Machine learning algorithms have been applied to address a variety of engineering and scientific problems. The Internet has historically been prone to failures and attacks that significantly degrade its performance. Frequent cases of various cyber threats have been encountered over the past years. In this case study, we describe design of machine learning models used to classify Internet anomalies caused by worms, viruses, power outages, ransomware attacks, infrastructure failures, router misconfigurations, and Internet Protocol hijacks. The reported results indicate that while performance of machine learning models greatly depends on the used datasets, they are viable tools for detecting the Internet anomalies.

We analyze datasets collected by the Center for Applied Internet Data Analysis (CAIDA) and the Réseaux IP Europeéns (RIPE) sites to demonstrate the efficacy of machine learning models in predicting Internet outages and disruptions that affect and hinder network access to essential services and humanitarian aid in times of conflict. Custom datasets for specific geographic areas are created using data filtering. A sliding time window transformation was applied to design models that accurately predict disruptions. Model performance is evaluated based on the prediction accuracy using Internet Outage Detection and Analysis (IODA) and RIPE datasets.

With the advancement of technology over the last decade, there has been a rapid increase in the number and types of malware attacks such as worms whose primary function is to self-replicate and infect systems and ransomware that corrupts and encrypts data. Developing proactive cyber defense techniques is essential for effectively detecting network anomalies that are evolving and becoming more challenging to identify. In this paper, we consider intrusion detection techniques using fast machine learning algorithms. We investigate Echo and Deep Echo State Networks machine learning structures for detecting worm and ransomware anomalies. We demonstrate, analyze, and compare merits of this approach using Slammer worm, WannaCrypt ransomware, and WestRock ransomware attack datasets.

Developing advanced cyber defense techniques is essential for effectively detecting network anomalies that are becoming more challenging to identify. In this paper, we generate machine learning models based on real-time Internet and historical data and evaluate their classification performance. We introduce a network anomaly detection tool CyberDefense that integrates various stages of the anomaly detection process. It facilitates performance evaluation of machine learning algorithms and generation of new machine learning models. Its modular and scalable design enables incorporating new datasets and machine learning algorithms. The tool has been utilized to generate models and evaluate their classification performance using datasets collected during reported power outage and ransomware attacks.

Machine learning approaches for detecting anomalies in communication networks heavily depend on the properties of training data. We analyze the impact of data probability distributions on performance of machine learning models developed based on Border Gateway Protocol datasets collected during the worm and ransomware attacks. Feature selection is performed to determine the most important features and identify their best fitting distributions. Experimental results indicate that certain features follow heavy-tailed distributions. Traffic anomalies are then classified based on selected features using the gradient boosting decision tree models suitable for designing real-time and scalable intrusion detection systems.

Software defined networks are a new Internet architecture paradigm that allows co-existence of heterogeneous network architectures. They optimize network management (maintenance, operability, and effective content delivery) by provisioning a centralized network intelligence. Virtual network embedding (VNE) algorithms improve scalability and utilization of physical resources in data center networks (DCNs). In this paper, we implement various DCN topologies and evaluate performance of VNE algorithms using the VNE-Sim simulator. We compare performance by implementing both server-centric and switch-centric DCN topologies.

The electric vehicle (EV) fleet is gradually growing into a major part of public transportation. Proper planning and operation of EV supply equipment (EVSE) is essential to ensure the efficient and economic operations of the EV fleets. Charging stations (CS) have gained market attention due to their lower cost and versatility. Battery swapping stations (BSS) have also received considerable attention because of their promise to provide fast and sustainable battery replacements. However, their commercial viability is unclear due to their requirement for large capital and infrastructure deployment. In this paper, we develop a stochastic model for interactions between CS/BSS and taxi/bus fleets. The model is based on a realistic abstraction of users’ behavior defined by various stochastic processes. It also considers the dynamic impacts of the road congestion. Analytical revenue boundaries are derived and verified by simulations. These simulation results may prove valuable for future studies of public transit.

