacks, but existing solutions typically assume symmetric routing and are limited to a single switch. These assumptions fail in modern networks where asymmetry is common, resulting in
dropped legitimate responses and persistent connectivity issues.
This paper presents ReAct, an in-network defense for AR-DDoS that is robust to asymmetry. ReAct performs request-response correlation across switches using programmable data planes and a sliding-window of Bloom filters. To handle asymmetric
traffic, ReAct introduces a data-plane-based request forwarding mechanism, enabling switches to validate responses even when paths differ. ReAct can automatically adapt to routing changes with minimal intervention, ensuring continued protection even
in dynamic network environments. We implemented ReAct on both a P4 interpreter and NVIDIA’s BlueField-3, demonstrating its applicability across multiple platforms. Evaluation results show that ReAct filters nearly all attack traffic without dropping
legitimate responses-even under high-volume attacks and asymmetry. Compared to state-of-the-art approaches, ReAct achieves significantly lower false positives. To our knowledge, ReAct is the first data-plane AR-DDoS defense that supports dynamic, crossswitch collaboration, making it uniquely suitable for deployment
in networks with asymmetry.

Service Mesh has become essential for modern
cloud-native applications by abstracting communication between microservices and providing zero-trust security, observability, and advanced traffic control without requiring code changes. This allows developers to leverage new network capabilities and focus on application logic without managing network complexities.

However, the additional layer can significantly impact system performance, latency, and resource consumption, posing challenges for cloud managers and operators.
In this work, we investigate the impact of the mTLS pro-
tocol—a common security and authentication mechanism—on application performance within service meshes. Recognizing that security is a primary motivation for deploying a service mesh, we evaluated the performance overhead introduced by leading service meshes: Istio, Istio Ambient, Linkerd, and Cilium. Our experiments were conducted by testing their performance in service-to-service communications within a Kubernetes cluster.

Our experiments reveal significant performance differences (in terms of latency and resource consumption) among the service meshes, rooting from the different architecture of the service mesh, sidecar versus sidecareless, and default extra features hidden in the mTLS implementation. Our results highlight the understanding of the service mesh architecture and its impact on performance.

ZEAL (Zero-shot Engine for IoT Asset Labeling) is an open-source system that labels never-seen IoT devices by finding their vendor (e.g., Xiaomi, TP-Link) and function (e.g., Light, Plug) based on textual features extracted from the device network traffic, such as domains and hostnames. The system gets as an input features and enriches them using online searches.

Then, it applies a string-matching algorithm to label its vendor and large language model (LLM) to label its function. The system is implemented as a serverless architecture on AWS, ZEAL utilizes services such as Lambda, Elastic File System (EFS), and S3, ensuring scalability but economic implementation. This demonstration showcases ZEAL’s ability to enhance network visibility and asset management by accurately labeling devices with minimal prior knowledge. The system is open-source publicly accessible via API and GUI for research and business applications (https://labelmydevice.com), licensed under the Apache License 2.0.

With the goal of improving the security of Internet protocols, we seek faster, semi-automatic methods to discover new vulnerabilities in protocols such as DNS, BGP, and others. To this end, we introduce the LLM-Assisted Protocol Attack Discovery (LAPRAD) methodology, enabling security researchers with some DNS knowledge to efficiently uncover vulnerabilities that would otherwise be hard to detect.

LAPRAD follows a three-stage process.
In the first, we consult an LLM (GPT‑o1) that has been trained on a broad corpus of DNS-related sources and previous DDoS attacks to identify potential exploits.
In the second stage, a different LLM automatically constructs the corresponding attack configurations using the ReACT approach implemented via LangChain (DNS zone file generation).
Finally, in the third stage, we validate the attack’s functionality and effectiveness.

Using LAPRAD, we uncovered three new DDoS attacks on the DNS protocol and rediscovered two recently reported ones that were not included in the LLM’s training data. The first new attack employs a bait-and-switch technique to trick resolvers into caching large, bogus DNSSEC RRSIGs, reducing their serving capacity to as little as 6%. The second exploits large DNSSEC encryption algorithms (RSA‑4096) with multiple keys, thereby bypassing a recently implemented default RRSet limit. The third leverages ANY-type responses to produce a similar effect.
These variations of a cache-flushing DDoS attack, called SigCacheFlush, circumvent existing patches, severely degrade resolver query capacity, and impact the latest versions of major DNS resolver implementations.

