High quality data is of vital importance for unlocking the full potential of AI for end users. Villalobos et al. stated in 2024 that finding new sources of such data is getting harder as most publicly-available human generated data will soon have been used. Additionally, publicly available data often is not representative of users of a particular system — for example, a research speech dataset of contractors interacting with an AI assistant will likely be more homogeneous, well articulated and self-censored that real world commands that end users will issue. Therefore unlocking high-quality data grounded in real user interactions is of vital interest to both system creators and end users themselves. However, the direct use of user data comes with significant privacy risks, which must be addressed before the data can be used. Differential Privacy (DP) is a well established framework for reasoning about and limiting information leakage, and is a gold standard for protecting user privacy. The focus of this work, Differentially Private Synthetic data, refers to synthetic data that preserves the overall trends of source data (often user-generated), while providing strong privacy guarantees to individuals that contributed to the source dataset. DP synthetic data can unlock the value of datasets that have previously been inaccessible due to privacy concerns. Additionally, DP synthetic data can replace the use of sensitive datasets that previously have only had rudimentary protections like ad-hoc rule-based anonymization. In this survey we explore the full suite of techniques surrounding DP synthetic data, the types of privacy protections different generation approaches can offer, and the state-of-the-art for various modalities including image, tabular, text and federated (decentralized) data. We outline all the components needed in a system that generates DP synthetic data, from sensitive data handling and preparation, to tracking the use of synthetic data and empirical privacy testing. We hope that work will result in increased adoption of DP synthetic data, spur additional research in still underexplored domains, and additionally increase trust in DP synthetic data approaches.

As deep learning models become widely deployed as components within larger production systems, their individual shortcomings can create system-level vulnerabilities with real-world impact. This paper studies how adversarial attacks targeting an ML component can degrade or bypass an entire production-grade malware detection system, performing a case study analysis of Gmail's pipeline where file-type identification relies on a ML model. The malware detection pipeline in use by Gmail contains a machine learning model that routes each potential malware sample to a specialized malware classifier to improve accuracy and performance. This model, called Magika, has been open sourced. By designing adversarial examples that fool Magika, we can cause the production malware service to incorrectly route malware to an unsuitable malware detector thereby increasing our chance of evading detection. Specifically, by changing just 13 bytes of a malware sample, we can successfully evade Magika in 90% of cases and thereby allow us to send malware files over Gmail. We then turn our attention to defenses, and develop an approach to mitigate the severity of these types of attacks. For our defended production model, a highly resourced adversary requires 50 bytes to achieve just a 20% attack success rate. We implement this defense, and, thanks to a collaboration with Google engineers, it has already been deployed in production for the Gmail classifier.

We propose a simple heuristic privacy analysis of noisy clipped stochastic gradient descent (DP-SGD) in the setting where only the last iterate is released and the intermediate iterates remain hidden. Namely, our heuristic assumes a linear structure for the model. We show experimentally that our heuristic is predictive of the outcome of privacy auditing applied to various training procedures. Thus it can be used prior to training as a rough estimate of the final privacy leakage. We also probe the limitations of our heuristic by providing some artificial counterexamples where it underestimates the privacy leakage. The standard composition-based privacy analysis of DP-SGD effectively assumes that the adversary has access to all intermediate iterates, which is often unrealistic. However, this analysis remains the state of the art in practice. While our heuristic does not replace a rigorous privacy analysis, it illustrates the large gap between the best theoretical upper bounds and the privacy auditing lower bounds and sets a target for further work to improve the theoretical privacy analyses.

"Machine unlearning" is a popular proposed solution for mitigating the existence of content in an AI model that is problematic for legal or moral reasons, including privacy, copyright, safety, and more. For example, unlearning is often invoked as a solution for removing the effects of specific information from a generative-AI model's parameters, e.g., a particular individual's personal data or the inclusion of copyrighted content in the model's training data. Unlearning is also proposed as a way to prevent a model from generating targeted types of information in its outputs, e.g., generations that closely resemble a particular individual's data or reflect the concept of "Spiderman." Both of these goals--the targeted removal of information from a model and the targeted suppression of information from a model's outputs--present various technical and substantive challenges. We provide a framework for ML researchers and policymakers to think rigorously about these challenges, identifying several mismatches between the goals of unlearning and feasible implementations. These mismatches explain why unlearning is not a general-purpose solution for circumscribing generative-AI model behavior in service of broader positive impact.

Deep learning models are often trained on distributed, web-scale datasets crawled from the internet. In this paper, we introduce two new dataset poisoning attacks that intentionally introduce malicious examples to a model’s performance. Our attacks are immediately practical and could, today, poison 10 popular datasets. Our first attack, split-view poisoning, exploits the mutable nature of internet content to ensure a dataset annotator’s initial view of the dataset differs from the view downloaded by subsequent clients. By exploiting specific invalid trust assumptions, we show how we could have poisoned 0.01% of the LAION-400M or COYO-700M datasets for just $60 USD. Our second attack, frontrunning poisoning, targets web-scale datasets that periodically snapshot crowd-sourced content—such as Wikipedia—where an attacker only needs a time-limited window to inject malicious examples. In light of both attacks, we notify the maintainers of each affected dataset and recommended several low-overhead defenses.