Advances in software defined and data center networks have enabled network virtualization. Virtual network embedding increases resources utilization and reduces cost of network deployment. Its performance depends on embedding algorithms and data center network topologies. In this paper, we evaluate performance of virtual network embedding algorithms based on acceptance ratio, revenue to cost ratio, and node and link utilizations by simulating virtual network embeddings on Spine-Leaf, Three-Tier, and Collapsed Core data center network topologies.

Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks are major threats to cybersecurity in communication networks. These cyber attacks are evolving and becoming more difficult to identify and, hence, a number of intrusion detection approaches have been proposed. Various machine learning techniques have proved useful in detecting such anomalies. We rely on supervised machine learning and apply echo state networks to detect known DoS and DDoS attacks. Echo state networks belong to a reservoir computing approach used to train recurrent neural networks. Their performance is compared to bidirectional long short-term memory using datasets collected by the Canadian Institute for Cybersecurity and the RIPE and Route Views data collection sites. Performance is evaluated based on accuracy, F-Score, false alarm rate, and training time. Experimental results indicate that echo state networks have comparable performance and shorter training time.

Denial of service attacks are harmful cyberattacks that diminish Internet resources and services. Hence, detecting these cyberattacks is a topic of great interest in cybersecurity. Using traditional machine learning approaches in intrusion detection systems requires long training time and has high computational complexity. Thus, we evaluate performance of fast machine learning algorithms for training and generating models to detect denial of service attacks in communication networks. We use synthetically generated datasets that captured Transmission Control Protocol and User Datagram Protocol network flows in a controlled testbed laboratory environment. Evaluated algorithms include broad learning system and its extensions as well as XGBoost, LightGBM, and CatBoost gra-dient boosting decision tree algorithms. Experiments indicate that boosting algorithms often require shorter training time and have better performance.

Cyber attacks are becoming more sophisticated and, hence, more difficult to detect. Using efficient and effective machine learning techniques to detect network anomalies and intrusions is an important aspect of cyber security. A variety of machine learning models have been employed to help detect malicious intentions of network users. In this paper, we evaluate performance of recurrent neural networks (Long Short-Term Memory and Gated Recurrent Unit) and Broad Learning System with its extensions to classify known network intrusions. We propose two BLS-based algorithms with and without incremental learning. The algorithms may be used to develop generalized models by using various subsets of input data and expanding the network structure. The models are trained and tested using Border Gateway Protocol routing records as well as network connection records from the NSL-KDD and Canadian Institute of Cybersecurity datasets. Performance of the models is evaluated based on selected features, accuracy, F-Score, and training time.

To commemorate the 50th anniversary of the IEEE Transactions on Systems, Man, and Cybernetics: Systems, this article examines and reports on its past to current topical coverage of systems science and engineering toward exploring the evolving focus of the research community. Results of a systematic bibliometric analysis are presented with associated conclusions, implications, and summary of topical areas. In addition, respective views regarding the current state of the field and where it is headed are offered by recent leaders of the IEEE Systems, Man, and Cybernetics Society, including its continued relevance and role in the advancement of systems technology.

Detection of evolving cyber attacks is a challenging task for conventional network intrusion detection techniques. Various supervised machine learning algorithms have been implemented in network intrusion detection systems. However, traditional algorithms require long training time and have high computational complexity. Therefore, we propose detection of denial of service cyber attacks in communication networks by employing the broad learning system (BLS) that requires shorter training time while achieving comparable performance. Because designing effective detection systems relies on training and test datasets that contain anomalous network traffic data, in this paper we evaluate the performance of various BLS models by using recently generated network intrusion datasets. The best accuracy and F-Score were often achieved using BLS with cascades while BLS with incremental learning usually required shorter training time.

