Reinforcement learning (RL)-based congestion control (CC) promises efficient CC in a fast-changing networking landscape, where evolving communication technologies, applications and traffic workloads pose severe challenges to human-derived, static CC algorithms. RL-based CC is in its early days and substantial research is required to understand existing limitations, identify research challenges and, eventually, yield deployable solutions for real-world networks. In this paper we present the first reproducible and systematic study of RL-based CC with the aim to highlight strengths and uncover fundamental limitations of the state-of-the-art. We identify challenges in evaluating RL-based CC, establish a methodology for studying said approaches and perform large-scale experimentation with RL-based CC approaches that are publicly available. We show that existing approaches can acquire all available bandwidth swiftly and are resistant to non-congestive loss, however, this is commonly at the cost of excessive packet loss in normal operation. We show that, as fairness is not embedded directly into reward functions, existing approaches exhibit unfairness in almost all tested network setups. Finally, we provide evidence that existing RL-based CC approaches under-perform when the available bandwidth and end-to-end latency dynamically change. Our experimentation codebase and datasets are publicly available with the aim to galvanise the community towards transparency and reproducibility, which have been recognised as crucial for researching and evaluating machine-generated policies.

Modern in-vehicle networks are shifting towards an Ethernet-based backbone where high bandwidth and low latency can be guaranteed. However, this comes with the cost of exposing the vehicle to more IP-based attacks such as blackholes and denial of service (DoS) attacks. To better secure the in-vehicle network, it is essential to provide efficient monitoring and anomaly detection mechanisms in order to detect such attacks. Software-defined networking (SDN) facilitates these tasks by providing a global view of the underlying network available at the SDN controller. To this end, we propose in this work an anomaly detection solution for SDN-enabled in-vehicle networks. In particular, we use deep learning and network tomography to monitor the network. The deep learning model used in this paper is based on deep autoencoder neural networks. Moreover, network tomography is leveraged so that only a subset of the network is monitored while the remaining can be inferred using the available measurements. We investigate anomaly detection using two types of statistics: flows and ports. We found that the flows' stats outperform the ports' stats in detecting anomalies. Moreover, by only monitoring selected flows, the proposed solution can detect anomalies with an accuracy of up to 99%. In addition, our approach can classify the type of attack, whether it is DoS, SYN flooding, or ARP spoofing attack with only 3% maximum error.

Microservices are fast becoming the predominant architectural style for orchestrating online services due to the advantages they can bestow over monolithic systems. However, as microservice architectures grow in size they quickly become complicated to understand and manage. Their characteristics raise the question as to whether they may behave like complex systems. In this paper, we use tools from graph theory to analyse the static and temporal dependency structure of a large-scale microservice architecture. We find that the dependency structure can fluctuate significantly at run time and further, that it can be clustered into distinct and persistent states with recognisable characteristics. Importantly, we show that these states can have functional implications for the performance of the microservice architecture. These early findings suggest that microservices may indeed behave like complex systems and, as such, would benefit from complex systems thinking when approaching their management and development.

A crucial step in remedying faults within network infrastructures is to determine their root cause. However, the large-scale, complex and dynamic nature of modern networks makes causal inference-based root cause analysis (RCA) challenging in terms of scalability and knowledge drift over time. In this paper, we propose a framework that utilises the neuroscientific concept of functional connectivity – a graph representation of statistical dependencies between events – as a scalable approach to acquire and maintain prior knowledge for causal inference-based RCA approaches in dynamic networks. We demonstrate on both synthetic and real world data that our proposed approach can provide significant speedups to existing causal inference approaches without significant loss of accuracy. Finally, we discuss the impact of the choice of user-defined parameters on causal inference accuracy and conclude that the framework can safely be deployed in the real world.

Due to the increased complexity of new in-vehicle networking architectures, which makes direct monitoring of internal network components intractable, alternative solutions are required to tackle this issue. One solution is to leverage the end-to-end measurements to estimate the internal network performance. To this end, we propose to employ network tomography as a monitoring approach for in-vehicle networks. Network tomography can infer the overall network performance by measuring only subset of the network. We investigate the use of network tomography in in-vehicle network by analysing network identifiability of three main architectures: bus-based, central-gateway, and Ethernet-based architectures. Our analysis results indicate the applicability of network tomography in in-vehicle networks based on certain topological and monitors' conditions. Furthermore, we validate our analytical results through simulation which shows a maximum error of only$174\mu s$. Moreover, we compare the proposed approach with one of existing solutions and show that network tomography achieves better bandwidth and latency performance with monitoring overhead saving up to 52.2% and$782.3\mu s$, respectively.