We present a novel yet simple and comprehensive DNS
cache POisoning Prevention System (POPS), designed
to integrate as a module in Intrusion Prevention Systems
(IPS). POPS addresses statistical DNS poisoning attacks—
documented from 2002 to the present—and offers
robust protection against similar future threats. It comprises
a detection module, which employs three simple rules, and
a mitigation module that leverages the TC flag in the DNS
header to enhance security. Once activated, the mitigation
module has zero false positives or negatives, correcting any
such errors on the side of the detection module. Thus, the
detection module is allowed to err on the false positive side
while minimizing false negatives.
We first analyze POPS against historical DNS services
and attacks, showing that it would have mitigated all network-based statistical poisoning attacks. We then simulate POPS on traffic benchmarks (PCAPs) incorporating current potential network-based statistical poisoning attacks, and benign PCAPs; the simulated attacks still succeed with a probability of 0.0076%. This occurs because five malicious packets go through before POPS detects the attack and activates the mitigation module. In addition, POPS completes its task using only 20%–50% of the time required by other tools (e.g., Suricata or Snort), and after examining just 5%–10% as many packets. It successfully detects DNS cache poisoning attacks—including fragmentation-based variants—that Suricata and Snort consistently miss, highlighting POPS’s superiority.

In this paper, we present DNS FLaRE, a DNS cache-based timing side-channel attack that allows an attacker to accurately infer the times at which a user visits specific websites.
We demonstrate the attack on DNS forwarders, a widely used  component of the DNS infrastructure that acts as an  intermediary cache between DNS clients and recursive resolvers.
The threat model assumes only that the victim is tricked into visiting a malicious website. We show that the attack can accurately infer the times at which a user visits specific websites by exploiting discrepancies in the DNS resolution times of a domain, depending on whether it is in the forwarder cache or not. Furthermore, when targeting IoT devices, the attack can infer when certain events were taking place at an IoT device.
This is enabled by observing IoT related DNS resolution  discrepancies by a browser in the same household. The attack facilitates sophisticated phishing attacks, IoT device detection and profiling and other potential privacy implications.

With 95% of Internet traffic now encrypted, an
effective approach to classifying this traffic is crucial for network security and management. This paper introduces ECHO—a novel optimization process for ML/DL-based encrypted traffic classification that can significantly improve many suggested classification schemes. ECHO targets both classification time and memory utilization and incorporates two innovative techniques.
The first component, HO (Hyperparameter Optimization of
binnings), aims at creating efficient traffic representations. While previous research often uses representations that map packet sizes and packet arrival times to fixed-sized bins, we show that non-uniform binnings are significantly more efficient. These non-uniform binnings are derived by employing a hyperparameter optimization algorithm in the training stage. HO significantly improves accuracy given a required representation size, or,
equivalently, achieves comparable accuracy using smaller representations.
Then, we explore EC (Early Classification of traffic), which
enables faster classification using a cascade of classifiers adapted for different exit times, where classification is based on the level of confidence. EC reduces the average classification latency by up to 90%. Remarkably, this method not only maintains classification accuracy but also, in certain cases, improves it.
Using three publicly available datasets, we demonstrate that
the combined method, Early Classification with Hyperparameter Optimization (ECHO), leads to a significant improvement in classification efficiency.
Index Terms—traffic classification, encrypted traffic, machine
learning, Bayesian optimization.

First this paper measures and analyzes various trade-offs be-
tween different DNSSEC configurations, such as, NSEC, NSEC3, aggressive caching, and online vs. offline signing. These measurements expose a trade-off between (1) aggressive cashing DNSSEC configuration that provides excellent performance (higher robustness to DDoS attacks) but is vulnerable to zone enumeration attacks in addition to offline signing disadvantages, and (2) online signing DNSSEC configuration, that prevents. Second, following these, we suggest and evaluate an alternative, Adaptive DNS over QUIC, (AdaDoQ), an adaptive, efficient and secure communication layer between a DNS resolver and the authoritative servers, that offers a better trade-off between DDoS resiliency and security. Under normal load conditions the resolver commu
nicates with each authoritative server with standard DNSSEC however,
when the traffic load increases, AdaDoQ switches to a QUIC connection
with heavily communicating authoritative server(s), for as long as the
traffic load is high. The public key of the authoritative ZSK (which is
verifiable through the DNSSEC chain of trust) is integrated into the symmetric key creation in QUIC to provide a DNSSEC level of authenticity
and security. AdaDoQ ensures DNS authenticity, good throughput, and
disables zone walking attacks, DNS hijacking, and cache poisoning.

Today’s software development landscape has witnessed a shift towards microservices based architectures. Using this approach, large software systems are implemented by combining loosely-coupled services, each responsible for specific task and defined with separate scaling properties.
Auto-scaling is a primary capability of cloud computing which allows systems to adapt to fluctuating traffic loads by dynamically increasing (scale-up) and decreasing (scale-down) the number of resources used.