Analyzing and detecting Border Gateway Protocol (BGP) anomalies are topics of great interest in cybersecurity. Various anomaly detection approaches such as time series and historical-based analysis, statistical validation, reachability checks, and machine learning have been applied to BGP datasets. In this paper, we use BGP update messages collected from Réseaux IP Europeens and Route Views to detect BGP anomalies caused by Slammer worm, WannaCrypt ransomware, and Moscow blackout by employing recurrent neural network machine learning algorithms.

It is recognized that system trustworthiness is a hyperstructure embodied by the structural, behavioral, and system dimensions with a set of coherent attributes. We explore a theoretical framework of tripartite trustworthiness that can be applied to real-world autonomous systems. We present a formal study of the essences and mathematical models of system trustworthiness and their quantitative measurements in the contexts of autonomous and mission-critical intelligent systems where humans and machines interact in a hybrid environment.

Tracking a maneuvering target is an important technology. Due to complex environment and diversity of sensors, errors need to be optimized with respect to various motion states during the tracking process. In this paper, we first propose how to unify the coordinate system and data preprocessing in case of tracking using multiple sensors. We then combine fuzzy sets with a novel trace optimization method based on extended Kalman filter (EKF) with nested probabilistic-numerical linguistic information (NPN-EKFTO). We present a case study of trace optimization of an unknown maneuvering target in Sichuan province in China. We solve the case by using both the proposed method and the traditional EKF and offer comparative analysis to validate the proposed approach.

Using machine learning techniques to detect network intrusions is an important topic in cybersecurity. A variety of machine learning models have been designed to help detect malicious intentions of network users. We employ two deep learning recurrent neural networks with a variable number of hidden layers: Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU). We also evaluate the recently proposed Broad Learning System (BLS) and its extensions. The models are trained and tested using Border Gateway Protocol (BGP) datasets that contain routing records collected from Réseaux IP Européens (RIPE) and BCNET as well as the NLS-KDD dataset containing network connection records. The algorithms are compared based on accuracy and F-Score.

Border Gateway Protocol (BGP) is used to exchange routing information across the Internet. BGP anomalies severely affect network performance and, hence, algorithms for anomaly detection are important for improving BGP convergence. Efficient and effective anomaly detection mechanisms rely on employing machine learning techniques. Support Vector Machine (SVM) is a widely used machine learning algorithm. In this paper, we evaluate performance of SVM with linear, quadratic, and cubic kernels. The SVM kernels are compared based on accuracy and the F-Score when detecting BGP anomalies in Internet traffic traces. The performance heavily depends on the selected features and their combinations.

Detecting, analyzing, and defending against network intrusions is an important topic in cyber security. Various detection systems have been designed using machine learning techniques that help detect malicious intentions of network users. We apply Recurrent Neural Networks (RNNs) and Broad Learning System (BLS) machine learning algorithms to classify known network intrusions. The developed models are trained and tested using the NSL-KDD dataset containing information about both intrusion and regular network connections. The algorithms are used to classify various types of intrusion classes and regular data and are compared based on accuracy and F-Score. Comparison results indicate that the BLS algorithm shows comparable performance with shorter training time.

Network virtualization helps overcome shortcomings of the current Internet architecture. The virtualized network architecture enables coexistence of multiple virtual networks (VNs) on an existing physical infrastructure. VN embedding (VNE) problem, which deals with the embedding of VN components onto a physical network, is known to be -hard. In this paper, we propose two VNE algorithms: MaVEn-M and MaVEn-S. MaVEn-M employs the multicommodity flow algorithm for virtual link mapping while MaVEn-S uses the shortest-path algorithm. They formalize the virtual node mapping problem by using the Markov decision process (MDP) framework and devise action policies (node mappings) for the proposed MDP using the Monte Carlo tree search algorithm. Service providers may adjust the execution time of the MaVEn algorithms based on the traffic load of VN requests. The objective of the algorithms is to maximize the profit of infrastructure providers. We develop a discrete event VNE simulator to implement and evaluate performance of MaVEn-M, MaVEn-S, and several recently proposed VNE algorithms. We introduce profitability as a new performance metric that captures both acceptance and revenue to cost ratios. Simulation results show that the proposed algorithms find more profitable solutions than the existing algorithms. Given additional computation time, they further improve embedding solutions.