A crucial step in remedying faults within network infrastructure is to determine their root cause. However, the large-scale, complex and dynamic nature of modern architecture makes root cause analysis challenging. Statistical approaches for causal inference are promising, however, their deployment has been historically limited due to their high time complexity. In this paper we propose a general framework for leveraging the concept of functional connectivity to reduce the computational overhead of causal inference algorithms. We demonstrate on synthetic data that our approach can achieve substantial speedups when combined with state-of-the-art causal discovery algorithms, with only a small cost in terms of loss of causal information in some cases.

Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that traffic obeys the log-normal distribution which is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate an alternative heavy-tailed distribution (the Weibull) and show that its performance is better than Gaussian but worse than log-normal. We examine anomalous traces which exhibit a poor fit for all distributions tried and show that this is often due to traffic outages or links that hit maximum capacity. We demonstrate that the data we look at is stationary if we consider samples of 15- minute long or even 1-hour long. This gives confidence that we can use the distributions for estimation and modelling purposes. We demonstrate the utility of our findings in two contexts: predicting that the proportion of time traffic will exceed a given level (for service level agreement or link capacity estimation) and predicting 95th percentile pricing. We also show that the log-normal distribution is a better predictor than Gaussian or Weibull distributions in both contexts.

In this paper we propose SCDP, a general-purpose data transport protocol for data centres that, in contrast to all other protocols proposed to date, supports efficient one-to-many and many-to-one communication, which is extremely common in modern data centres. SCDP does so without compromising on efficiency for short and long unicast flows. SCDP achieves this by integrating RaptorQ codes with receiver-driven data transport, packet trimming and Multi-Level Feedback Queuing (MLFQ); (1) RaptorQ codes enable efficient one-to-many and many-to-one data transport; (2) on top of RaptorQ codes, receiver-driven flow control, in combination with in-network packet trimming, enable efficient usage of network resources as well as multi-path transport and packet spraying for all transport modes. Incast and Outcast are eliminated; (3) the systematic nature of RaptorQ codes, in combination with MLFQ, enable fast, decoding-free completion of short flows. We extensively evaluate SCDP in a wide range of simulated scenarios with realistic data centre workloads. For one-to-many and many-to-one transport sessions, SCDP performs significantly better compared to NDP and PIAS. For short and long unicast flows, SCDP performs equally well or better compared to NDP and PIAS.

In software-defined networks (SDN), a controller program is in charge of deploying diverse network functionality across a large number of switches, but this comes at a great risk: deploying buggy controller code could result in network and service disruption and security loopholes. The automatic detection of bugs or, even better, verification of their absence is thus most desirable, yet the size of the network and the complexity of the controller makes this a challenging undertaking. In this paper, we propose MOCS, a highly expressive, optimised SDN model that allows capturing subtle real-world bugs, in a reasonable amount of time. This is achieved by (1) analysing the model for possible partial order reductions, (2) statically pre-computing packet equivalence classes and (3) indexing packets and rules that exist in the model. We demonstrate its superiority compared to the state of the art in terms of expressivity, by providing examples of realistic bugs that a prototype implementation of MOCS in Uppaal caught, and performance/scalability, by running examples on various sizes of network topologies, highlighting the importance of our abstractions and optimisations.

Software-defined networking (SDN) enables advanced operation and management of network deployments through (virtually) centralised, programmable controllers, which deploy network functionality by installing rules in the flow tables of network switches.Although this is a powerful abstraction, buggy controller functionality could lead to severe service disruption and security loopholes, motivating the need for (semi-)automated tools to find, or even verify absence of, bugs.Model checking SDNs has been proposed in the literature, but none of the existing approaches can support dynamic network deployments, where flow entries expire due to timeouts.This is necessary for automatically refreshing (and eliminating stale) state in the network (termed as soft-state in the network protocol design nomenclature), which is important for scaling up applications or recovering from failures.In this paper, we extend our model (MoCS) to deal with timeouts of flow table entries, thus supporting soft state in the network.Optimisations are proposed that are tailored to this extension.We evaluate the performance of the proposed model in UPPAAL using a load balancer and firewall in network topologies of varying size.