Machine learning models trained on private datasets have been shown to leak their private data. Recent work has found that the average data point is rarely leaked---it is often the outlier samples that are subject to memorization and, consequently, leakage. We demonstrate and analyze an Onion Effect of memorization: removing the "layer" of outlier points that are most vulnerable to a privacy attack exposes a new layer of previously-safe points to the same attack. We perform several experiments that are consistent with this hypothesis. For example, we show that for membership inference attacks, when the layer of easiest-to-attack examples is removed, another layer below becomes easy-to-attack. The existence of this effect has various consequences. For example, it suggests that proposals to defend against memorization without training with rigorous privacy guarantees are unlikely to be effective. Further, it suggests that privacy-enhancing technologies such as machine unlearning could actually harm the privacy of other users.

A membership inference attack allows an adversary to query a trained machine learning model to predict whether or not a particular example was contained in the model’s training dataset. These attacks are currently evaluated using average-case “accuracy” metrics that fail to characterize whether the attack can confidently identify any members of the training set. We argue that attacks should instead be evaluated by computing their true-positive rate at low (e.g., ≤ 0.1%) false-positive rates, and find most prior attacks perform poorly when evaluated in this way. To address this we develop a Likelihood Ratio Attack (LiRA) that carefully combines multiple ideas from the literature. Our attack is $10\times$ more powerful at low false-positive rates, and also strictly dominates prior attacks on existing metrics.

Large flows like videos consume significant bandwidth. Some ISPs actively manage these high volume flows with techniques like policing, which enforces a flow rate by dropping excess traffic. While the existence of policing is well known, our contribution is an Internet-wide study quantifying its prevalence and impact on video quality metrics. We developed a heuristic to identify policing from server-side traces and built a pipeline to deploy it at scale on traces from a large online content provider, collected from hundreds of servers worldwide. Using a dataset of 270 billion packets served to 28,400 client ASes, we find that, depending on region, up to 7% of lossy transfers are policed. Loss rates are on average six times higher when a trace is policed, and it impacts video playback quality. We show that alternatives to policing, like pacing and shaping, can achieve traffic management goals while avoiding the deleterious effects of policing.

Time synchronization is an essential service in many sensor network applications. Harsh environment which causes nodes to fail, go offline, or reboot can challenge many time synchronization protocols. In this work, we first characterize this challenge and use a real time clock in one of the nodes in the network to improve robustness of time synchronization. Our experiments show that our approach improves the robustness of state-of-the-art offline time synchronization protocols.

Recent work has shown that network protocols which rely on precisely-timed concurrent transmissions can achieve reliable, energy-efficient, and conceptually simple network flooding. While these multi-transmitter schemes work well, they require all nodes in the network to forward every data packet, which has inherent inefficiencies for non-flooding traffic patterns (where not all nodes need to receive the data). In this work, we formalize the concept of the “useful” forwarder set for point-to-point transmissions in low power multi-transmitter networks, those nodes which help forward data to the destination. We present a mechanism for approximating membership in this set based on simple heuristics. Incorporating forwarder selection on our 66-node testbed reduced radio duty cycle by 30% and increased throughput by 49% relative to concurrent flooding while preserving a 99.4% end-to-end packet reception ratio under the collection traffic pattern. We envision forwarder selection as a fundamental task in an efficient multi-transmitter networking stack. This work demonstrates that adding forwarder selection can improve energy efficiency and throughput while providing similar end-to-end packet delivery rates to flooding.

To serve users quickly, Web service providers build infrastructure closer to clients and use multi-stage transport connections. Although these changes reduce client-perceived round-trip times, TCP's current mechanisms fundamentally limit latency improvements. We performed a measurement study of a large Web service provider and found that, while connections with no loss complete close to the ideal latency of one round-trip time, TCP's timeout-driven recovery causes transfers with loss to take five times longer on average.

Standardization has driven interoperability at multiple layers of the stack, such as the routing and application layers, standardization of radio duty cycling mechanisms have not yet reached the same maturity. In this work, we pitch the two de facto standard flavors of sender-initiated radio duty cycling mechanisms against each other: ContikiMAC and TinyOS LPL. Our aim is to explore pragmatic interoperability mechanisms at the radio duty cycling layer. This will lead to better understanding of interoperability problems moving forward, as radio duty cycling mechanisms get standardized. Our results show that the two flavors can be configured to operate together but that parameter configuration may severely hurt performance.