We propose an optimal Physical Layer Convergence Procedure Protocol Data Unit (PPDU) duration algorithm that divides a long data stream into two portions among consecutive groups based on the average PPDU duration of the Very High Throughput (VHT) group. The proposed solution considers all Wireless Local Area Network (WLAN) parameters and satisfies requirements of the VHT Multi-User Multiple Input Multiple Output (MU-MIMO) protocols. The simulation results show that the optimal PPDU duration algorithm offers significant improvements by accommodating traffic of additional STAs in shorter time and by efficiently utilizing the previously wasted sections of space-time streams.

Data centers are core infrastructure of cloud computing. Network virtualization in these centers is a promising solution that enables coexistence of multiple virtual networks on a shared infrastructure. It offers flexible management, lower implementation cost, higher network scalability, increased resource utilization, and improved energy efficiency. In this paper, we consider switch-centric data center network topologies and evaluate their use for network virtualization by comparing Deterministic (D-ViNE) and Randomized (R-ViNE) Virtual Network Embedding, Global Resource Capacity (GRC), and Global Resource Capacity-Multicommodity (GRC-M) Flow algorithms.

Collaborative filtering is a well-known technique used for designing recommender systems when advertising services and products offered to the Internet users. In this paper, we employ the Restricted Boltzmann Machine (RBM) for collaborative filtering and propose the neighborhood-conditional RBM (N-CRBM) model based on joint distributions of similarity and popularity scores. The model is trained and evaluated based on the number of hidden units, learning rates, and activation functions. Simulation results using a dataset consisting of 22 million records show that the proposed N-CRBM model achieves 0.46 average root mean square error (RMSE) and 78.5% accuracy in predicting users' selections of recommended advertisements.

Network visualization enables support and deployment of new services and applications that the current Internet architecture is unable to support. Virtual Network Embedding (VNE) problem that addresses efficient mapping of virtual network elements onto a physical infrastructure (substrate network) is one of the main challenges in network virtualization. The Global Resource Capacity (GRC) is a VNE algorithm that utilizes for virtual link mapping a modified version of Dijkstra's shortest path algorithm. In this paper, we propose the GRC-M algorithm that utilizes the Multicommodity Flow (MCF) algorithm. MCF enables path splitting and yields to higher substrate resource utilizations. Simulation results show that MCF significantly enhances performance of the GRC algorithm.

Network visualization enables coexistence of multiple virtual networks on a shared infrastructure without requiring unified protocols, applications, and control and management planes. Recent approaches such as Software Defined Networking have enabled cloud service providers to offer virtualized network services that require embedding virtual network requests in data centers. In this paper, we employ R-Vine, D-Vine, and Global Resource Capacity (GRC) algorithms to perform a series of virtual net work embeddings on BCube and Fat-Tree substrate networks. We compare these two data center network topologies to determine the topology that is better suited for virtual network embeddings. Simulation results show that the Fat-Tree network is capable of hosting additional virtual network requests, resulting in higher substrate node and link utilization.

Border Gateway Protocol (BGP) anomalies affect network operations and, hence, their detection is of interest to researchers and practitioners. Various machine learning techniques have been applied for detection of such anomalies. In this paper, we first employ the minimum Redundancy Maximum Relevance (mRMR) feature selection algorithms to extract the most relevant features used for classifying BGP anomalies and then apply the Support Vector Machine (SVM) and Long Short-Term Memory (LSTM) algorithms for data classification. The SVM and LSTM algorithms are compared based on accuracy and F-score. Their performance was improved by choosing balanced data for model training.

