IP Networks serve a variety of connected network entities (NEs) such as personal computers, servers, mobile devices, virtual machines, hosted containers, etc. The growth in the number of NEs and technical considerations has led to a reality where a single IP address is used by multiple NEs. A typical example is a home router using Network Address Translation (NAT). In organizations and cloud environments, a single IP can be used by multiple virtual machines or containers running on a single device. Discovering the number of NEs served by an IP address and clustering their traffic correctly is of value in many use cases for security, lawful interception, asset management, and other purposes. In this paper, we introduce IPvest, a system that incorporates unsupervised and supervised learning algorithms based on various features for counting and clustering network traffic of NEs masqueraded by a single IP. The features are based on the characteristics of operating systems (OSs), NAT behavior, and users' habits. Our model is evaluated on real-world datasets including Windows, Linux-based, Android, and iOS-based devices, containers, virtual machines, and load-balancers. We show that IPvest can count the number of NEs and cluster their traffic with high precision, even for containers running on a single device and servers behind a load-balancer.

Network routing may be required, under certain applications, to avoid certain areas (or nodes). These areas can be of potential security threat, possess poor quality or have other undesired characteristics. Thus, protocols that can perform area avoidance routing can be beneficial for many objectives. Such routing is particularly challenging in distance-vector networks, where only the shortest-distance information is available to the nodes. We address this challenge by algorithms that retrieve distance-vector information from other nodes in the network, referred to as reference nodes, and exploit it for computing guaranteed area-avoiding paths. Having these paths, the source can direct the packets using loose source routing towards the destination. We lay out the model for area avoidance routing and study several algorithms for calculating area-avoiding paths. In addition, we address the problem of dynamically selecting reference nodes. We show, through analysis and extensive simulation, that in many cases a small number of reference nodes are sufficient for area avoidance routing.

Traditional network routing uses the single (shortest) path paradigm. This paradigm exposes sessions to various attacks along this path, such as eavesdropping, DoS attacks etc. As a result, certain nodes or network regions may pose security threats and it is desired to consider node routing schemes which avoid them. The task of node avoidance routing is particularly challenging in distance-vector networks, where only shortest-distance information is available to the nodes. We address this problem by proposing a new routing paradigm in which the forwarding mechanism exploits the distance-vector information towards several nodes and utilizes it to forward network traffic on non-shortest paths routes; in particular on node-avoiding routes aiming at bypassing security-suspected nodes. We study this paradigm, propose a routing algorithm based on it and establish their properties. Extensive evaluation of the algorithm in general situations is conducted via simulation.

Abstract — Traditional network routing uses the single (shortest) path paradigm. This paradigm leaves the session vulnerable to a variety of security threats, such as eavesdropping. We propose to overcome this via dispersive routing, conducted over multiple paths. This increases significantly the costs inflicted on an attacker who wishes to eavesdrop sessions by hijacking network links (or routers). We formulate the Security Traffic Manager (STM) problem (route session fragments 1, over multiple paths, so that protection against an attacker, with a known hijacking budget, is guaranteed) and the attacker problem (find the cheapest hijacking strategy). The problems are analyzed for cases in which the attacker must eavesdrop all the fragments as well for cases in which it must eavesdrop only a fraction of them. We analyze the theoretical complexity of these problems and offer algorithms for finding dispersive routes that guarantee security. Though some theoretical cases of the problem are shown to be NP-Hard, typical practical cases can be solved by polynomial time algorithms. We extend the STM problem to more practical situations where the goal of the STM is to guarantee privacy, using minimal number of limited-length paths. The algorithms are tested through simulation and shown to be efficient in many scenarios. The model and algorithms offered in this study can be used for deploying a “session enhanced security ” service in packet networks 2. Keywords-component; traffic dipersion, security, eavesdrop, multi-path routing I.

Next generation networks (NGN) and the migration towards IP networks is likely to make the IP technology the main vehicle for earning voice and video calls on modern networks. Packet dispersion is a mechanism by which the packets of a certain session are dispersed over multiple paths, in contrast to the traditional approach by which they follow a single path most of the time. In this work we examine the quality of voice over IP (VoIP) applications and the effects of packet dispersion on it. We focus on the effect of the network loss on the applications, where we propose to use noticeable loss rate (NLR) as a measure correlated with the voice quality. We analyze the NLR for various packet dispersion strategies over paths experiencing memory-less (Bernoulli) or bursty (Gilbert model) losses, and compare them to each other. Our analysis reveals, that in many situations, in particular for most cases where losses are bursty, the use of packet dispersion reduces the NLR and thus improves session quality. The results suggest that the use of packet dispersion can be quite beneficial for these applications.