Virtualization is a foundational technology in modern cloud computing. However, it is subject to security threats such as malicious co-located tenants, hypervisor vulnerabilities, and side-channel attacks. Such a threat is countered by deploying advanced and complex security solutions that have significant performance overhead.Prior work on VMs and containers has mainly evaluated basic security solutions, such as firewalls, using narrow performance metrics and synthetic models within limited evaluation frameworks. These studies often overlook advanced security modules in both user and kernel space, lack flexibility to incorporate emerging features, and fail to capture detailed system-level impacts. To address these gaps, we present VirtShield, an open-source framework for unified security testing in VMs and containers that mimics realistic cloud infrastructures. VirtShield supports advanced security modules across user and kernel space, providing rich, system-level performance metrics for comprehensive evaluation.Our evaluation shows that containers generally outperform VMs due to their lower virtualization overhead, achieving a throughput of 9.38 Gb/s compared to 1.98 Gb/s for VMs. However, VMs are comparable for kernel-space deployments, as Docker utilizes the shared kernel space Docker bridge, which can result in packet congestion. In latency-sensitive workloads, VM access latency (14.91 ms) is comparable to Docker (12.86 ms). In storage benchmarks (FIO), however, VMs outperform Docker due to the overhead of Docker’s layered, copy-on-write file system, whereas VMs leverage optimized virtual block devices with near-native I/O performance. These results highlight essential trade-offs in partitioning security workloads between user and kernel space, as well as across containerized and virtualized environments.

Darknet traffic classification is challenging due to the use of different obfuscation techniques. In this paper, we rely on Explainable Artificial Intelligence (XAI) techniques such as LIME and SHAP to identify the most relevant features of Darknet traffic, and use combinations of these features to train deep learning models such as Convolutional Neural Networks and Long-Short Term Memory neural networks for classification. Our results on realistic datasets lead to a classification accuracy of 95% when pertinent features are used, compared to only 87% when all features considered; thus increasing the classification accuracy while reducing the cost.

Position tracking functionality has many applications and is becoming increasingly important. While many position tracking systems, such as GPS and eLoran, are available, none of the existing systems are capable of indoor/outdoor localization with close to one-meter accuracy. In this paper, we aim to fill this gap by proposing a terrestrial position tracking system relying on low-frequency chirp signals and enhancing the distance resolution using zero padding. Experimental results highlight the efficacy of our proposal.

Live video streaming is becoming increasingly prevalent in today’s Internet landscape. Current streaming solutions struggle to maintain low latency while delivering high-quality content, particularly under varying network conditions. In this paper, we investigate the effectiveness of different adaptive streaming algorithms over TCP and QUIC protocols as potential solutions for low-latency live streaming. Our results reveal a fundamental trade-off between quality-focused and stabilityfocused algorithms. These findings provide practical guidelines for algorithm selection in live streaming applications and identify the need for new algorithms that better balance quality and stability.

Virtual Private Networks are effective in bypassing Internet censorship. Extensive research has been done to obfuscate VPN traffic in order to circumvent control filtering. In this paper, we introduce a new threat model in which a censorship body can use home routers running a custom firmware or an embedded OS to identify VPN connections. Monitoring network traffic at home routers enables efficient and accurate fingerprinting of VPN traffic before the traffic is NATed to the Internet. The proposed model leverages a vulnerability in VPN implementations. Experimental results highlight its ability to fingerprint with negligible false positives/negatives. The purpose of the study is to increase awareness of this issue and inspire others to take this threat model as a reasonable risk that needs to be addressed.

In this paper, we investigate the feasibility of jamming the Helium network devices in the presence of multiple hotspots. We introduce the Wolfpack algorithm, which identifies the minimum number of jammers that are needed, and their appropriate locations relative to the devices to be jammed. Theoretical analysis and experimental results highlight the risks, the resilience of hotspot redundancy to jamming attacks, and the edge that jammers can have with more powerful hardware.