The exponential growth of the Routing Information Base (RIB) of the Internet's Default-Free Zone (DFZ) routers has raised concerns about non-scalability of the current Internet's routing architecture. The main reason is that Internet addresses currently carry information about both the identity and location (physical connection point) of devices connected to the Internet. The Locator/ID Separation Protocol (LISP) has been introduced to potentially remedy this non-scalability by splitting the location and identity of devices. In this paper, we present the architecture of a deployed testbed that is multihomed using LISP. We investigate LISP performance as a multihoming solution in terms of load balancing and traffic routing in the case of link failures.

Deflection routing is employed to ameliorate packet loss caused by contention in buffer-less architectures such as optical burst-switched networks. The main goal of deflection routing is to successfully deflect a packet based only on a limited knowledge that network nodes possess about their environment. In this paper, we present a framework that introduces intelligence to deflection routing (iDef). iDef decouples the design of the signaling infrastructure from the underlying learning algorithm. It consists of a signaling and a decision-making module. Signaling module implements a feedback management protocol while the decision-making module implements a reinforcement learning algorithm. We also propose several learning-based deflection routing protocols, implement them in iDef using the ns-3 network simulator, and compare their performance.

Contention is the main source of information loss in buffer-less network architectures where deflection routing is a viable contention resolution scheme. In recent years, various reinforcement learning-based deflection routing algorithms have been proposed. However, performance of these algorithms has not been evaluated in larger networks that resemble the autonomous system-level topology of the Internet. In this paper, we compare performance of three reinforcement learning-based deflection routing algorithms by using topologies generated with Waxman and Barabási-Albert algorithms. We examine the scalability of deflection routing algorithms by increasing the network size while keeping the network load constant.

Border Gateway Protocol (BGP) is the core component of the Internet's routing infrastructure. Abnormal routing behavior impairs global Internet connectivity and stability. Hence, designing and implementing anomaly detection algorithms is important for improving performance of routing protocols. While various machine learning techniques may be employed to detect BGP anomalies, their performance strongly depends on the employed learning algorithms. These techniques have multiple variants that often work well for detecting a particular anomaly. In this paper, we use the decision tree and fuzzy rough set methods for feature selection. Decision tree and extreme learning machine classification techniques are then used to maximize the accuracy of detecting BGP anomalies. The proposed techniques are tested using Internet traffic traces.

Over the last decade, complex networks have emerged to be a promising research field in the area of circuits and systems. This mini-review paper introduces the special session that deals with theory and applications of complex networks and provides brief review of their advances and challenges. The paper further promotes some important research topics in the field with emphasis on the multidisciplinary research interests.

In this paper, we introduce a predictive Q-learning deflection routing (PQDR) algorithm for buffer-less networks. Q-learning, one of the reinforcement learning (RL) algorithms, has been considered for routing in computer networks. The RL-based algorithms have not been widely deployed in computer networks where their inherent random nature is undesired. However, their randomness is sought-after in certain cases such as deflection routing, which may be employed to ameliorate packet loss caused by contention in buffer-less networks. We compare the proposed algorithm with two existing reinforcement learning-based deflection routing algorithms. Simulation results show that the proposed algorithm decreases the burst loss probability in the case of heavy traffic load while it requires fewer deflections. The PQDR algorithm is implemented using the ns-3 network simulator.

Worms such as Slammer, Nimda, and Code Red I are anomalies that affect performance of the global Internet Border Gateway Protocol (BGP). BGP anomalies also include Internet Protocol (IP) prefix hijacks, miss-configurations, and electrical failures. Statistical and machine learning techniques have been recently deployed to classify and detect BGP anomalies. In this paper, we introduce new classification features and apply Support Vector Machine (SVM) models and Hidden Markov Models (HMMs) to design anomaly detection mechanisms. We apply these multi classification models to correctly classify test datasets and identify the correct anomaly types. The proposed models are tested with collected BGP traffic traces and are employed to successfully classify and detect various BGP anomalies.

