JavaScript interpreters, crucial for modern web browsers, require an effective fuzzing method to identify security-related bugs. However, the strict grammatical requirements for input present significant challenges. Recent efforts to integrate language models for context- aware mutation in fuzzing are promising but lack the necessary coverage guidance to be fully effective. This paper presents a novel technique called CovRL (Coverage-guided Reinforcement Learning) that combines Large Language Models (LLMs) with Reinforcement Learning (RL) from coverage feedback. Our fuzzer, CovRL-Fuzz, integrates coverage feedback directly into the LLM by leveraging the Term Frequency-Inverse Document Frequency (TF-IDF) method to construct a weighted coverage map. This map is key in calculating the fuzzing reward, which is then applied to the LLM-based mutator through reinforcement learning. CovRL-Fuzz, through this approach, enables the generation of test cases that are more likely to discover new coverage areas, thus improving bug detection while minimizing syntax and semantic errors, all without needing extra post-processing. Our evaluation results show that CovRL-Fuzz outperforms the state-of-the-art fuzzers in enhancing code coverage and identifying bugs in JavaScript interpreters: CovRL-Fuzz identified 58 real-world security-related bugs in the latest JavaScript interpreters, including 50 previously unknown bugs and 15 CVEs.

VM (Virtual Machine) live migration is a server virtualization technique for deploying a running VM to another server node while minimizing downtime of service the VM provides. Currently, in cloud data centers, VM live migration is widely used to apply load balancing on CPU workload and network traffic, to reduce electricity consumption, and to provide uninterrupted service during the maintenance of hardware and software updates on servers. It is critical to use VM live migration as a prevention or mitigation measure for possible failure when its indications are detected or predicted. Especially in NFV (Network Function Virtualization) environment, timely use of VNF (Virtual Network Function) live migration can maintain system availability and reduce operator's loss due to service failure. In this paper, we propose a proactive live migration method for vEPC (Virtual Evolved Packet Core) based on failure prediction. A machine learning model learns periodic monitoring data of resource usage and logs from servers and VMs/VNFs to predict future vEPC paging failure probability. We implemented the proposed method in OpenStack-based NFV environment to evaluate the real service performance gains for open source vEPC implementations.

FPGAs are field-programmable and reconfigurable integrated circuits; consequently, they entail numerous security concerns. For example, malicious functions such as hardware Trojans (HTs), can be inserted into the circuits in both development and deployment stages, as malicious fabrication and modification are possible even after deployment. Therefore, to detect HTs in FPGAs effectively, it is necessary to exploit both netlists available at the development stage and bitstreams available at deployment stage; this is in contrast with existing approaches, which require source code or gate-level netlists. In achieving this, we encounter two major challenges: effectively exploiting FPGA netlists closer to bitstreams for HTs detection and reverse-engineering bitstreams to netlists at an acceptable level. To address these problems, we develop a bidirectional mechanism for detecting HTs in FPGAs at any stage. To the best of our knowledge, this is the first study on bidirectional HT detection in FPGAs. To address the first challenge, we focus on LUT-level netlists; regarding the second challenge, we directly reverse-engineer bitstreams to LUT-level netlists. For HTs detection, we employ features extracted from LUT-level netlists, which can also be derived from reversed bitstreams and used to identify HTs. We design and implement our system for experimental studies. The experiments achieve a TPR of more than 99.3% and an FPR of less than 0.15% for 15 TrustHub benchmarks in forward and backward (reverse) directions for FPGA Virtex-5 devices.

Network softwarization paradigms such as SDN and NFV provide network operators with advantages in terms of scalability, cost and resource efficiency, as well as flexibility. However, in order to fully reap these benefits and cope with new challenges regarding the heterogeneity of user demands and an ever-growing service landscape, management and operation of such networks requires a high degree of automation that ensures fast and proactive decision making. With the recent success of machine learning (ML) across numerous domains, a shift from traditional rule-based policies towards ML-based approaches in the context of network management is taking place. Although many individual contributions cover use cases such as predicting various network characteristics or optimizing the configuration of components, a fully integrated architecture for achievingNetwork Intelligenceis still missing. Hence, in this work, we propose such an architecture that combines the capabilities of softwarized networks with ML-based management. The contribution of this article is threefold: first, we present the proposed architecture alongside its components. Second, we implement a proof-of-concept version of all components in our OpenStack-based testbed. Finally, we demonstrate in a case study regarding VNF resource prediction how the proposed architecture can be used to generate realistic data sets to train and evaluate ML-based models for this task.

Service Function Chaining (SFC) can be a basic deployment unit that composes a chaining order of required network functions to provide a network service. With the proliferation of Software-Defined Networking (SDN) and cloud computing, such virtualized network functions can be dynamically deployed in different sites, depending on SFC requests. While offering the advantages of flexibility and efficiency, this also leaves management complexity and room for optimization where Machine Learning (ML) can be applicable to solve the problems based on monitoring data. In this paper, we treat SFC as a problem of finding a best source-to-destination routing path from multiple candidates with different link costs and a required traversal order of network functions. There are many mathematical approaches that ensure best optimum but not scalable to the problem size, whereas our approach hides underlying considerations by applying ML technique on measured SFC data to quickly find suboptimal routing paths on a new SFC request, based on their predicted network performance such as the number of successful requests or end-to-end delay. So, we developed a measurement system that records the performance and path costs of SFCs in emulated networks with different per link costs and chain lengths. Then, we evaluate four different ML models for the approach described above.