Biking is one of the most efficient and environmentally friendly ways to control weight and commute. To precisely estimate caloric expenditure, bikers have to install a bike computer or use a smartphone connected to additional sensors such as heart rate monitors worn on their chest, or cadence sensors mounted on their bikes. However, these peripherals are still expensive and inconvenient for daily use. This work poses the following question: is it possible to use just a smartphone to reliably estimate cycling activity? We answer this question positively through a pocket sensing approach that can reliably measure cadence using the phone's on-board accelerometer with less than 2% error. Our method estimates caloric expenditure through a model that takes as inputs GPS traces, the USGS elevation service, and the detailed road database from OpenStreetMap. The overall caloric estimation error is 60% smaller than other smartphone-based approaches. Finally, the smartphone can aggressively duty-cycle its GPS receiver, reducing energy consumption by 57%, without any degradation in the accuracy of caloric expenditure estimates. This is possible because we can recover the bike's route, even with fewer GPS location samples, using map information from the USGS and OpenStreetMap databases.

We present A-MAC, a receiver-initiated link layer for low-power wireless networks that supports several services under a unified architecture, and does so more efficiently and scalably than prior approaches. A-MAC's versatility stems from layering unicast, broadcast, wakeup, pollcast, and discovery above a single, flexible synchronization primitive. A-MAC's efficiency stems from optimizing this primitive and with it the most consequential decision that a low-power link makes: whether to stay awake or go to sleep after probing the channel. Today's receiver-initiated protocols require more time and energy to make this decision, and they exhibit worse judgment as well, leading to many false positives and negatives, and lower packet delivery ratios. A-MAC begins to make this decision quickly, and decides more conclusively and correctly in both the negative and affirmative. A-MAC's scalability comes from reserving one channel for the initial handshake and different channels for data transfer. Our results show that: (i) a unified implementation is possible; (ii) A-MAC's idle listening power increases by just 1.12× under interference, compared to 17.3× for LPL and 54.7× for RI-MAC; (iii) A-MAC offers high single-hop delivery ratios; (iv) network wakeup is faster and more channel efficient than LPL; and (v) collection routing performance exceeds the state-of-the-art.

Efficient thermal management is important in modern data centers as cooling consumes up to 50% of the total energy. Unlike previous work, we consider proactive thermal management, whereby servers can predict potential overheating events due to dynamics in data center configuration and workload, giving operators enough time to react. However, such forecasting is very challenging due to data center scales and complexity. Moreover, such a physical system is influenced by cyber effects, including workload scheduling in servers. We propose ThermoCast, a novel thermal forecasting model to predict the temperatures surrounding the servers in a data center, based on continuous streams of temperature and airflow measurements. Our approach is (a) capable of capturing cyberphysical interactions and automatically learning them from data; (b) computationally and physically scalable to data center scales; (c) able to provide online prediction with real-time sensor measurements. The paper's main contributions are: (i) We provide a systematic approach to integrate physical laws and sensor observations in a data center; (ii) We provide an algorithm that uses sensor data to learn the parameters of a data center's cyber-physical system. In turn, this ability enables us to reduce model complexity compared to full-fledged fluid dynamics models, while maintaining forecast accuracy; (iii) Unlike previous simulation-based studies, we perform experiments in a production data center. Using real data traces, we show that ThermoCast forecasts temperature better than a machine learning approach solely driven by data, and can successfully predict thermal alarms 4.2 minutes ahead of time.

No abstract available.

Flash-based solid-state drives (SSDs) will become key components in future storage systems. An accurate performance model will not only help understand the state-of-the-art of SSDs, but also provide the research tools for exploring the design space of such storage systems. Although over the years many performance models were developed for hard drives, the architectural differences between two device families prevent these models from being effective for SSDs. The hard drive performance models cannot account for several unique characteristics of SSDs, e.g., low latency, slow update, and expensive block-level erase. In this paper, we utilize the black-box modeling approach to analyze and evaluate SSD performance, including latency, bandwidth, and throughput, as it requires minimal a priori information about the storage devices. We construct the black-box models, using both synthetic workloads and real-world traces, on three SSDs, as well as an SSD RAID. We find that, while the black-box approach may produce less desirable performance predictions for hard disks, a black-box SSD model with a comprehensive set of workload characteristics can produce accurate predictions for latency, bandwidth, and throughput with small errors.

IEEE 802.15.4 links can be classified into three distinct reception regions: connected, transitional, and disconnected. The transitional region is large in size and characterized by the existence of links with intermediate reception ratios. Our work leverages previous work on understanding the properties of wireless links in the space and time domains but differs in the sense that we seek opportunities to actively adjust the physical topologies of sensor networks to improve link quality. Based on an existing theoretical model supported by extensive experiments in a variety of environments, we propose an efficient mechanism to identify locations with high reception ratios in the transitional region. The proposed mechanism can be used to effectively construct long, yet high reception ratio links that are 100% longer than the size of the connected region, thereby reducing the number of relay nodes necessary to interconnect sparse sensor networks by 34%. Furthermore, this mechanism can help better position mobile sinks and guide the communication protocols for mobile sensor networks. Overall, this paper provides fresh insights into the implications of the log-normal path loss model on deploying and moving sensor motes.

