Distributed Denial of Service (DDoS) attacks continue to escalate in both frequency and sophistication, often overwhelming critical network infrastructures. While deep learning methods excel at recognizing malicious patterns, their lack of transparency undermines trust and hampers effective mitigation. This paper introduces a unified, on-premise pipeline that integrates an advanced flow based attack classifier with a local large language model (LLM) to deliver explainable, real-time DDoS defense. The proposed approach detects threats at the flow level, rapidly fags suspicious traffic, and then generates human-readable analyses and device specific countermeasures ranging from firewall rules to intrusion prevention system signatures all without transmitting data of-site. Through comprehensive testing on diverse, large scale network traces, we demonstrate that this framework not only achieves near-perfect detection accuracy but also considerably reduces operational costs and privacy risks associated with external cloud services. Furthermore, evaluators confirm the clarity and correctness of the automatically generated mitigation strategies, highlighting the system’s practicality in enterprise environments. Overall, our results validate on-premise, LLM-enhanced DDoS defense as a robust, transparent, and economical solution for safeguarding modern network ecosystems.

Distributed Denial of Service (DDoS) attacks pose an increasingly substantial cybersecurity threat to organizations across the globe. In this paper, we introduce a new deep learning-based technique for detecting DDoS attacks, a paramount cyber-security challenge with evolving complexity and scale. Specifically, we propose a new dual-space prototypical network that leverages a unique dual-space loss function to enhance detection accuracy for various attack patterns through geometric and angular similarity measures. This approach capitalizes on the strengths of representation learning within the latent space (a lower-dimensional representation of data that captures complex patterns for machine learning analysis), improving the model’s adaptability and sensitivity towards varying DDoS attack vectors. Our comprehensive evaluation spans multiple training environments, including offline training, simulated online training, and prototypical network scenarios, to validate the model’s robustness under diverse data abundance and scarcity conditions. The Multilayer Perceptron (MLP) with Attention, trained with our dual-space prototypical design over a reduced training set, achieves an average accuracy of 94.85% and an F1-Score of 94.71% across our tests, showcasing its effectiveness in dynamic and constrained real-world scenarios.

Researchers have proposed a wide range of ransomware detection and analysis schemes. However, most of these efforts have focused on older families targeting Windows 7/8 systems. Hence there is a critical need to develop efficient solutions to tackle the latest threats, many of which may have relatively fewer samples to analyze. This paper presents a machine learning (ML) framework for early ransomware detection and attribution. The solution pursues a data-centric approach which uses a minimalist ransomware dataset and implements static analysis using portable executable (PE) files. Results for several ML classifiers confirm strong performance in terms of accuracy and zero-day threat detection.

Fog computing complements cloud paradigms to provide fast service provisioning by processing user demands at the edge of the network. This offers local services without the need to offload or relay demands back to the cloud core, thus saving time and energy. However, the distribution of fog nodes comes at the detriment of limited resource capacity. Therefore, fog nodes are vulnerable to saturation under high traffic volumes. Hence, fog paradigms can act as a bottleneck to incoming requests and degrade network capacity and quality-of-experience (QoE). Along this, resource management is vital for fog nodes to maintain efficient node utilization and high admission rates. Hence, this paper proposes a load migration scheme that redistributes load assignment between fog nodes, i.e., from highly-to lightly-loaded nodes. The scheme leverages Luus-Jaakola meta-heuristic to allocate the optimal recipient node that accepts the excess load, while maintaining minimal migration delays at high success rates.

Network function virtualization (NFV) technologies are being rapidly adopted across many enterprise and service provider networks to help replace costly, proprietary hardware systems. This paradigm runs virtual “softwarized” networking functions on low-cost off-the-shelf servers and can be used to construct highly-customized service function chains (SFC) for clients. NFV also offers many advantages at the network edge, and hence newer studies have started to look at SFC deployment in specialized fog computing domains, i.e., to support clients with stringent delay and localized contextual service needs. As these trends accelerate, there is a growing need to further address service survivability in these settings, particularly for clients with stringent/rapid failure recovery requirements. Hence this paper presents novel “on-demand” heuristic solutions and batch sorting methodologies for SFC service mapping and protection in fog domains. These schemes take into account key end-user client and operator concerns, including service delay, bandwidth, and node/link resource parameters.

To support latency-sensitive applications (e.g., emergency response) in Software-Defined Networking (SDN) environments, reliable Quality of Service (QoS) mechanisms are needed to ensure the minimization of end-to-end (E2E) latency and control response time. In this research, we design a double-queue system with feedback, named QoSP, to improve data-control communication performance and impose efficient queueing control in SDN. We further study a priority-based queueing scheme to achieve differentiated QoS provisioning via maintaining multiple OpenFlow queues with different priorities at the switch ports of a data plane. The prototype of QoSP is implemented and evaluated on the NSF-sponsored GENI testbed.