The Minimal Route Advertisement Interval (MRAI) plays a prominent role in convergence of the Border Gateway Protocol (BGP). Previous studies have suggested using adaptive MRAI and reusable timers to reduce the BGP convergence time. The adaptive MRAI timers perform well under the normal load of BGP updates. However, a large number of BGP updates may flood Internet routers. We propose a new algorithm, MRAI with Flexible Load Dispersing (FLD-MRAI), which reduces the router's overhead by dispersing the load in case of a large number of BGP updates. We also examine the MRAI timers under the normal load of BGP updates. Since BGP routing policies play a significant role in preserving the Internet routing stability, we evaluate their impact on BGP convergence time and Route Flap Damping (RFD) algorithms. The proposed algorithms are evaluated using the ns-BGP network simulator.

In this paper, we address routing in complex networks. Routing traffic across a network requires finding best possible paths between sources and destinations. When data traffic changes dynamically, a path that was optimal in the past may not be the best for the next packet. Adapting to traffic changes and finding optimal paths dynamically are challenging tasks. They become more demanding in large and complex networks. In optical burst switching (OBS) networks, two optical bursts contending for the same link need resolution mechanisms other than queueing. Deflection routing protocols are used to override routing tables and “deflect” one of the bursts to a free link. Instead of deflecting bursts at an immediate point of contention, the proposed Random Early Deflection (RED-f) routing protocol triggers deflection ahead of time and, thus, offers additional routing paths and lowers the burst loss rate due to contention. Simulations demonstrate that RED-f enabled nodes in a scale-free complex network reduce burst loss rate by exchanging control information with only few other network nodes.

The Border Gateway Protocol (BGP) is the de facto Internet routing protocol. Various aspects of the BGP protocol have been analyzed using mathematical and experimental approaches. Formal verification of BGP specification validates whether or not a specific set of requirements is satisfied. In resent years, the probabilistic behavior of BGP has been explored. The size of routing tables has been modeled as a stochastic process that changes over time according to some probability distribution function. Hence, the verification of BGP may also be probabilistic in nature due to its randomized behavior. In this paper, we present a probabilistic model checking approach to analyze BGP convergence properties that may be employed to automate the BGP convergence analysis.

Parallel structures may be used to increase a system processing speed in case of large amount of data or highly complex calculations. Dynamic Voltage and Frequency Scaling (DVFS) may be used for simpler calculations in order to decrease the system voltage or frequency and achieve lower power consumption. Combining these two mechanisms may lead to higher efficiency and lower power consumption. In this paper, we introduce a parallel decoding process with Digital Signal Processing (DSP) for power efficiency in a heterogeneous multi-core embedded system. We describe a parallel low-power design on the system level. Under the condition of preserving the original decoding process, we manage the size of the system's multimedia buffer by considering the spontaneous streaming transfer and tuning the decoding process scheduling time by using the DVFS system in order to decrease the multimedia data dependency and achieve a multi-core embedded system with accurate and low-power detection mechanism.

Understanding circuits is fundamental to electric engineering and continuing to offer courses in theory and applications of electric circuits to new generations of engineering students remains an important part of any engineering curriculum. Attracting new generations of students to circuits is a challenging task that calls for new approaches, methodologies, and projects that will appeal to current generations of both educators and students. Designing these new tools and making them freely available to educators is an important step in eliciting renewed interest in circuits.

The discovery of power-laws and spectral properties of the Internet topology indicates a complex underlying network infrastructure. Analysis of spectral properties of the Internet topology has been usually based on the normalized Laplacian matrix of graphs capturing Internet structure on the Autonomous System (AS) level. In this paper, we first extend the previous analysis of the Route Views data to include datasets collected from the RIPE project. Spectral analysis of collected data from the RIPE datasets confirms the previously observed existence of power-laws and similar historical trends in the development of the Internet. Presented spectral analysis of both the adjacency matrix and the normalized Laplacian matrix of the associated graphs also reveals new historical trends in the clustering of AS nodes and their connectivity. The connectivity and clustering properties of the Internet topology are further analyzed by examining element values of the corresponding eigenvectors.