In addition to providing network operators with benefits in terms of flexibility and cost efficiency, softwarization paradigms like SDN and NFV are key enablers for the concept of Service Function Chaining (SFC). The corresponding networks need to support a wide range of services and applications with highly dynamic temporal profiles and heterogeneous demands. Hence, efficient management and operation of such networks requires a high degree of automation that is paired with fast and proactive decisions in order to cope with these phenomena. In particular, determining the optimal number of VNF instances that is required for accommodating current and upcoming demands is a crucial task that also affects subsequent management decisions. To enable fast and proactive decisions in this context, we propose a machine learning-based approach that uses recent monitoring data to predict whether to adapt the current number of VNF instances of a given type. Furthermore, we present a work flow for generating labeled training data that reflects temporal dynamics and heterogeneous demands of real world networks. In addition to demonstrating the feasibility of the approach in a case study, we provide guidelines regarding the choice of monitoring data that should be collected for reliable prediction as well as the amount of data that is required to train such a predictor.

The OS kernel, which has entire system privileges, is an attractive target of attackers. To reduce this threat, we need to find security bugs in the kernel prior to the attackers, and system call fuzzing is a widely used technique for this purpose. However, many system call fuzzers have not been evaluated for coverage performance which is an important indicator in fuzzing. In this poster, we propose a methodology to evaluate the code coverage performance of system call fuzzers with a strategy that combines virtualization and Intel Processor Trace (PT). First, we extract all the functions in the kernel that can be executed by system calls. Then we perform fuzzing with the target system call fuzzer on the guest OS, and record coverage information by leveraging the Intel PT. Finally, we evaluate system call fuzzers by comparing the list of functions related to system calls with the executed functions logged by Intel PT while fuzzing.

In addition to providing network operators with benefits in terms of flexibility and cost efficiency, softwarization paradigms like SDN and NFV are key enablers for the concept of Service Function Chaining (SFC). The corresponding networks need to support a wide range of services and applications with highly heterogeneous requirements that change dynamically during the network's lifetime. Hence, efficient management and operation of such networks requires a high degree of automation that is paired with fast and proactive decisions in order to cope with these phenomena. In particular, determining the optimal number of VNF instances that is required for accommodating current and upcoming demands is a crucial task that also affects subsequent management decisions. To enable fast and proactive decisions in this context, we propose a machine learning-based approach that uses recent monitoring data to predict whether to adapt the current number of VNF instances of a given type. Furthermore, we present a methodology for generating labeled training data that reflects temporal dynamics and heterogeneous demands of real world networks. We demonstrate the feasibility of the approach using two different network topologies that represent WAN and mobile edge computing use cases, respectively. Additionally, we investigate how well the models generalize among networks and provide guidelines regarding the prediction horizon, i.e., how far ahead predictions can be performed in a reliable manner.

Software-Defined Networking (SDN) and Network Function Virtualization (NFV) greatly facilitate network service management. Specifically, these new network paradigms help manage the network environment dynamically and cost-efficiently. Virtual Network Function (VNF) and Service Function Chaining (SFC) are important aspects of the NFV environment. In terms of NFV management, resource demand of VNFs can be predicted at a future time to handle Quality of Service (QoS) and resource allocation problems efficiently. Hence, researchers study and build a management system where machine-learning-based predictions of VNF information are used to handle auto-scaling, deployment and migration of VNFs. In addition, in recent studies, these systems have involved SFC to obtain useful information, not just a lone VNF. However, not many of studies explain clearly how chaining dependency among VNFs in a SFC can be used to predict future resource demand of a VNF. In this paper, we introduce VNF resource prediction machine learning model that maximizes the benefits of using SFC. Then, we compare several machine learning models and analyze how SFC data can help predict resource usage patterns of VNFs. We also show benefits of Attention model to improve prediction accuracy and convergence time through experiments.

Software-Defined Networking (SDN) and Network Function Virtualization (NFV) are paradigms that help administrators to manage dynamic networks. While SDN allows centralized network control, NFV provides flexible and scalable Virtual Network Functions (VNFs). These paradigms are also enablers for concepts such as Service Function Chaining (SFC) where chains are composed of several VNFs to provide a specific service. However, in order to maximize the benefits from the above-mentioned flexibility, new research questions need to be addressed, e.g., regarding effective management processes for dynamic networks. We proposed a novel learning model based on the flexibility of softwarization and abundant volume of monitoring data in NFV environments to predict VNF resource demands using SFC data. Our model is based on Context and Aspect Embedded Attentive Target Dependent Long Short Term Memory (CAT-LSTM) that consists of Target-Dependent LSTM (TD-LSTM), context embedding, aspect embedding, and attention. We developed this model to obtain high accuracy for the prediction of VNF resources such as the CPU. Our model uses two labeling systems: the qualitative resource state and the quantitative resource usage, both of which are used to evaluate its performance. This assists the administrator in understanding the network conditions, improves prediction performance, and provides practically useful information. Our learning model for predicting VNF resource demands can be utilized to solve essential SFC problems such as auto-scaling and optimal placement, which in turn prevent service interruption and provide high reliability.