Recent advances in distributed data processing and machine learning provide new opportunities to enable critical, time-sensitive functionalities of smart distribution grids in a secure and reliable fashion. Combining the recent advents of edge computing (EC) and edge intelligence (EI) with existing advanced metering infrastructure (AMI) has the potential to reduce overall communication cost, preserve user privacy, and provide improved situational awareness. In this paper, we provide an overview for how EC and EI can supplement applications relevant to AMI systems. Additionally, using such systems in tandem can enable distributed deep learning frameworks (e.g., federated learning) to empower distributed data processing and intelligent decision making for AMI. Finally, to demonstrate the efficacy of this considered architecture, we approach the non-intrusive load monitoring (NILM) problem using federated learning to train a deep recurrent neural network architecture in a 2-tier and 3-tier manner. In this approach, smart homes locally train a neural network using their metering data and only share the learned model parameters with AMI components for aggregation. Our results show this can reduce communication cost associated with distributed learning, as well as provide an immediate layer of privacy, due to no raw data being communicated to AMI components. Further, we show that FL is able to closely match the model loss provided by standard centralized deep learning where raw data is communicated for centralized training.

Software-defined networking (SDN) is an emerging networking technology and allows for a separation of data and control planes traffic in order to enhance the Quality of Service (QoS) for traffic and services delivery. Latency metric is regarded as a critical parameter by service providers and end users alike, where inter-link delays can be measured using end-to-end (E2E) probing packets. Moreover, to support latency-sensitive applications in SDN such as emergency response, we need a comprehensive QoS mechanism to ensure the minimization of E2E latency, the efficacious calculation of forwarding paths, and the minimization of control response time. We first distinguish between a flow’s admission latency and a flow’s packet forwarding latency. The former is decided by its controller’s response time, and the latter by its data plane queue delay. We then design a two-queue system with feedback, named QoSP, that aims to control overall latency performance in SDN through improving data-control communication performance and imposing efficient queueing control. We specifically introduce a priority-based queueing discipline in the data plane to achieve differentiated QoS provisioning via maintaining multiple OpenFlow queues with different priorities at each switch port. We implement the proposed QoSP using a Floodlight SDN controller and conduct emulation studies on the Global Environment for Networking Innovations. Our evaluation shows that QoSP can optimize the E2E delay and significantly reduce the control response time for priority traffic.

This paper presents a flow-based entropy characterization of a small/medium-sized campus network that uses network address translation (NAT). Although most networks follow this configuration, their entropy characterization has not been previously studied. Measurements from a production network show that the entropies of flow elements (external IP address, external port, campus IP address, campus port) and tuples have particular characteristics. Findings include: i) entropies may widely vary in the course of a day. For example, in a typical weekday, the entropies of the campus and external ports may vary from below 0.2 to above 0.8 (in a normalized entropy scale 0-1). A similar observation applies to the entropy of the campus IP address; ii) building a granular entropy characterization of the individual flow elements can help detect anomalies. Data shows that certain attacks produce entropies that deviate from the expected patterns; iii) the entropy of the 3-tuple {external IP, campus IP, campus port} is high and consistent over time, resembling the entropy of a uniform distribution's variable. A deviation from this pattern is an encouraging anomaly indicator; iv) strong negative and positive correlations exist between some entropy time-series of flow elements.

The centralized control capability of Software Defined Networking (SDN) presents a unique opportunity for enabling Quality of Service (QoS) routing. For delay sensitive traffic flows, a QoS mechanism requires efficiently computing path latency and minimizing controller's response time. At the core of the challenges is how to handle short term network state fluctuations in terms of congestion and latency while guaranteeing the end-to-end latency performance of networking services. In this paper, we present LatencySmasher, a systematic framework that considers active link latency measurements, efficient statistic estimate of network states, and fast adaptive path computation. We first implement LatencySmasher as an SDN controller application and then conduct extensive experimental studies on the Global Environment for Network Innovations (GENI), a real-world distributed network testbed. Our performance evaluation shows that the proposed framework can find optimal end-to-end paths with minimum latency and significantly reduce the control overhead.

This paper presents an initial study on using diversity coding schemes for virtual network function (VNF) link and node failure recovery in 5G and beyond networks. In contrast to conventional link recovery methods, the proposed scheme offers near-instantaneous recovery times without retransmission requirements. Furthermore, the recovery scheme provides significant reduction in routing and capacity costs, at reduced number of redundant links and high number of traffic requests. Hence reliable recovery, node resiliency, reduced delays and ultra-low latency are achieved here. In addition, a mixed liner integer programming (MILP) optimization formulation model is also proposed for the VNF failure restoration.

The Internet of Things [IoT] promises to revolutionize the way we interact with our surroundings. Smart cars, smart cities, smart homes are now being realized with the help of various embedded devices that operate with little to no human interaction. However these embedded devices bring forth a plethora of security challenges as most manufacturers still assign higher importance to the three Ps (prototyping, production and performance) than security. This inherent flaw has manifested itself in the form of various Denial of Service (DoS) attacks orchestrated with the help of unsolicited IoT devices on the Internet. We are even seeing massive throughputs without the need for amplifications affecting large scale infrastructures on the Internet. Thus, understanding the nature of these attacks and quickly identifying infected devices becomes imperative to combat this situation. In this paper we present a model to classify unsolicited IoT devices in enterprises using machine learning (ML). Namely IP header information from darknet data is collected for analysis. We then consider multiple supervised ML algorithms to classify these Layer 3 headers. We evaluate these algorithms and compare their performances in terms of accurately identifying activities of malicious IoT devices on the Internet. Our results show that Random Forest and Gradient Boosting have high recall and precision scores whereas NaiveBayes has the worst performance. We believe our model can be used by enterprises as a part of their intrusion detection system to quickly identify infected IoT devices within their own environment as well as identify scanning activities directed towards them.