Getting good statistical models of traffic on network links is a well-known, often-studied problem. A lot of attention has been given to correlation patterns and flow duration. The distribution of the amount of traffic per unit time is an equally important but less studied problem. We study a large number of traffic traces from many different networks including academic, commercial and residential networks using state-of-the-art statistical techniques. We show that the log-normal distribution is a better fit than the Gaussian distribution commonly claimed in the literature. We also investigate a second heavy-tailed distribution (the Weibull) and show that its performance is better than Gaussian but worse than log-normal. We examine anomalous traces which are a poor fit for all distributions tried and show that this is often due to traffic outages or links that hit maximum capacity.We demonstrate the utility of the log-normal distribution in two contexts: predicting the proportion of time traffic will exceed a given level (for service level agreement or link capacity estimation) and predicting 95th percentile pricing. We also show the log-normal distribution is a better predictor than Gaussian or Weibull distributions.

To respond rapidly and accurately to network and service outages, network operators must deal with a large number of events resulting from the interaction of various services operating on complex, heterogeneous and evolving networks. In this paper, we introduce the concept of functional connectivity as an alternative approach to monitoring those events. Commonly used in the study of brain dynamics, functional connectivity is defined in terms of the presence of statistical dependencies between nodes. Although a number of techniques exist to infer functional connectivity in brain networks, their straightforward application to commercial network deployments is severely challenged by: (a) non-stationarity of the functional connectivity, (b) sparsity of the time-series of events, and (c) absence of an explicit model describing how events propagate through the network or indeed whether they propagate. Thus, in this paper, we present a novel inference approach whereby two nodes are defined as forming a functional edge if they emit substantially more coincident or short-lagged events than would be expected if they were statistically independent. The output of the method is an undirected weighted graph, where the weight of an edge between two nodes denotes the strength of the statistical dependence between them. We develop a model of time-varying functional connectivity whose parameters are determined by maximising the model's predictive power from one time window to the next. We assess the accuracy, efficiency and scalability of our method on two real datasets of network events spanning multiple months and on synthetic data for which ground truth is available. We compare our method against both a general-purpose time-varying network inference method and network management specific causal inference technique and discuss its merits in terms of sensitivity, accuracy and, importantly, scalability.

ISP and commercial networks are complex and thus difficult to characterise and manage. Network operators rely on a continuous flow of event log messages to identify and handle service outages. However, there is little published information about such events and how they are typically exploited. In this paper, we describe in as much detail as possible the event logs and network topology of a major commercial network. Through analysing the network topology, textual information of events and time of events, we highlight opportunities and challenges brought by such data. In particular, we suggest that the development of methods for inferring functional connectivity could unlock more of the informational value of event log messages and assist network management operators.

Understanding which node failures in a network have more impact is an important problem. Current understanding, motivated by the scale free models of network growth, places emphasis on the degree of the node. This is not a satisfactory measure; the number of connections a node has does not capture how redundantly it is connected into the whole network. Conversely, the structural entropy of a graph captures the resilience of a network well, but is expensive to compute, and, being a global measure, does not attribute any specific value to a given node. This lack of locality prevents the use of global measures as a way of identifying critical nodes. In this paper, we introduce local vertex measures of entropy which do not suffer from such drawbacks. In our theoretical analysis, we establish the possibility that our local vertex measures approximate global entropy, with the advantage of locality and ease of computation. We establish properties that vertex entropy must have in order to be useful for identifying critical nodes. We have access to a proprietary event, topology, and incident dataset from a large commercial network. Using this dataset, we demonstrate a strong correlation between vertex entropy and incident generation over events.

From Definition 2 in the above-named work, we have for a simple graph$G=(V,E)$, the following expression for the chromatic entropy$I_{C}(G)$of a graph:\begin{equation*} I_{C}\left ({G}\right) = \min _{\left \{{C_{i}}\right \}} - \sum _{i=1}^{N_{c}} \frac {|C_{i}|}{n} \log _{2} \frac {|C_{i}|}{n} \tag{1}\end{equation*}

Modern data centres provide large aggregate network capacity and multiple paths among servers. Traffic is very diverse; most of the data is produced by long, bandwidth hungry flows but the large majority of flows, which commonly come with strict deadlines regarding their completion time, are short. It has been shown that TCP is not efficient for any of these types of traffic in modern data centres. More recent protocols such MultiPath TCP (MPTCP) are very efficient for long flows, but are ill-suited for short flows. In this paper, we present Maximum MultiPath TCP (MMPTCP), a novel transport protocol which, compared to TCP and MPTCP, reduces short flows' completion times, while providing excellent goodput to long flows. To do so, MMPTCP runs in two phases; initially, it randomly scatters packets in the network under a single congestion window exploiting all available paths. This is beneficial to latency-sensitive flows. After a specific amount of data is sent, MMPTCP switches to a regular MultiPath TCP mode. MMPTCP is incrementally deployable in existing data centres as it does not require any modifications outside the transport layer and behaves well when competing with legacy TCP and MPTCP flows. Our extensive experimental evaluation in simulated FatTree topologies shows that all design objectives for MMPTCP are met.