Interoperability is essential for the commercial adoption of wireless sensor networks. However, existing sensor network architectures have been developed in isolation and thus interoperability has not been a concern. Recently, IP has been proposed as a solution to the interoperability problem of low-power and lossy networks (LLNs), considering its open and standards-based architecture at the network, transport, and application layers. We present two complete and interoperable implementations of the IPv6 protocol stack for LLNs, one for Contiki and one for TinyOS, and show that the cost of interoperability is low: their performance and overhead is on par with state-of-the-art protocol stacks custom built for the two platforms. At the same time, extensive testbed results show that the ensemble performance of a mixed network with nodes running the two interoperable stacks depends heavily on implementation decisions and parameters set at multiple protocol layers. In turn, these results argue that the current industry practice of interoperability testing does not cover the crucial topic of the performance and motivate the need for generic techniques that quantify the performance of such networks and configure their run-time behavior.

Interoperability is key to widespread adoption of sensor network technology, but interoperable systems have traditionally been difficult to develop and test. We demonstrate an interoperable system development and performance diagnosis environment in which different systems, different software, and different hardware can be simulated in a single network configuration. This allows both development, verification, and performance diagnosis of interoperable systems. Estimating the performance is important since even when systems interoperate, the performance can be sub-optimal, as shown in our companion paper that has been conditionally accepted for SenSys 2011.

We present the design of the Tempo mote that operates on ambient energy harvested from the environment. Equipped with a ultra low-power timing module that acquires Coordinated Universal Time (UTC) information from a longrange radio transmitter, Tempo can persistently access the global time and is thereby resilient to power outages. A prototype implementation of the Tempo mote shows that it achieves millisecond level accuracy at 100 μA current draw. We argue that one can more generally leverage the access to global time across all nodes of a wireless sensor network to overcome the challenges related to the very tight energy budget that is inherent with harvesting ambient energy.

Most target tracking applications developed for wireless sensor networks thus far employ passive sensors which detect the target's emissions. Their performance is thereby dictated by the magnitude of the target's signal and the receivers' sensitivity. Instead, we propose using a network of low-power Doppler radars that actively measure the target's radial velocity. Nodes combine their measurements to solve a system of nonlinear equations that estimate the target's position and velocity. Because these equations have no closed-form solutions we solve them using numerical methods. These methods however can lead to local minima or even diverge in the presence of even small measurement noise. For this reason we couple the proposed numerical method with an Extended Kalman filter that models the target's movement along a straight line. Clearly the target does not always follow a linear path and so we augment this simple Kalman filter with a method that detects the target's turns and updates the filter's dynamical model accordingly. The combination of the two approaches improve tracking accuracy compared to the numerical solution alone. Results from simulations and a prototype implementation suggest that the combined solution can effectively track a mobile target with average localization error as low as 25 cm in a 10×10 m outdoor field.

Techniques for controlling the transmission power of mobile devices have been widely studied in MANETs and cellular networks. However, as mobile applications for WSNs emerge, the unique characteristics of WSNs, such as severe resource constraints, suggest that transmission power control should be revisited from a WSN perspective. In this work, we take an experimental approach to examine the effectiveness of transmission power control for WSNs that involve mobility at human walking speeds. We propose two lightweight transmission power control schemes to improve energy efficiency and spatial reuse. The first is an active probing based scheme that adjusts transmission power based on (the lack of) packet losses and applies to all low-power radios, while the second scheme requires radios that offer link quality indicators (LQI) to estimate the proximity between the transmitter and receiver. We evaluate both schemes using mobile nodes in an indoor and an outdoor environment. Results show that the energy efficiency of the proposed transmission power control schemes can be very close to that of the optimal offline strategy and our schemes significantly reduce the interference for spatial reuse. To our knowledge, this is the first work that evaluates the effect of transmission power control in mobile WSNs.

We introduce the Egs mote platform based on the Cortex M3 microcontroller that focuses on medical sensing applications. Egs uses an Atmel SAM3U microcontroller that runs up to 96 MHz and has up to 52 KB of RAM and 256 KB of Flash. Egs combines this microcontroller with two radios (802.15.4 and Bluetooth), external flash, on board sensors, and a LCD touchscreen to enable a rich set of wireless sensing applications.

We present A-MAC, a receiver-initiated link layer for low-power wireless networks that supports several services under a unified architecture, and does so more efficiently and scalably than prior approaches. A-MAC's versatility stems from layering unicast, broadcast, wakeup, pollcast, and discovery above a single, flexible synchronization primitive. A-MAC's efficiency stems from optimizing this primitive and with it the most consequential decision that a low-power link makes: whether to stay awake or go to sleep after probing the channel. Today's receiver-initiated protocols require more time and energy to make this decision, and they exhibit worse judgment as well, leading to many false positives and negatives, and lower packet delivery ratios. A-MAC begins to make this decision quickly, and decides more conclusively and correctly in both the negative and affirmative. A-MAC's scalability comes from reserving one channel for the initial handshake and different channels for data transfer. Our results show that: (i) a unified implementation is possible; (ii) A-MAC's idle listening power increases by just 1.12x under interference, compared to 17.3x for LPL and 54.7x for RI-MAC; (iii) A-MAC offers high single-hop delivery ratios, even with multiple contending senders; (iv) network wakeup is faster and far more channel efficient than LPL; and (v) collection routing performance exceeds the state-of-the-art.