Technological advances and innovative business models led to the modernization of the cyber-physical concept with the realization of the Internet of Things (IoT). While IoT envisions a plethora of high impact benefits in both, the consumer as well as the control automation markets, unfortunately, security concerns continue to be an afterthought. Several technical challenges impede addressing such security requirements, including, lack of empirical data related to various IoT devices in addition to the shortage of actionable attack signatures. In this paper, we present what we believe is a first attempt ever to comprehend the severity of IoT maliciousness by empirically characterizing the magnitude of Internet-scale IoT exploitations. We draw upon unique and extensive darknet (passive) data and develop an algorithm to infer unsolicited IoT devices which have been compromised and are attempting to exploit other Internet hosts. We further perform correlations by leveraging active Internet-wide scanning to identify and report on such IoT devices and their hosting environments. The generated results indicate a staggering 11 thousand exploited IoT devices that are currently in the wild. Moreover, the outcome pinpoints that IoT devices embedded deep in operational Cyber-Physical Systems (CPS) such as manufacturing plants and power utilities are the most compromised. We concur that such results highlight the wide-spread insecurities of the IoT paradigm, while the actionable generated inferences are postulated to be leveraged for prompt mitigation as well as to facilitate IoT forensic investigations using real empirical data.

Millimeter wave channels suffer from large path losses, penetration losses and atmospheric attenuation. Although beamforming techniques can significantly enhance link margins here, they also introduce initial beam access problems at the base and mobile stations prior to data transmission. Hence this paper presents an effective access scheme inspired by the Hooke Jeeves direct pattern search for analog beamforming cascaded codebooks. Simulation results show that the proposed algorithm delivers substantial performance improvements versus existing solutions in terms of computational complexity, access times and power and energy consumption.

The use of beamforming techniques in millimeter wave systems is crucial for overcoming poor scattering channel impairments. This directional transmission and reception method compels the base station and mobile station to conduct exhaustive spatial beam search, i.e., to determine directions with optimum gains. Consequently, this technique results in high computational complexity, prolonged discovery times and energy inefficiency. Hence this paper proposes a novel initial beam discovery algorithm for sparse millimeter wave channels in non-line of sight outdoor environments. The discovery problem is formulated as an optimization problem, and a modified form of coordinated generalized pattern search is presented to mitigate the aforementioned limitations. Results show that the proposed algorithm delivers significant performance enhancement compared to existing solutions.

Various large-scale failures and attacks (e.g., natural disasters, high-altitude electromagnetic pulses (HEMPs), weapons of mass destruction (WMDs), etc.) can instigate initial failures of critical network components (e.g., router, generator) in a cyber-physical infrastructure. In addition, the intra-dependency among various components inside a communication network and the inter-dependency with supporting power supply nodes can contribute to the propagation of the initial failures. Under the probabilistic initial failures of the networks' physical infrastructures, in this paper, we develop a stochastic model to track the functionality dynamics in a communication network considering dependency among communication nodes as well as with power nodes. A closed-form analytical formula is derived to find the steady state probabilities of all communication nodes in the communication network which are influenced by power node functionalities. Using this model, we show that both intra-dependencies among communication nodes and interdependencies with power nodes play a key role to the failure dynamics of communication network, which is also validated by numerical simulation on a real network topology.

Cloud computing is being widely accepted and utilized in the business world. From the perspective of businesses utilizing the cloud, it is critical to meet their customers' requirements by achieving service-level-objectives. Hence, the ability to accurately characterize and optimize cloud-service performance is of great importance. In this paper a stochastic multi-tenant framework is proposed to model the service of customer requests in a cloud infrastructure composed of heterogeneous virtual machines. Two cloud-service performance metrics are mathematically characterized, namely the percentile and the mean of the stochastic response time of a customer request, in closed form. Based upon the proposed multi-tenant framework, a workload allocation algorithm, termed maxmin-cloud algorithm, is then devised to optimize the performance of the cloud service. A rigorous optimality proof of the max-min-cloud algorithm is also given. Furthermore, the resource-provisioning problem in the cloud is also studied in light of the max-min-cloud algorithm. In particular, an efficient resource-provisioning strategy is proposed for serving dynamically arriving customer requests. These findings can be used by businesses to build a better understanding of how much virtual resource in the cloud they may need to meet customers' expectations subject to cost constraints.