Currently, server (host) virtualization technology that brings effective use of server resources to a data center is promising as cloud services are being prevalent with increasing traffic volumes and requirements for higher service quality. Proposed network TAP, named vTAP (Virtual Test Access Port), overcomes the problem that existing hardware TAP devices cannot be utilized for virtual network links to monitor traffic among virtual machines (VMs) at a packet level. vTAP can be implemented by a virtual switch that gives network connectivity to VMs by switching packets over the virtual network links. The port mirroring feature of a virtual switch can be a naive solution to provide packet level monitoring among VMs. However, using the feature in an environment that needs to treat large volume of network traffic with low delay such as NFV (Network Function Virtualization) incurs performance degradation in packet switching capability of the switch and error-prone manual configurations. This paper provides design and implementation approaches to vTAP using Open vSwitch with DPDK (Data Plane Development Kit) and an OpenFlow SDN (Software-Defined Networking) controller to overcome the problems. DPDK can accelerate overall packet processing operations needed in vTAP, and OpenFlow controller can provide a centralized and flexible way to apply and manage TAP policies in an SDN network. This paper also provides performance comparisons of the proposed vTAP and the naive method, port mirroring.

Software-defined Networking (SDN) is a network paradigm to resolve the challenges of traditional networks. SDN can utilize its concept of control and data plane separation to improve Quality of Service (QoS) of certain network traffic efficiently. Because traffic engineering in SDN is a promising way to satisfy the requirement well, we propose an application-aware traffic engineering system that cooperates with Deep Packet Inspection (DPI). In the system, port number and DPI-based traffic classification are used to identify application or service flows. The system improves QoS of the identified flows by distributing them to multiple queues with different priorities in each switch port. A network admin can define a mapping table between an identified flow and its QoS priority (queue) in the system. To demonstrate the feasibility of the system, we designed and implemented the system by constructing an SDN controller application and data plane entities. The results of the experiment shows increased throughput and reduced packet delay for identified application traffic.

Owing to the development of information technology, many people can access various services through the Internet. In addition, with the emergence of the Web 2.0 concept of opening, participating, and sharing, public institutions and companies have made it possible to use their data and services in a variety of ways. In this environment, service providers have developed new services by linking open data and services to meet the rapidly changing requirements of Internet users. A new service developed through the interworking of data and services is called a mashup service. A mashup service has the advantage of providing useful functions required by users by combining the existing data and services. However, to develop a mashup service, it is necessary to process the data collected from other sources and link the services, which greatly increases the developers burden. In this study, we propose an open application programming interface (openAPI)-based message router for mashup service development to overcome this problem. The message router supports the development of the mashup service by providing useful functions required by the developer in cooperation with various platforms according to the request messages transmitted through openAPI.

Software-Defined Networking (SDN) is an emerging networking paradigm aims to improve network management flexibility and efficiency. OpenFlow is the popular SDN de-facto standard, which has been prevalently adopted by both academia and industry for research and development purpose. OpenFlow provides rich programmable interface to network administrator to ease traffic monitoring and control. Because OpenFlow supports L4 network stack, it is feasible to provide application level traffic control by specifying TCP/UDP port number in flow rules. The major deficiency of the port-based traffic control is that it only provides the ability to control traffic from applications which have well-known TCP/UDP port numbers. In the case of port number change or dynamic (ephemeral) port allocation to an application, it is difficult to accurately control the application traffic. To be a solution, we propose an application-aware traffic management method by integrating Deep Packet Inspection (DPI) function with SDN controller. To show the feasibility, we design and implement Firewall and Bandwidth Manager applications based on the proposed management method. The applications perform on top of ONOS [1] controller, and FTP rate control example is shown to prove the feasibility of the proposed flow management method.

With the advancement of the Internet technologies, cloud services and various open data, there have been many active attempts to develop mashup services. To develop a mashup service, many data sources and service platforms should be interlinked. Therefore, efficient ways of interconnecting various service platforms and managing data are essential to provide easy service development environment. However, current mashup service development environments do not provide any of them, which forces each developer to fully understand every platforms, interfaces and data format to develop a mahsup service. So, it gives a big burden to mashup service developers and also hinders growth of mashup service industry. In this paper, we propose ICBMS Smart Mediator which connects IoT, cloud, big data, mobile, and security platforms and helps developers to easily utilize them with less overhead and provides easy access to data. We have designed and implemented the proposed ICBMS Smart Mediator and created a new mahsup service with the ICBMS Smart Mediator.