A key objective of monitoring networks is to identify potential service threatening outages from events within the network before service is interrupted. Identifying causal events, Root Cause Analysis (RCA), is an active area of research, but current approaches are vulnerable to scaling issues with high event rates. Elimination of noisy events that are not causal is key to ensuring the scalability of RCA. In this paper, we introduce vertex-level measures inspired by Graph Entropy and propose their suitability as a categorization metric to identify nodes that are a priori of more interest as a source of events. We consider a class of measures based on Structural, Chromatic and Von Neumann Entropy. These measures require NP-Hard calculations over the whole graph, an approach which obviously does not scale for large dynamic graphs that characterise modern networks. In this work we identify and justify a local measure of vertex graph entropy, which behaves in a similar fashion to global measures of entropy when summed across the whole graph. We show that such measures are correlated with nodes that generate incidents across a network from a real data set.

With the proliferation of smartphones and their advanced connectivity capabilities, opportunistic networks have gained a lot of traction during the past years; they are suitable for increasing network capacity and sharing ephemeral, localised content. They can also offload traffic from cellular networks to device-to-device ones, when cellular networks are heavily stressed. Opportunistic networks can play a crucial role in communication scenarios where the network infrastructure is inaccessible due to natural disasters, large-scale terrorist attacks or government censorship. Geocasting, where messages are destined to specific locations (casts) instead of explicitly identified devices, has a large potential in real world opportunistic networks, however it has attracted little attention in the context of opportunistic networking. In this paper we propose Geocasting Spray And Flood (GSAF), a simple but efficient and flexible geocasting protocol for opportunistic, delay-tolerant networks. GSAF follows a simple but elegant and flexible approach where messages take random walks towards the destination cast. Messages that follow directions away from the cast are extinct when the device buffer gets full, freeing space for new messages to be delivered. In GSAF, casts do not have to be pre-defined; instead users can route messages to arbitrarily defined casts. Our extensive evaluation shows that GSAF is efficient, in terms of message delivery ratio and latency as well as network overhead.

In this paper, we introduce MMPTCP, a novel transport protocol which aims at unifying the way data is transported in data centres. MMPTCP runs in two phases; initially, it randomly scatters packets in the network under a single congestion window exploiting all available paths. This is beneficial to latency-sensitive flows. During the second phase, MMPTCP runs in Multi-Path TCP (MPTCP) mode, which has been shown to be very efficient for long flows. Initial evaluation shows that our approach significantly improves short flow completion times while providing high throughput for long flows and high overall network utilisation.

Datacenter networking has brought high-performance storage systems' research to the foreground once again. Many modern storage systems are built with commodity hardware and TCP/IP networking to save costs. In this paper, we highlight a group of problems that are present in such storage systems and which are all related to the use of TCP. As an alternative, we explore Trevi: a fountain coding-based approach for distributing I/O requests that overcomes these problems while still efficiently scheduling resources across both networking and storage layers. We also discuss how receiver-driven flow and congestion control, in combination with fountain coding, can guide the design of Trevi and provide a viable alternative to TCP for datacenter storage.

Large, reliable and efficient storage systems are becoming increasingly important in enterprise environments. Our research in storage system design is oriented towards the exploitation of commodity hardware for building a high performance, resilient and scalable storage system. We present the design and implementation of DHTbd, a general purpose decentralized storage system where storage nodes support a distributed hash table based interface and clients are implemented as in-kernel device drivers. DHTbd, unlike most storage systems proposed to date, is implemented at the block device level of the I/O stack, a simple yet efficient design. The experimental evaluation of the proposed system demonstrates its very good I/O performance, its ability to scale to large clusters, as well as its robustness, even when massive failures occur.

During the past few years, large, reliable and efficient storage systems have become increasingly important in enterprise environments. Additional requirements for these environments include low installation, maintenance and administration costs. In this paper we propose a hash-based storage approach, combined with block-level operating system semantics. The experimental evaluation confirms that the proposed approach is viable and can offer a cost-effective storage solution.