State-of-the-art cloud simulators in use today are limited in the number of features they provide, lack real network communication models, and do not provide extensive Graphical User Interface (GUI) to support developers and researchers to extend the behavior of the cloud environment. We propose CloudNetSim++, a comprehensive packet level simulator that enables simulation of cloud environments. CloudNetSim++ can be used to evaluate a wide spectrum of cloud components, such as processing elements, storage, networking, Service Level Agreement (SLA), scheduling algorithms, fine grained energy consumption, and VM consolidation algorithms. CloudNetSim++ offers extendibility, which means that the developers and researchers can easily incorporate own algorithms for scheduling, workload consolidation, VM migration, and SLA agreement. The simulation environment of CloudNetSim++ offers a rich GUI that provides a high level view of distributed data centers connected with various network topologies. The package also includes an energy computation module that provides a fine grained analysis of energy consumed by each component. This paper shows the flexibility and effectiveness of CloudNetSim++ through experimental results demonstrated using real-world data center workloads. Moreover, to demonstrate the correctness of CloudNetSim++, we performed formal modeling, analysis, and verification using High-level Petri Nets, Satisfiability Modulo Theories (SMT), and Z3 solver.

Network virtualization is a key provision for improving the scalability and reliability of cloud computing services. In recent years, various mapping schemes have been developed to reserve VN resources over substrate networks. However, many cloud providers are very concerned about improving service reliability under catastrophic disaster conditions yielding multiple system failures. To address this challenge, this work presents a novel failure region-disjoint VN mapping scheme to improve VN mapping survivability. The problem is first formulated as a mixed integer linear programming problem and then two heuristic solutions are proposed to compute a pair of failure region-disjoint VN mappings. The solution also takes into account mapping costs and load balancing concerns to help improve resource efficiencies. The schemes are then analyzed in detail for a variety of networks and their overall performances compared to some existing survivable VN mapping schemes.

Resource management (RM) is a critical action in systems with limited resources such as sensor networks. Efficient RM depends heavily upon the availability of accurate information on the state of available resources. However, exchange of state information incurs an overhead on the system. In this paper, the sensing and computing resource management in sensor networks is considered. A lossless, distributed source-coding framework is presented to model the exchange of state information. The framework enables the characterization of the interplay between the performance and overhead of RM by leveraging the correlation among the state information of various nodes. Moreover, the proposed framework enables an improved estimate of the lower bound for the minimum control overhead necessary to accurately describe the state of nodes in the network. This improvement is achieved by exploiting the correlation among the state information of nodes as well as the available information on prior resource allocation actions as side information.

We present a routing scheme for MPLS networks with probabilistic failures. Our routing scheme simultaneously maximizes the expected satisfied demand and minimizes the maximum link utilization of the network. Our approach is novel in that it is the first to jointly address the traffic engineering and the routing through reliable paths problems. In addition to the optimal routing algorithm, we present a lower complexity heuristic algorithm based on Linear Programming and Yen's algorithm. Finally, numerical results are presented to demonstrate the effectiveness of both our optimal and heuristic algorithms.

Multi-failure network survivability is a key concern for operators owing to the recent spate of natural and man-made disasters. Hence this paper presents a new diverse lightpath protection scheme for random correlated failure recovery in multi-domain optical networks. The solution leverages topology abstraction and hierarchical inter-domain routing and assumes a-priori link failure probability state. The path computation process also takes into account both traffic engineering and risk minimization objectives. The proposed scheme is analyzed using network simulation for a variety of multi-failure scenarios.

Power control is an important resource management concern in wireless cognitive radio networks. In particular, the transmit powers of base stations and handsets must be carefully adjusted to help reduce interference between users and also improve cell capacity. Indeed, large gains can be achieved by taking into account primary user's behaviors and allowing secondary users to utilize the unused spectrum of idling primary users. Along these lines, this study presents a novel game-theoretic solution in which primary users are rewarded for sharing their spectrum with secondary users to help achieve energy-efficient transmission. Overall, this effort extends upon our earlier work on fast-flat fading channels by further analyzing Rician slow-flat- fading channels. In particular, the presentation derives a closed-form expression for the average utility function and also shows the existence and uniqueness of the Nash equilibrium. Detailed simulation results are then presented to verify performance of the game-theoretic formulation under realistic slow-flat fading channels, and the findings compared against those with the simpler additive white Gaussian noise channel model.

The physical infrastructure of communication networks is vulnerable to spatially correlated failures arising from various physical stresses such as natural disasters (earthquakes and hurricanes) as well as malicious coordinated attacks using weapons of mass destruction. Some disaster events such as earthquakes and terrorist attacks may occur in more than one location in a short period of time. Hence multiple sets of correlated link failures may occur if more events occurred before the previous set of failed links were repaired. Here, the statistical properties of induced-failure patterns depend upon the spatial interaction among stress centers (e.g., interaction among earthquake or attack locations). This paper presents a stochastic model, based on spatial point processes, for representing stress centers in geographical plane in order to facilitate the modeling of spatially inhomogeneous and correlated link failures in communication networks. This model is then used to further generate scenarios with inhibition or clustering between stress centers, which enables detailed assessment of vulnerabilities of the network to the level of inhomogeneity and spatial correlation in the stress-event centers. Detailed simulation results are presented to compare network reliability for various scenarios of link failures and to find geographically vulnerable areas of a network as well as worst-case scenarios of stress-events. Overall, this effort will provide some critical knowledge and simulation capability for other focus areas of research in network reliability and survivability.