Frequency overlap across wireless networks with different radio technologies can cause severe interference and reduce communication reliability. The circumstances are particularly unfavorable for ZigBee networks that share the 2.4 GHz ISM band with WiFi senders capable of 10 to 100 times higher transmission power. Our work first examines the interference patterns between ZigBee and WiFi networks at the bit-level granularity. Under certain conditions, ZigBee activities can trigger a nearby WiFi transmitter to back off, in which case the header is often the only part of the Zig-Bee packet being corrupted. We call this the symmetric interference regions, in comparison to the asymmetric regions where the ZigBee signal is too weak to be detected by WiFi senders, but WiFi activity can uniformly corrupt any bit in a ZigBee packet. With these observations, we design BuzzBuzz to mitigate WiFi interference through header and payload redundancy. Multi-Headers provides header redundancy giving ZigBee nodes multiple opportunities to detect incoming packets. Then, TinyRS, a full-featured Reed Solomon library for resource-constrained devices, helps decoding polluted packet payload. On a medium-sized testbed, BuzzBuzz improves the ZigBee network delivery rate by 70%. Furthermore, BuzzBuzz reduces ZigBee retransmissions by a factor of three, which increases the WiFi throughput by 10%.

Driven by the confluence between the need to collect data about people's physical, physiological, psychological, cognitive, and behavioral processes in spaces ranging from personal to urban and the recent availability of the technologies that enable this data collection, wireless sensor networks for healthcare have emerged in the recent years. In this review, we present some representative applications in the healthcare domain and describe the challenges they introduce to wireless sensor networks due to the required level of trustworthiness and the need to ensure the privacy and security of medical data. These challenges are exacerbated by the resource scarcity that is inherent with wireless sensor network platforms. We outline prototype systems spanning application domains from physiological and activity monitoring to large-scale physiological and behavioral studies and emphasize ongoing research challenges.

This special issue highlights the state-of-the-art enabling technologies which are critical to sensor networking and explores today's application areas as well as expected future developments.

Staff shortages and an increasingly aging population are straining the ability of emergency departments to provide high quality care. At the same time, there is a growing concern about hospitals' ability to provide effective care during disaster events. For these reasons, tools that automate patient monitoring have the potential to greatly improve efficiency and quality of health care. Towards this goal, we have developed MEDiSN , a wireless sensor network for monitoring patients' physiological data in hospitals and during disaster events. MEDiSN comprises Physiological Monitors (PMs), which are custom-built, patient-worn motes that sample, encrypt, and sign physiological data and Relay Points (RPs) that self-organize into a multi-hop wireless backbone for carrying physiological data. Moreover, MEDiSN includes a back-end server that persistently stores medical data and presents them to authenticated GUI clients. The combination of MEDiSN's two-tier architecture and optimized rate control protocols allows it to address the compound challenge of reliably delivering large volumes of data while meeting the application's QoS requirements. Results from extensive simulations, testbed experiments, and multiple pilot hospital deployments show that MEDiSN can scale from tens to at least five hundred PMs, effectively protect application packets from congestive and corruptive losses, and deliver medically actionable data.

Many threads packages have been proposed for programming wireless sensor platforms. However, many sensor network operating systems still choose to provide an event-driven model, due to efficiency concerns. We present TOS-Threads, a threads package for TinyOS that combines the ease of a threaded programming model with the efficiency of an event-based kernel. TOSThreads is backwards compatible with existing TinyOS code, supports an evolvable, thread-safe kernel API, and enables flexible application development through dynamic linking and loading. In TOS-Threads, TinyOS code runs at a higher priority than application threads and all kernel operations are invoked only via message passing, never directly, ensuring thread-safety while enabling maximal concurrency. The TOSThreads package is non-invasive; it does not require any large-scale changes to existing TinyOS code.

RACNet is a sensor network for monitoring a data center's environmental conditions. The high spatial and temporal fidelity measurements that RACNet provides can be used to improve the data center's safety and energy efficiency. RACNet overcomes the network's large scale and density and the data center's harsh RF environment to achieve data yields of 99% or higher over a wide range of network sizes and sampling frequencies. It does so through a novel Wireless Reliable Acquisition Protocol (WRAP). WRAP decouples topology control from data collection and implements a token passing mechanism to provide network-wide arbitration. This congestion avoidance philosophy is conceptually different from existing congestion control algorithms that retroactively respond to congestion. Furthermore, WRAP adaptively distributes nodes among multiple frequency channels to balance load and lower data latency. Results from two testbeds and an ongoing production data center deployment indicate that RACNet outperforms previous data collection systems, especially as network load increases.