QUIC is a transport protocol that was proposed by Google and standardized by the Internet Engineering Task Force (IETF). The protocol is gaining popularity, and there seems to be an urge to use it in several use cases and applications. However, while some research efforts have demonstrated performance improvements by switching to QUIC, others have shown performance degradation. In this paper, we conduct a thorough investigation of QUIC under different network and workload conditions, both in a controlled environment and in the wild. Our results highlight the conditions in which QUIC excels and when it underperforms and provide a foundation for an educated choice of the transport protocol based on the constraints and needs of a specific use case.

Open vSwitch has become increasingly popular in the network virtualization world due to its flexible, flow-based forwarding scheme. However, this flexibility comes at a performance cost. To mitigate the cost, in recent years, organizations have begun to download flow-table entries to a hardware cache to improve throughput. This mechanism is known as OVS Offload. In this paper, we introduce MEG, a new algorithm to select flow candidates for offload that minimizes the offload cost while maintaining a high hardware cache hit ratio. MEG builds on a measurement study of traffic handled by Internet core routers. Experimental results reveal that MEG outperforms other offload algorithms and traditional OVS.

In this paper, we introduce MASS, a Multiple channel Access solution for constrained devices relying on M-Ary direct sequence Spread Spectrum. MASS is uncoordinated in the sense that it does not require a per-device pre-shared key with the access point. It does not require per-device signal power adaptation to counter the popular near-far problem, and does not assume fixed size messages. As such, MASS does not need expensive coordination or complex hardware for the constrained sensors, and its multi-access solution leads to higher throughput and longer (and more predictable) lifetimes for constrained IoT devices compared to typical contention-based media access protocols. These benefits are achieved by trading-off the processing capacity at powerful access points for more efficient communication and more power savings for resource-constrained devices. Experimental results highlight the efficacy of MASS communication.

Power efficiency is an important aspect of the design of any commercial network infrastructure. With measurement studies revealing that the utilization of forwarding devices does not exceed 40% most of the time, it becomes natural to design these devices with power-proportionality in mind; i.e., consuming less power when under-utilized, and more power when highly utilized. While power-proportionality by itself offers power savings, it opens the door for potential extra power savings when traffic is carefully routed across the network to achieve the utilization at devices leading to an optimized overall power consumption. Towards this end, we study different power-proportional models that mimic current industry standards, show how flow rates in a network can be orchestrated by networking devices to minimize the overall power consumption, and study the merit of putting devices to sleep. Our conclusions provide important network design and management guidelines for efficient operation of networking infrastructures.

Today’s networks are seeing a large influx of Internet connected devices that reside primarily on the edge of the network. Many of these devices, such as Internet of Things (IoT) devices, are resource constrained both by storage capacity and power requirements that limit a device’s Internet availability. Several interesting architectures have been proposed to address security, device management, configuration, and multi-party interaction concerns using blockchain technology. These architectures require a trusted intermediary to interact with the blockchain on behalf of the edge device. This introduces a single point of failure in trust and security. This paper proposes a novel adaptation of blockchain technology to enable these edge devices to interact and participate with a blockchain without requiring a trusted intermediary. The proposed architecture provides a flexible and extensible framework that enables multi party interactions to take place at the edge of the network. The efficacy of the proposed design is demonstrated through theoretical analysis and by an application to a network of resource constrained IoT devices.

In this paper, we study some of the security pitfalls present in the OpenFlow protocol, which plays a central role in Software Defined Networks. Specifically, we introduce information disclosure attacks capable of identifying idle and hard timeout values, and the number of free entries in the flow tables at SDN switches. We then leverage this information to mount Denial of Service (DoS) attacks using a small number of packets and without flooding the SDN network, making it harder to detect. Experimental results indicate that mounting the proposed attack leads to delays and packet losses for legitimate flows. We further propose solutions to detect and mitigate similar attacks.