Discovering properties of the Internet topology is important for evaluating performance of various network protocols and applications. The discovery of power-laws and the application of spectral analysis to the Internet topology data indicate a complex behavior of the underlying network infrastructure that carries a variety of the Internet applications. In this paper, we present analysis of datasets collected from the Route Views project. The analysis of collected data shows certain historical trends in the development of the Internet topology. While values of various power-laws exponents have not substantially changed over the recent years, spectral analysis of the normalized Laplacian matrix of the associated graphs reveals notable changes in the clustering of Autonomous System (AS) nodes and their connectivity.

It has been observed that the TCP-RED system may exhibit instability and oscillatory behavior. Control methods proposed in the past have been based on the analytical models that rely on statistical measurements of network parameters. In this paper, we apply the detrended fluctuation analysis (DFA) method to analyze stability of the TCP-RED system. The DFA has been used for detecting long-range correlations in seemingly non-stationary noisy signals. The key indicator emanating from DFA is known as the scaling exponent. By examining the variations of the DFA scaling exponent when varying system parameters, we quantify the stability of the TCP-RED system in terms of system’s characteristics.

It has been observed that a bottleneck random early detection (RED) gateway becomes oscillatory when regulating a flow in multiple TCP connections. The stability boundary of the TCP-RED system depends on various network parameters, making the adjustment of the RED gateway a difficult task. Based on a fluid-flow model, analytical conditions were formulated that describe the stable boundary of the RED gateway depending on the number of TCP Reno connections. The proposed model accurately generates a stability boundary surface in a four dimensional space, which facilitates the adjustment of parameters for stable operation of the RED gateway. The accuracy of the analytical results has been verified using the ns-2 network simulations.

Satellite data networks provide broadband access for areas not served by traditional broadband technologies.In this thesis, we describe a collection of traffic data (billing records and tcpdump traces) from a satellite Internet service provider in China.We use the billing records to investigate the downloaded and uploaded traffic volume and the aggregate user behavior.We examine daily and weekly cycles and effects of holidays on traffic patterns.We also employ cluster analysis methods to classify the users according to their traffic.Analysis of the tcpdump traces indicates that transmission control protocol (TCP) accounts for the majority of data transfers.The analysis also includes the detection of anomalies such as invalid TCP flag combinations, port scans, and anomalies in traffic volume.

The duration of the minimal route advertisement interval (MRAI) and the implementation of MRAI timers have a significant influence on the convergence time of the border gateway protocol (BGP). Previous studies have reported existence of optimal MRAI values that minimize the BGP convergence time for various network topologies and traffic loads. In this paper, we propose the adaptive MRAI algorithm for adaptive adjustment of MRAI values. We also introduce reusable MRAI timers that independently limit advertisements of individual destinations. The modified BGP is named BGP with adaptive MRAI (BGP-AM). BGP processing delay used in the evaluation of BGP-AM is based on reported measurements, ns-2 simulation results demonstrate that BGP-AM leads to a shorter convergence time while maintaining a number of update messages comparable to the current BGP implementation. BGP-AM convergence time depends linearly on the BGP processing delay.

In this paper, we describe a simple second-order discrete-time model for the transmission control protocol (TCP) with random early detection (RED) algorithm. The TCP/RED mechanism is viewed as a feedback control system where TCP adjusts its sending rate depending on packet loss. We investigate bifurcations and chaos in a TCP/RED system with a single TCP connection. We conjecture that the complex behavior observed in the system is attributed to a class of discontinuity-induced bifurcations observed in piecewise smooth systems.