During the past twenty years the Domain Name System (DNS) has sustained phenomenal growth while maintaining satisfactory user-level performance. However, the original design focused mainly on system robustness against physical failures, and neglected the impact of operational errors such as mis-configurations. Our measurement efforts have revealed a number of mis-configurations in DNS today: delegation inconsistency, lame delegation, diminished server redundancy, and cyclic zone dependency. Zones with configuration errors suffer from reduced availability and increased query delays up to an order of magnitude. The original DNS design assumed that redundant DNS servers fail independently, but our measurements show that operational choices create dependencies between servers. We found that, left unchecked, DNS configuration errors are widespread. Specifically, lame delegation affects 15% of the measured DNS zones, delegation inconsistency appears in 21% of the zones, diminished server redundancy is even more prevalent, and cyclic dependency appears in 2% of the zones. We also noted that the degrees of mis-configuration vary from zone to zone, with the most popular zones having the lowest percentage of errors. Our results indicate that DNS, as well as any other truly robust large-scale system, must include systematic checking mechanisms to cope with operational errors.

We introduce join scheduling algorithms that employ a balanced network utilization metric to optimize the use of all network paths in a global-scale database federation. This metric allows algorithms to exploit excess capacity in the network, while avoiding narrow, long-haul paths. We give a two- approximate, polynomial-time algorithm for serial (left-deep) join schedules. We also present extensions to this algorithm that explore parallel schedules, reduce resource usage, and define tradeoffs between computation and network utilization. We evaluate these techniques within the SkyQuery federation of Astronomy databases using spatial-join queries submitted by SkyQuery's users. Experiments show that our algorithms realize near-optimal network utilization with minor computational overhead.

We present Koala, a reliable data retrieval system designed to operate at permille (.1%) duty cycles, essential for long term environmental monitoring networks. Koala achieves these low duty cycles by letting the network's nodes sleep most of the time and reviving them through an efficient wake-up strategy whenever the gateway performs a bulk data download. Unlike other systems which consume energy to maintain consistent network state (e.g. routes, sleep schedules, etc.) across the network's nodes, Koala maintains no persistent routing state on the motes. Instead, a basestation calculates the network paths using reachability information collected by the motes. The flexible control protocol (FCP), a protocol we developed, is then used to install this routing information on the network's nodes. This paradigm of operation not only eliminates the overhead of maintaining routing state, but also significantly reduces the complexity of the networking code running on the motes. Results from simulation and an actual implementation on TinyOS 2 indicate that Koala can achieve very low duty cycles under a wide range of download and network sizes.

Innovation in gateways for data gathering sensor networks has lagged compared to advances in mote-class devices, leaving us with a limited set of options for deploying such systems. In this paper we outline the system design of a gateway that meets the hardware and software demands of data gathering networks and present a prototype implementation of this design using the popular Stargate platform. The gateway communicates with the back-end servers through a periodic query-response protocol which is robust to connectivity outages. Commands from the back-end servers instruct the gateway to wake up the sensor network, perform bulk data downloads, and finally upload the collected measurements to a remote server. We investigate mechanisms to minimize energy consumption at the gateway including completely powering it off in between query intervals and batching data uploads. While we ground our design using the Stargate device and evaluate its power consumption using different long-haul radios, we present several platforms which could become viable alternatives in terms of their cost/performance ratio.

Staff shortages and an increasingly aging population are straining the ability of emergency departments to provide high-quality care. Moreover, there is a growing concern about the ability of hospitals to provide effective care during disaster events. Tools that automate patient monitoring would greatly improve efficiency, quality of care, and the volume of patients treated. Towards this goal, we have developed MEDiSN, a wireless sensor network for monitoring patients' vital signs in hospitals and disaster events. MEDiSN consists of Patient Monitors which are custom-built, patient-worn motes that sample, compress and secure medical data, and Relay Points that form a static multi-hop wireless backbone for carrying patient data. Moreover, MEDiSN includes a back-end server that persistently stores medical data and presents them to multiple GUI clients. MEDiSN's heterogeneous architecture enables it to address the compound challenge of reliably delivering large volumes of data while meeting the application's QoS requirements.

In this paper, we measure the performance impact of anycast on DNS. We study four top-level DNS servers to evaluate how anycast improves DNS service and compare different anycast configurations. Increased availability is one of the supposed advantages of anycast and we found that indeed the number of observed outages was smaller for anycast, suggesting that it provides a mostly stable service. On the other hand, outages can last up to multiple minutes, mainly due to slow BGP convergence. We also found that anycast indeed reduces query latency. Furthermore, depending on the anycast configuration used, 37% to 80% of the queries are directed to the closest anycast instance. Our measurements revealed an inherent trade-off between increasing the percentage of queries answered by the closest server and the stability of the DNS zone, measured by the number of query failures and server switches. We believe that these findings will help network providers to deploy anycast more effectively in the future.

The academic community has long acknowledged the existence of malicious botnets, however to date, very little is known about the behavior of these distributed computing platforms. To the best of our knowledge, botnet behavior has never been methodically studied, botnet prevalence on the Internet is mostly a mystery, and the botnet life cycle has yet to be modeled. Uncertainty abounds. In this paper, we attempt to clear the fog surrounding botnets by constructing a multifaceted and distributed measurement infrastructure. Throughout a period of more than three months, we used this infrastructure to track 192 unique IRC botnets of size ranging from a few hundred to several thousand infected end-hosts. Our results show that botnets represent a major contributor to unwanted Internet traffic - 27% of all malicious connection attempts observed from our distributed darknet can be directly attributed to botnet-related spreading activity. Furthermore, we discovered evidence of botnet infections in 11% of the 800,000 DNS domains we examined, indicating a high diversity among botnet victims. Taken as a whole, these results not only highlight the prominence of botnets, but also provide deep insights that may facilitate further research to curtail this phenomenon.