Network attacks are becoming ever more sophisticated and are able to hide more easily in the increasing amount of traffic being generated by everyday activity. Administrators are placed in the unfortunate position of distinguishing between the two. The attack graph has been in use for some time because it provides a concise knowledge representation, and has had successful security metrics developed from it. Previous methods of attack plan recognition have relied on statistical inference to capture network attacks, however they are computationally expensive and can fail to capture obvious cause and effect relationships. In this paper, we use automated planning to capture new properties of attack graphs and use it for plan recognition. Experimental results demonstrate the efficacy of our approach.

Distributed databases have received a tremendous amount of attention in recent years due to the explosive growth in data facilitated by the Internet. This trend has further accelerated with the emergence of easy to use “Big Data” processing techniques such as Map/Reduce in combination with infrastructure and platform as a service offerings such as AmazonWeb Services. Distributed databases have tended to focus on partitioning and replicating data across a cluster, since that is the most common inhibitor to scalability. However, there are cases where the data is relatively bounded and has higher availability requirements such as very low latency, which has not been so thoroughly studied. In this paper we investigate the scalability properties of “Small Data”, in which a large set of small values needs to be globally replicated with latency dominating consistency requirements.

Advances in the development of large scale distributed computing systems such as Grids and Computing Clouds have intensified the need for developing scheduling algorithms capable of allocating multiple resources simultaneously. In principle, the required resources may be allocated by sequentially scheduling each resource individually. However, such a solution can be computationally expensive, hence inappropriate for time-sensitive applications, and may lead to deadlocks. In this work we present an efficient online algorithm for co-allocating resources that also provides support for advance reservations. The algorithm utilizes data structures specifically designed to organize the temporal availability of resources, and implements co-allocation through efficient range searches that identify all available resources simultaneously. We use simulations driven by real workloads to show that the co-allocation algorithm scales to systems with large numbers of users and resources, and we perform an in-depth comparative analysis against existing batch scheduling mechanisms. Our findings indicate that the online scheduling algorithms may achieve higher utilization while providing smaller delays and better QoS guarantees without adding much complexity.

The performance of mobile ad hoc networks (MANETs) is influenced by many factors including node mobility, node density, and wireless transmission range. The dynamics induced by these factors along the paths between MANET nodes affect node connectivity. Research efforts aiming at quantifying such path dynamics are limited (1) considering only the impact of a small number of factors, mostly node mobility; (2) quantifying only some path metrics, mainly the distribution of path lifetime and the expected path lifetime; and (3) relying mainly on simulation rather than analysis. In this paper, we provide closed form equations relating node mobility, node density, and wireless transmission range to path dynamics in MANETs as expressed by the path lifetime, the path churn rate and the path frequency. The closed form equations reveal interesting aspects of MANET performance and can be used in optimizing MANET routing protocols and applications.

The characteristics of node-pair paths are a primary consideration in the design of routing protocols in mobile ad-hoc networks (MANETs). Existing research studies on MANET paths focus on their dynamics in the presence of node mobility and ignore the impact of network configuration such as node density and node transmission range. In this paper, we study MANET paths using a smooth mobility model, which complies with the physical law of smooth motion and is sensitive to the change of node velocity over small timescales. Our study reveals that for paths connecting nodes with slow mobility through a small number of hops, path stability and availability are dominated by network configuration; whereas, for paths connecting nodes with moderate/fast mobility through a large number of hops, they are dominated by node mobility.

Support for advance reservations of resources plays a key role in Grid resource management as it enables the system to meet user expectations with respect to time requirements and temporal dependence of applications, increases predictability of the system and enables co- allocation of resources. Despite these attractive features, adoption of advance reservations is limited mainly due to the fact that related algorithms are typically complex and fail to scale to large and loaded systems. In this work we consider two aspects of advance reservations. First, we investigate the impact of heterogeneity on Grid resource management when advance reservations are supported. Second, we employ techniques from computational geometry to develop an efficient heterogeneity-aware scheduling algorithm. Our main finding is that Grids may benefit from high levels of resource heterogeneity, independently of the total system capacity. Our results show that our algorithm performs well across several user and system performance and overcome the lack of scalability and adaptability of existing mechanisms.