We present a multi-objective optimization approach for joint throughput optimization and traffic engineering, where the routing request of traffic arrives one-by-one. We provide an Integer Linear Program (ILP) that simultaneously i) maximizes the aggregate throughput, ii) minimizes the resource consumption, and iii) minimizes the maximum link utilization. We study the impact of optimizing the three different objectives simultaneously in dynamic environments, and show that better solutions than those of mono-objective approaches can be obtained. Because of the complexity of the ILP, we also propose another ILP with reduced complexity, and study its performance and the optimality gap between it and optimal solutions.

Advance reservation of connection requests is a growing focus area and a range of solutions have been proposed. However, most efforts here have focused on scheduling algorithm design and have not addressed related implementation concerns in distributed settings. As a result, most schemes imply the use of a centralized controller, posing many scalability and reliability challenges. In order to address these concerns, this paper proposes a distributed routing solution for advance reservation. Namely, new link-state data structures are defined to summarize timeline-bandwidth state without the "time-slot" constraint along with novel routing update triggering policies for timely state dissemination. A refined distributed path- computation scheme is then developed to use this propagated state. The proposed solution is analyzed using discrete event simulation.

Multi-domain traffic engineering is a major focus area for carriers and crankback signaling offers a very promising alternative. However, even though various crankback studies have been done, there remains significant latitude for improved multi-domain designs. To address these challenges, this work develops a novel solution for intra/inter-domain signaling crankback in IP/MPLS networks. Namely, dynamic intra-domain link-state routing information is coupled with inter-domain path/distance-vector routing state to improve the search process. Mechanisms are also added to limit setup signaling overheads and track crankback history from congested links. The performance of the proposed solution is analyzed using simulation and compared against other techniques including hierarchical inter-domain routing.

As optical networking deployments increase, multi-domain provisioning and survivability are becoming major concerns. A key challenge in multi-domain survivability is the scalability problem. To address this concern, various solutions have already been proposed based upon topology aggregation schemes. However, these mechanisms do not scale well with increasing domain counts and further investigation is required to develop more scalable alternatives. Along these lines, in this paper we propose to use graph partitioning techniques to solve the scalability problem in multi-domain optical networks. To demonstrate the efficiency of our method, we also extend the p-cycle concept to multi-domain settings. Overall simulation results show the efficiency of our proposed solution in terms of resource utilization and the number of p-cycle structures.

Multi-domain traffic engineering is a major focus area for carriers and crankback signaling offers a very promising alternative. However, even though various crankback studies have been done, there remains significant latitude for improved multi-domain designs. To address these challenges, this work develops a novel solution for intra/inter-domain signaling crankback in IP/MPLS networks. Namely, dynamic intra-domain link-state routing information is coupled with inter-domain path/distance-vector routing state to improve the search process. Mechanisms are also added to limit setup signaling overheads and track crankback history from congested links. The performance of the proposed solution is analyzed using simulation and compared against other techniques including hierarchical inter-domain routing.

This paper studies distributed multi-domain, multi-layer provisioning (grooming) in IP/MPLS-DWDM networks. Although many multi-domain studies have emerged over the years, these have primarily considered "homogeneous" network layers. Meanwhile, most grooming studies have assumed idealized settings with "global" link state across all layers. Hence there is a critical need to develop practical distributed grooming schemes for real-world networks consisting of multiple domains and technology layers. Along these lines, a detailed hierarchical framework is proposed to implement inter-layer routing, distributed grooming, and setup signaling. The performance of this solution is analyzed using simulation studies and future directions high-lighted.

A light-trail is a generalization of a lightpath such that multiple nodes can take part in communication along the path. A light-trail exhibits properties of dynamic provisioning, optical multicasting and sub-wavelength grooming and architecturally is analogous to a shared wavelength optical bus with an Out-Of-Band (OOB) control channel. The bus feature results in a node that has a large pass-through loss, and hence restricts the size of a light-trail to metro environments. Within a bus the OOB control channel allows for dynamic real-time arbitration. Due to this limitation, it is difficult to extend the light-trail concept to regional and core networks. In this paper we propose a method to provide multihop communication in light-trails thereby relaxing the limitation in hop count, as well as enhancing reach of communications. We propose node architecture and protocol requirements for creating Multi-hop Light-trails (MLTs). We then discuss design issues for MLTs in regional area networks through problem formulation. A simulations study validates MLTs.

Advances in SONET/SDH technologies have introduced novel features for improved services mapping and provisioning, enabling many new avenues for new Carrier Ethernet support. However Ethernet-over-SONET studies have mostly focused on provisioning point-to-point Ethernet private line offerings. This paper considers the more challenging case of provisioning multi-point-to-multi-point Ethernet LAN services over advanced SONET/SDH networks and presents novel strategies based upon connection group overlays. Detailed simulation results are also presented along with directions for future work.

This paper proposes three novel admission control schemes for networks supporting prioritized advance reservation. The integer linear programming model for prioritized advance reservation and the pseudo-code algorithms implementing the schemes are outlined. Detailed simulation analysis results are then presented to compare the performance of the proposed schemes under different network load scenarios.