We observe that when microservices which utilize separate auto-scaling mechanisms operate in tandem to process traffic, they may perform ineffectively, especially under overload conditions, due to DDoS attacks. This can result in throttling (Denial of service — DoS) and over-provisioning of resources (Economic Denial of Sustainability — EDoS).

This paper demonstrates how an attacker can exploit the tandem behavior of microservices with different auto-scaling mechanisms to create an attack we denote as the \emph{Tandem Attack}. We demonstrate the attack on a typical \emph{Serverless} architecture and analyze its economical and performance damages. One intriguing finding is that some attacks may make a cloud customer paying for service denied requests.

We conclude that independent scaling of loosely coupled components might form an inherent difficulty and end-to-end controls might be needed.

The proliferation of software vulnerabilities poses a significant challenge for security databases and analysts tasked with their timely identification, classification, and remediation. With the National Vulnerability Database (NVD) reporting an ever-increasing number of vulnerabilities, the traditional manual analysis becomes untenably time-consuming and prone to errors. This paper introduces \VulnScopper, an innovative approach that utilizes multi-modal representation learning, combining Knowledge Graphs (KG) and Natural Language Processing (NLP), to automate and enhance the analysis of software vulnerabilities. Leveraging ULTRA, a knowledge graph foundation model, combined with a Large Language Model (LLM),  VulnScopper effectively handles unseen entities, overcoming the limitations of previous KG approaches.

We evaluate VulnScopper on two major security datasets, the NVD and the Red Hat CVE database. Our method significantly improves the link prediction accuracy between Common Vulnerabilities and Exposures (CVEs), Common Weakness Enumeration (CWEs), and Common Platform Enumerations (CPEs). Our results show that VulnScopper outperforms existing methods, achieving up to 78% Hits@10 accuracy in linking CVEs to CPEs and CWEs and presenting an 11.7% improvement over large language models in predicting CWE labels based on the Red Hat database.
Based on the NVD, only 6.37% of the linked CPEs are being published during the first 30 days; many of them are related to critical and high-risk vulnerabilities which, according to multiple compliance frameworks (such as CISA and PCI), should be remediated within 15-30 days. We provide an analysis of several CVEs published during 2023, showcasing the ability of our model to uncover new products previously unlinked to vulnerabilities. As such, our approach dramatically reduces the vulnerability remediation time and improves the vulnerability management process.

The IoT market is diverse and characterized by a multitude of vendors that support different device functions (e.g., speaker, camera, vacuum cleaner, etc.). Within this market, IoT security
and observability systems use real-time identification techniques to manage these devices effectively. Most existing IoT identification solutions employ machine learning techniques
that assume the IoT device, labeled by both its vendor and function, was observed during their training phase. We tackle a key challenge in IoT labeling: how can an AI solution
label an IoT device that has never been seen before and whose label is unknown?

Our solution extracts textual features such as domain names and hostnames from network traffic, and then enriches these features using Google search data alongside catalog of vendors
and device functions. The solution also integrates an auto-update mechanism that uses Large Language Models (LLMs) to update these catalogs with emerging device types.
Based on the information gathered, the device’s vendor is identified through string matching with the enriched features.
The function is then deduced by LLMs and zero-shot classification from a predefined catalog of IoT functions. In an evaluation of our solution on 97 unique IoT devices,
our function labeling approach achieved HIT1 and HIT2 scores of 0.7 and 0.77, respectively. As far as we know, this is the first research to tackle AI-automated IoT labeling.

With 95% of Internet traffic now encrypted, an effective approach to classifying this traffic is crucial for network security and management. This paper introduces ECHO — a novel optimization process for ML/DL-based encrypted traffic classification. ECHO targets both classification time and memory utilization and incorporates two innovative techniques.
The first component, HO (Hyperparameter Optimization of binnings), aims at creating efficient traffic representations. While previous research often uses representations that map packet sizes and packet arrival times to fixed-sized bins, we show that non-uniform binnings are significantly more efficient. These non-uniform binnings are derived by employing a hyperparameter optimization algorithm in the training stage. HO significantly improves accuracy given a required representation size, or, equivalently, achieves comparable accuracy using smaller representations.
Then, we introduce EC (Early Classification of traffic), which enables faster classification using a cascade of classifiers adapted for different exit times, where classification is based on the level of confidence. EC reduces the average classification latency by up to 90\%. Remarkably, this method not only maintains classification accuracy but also, in certain cases, improves it.
Using three publicly available datasets, we demonstrate that the combined method, Early Classification with Hyperparameter Optimization (ECHO), leads to a significant improvement in classification efficiency.