In this paper, we introduce a search engine, Dgoogle, designed for large scale P2P systems. Dgoogle is purely text- based, does not organize documents based on pre-defined keywords or based on their semantics. It is simple to implement and can tolerate variations in the wording of text queries. Compared to existing proposals, such as Inverted Indices, Dgoogle does not stress network bandwidth and offers an order of magnitude of savings in storage overhead and in the response time to user queries. Furthermore, Dgoogle's performance is not affected by long queries or by processing popular query words. Simulation results validate the efficacy of our proposal.

Router-level maps of the Internet implicate a large body of research on network management, overlay networks, performance evaluation, and security. The inaccuracies in these maps result in misleading conclusions. In this paper, we propose AROMA (accurate router-level map), a tool to infer router-level, layer-3 maps of the Internet. AROMA uncovers more routers and links in targeted (mapped) networks than existing tools with less probing overhead. For example, AROMA reveals the same number of routers and links as the Rocketfuel tool after sending less than 5.1% of the number of probes used by Rocketfuel, and reveals at least 100% more links and routers than Rocketuel while using the same number of probe packets. We use AROMA to draw the maps of four major ISP networks and revisit the conclusions drawn by earlier research on the Internet IP structure. Surprisingly, AROMA maps consistently reveal that core routers have a higher degree than edge routers in contrast to the recently suggested higher connectivity of routers at the network edge. The maps also reveal that routers' degree distribution follows a power-law in contrast to the recently suggested Weibull distribution.

In this paper, we investigate the impact of layer-2 devices on our perception of the Internet IP topology and on the performance and security of the Internet. We make the case that a power law connectivity observed in the Internet IP topology is not an illusion as suggested by some researchers. It is mainly manifested due to the blindness of traceroute to layer-2 devices, and this manifestation will persist independent of the nature of the underlying physical topology. Furthermore, we make the case that the Internet physical topology is not likely to have a power law connectivity. Our conclusions challenge common wisdom about the Internet topology and highlight the need for more thorough investigations.

Distributed hash tables (DHTs) provide efficient data naming and location with simple hash-table-like primitives, upon which sophisticated distributed applications can be built. DHT users providefreebutunstablepeer-to-peer (P2P) capacity. With stable DHT nodes being relatively scarce, a DHT can either rely on a small set of stable nodes with limited collective capacity, or a larger set of potentially less stable nodes and suffer maintenance and data redundancy overhead. In this paper, we provide an analytical model that captures the tradeoff between the stability and the scalability in DHT-based P2P systems. We use the model to demonstrate that the DHT throughput can be optimized through careful engineering of DHT node selection and data redundancy parameters.

We consider the problem of providing QoS guarantees to Grid users through advance reservation of resources. Advance reservation mechanisms provide the ability to allocate resources to users based on agreed-upon QoS requirements and increase the predictability of a Grid system, yet incorporating such mechanisms into current Grid environments has proven to be a challenging task due to the resulting resource fragmentation. We use concepts from computational geometry to present a framework for tackling the resource fragmentation, and for formulating a suite of scheduling strategies. We also develop efficient implementations of the scheduling algorithms that scale to large Grids. We conduct a comprehensive performance evaluation study using simulation, and we present numerical results to demonstrate that our strategies perform well across several metrics that reflect both user-and system-specific goals. Our main contribution is a timely, practical, and efficient solution to the problem of scheduling resources in emerging on-demand computing environments.

