Website Fingerprinting (WFP) attacks infer the websites or webpages a user is visiting from encrypted traffic. To date, it remains uncertain if WFP can attack many users from a central location in an online scenario. We close this gap with PROFI, a WFP attack that detects websites based on the initial TLS connection from the client to the server using at most the connection’s first 30 packets. PROFI achieves a precision and recall of 86.51% and 85.35% in a closed-world, and 68.90% and 78.71% in an open-world scenario, which is competitive to state-of-the-art (SoA) WFP attacks, while taking a fraction of the time of SoA attacks to classify a webpage. Further, we implement PROFI as a micro service-based prototype and evaluate the attack in an online scenario with real traffic traces. We show that PROFI can monitor up to 100 websites at 10 G, corresponding to up to 424 webpages per second. We also show that PROFI has the potential to interfere with a victim’s webpage access.

Cluster orchestrators such as Kubernetes (K8s) provide many knobs that cloud administrators can tune to conFigure their system. However, different configurations lead to different levels of performance, which additionally depend on the application. Hence, finding exactly the best configuration for a given system can be a difficult task. A particularly innovative approach to evaluate configurations and optimize desired performance metrics is the use of Digital Twins (DT). To achieve good results in short time, the models of the cloud network functions underlying the DT must be minimally complex but highly accurate. Developing such models requires detailed knowledge about the system components and their interactions. We believe that a data-driven paradigm can capture the actual behavior of a network function (NF) deployed in the cluster, while decoupling it from internal feedback loops. In this paper, we analyze the HTTP load balancing function as an example of an NF and explore the data-driven paradigm to learn its behavior in a K8s cluster deployment. We develop, implement, and evaluate two approaches to learn the behavior of a state-of-the-art load balancer and show that Machine Learning has the potential to enhance the way we model NF behaviors.

Mobility management in 5G is challenging, and at higher frequencies, a larger number of cells is needed to provide similar coverage to that in 4G. Consequently, Base Stations (BSs) are placed much more densely and users experience frequent handovers, reducing network capacity. Advanced handover techniques are needed in 5G to perform smooth network operation. In this paper, we formulate an optimization problem, whose goal is to strive for fairness in data rates among users and to reduce handovers. To accomplish that, we consider jointly the decisions when to handover and to which BS a user is to be assigned. This is an integer nonlinear program, and by relaxing it, we obtain an upper bound. Further, due to its NP-hardness, we propose a centralized and a multi-agent Deep Q Network (DQN)-based algorithm, which both find near-optimal user-to-BS assignments. We evaluate our Reinforcement Learning-based solutions for networks of different sizes and users with different velocities. We compare our approaches with baselines and show that they outperform them considerably in terms of fairness and radio link failures while being within 95% of the optimum. Our DQN algorithms also reduce the handover rate by up to 93% and avoid ping-pong handovers almost completely.

Traffic Engineering (TE) mechanisms in data center networks make distributed forwarding decisions based on the global network state. Thus, new TE mechanisms require the design and implementation of effective information exchange and efficient decentralized algorithms to compute forwarding decisions, which is challenging and time-intensive. To automate and simplify this process, we proposeMistill.Mistilldistills the forwarding behavior of TE policies from exemplary forwarding decisions into a Neural Network.Mistilllearns (i) how to encode local state into update messages, (ii) which network devices must exchange updates, and (iii) how to map the exchanged updates into forwarding decisions. We demonstrate the abilities ofMistillby learning three TE policies, verifying their performance in simulations on synthetic and real-world traffic patterns, and by showing that the learned policies generalize to unseen traffic patterns. We implementMistillas a proof-of-concept and show thatMistillreacts on average within 1.3ms to changes in the network.

Automated Web Browsing tools, such as Selenium and headless browsers, are used to collect traffic traces from networked applications, with which statistical models describing the traffic are obtained. However, we show that traces from Selenium and headless browsers have markedly different traffic characteristics than human generated traces, with potential impact on the quality of the obtained models. To overcome this limitation, we propose RLBrowse, an automated web automation framework that imitates human browsing habits by separating web automation from the browser using reinforcement learning. By separating the browser and automation tool, RLBrowse improves on 9 out of the 13 traffic trace features tested. The distribution of packet sizes in a trace improves the most, with a nearly 400 % improvement. We test RLBrowse by collecting a corpus of network packet traces on a set of human-navigated website browsing sessions, and by RLBrowse and Selenium. In the subsequent analysis, we identify key differences in the resulting packet traces.

Realizing Service Function Chaining with a micro-service-based architecture results in an increased number of computationally cheap Virtual Network Functions (VNFs). Pinning cheap VNFs to dedicated CPU cores can waste resources since not every VNF fully utilizes its core. Thus, cheap VNFs should share CPU cores to improve resource utilization. However, sharing cores can result in degraded performance due to interference between VNFs, even in mildly loaded scenarios. We proposeD2A, a system that combines Neural Combinatorial Optimization, Machine Learning (ML)-based Digital Twins (DTs), and Game Theory to optimize VNF assignments. Measurements in a testbed show thatD2Aincreases throughput by up to 46% and reduces latency by up to 93%, compared to three baseline algorithms. Using an ML-based DT to model VNF interference increases throughput by up to 11%, and reduces latency by up to 90% compared to an analytical model of the system.