Enterprise networks form the backbone of corporate communication. Ethernet is the default layer-2 transport protocol and has undergone decades of constant innovation and improvisation. We propose a solution called CAMPUS for enterprise networks primarily based on end-to-end Ethernet. This all-Ethernet campus networking paradigm is designed for large enterprises or even metro networks relegating IP functions to only large core routers, while making good use of carrier-class Ethernet switches in the access and the metro area. Implementation of the CAMPUS solution is discussed from a theoretical as well as hardware perspective. Service provisioning, scalability and performance features are evaluated through extensive simulations model.

Data center networking (DCNs) is a fast emerging enterprise application that is driving metropolitan bandwidth needs. This paper evaluates the needs of this emerging IT-centric, bandwidth voluminous and service rendering application from a metro optical networking perspective. We identify a set of needs called CAVALIER (consolidation, automation, virtualization, adaptability, latency, integration, economy and reliability) that are underlying requirements for a network to support DCN services. The CAVALIER requirements are met by proposing a metro optical solution which is based on light-trail ROADM technology. Light-trails exhibit properties such as dynamic bandwidth provisioning, optical multicasting, sub-wavelength granular support and low-cost for deployment. Adapting light-trails to DCN needs is discussed in this paper through engineering requirements and network-wide design. Each aspect of the CAVALIER requirement is then mapped on to light-trail technology. Simulation results are shown to lead to performance betterments.

Recent studies on inter-domain DWDM networks have focused on topology abstraction for state summarization, i.e. transforming a physical topology to a virtual mesh, tree, or star network. Although these schemes give very good inter- domain blocking reduction, associated inter-domain routing overheads are significant, particularly as the number of domains and border OXC nodes increase. To address these scalability limitations, novel routing update triggering policies for multi-domain DWDM networks are developed. The performance of inter-domain lightpath RWA and signaling schemes in conjunction with these strategies is then studied in order to gauge the overall effectiveness of these approaches.

A light-trail is a generalized lightpath that enables multiple nodes to statistically share an optical communication path (wavelength bus). A light-trail is different from a lightpath on account of its unique node architecture - that enables formation of unidirectional wavelength buses. A node in a light-trail supports signal flow characteristics of drop-and-continue as well as passive addition leading to formation of the bus. Apart from the node architecture, another differentiation between light-trails and lightpaths is in the use of out-of-band control channel (optical supervisory channel - OSC) for dynamic communication. The combined effect of a unique node architecture and out-of-band control channel enables light-trails to provide capability of sub-wavelength grooming, dynamic provisioning and optical multicasting. These features offered by light-trails are critical for next generation emerging applications such as VoIP, video-on-demand (VoD), triple-play and pseudo-wire edge-to-edge emulation (PWE3). Current OSC based control channel requires engineering enhancement to provision dynamic and bandwidth efficient services over light-trails. We investigate into the control channel hierarchies in light-trail networks to provision these emerging services. Centralized, distributed, static and dynamic control mechanisms are proposed. Light-trail control for provisioning next generation services is considered through theory and simulation.

A recent advance in high-speed networks is the concept of Photonic Integrated Circuits (PICs) on an Indium Phosphide substrate, allowing miniaturization and integration of multiple OE and EO modules in a chip. PICs have the potential to do away with the opto-electronic bandwidth mismatch as well as result in severe cost reduction, hence questioning the need for all-optical networking. In this paper we analyze the impact of this digital optical networking concept by combining PIC technology with an all-optical solution - light-trails, resulting in a new solution called LiTPiC (Light-Trail Photonic Integrated Circuit). LiTPiCs offer the best of both digital and all-optical worlds. By enabling selective (and on-demand) regeneration of the signal, we are able to enhance the reach of all-optical light-trails. In addition, we are able to partition light-trail buses into multiple geographically disjoint sub-buses called PIC-Trails, thus for the first time introducing wavelength reuse within a light-trail. The LiTPiC concept gives PICs a new direction - that of being a technology enabler for next generation services using ROADM (Reconfigurable Optical Add-Drop Multiplexer) architecture and a complementary solution to the light-trail technology.

This paper devises and examines via computer simulation an innovative fully distributed global information- based integrated signaling framework for dynamically provisioning EVCs at any bandwidth granularity including both full wavelength and finer granularity (sub-lambda) EVCs at the optical layer.

As DWDM technology proliferates there is a growing need to address distributed inter-domain lightpath provisioning issues. Although inter-domain provisioning has been well-studied for packet/cell- switching networks, the wavelength dimension presents many additional challenges. This paper develops a novel hierarchical GMPLS-based framework for provisioning all-optical and opto-electronic multi-domain DWDM networks. The scheme adapts topology abstraction schemes to aggregate domain-level state to improve routing scalability and lower inter-domain blocking. Related inter-domain lightpath RWA and signaling schemes are also tabled. Performance analysis results are presented along with directions for future work.