The current Domain Name System (DNS) follows a hierarchical tree structure. Several recent efforts proposed to re-implement DNS as a peer-to-peer network with a flat structure that uses Distributed Hash Tables (DHT) to improve the system availability. In this paper we compare the performance and availability of these two designs, enabled by caching and redundancy in both cases. We show that the caching and redundancy mechanisms in each design are closely bound to its system structure. We further demonstrate that each of the two system structures provides unique advantages over the other, while each has its own shortcomings. Using analysis and tracedriven simulations, we show that hierarchical structure enables high performance caching and that DHT structures provide high degree of robustness against targeted attacks. We further show that the current DNS design offers engineering flexibilities which have been utilized to optimize system performance under typical Internet failures and traffic loads, and which can be further extended to overcome DNS weaknesses against the aforementioned attacks.

A landslide occurs when the balance between a hill's weight and the countering resistance forces is tipped in favor of gravity. While the physics governing the interplay between these competing forces is fairly well understood, prediction of landslides has been hindered thus far by the lack of field measurements over large temporal and spatial scales necessary to capture the inherent heterogeneity in a landslide.We propose a network of sensor columns deployed at hills with landslide potential with the purpose of detecting the early signals preceding a catastrophic event. Detection is performed through a three-stage algorithm: First, sensors collectively detect small movements consistent with the formation of a slip surface separating the sliding part of hill from the static one. Once the sensors agree on the presence of such a surface, they conduct a distributed votingalgorithm to separate the subset of sensors that moved from the static ones. In the second phase, moved sensors self-localize through a trilateration mechanism and their displacements are calculated. Finally, the direction of the displacements as well as the locations of the moved nodes are used to estimate the position of the slip surface. This information along with collected soil measurements e.g. soil pore pressures) are subsequently passed to a Finite Element Model that predicts whether and when a landslide will occur.Our initial results from simulated landslides indicate that we can achieve accuracy in the order of cm in the localization as well as the slip surface estimation steps of our algorithm. This accuracy persists as the density and the size of the sensor network decreases as well as when considerable noise is present in the ranging estimates. As for our next step, we plan to evaluate the performance of our system in controlled environments under a variety of hill configurations.

Science is increasingly driven by data collected automatically from arrays of inexpensive sensors. The collected data volumes require a different approach from the scientists' current Excel spreadsheet storage and analysis model. Spreadsheets work well for small data sets; but scientists want high level summaries of their data for various statistical analyses without sacrificing the ability to drill down to every bit of the raw data. This demonstration describes our prototype data analysis system that is suitable for browsing and visualization - like a spreadsheet - but scalable to much larger data sets.

The cost savings and novel features associated with voice over IP (VoIP) are driving its adoption by service providers. Unfortunately, the Internet's best effort service model provides no quality of service guarantees. Because low latency and jitter are the key requirements for supporting high-quality interactive conversations, VoIP applications use UDP to transfer data, thereby subjecting themselves to quality degradations caused by packet loss and network failures. In this paper, we describe an architecture to improve the performance of such VoIP applications. Two protocols are used for localized packet loss recovery and rapid rerouting in the event of network failures. The protocols are deployed on the nodes of an application-level overlay network and require no changes to the underlying infrastructure. Experimental results indicate that the architecture and protocols can be combined to yield voice quality on par with the public switched telephone network

Router queues buffer packets during congestion epochs. A recent result by Appenzeller et al. showed that the size of FIFO queues can be reduced considerably without sacrificing utilization. While Appenzeller showed that link utilization is not affected, the impact of this reduction on other aspects of queue management such as fairness, is unclear. Recently, a new class of low-rate DoS attacks called shrews was shown to throttle TCP connections by causing periodic packet drops. Unfortunately, smaller buffer sizes make shrew attacks more effective and harder to detect since shrews need to overflow a smaller buffer to cause drops. In this paper, we investigate the relation between buffer size and the shrew sending rate required to cause damage. Using a simple mathematical model, we show that a relatively small increase in the buffer size over the value proposed by Appenzeller is sufficient to render the shrew attack ineffective. Intuitively, bigger buffers require the shrews to transmit at much higher rates to fill the router queue. However, by doing so, shrews are no longer low-rate attacks and can be detected by active queue management (AQM) techniques such as RED-PD. We verified our analysis through simulations showing that a moderate increase in the buffer size, coupled with an AQM mechanism is adequate to achieve high link utilization while protecting TCP flows from shrew attacks.