The development and deployment of distributed network-aware applications and services require the ability to compile and maintain a model of the underlying network resources with respect to one or more characteristic properties of interest. To be manageable, such models must be compact; and to be general-purpose, should enable a representation of properties along temporal, spatial, and measurement resolution dimensions. In this paper, we propose MINT - a general framework for the construction of such metric-induced models using end-to-end measurements. We present the basic theoretical underpinnings of MINT for a broad class of performance metrics, and describe PERISCOPE, a Linux embodiment of MINT constructions. We instantiate MINT and PERISCOPE for a specific metric of interest - namely, packet loss rates - and present results of simulations and Internet measurements that confirm the effectiveness and robustness of our constructions over a wide range of network conditions.

High-speed networks with large delays present a unique environment where TCP may have a problem utilizing the full bandwidth. Several congestion control proposals have been suggested to remedy this problem. The existing protocols consider mainly two properties: TCP friendliness and bandwidth scalability. That is, a protocol should not take away too much bandwidth from standard TCP flows while utilizing the full bandwidth of high-speed networks. This work presents another important constraint, namely, RTT (round trip time) unfairness where competing flows with different RTTs may consume vastly unfair bandwidth shares. Existing schemes have a severe RTT unfairness problem because the congestion window increase rate gets larger as the window grows ironically the very reason that makes them more scalable. RTT unfairness for high-speed networks occurs distinctly with drop tail routers for flows with large congestion windows where packet loss can be highly synchronized. After identifying the RTT unfairness problem of existing protocols, This work presents a new congestion control scheme that alleviates RTT unfairness while supporting TCP friendliness and bandwidth scalability. The proposed congestion control algorithm uses two window size control policies called additive increase and binary search increase. When the congestion window is large, additive increase with a large increment ensures square RTT unfairness as well as good scalability. Under small congestion windows, binary search increase supports TCP friendliness. The simulation results confirm these properties of the protocol.

Accurate measurement of network bandwidth is crucial for network management applications as well as flexible Internet applications and protocols which actively manage and dynamically adapt to changing utilization of network resources. Extensive work has focused on two approaches to measuring bandwidth: measuring it hop-by-hop, and measuring it end-to-end along a path. Unfortunately, best-practice techniques for the former are inefficient, and techniques for the latter are only able to observe bottlenecks visible at end-to-end scope. In this paper, we develop end-to-end probing methods which can measure bottleneck bandwidth along arbitrary, targeted subpaths of a path in the network, including subpaths shared by a set of flows. We evaluate our technique through extensive ns simulations, then provide a comparative Internet performance evaluation against hop-by-hop techniques. We also describe a number of applications which we foresee as standing to benefit from solutions to this problem, ranging from network troubleshooting and capacity provisioning to optimizing the layout of application-level overlay networks to optimized replica placement.

The development and deployment of distributed network-aware applications and services require the ability to compile and maintain a model of the underlying network resources with respect to (one or more) characteristic properties of interest. To be manageable, such models must be compact, and to be general-purpose, they should enable a representation of properties along temporal, spatial, and measurement resolution dimensions. We propose MINT - a general framework for the construction of such metric-induced models using end-to-end measurements. We present the basic theoretical underpinnings of MINT for a broad class of metrics obeying certain properties. We instantiate MINT for two metrics of interest, namely packet loss rates and bottleneck bandwidth. For the loss rate metric, we leverage previously proposed end-to-end techniques for the estimation of shared losses to characterize loss topologies. We present results of simulations and Internet measurements that confirm the effectiveness and robustness of our loss topology constructions over a wide range of network conditions.

Current Internet transport protocols make end-to-end measurements and maintain per-connection state to regulate the use of shared network resources. When two or more such connections share a common endpoint, there is an opportunity to correlate the end-to-end measurements made by these protocols to better diagnose and control the use of shared resources. We develop packet probing techniques to determine whether a pair of connections experience shared congestion. Correct, efficient diagnoses could enable new techniques for aggregate congestion control, QoS admission control, connection scheduling and mirror site selection. Our extensive simulation results demonstrate that the conditional (Bayesian) probing approach we employ provides superior accuracy, converges faster, and tolerates a wider range of network conditions than previously proposed memoryless (Markovian) probing approaches.