Dynamic bandwidth allocation for upstream transmission in EPONs has gathered significant attention. Maximizing utilization is inversely related to dynamic bandwidth allocation. We propose an auctioning mechanism for bandwidth allocation with a view to dissolution of the paradox between efficiency (utilization) and dynamism. While conventional bandwidth auctioning schemes pose efficiency as well as fairness issues, our extensions overcome these. We propose three extensions: to increase efficiency we propose a K- out-of-N auctioning mechanism; to promote dynamism and reduce bandwidth starvation, we enhance the auctioning mechanism by introducing strategic scaling; and to cater to services we propose a bid computation mechanism that is uniquely tailored to reflect different service requirements. Through a simulation model we evaluate the performance of our scheme for latency, dynamism, efficiency and blocking probability.

Ethernet passive optical networks (EPONs) are being designed to deliver multiple services and applications, such as voice communications (VoIP), standard and high-definition video (STV and HDTV), video conferencing (interactive video) and data traffic access network. However, most of the current work focuses on inter-ONU dynamic bandwidth allocation (DBA) algorithms. In this paper, we concentrate on the intra-ONU bandwidth allocation for different classes of services. We present a new intra-ONU scheduling scheme based on the Deficient Weighted Round Robin (DWRR) scheduling to achieve adaptive fairness among different classes of services. We validate our reasoning by measuring both the end-to-end delay of different traffic along with the jitter performance of high priority traffic using extensive simulation experiments.

Advances in next-generation SONET/SDH along with GMPLS control have enabled many new service provisioning capabilities. A key paradigm is the new Layer 1 virtual private network (L1 VPN) framework, which allows clients to directly provision their own services without deploying expensive infrastructures. This paper proposes a novel L1 VPN resource management scheme for virtual concatenation-enabled nextgeneration SONET/SDH networks. The scheme is fully compatible with both centralized and distributed control frameworks and allows for dynamic resource sharing. Detailed performance analysis results are also presented.

Advances in next-generation SONET/SDH technologies have enabled many new service provisioning paradigms. A key addition is the inverse multiplexing feature which enables the splitting of connection demands across SONET/SDH domains. This paper presents a novel tiered survivability scheme that leverages this feature to support multiple levels of service survivability and achieve higher load carrying capability and service resiliency. Detailed simulation performance analysis results are also presented along with conclusions and directions for future work.

Trains as a mass transport system are a strong application case for coarsely granular bandwidth-on-demand networking. Multiple trains time-sharing the same track, traveling at a significant speed and containing a large number of bandwidth savvy users represents a premier motivation for the merger of optical and wireless communications. Wireless delivery methods alone cannot suffice the need for such a large moving mass of bandwidth intensive users. We propose a method to efficiently integrate a wireless network over a flexible optical backbone. The proposed method is built upon the light-trails optical platform and involves a unique control layer that adapts to an overlaid wireless network. Here, we propose a cross-layer protocol that enables seamless communication for these "light-trains". We also show benefits in terms of throughput, end-to-end delay, bandwidth efficiency and scalability of such a scheme through a simulation study.

Layer 1 virtual private network (LI-VPN) is new emerging framework that allows clients to directly set up logical topologies and provision their own services without deploying expensive network infrastructure. Emerging and current networks are partitioned in different domains in order to implement different associated administrative, management, control boundaries. For carriers operating multi-domain networks, end-to-end control is becoming increasingly a critical requirement. This paper presents a novel control scheme for shared L1-VPN operation in multi-domain networks and derives both centralized and distributed variants. The paper also analyzes the performance evaluation of resource management model, namely dedicated and shared L1-VPN. Results showed that distributed control provides better network utilization and shared L1-VPN increases the network utilization.

As DWDM networks proliferate there is a growing need to address the issue of distributed interdomain lightpath provisioning. Although inter-domain provisioning has been well-studied for packet/cellswitching networks, the wavelength dimension presents many additional challenges. This paper develops a novel hierarchical GMPLS-based framework for provisioning all-optical and opto-electronic multi-domain DWDM networks. In particular, several topology abstraction schemes are proposed for aggregating domain-level state to improve routing scalability and lower inter-domain blocking. Inter-domain lightpath RWA and signaling schemes are also tabled. Performance analysis results are presented along with directions for future work.

This paper presents a signaling framework for supporting and implementing traffic engineering in an all Ethernet global multi-service infrastructure.

As DWDM technology proliferates there is a growing need to address distributed inter-domain lightpath provisioning issues. Although inter-domain provisioning has been well-studied for packet/cell- switching networks, the wavelength dimension presents many additional challenges. This paper develops a novel hierarchical GMPLS-based framework for provisioning all-optical and opto-electronic multi-domain DWDM networks. The scheme adapts topology abstraction schemes to aggregate domain-level state to improve routing scalability and lower inter-domain blocking. Related inter-domain lightpath RWA and signaling schemes are also tabled. Performance analysis results are presented along with directions for future work.