The cost savings and novel features associated with Voice over IP (VoIP) are driving its adoption by service providers. Such a transition however can successfully happen only if the quality and reliability offered is comparable to the existing PSTN. Unfortunately, the Internet's best effort service model provides no inherent quality of service guarantees. Because low latency and jitter is the key requirement for supporting high quality interactive conversations, VoIP applications use UDP to transfer data, thereby subjecting themselves to performance degradations caused by packet loss and network failures.In this paper we describe two algorithms to improve the performance of such VoIP applications. These mechanisms are used for localized packet loss recovery and rapid rerouting in the event of network failures. The algorithms are deployed on the routers of an application-level overlay network and require no changes to the underlying infrastructure. Initial experimental results indicate that these two approaches can be composed to yield voice quality on par with the PSTN.

In this paper we outline a sensor network for landslide detection. Network sensors deployed on the surface and underground the hill under observation, use distributed signal processing techniques to self-localize and detect any changes in their relative locations. When such movements occur, changes in location as well as soil parameters are passed to a central location and used as input to a Finite Element Model that predicts whether and when a landslide will occur.

We present the initial results from our evaluation study on the performance implications of anycast in DNS, using four anycast servers deployed at top-level DNS zones. Our results show that 15% to 55% of the queries sent to an anycast group, are answered by the topologically closest server and at least 10% of the queries experience an additional delay in the order of 100ms. While increased availability is one of the supposed advantages of anycast, we found that outages can last up to multiple minutes, mainly due to slow BGP convergence. On the other hand, the number of outages observed was fairly small, suggesting that anycast provides a generally stable service.

Overlay networks represent an emerging technology for rapid deployment of novel network services and applications. However, since public overlay networks are built out of loosely coupled end-hosts, individual nodes are less trustworthy than Internet routers in carrying out the data forwarding function. Here we describe a set of mechanisms designed to detect and repair errors in the data stream. Utilizing the highly redundant connectivity in overlay networks, our design splits each data stream to multiple sub-streams which are delivered over disjoint paths. Each sub-stream carries additional information that enables receivers to detect damaged or lost packets. Furthermore, each node can verify the validity of data by periodically exchanging Bloom filters, the digests of recently received packets, with other nodes in the overlay. We have evaluated our design through both simulations and experiments over a network testbed. The results show that most nodes can effectively detect corrupted data streams even in the presence of multiple tampering nodes.

During the past twenty years the Domain Name System (DNS) has sustained phenomenal growth while maintaining satisfactory performance. However, the original design focused mainly on system robustness against physical failures, and neglected the impact of operational errors such as misconfigurations. Our recent measurement effort revealed three specific types of misconfigurations in DNS today: lame delegation, diminished server redundancy, and cyclic zone dependency. Zones with configuration errors suffer from reduced availability and increased query delays up to an order of magnitude. Furthermore, while the original DNS design assumed that redundant DNS servers fail independently, our measurements show that operational choices made at individual zones can severely affect the availability of other zones. We found that, left unchecked, DNS configuration errors are widespread, with lame delegation affecting 15% of the DNS zones, diminished server redundancy being even more prevalent, and cyclic dependency appearing in 2% of the zones. We also noted that the degrees of misconfiguration vary from zone to zone, with most popular zones having the lowest percentage of errors. Our results indicate that DNS, as well as any other truly robust large-scale system, must include systematic checking mechanisms to cope with operational errors.

As a soft-state protocol, RSVP specifies that each RSVP node sends periodic control messages to maintain the state for active RSVP sessions. The protocol overhead due to such periodic messages grows linearly with the number of RSVP sessions. One may reduce the overhead by using a longer refresh period, which unfortunately leads to longer delays in re-synchronizing RSVP state. In this paper we introduce a novel "state-compression" approach to reducing the overhead of periodic refreshes. Instead of per session refresh messages, an RSVP node sends periodically to each of its neighbor node a digest message that contains a compressed version of the entire RSVP state shared with that particular neighbor. In order to speed up state synchronization in face of message losses we also enhance RSVP with an acknowledgment mechanism. Our mechanisms achieve a constant message transmission overhead and low delay while retaining the soft-state nature of the RSVP protocol.

With advances in packet routing technology, and resource reservation protocols, the Internet is expected to provide ubiquitous integrated transport of speech, audio, video, and other real-time multimedia data in addition to the current best effort data traffic. Such integrated transport will also need to be supported for the increasing number of mobile users who access the Internet over wireless access networks, using Mobile-IP to retain continual IP connectivity. We present a simple quality of service (QoS) signaling protocol for mobile users in an integrated service Internet. The protocol works by combining pre-provisioned RSVP tunnels with Mobile IP. Our protocol, even-though simple, captures the essence of QoS provisioning for wireless and mobile networks. The wireless medium provides a completely different medium than wires, and therefore one's expectations from it should be different. Service quality is inherently mobility dependent, and intermittent disconnections are bound to happen. It is not the signaling protocol's task to completely overcome or conceal transient conditions from applications, but rather applications should try to adapt. Our approach can be easily implemented today with minimal changes to other components of the Internet architecture. We also evaluate the application level performance impact of the QoS provisioning delays associated with our protocol on a prototypical packet speech application with various playout buffering strategies, and compare against the performance of the ordinary RSVP protocol suite with Mobile IP.