Ethernet passive optical networks (EPONs) have emerged as one of the most promising access network technologies. Propelled by rapid price declines in fiber optics and Ethernet components, these architectures combine the latest in optical and electronic advances and are poised to become the dominant means of delivering gigabit broadband connectivity to homes over a unified single platform. As this technology matures, related quality of service (QoS) issues are becoming a key concern. This paper proposes a novel dynamic scheduling algorithm, termed hybrid granting protocol (HGP), to support different QoS in EPON. Specifically, the proposed dynamic scheduling algorithm minimizes packet delay and jitter for delay and delay-variation sensitive traffic (e.g., voice transmissions) by allocating bandwidth in a grant-before-report (GBR) fashion. This considerably improves their performance without degrading QoS guarantees for other service types. Detailed simulation experiments are presented to validate the effectiveness of the proposed algorithm.

Rapid advances in next-generation SONET/SDH and optical switching along with GMPLS control have enabled many new service provisioning capabilities. In particular, a key paradigm is the new Layer 1 virtual private network (L1 VPN) framework, which allows clients to directly provision their own services without deploying expensive infrastructures. This paper proposes novel L1 VPN resource management schemes for virtual concatenation-enabled next-generation SONET/SDH networks, using both centralized and distributed control. Detailed performance analysis results are also presented.

Ethernet passive optical networks (EPONs) have emerged as the one of the most promising candidates for next-generation access networks. These new architectures couple low-cost optics with advanced edge electronics to offer vastly improved scalability over competing digital subscriber line and cable modem offerings. This paper proposes several novel architectural enhancements for EPON, which will help increase the viability of optical access over a broader range of subscriber access scenarios. Specifically, this paper proposes a two-stage EPON architecture that allows more end-users to share an optical line terminal link, and enables longer access reach/distances (beyond the usual 25 km distance). In addition, a new dynamic bandwidth allocation (DBA) algorithm is proposed to effectively allocate bandwidths between end users. This DBA algorithm can support differentiated services in a network with heterogeneous traffic. We conduct detailed simulation experiments to study the performance and validate the effectiveness of the proposed architecture and algorithms.

Ethernet passive optical networks (EPONs) have emerged as a well accepted candidate for next-generation access networks. Propelled by rapid price declines in fiber optics and Ethernet components, these new EPON architectures combine the latest in optical and electronic advances, and are poised to become the dominant means of delivering bundled services over a single platform. This paper proposes a novel EPON architecture capable of delivering bandwidth-intensive voice, data video services at distances beyond 25 km in the subscriber access network. Specifically, this paper proposes a two-stage EPON architecture that allows more end-users to share an OLT link, and enables longer access reach/distances (beyond the usual 25 km distance). In addition, a new dynamic bandwidth allocation (DBA) algorithm is proposed to effectively and fairly allocate bandwidths between end users. This DBA algorithm can support differentiated services in a network with heterogeneous traffic. We conduct detailed simulation experiments to study the performance and validate the effectiveness of the proposed architecture and algorithms.

Optical dense wavelength division multiplexing (DWDM) has yielded unprecedented levels of bandwidth scalability. In order to exploit these gains, new converged multiservice transport setups have been evolved, most notably under the multiprotocol label switching (MPLS) and generalized MPLS (GMPLS) frameworks. These paradigms offer very efficient data-optical integration and enable a host of new service capabilities. As operators deploy these new technologies, the provisioning of "subwavelength" demands over wavelengths has become a crucial requirement, i.e., traffic engineering/grooming. This work addresses data-optical grooming in converged GMPLS networks. Here, novel integrated constraint-based routing algorithms are developed to provision subwavelength demands at both packet-switching and lightpath routing levels. Simulations indicate notable performance gains and resource efficiencies with the proposed schemes.

The efficient use of network capacity strongly depends upon the path selection procedure. In this paper we propose and evaluate efficient path selection algorithms for survivable optical networks with shared protection. Two distributed path selection algorithms are presented. The first approach maintains global information on network resource usage to determine link sharability and compute the optimal shared paths. The second approach, however, only relies upon local information maintained at each node. Subsequently, we present an analytical model to evaluate the performance of these path selection algorithms and show its accuracy through numerical examples.

Rate allocation for available bit-rate (ABR) services in ATM networks has received a considerable amount of attention, but important issues such as bandwidth fairness, MCR rate guarantees, and queue control still require further investigation. In light of these concerns, an enhanced rate allocation algorithm is proposed for congestion management using explicit rate feedback control. The algorithm uses fast, exact rate computations and is capable of achieving a variety of MCR-related fairness criteria. The scheme handles transient effects and can function in heterogeneous networks carrying higher priority real-time traffic. Simulation results for a wide range of network scenarios demonstrate that the algorithm effectively controls queue buildups and achieves good fairness. Performance scalability to large networks under challenging conditions is also shown for a given control parameter set.

An approximate queueing analysis of a distributed explicit rate allocation algorithm for the flow control of available bit rate (ABR) service, which captures the effect of bandwidth-delay, is described. Attention is focused on bounding the worst case transient queueing behaviour in a strictly-ABR environment with persistent start-up sources. At each switch, resource management (RM) cells are enqueued using a buffer separate from the data cells, and are served with a higher priority than data cells. Both single and multiple node network cases are treated for connections with differing delays. The approximate analysis shows relatively good agreement with simulation results for single node networks, but gives looser estimates for the multiple node case.