Traditional statistical analysis and mining of network data are often employed to determine traffic distribution, to summarize a user's behavior patterns, or to predict future network traffic. We analyze three months of network log data from a deployed public safety trunked radio network. After data cleaning and traffic extraction, we apply the K-means algorithm and identify that three clusters of talk groups best reflect users' behavior patterns represented by the hourly number of calls. We propose a traffic prediction model by applying the classical SARIMA models on clusters of users. The predicted network traffic agrees with the collected traffic data and the proposed cluster-based prediction approach performs well compared to the prediction based on the aggregate traffic

In this paper, we examine the behavior of the Gnutella peer-to-peer file sharing network and propose a protocol modification to improve its performance. Gnutella exhibits sub-optimal performance in terms of message latency because its overlay topology does not match the underlying physical network. In order to characterize Gnutella's performance, we modified an existing Gnutella simulation framework developed for the ns-2 network simulator to gather information about query and query hit propagation. We then modified the simulated protocol to use the Vivaldi synthetic coordinate system and to bias neighbor selection to favor nodes that are "close" in the Euclidean sense. Simulations with the adapted Gnutella protocol showed an improvement in both query and query hit propagation times.

Public safety wireless networks (PSWNs) play a vital role in the operation of emergency agencies. In this paper, we describe analysis and modeling of traffic data collected from E-Comm, the public safety wireless network deployed in Southwestern British Columbia. We also introduce a newly developed wide area radio network simulator, named WarnSim. The simulator is used to validate traffic models and to evaluate and predict the performance of the E-Comm network.

In this paper, we propose packet control algorithms to be deployed in intermediate network routers. They improve TCP performance in wireless networks with packet delay variations and long sudden packet delays. The ns-2 simulation results show that the proposed algorithms reduce the adverse effect of spurious fast retransmits and timeouts and greatly improve the goodput compared to the performance of TCP Reno. The TCP goodput was improved by -30% in wireless networks with 1% packet loss. TCP performance was also improved in cases of long sudden delays. These improvements highly depend on the wireless link characteristics.

Mobile radio systems for public safety and agencies engaged in emergency response and disaster recovery operations must support multicast voice traffic. In this paper, we analyze the distribution of call interarrival and call holding times for multicast voice (talk group) traffic on a transmission trunked mobile radio system. In such systems, the channel is held only while a user is making a call (while the push-to-talk key is pressed and the radio is transmitting). We find that the call interarrival time distributions are exponential and exhibit tendency toward long-range dependence. The call holding times best fit lognormal distributions and are not correlated. A potentially important implication of these findings is that performance estimation methods that assume memoryless Markov arrival and departure processes may not be viable approaches.

In this paper and attached video, we present a third-generation expert system named Knowledge Amplification by Structured Expert Randomization (KASER) for which a patent has been filed by the U.S. Navy's SPAWAR Systems Center, San Diego, CA (SSC SD). KASER is a creative expert system. It is capable of deductive, inductive, and mixed derivations. Its qualitative creativity is realized by using a tree-search mechanism. The system achieves creative reasoning by using a declarative representation of knowledge consisting of object trees and inheritance. KASER computes with words and phrases. It possesses a capability for metaphor-based explanations. This capability is useful in explaining its creative suggestions and serves to augment the capabilities provided by the explanation subsystems of conventional expert systems. KASER also exhibits an accelerated capability to learn. However, this capability depends on the particulars of the selected application domain. For example, application domains such as the game of chess exhibit a high degree of geometric symmetry. Conversely, application domains such as the game of craps played with two dice exhibit no predictable pattern, unless the dice are loaded. More generally, we say that domains whose informative content can be compressed to a significant degree without loss (or with relatively little loss) are symmetric. Incompressible domains are said to be asymmetric or random. The measure of symmetry plus the measure of randomness must always sum to unity.

This paper addresses the problem of detecting and countering potential terrorist threats. It describes a synergistic conjunction of intelligent technologies with a view towards that goal. Many databases exist, which when fused through the use of intelligent agents can provide an intermediary database that often contains critical information. The goal of this paper is to show how a directed mining approach using a blackboard architecture can be designed to extract the maximum amount of relevant information from the database, while filtering out the irrelevant information in tractable timeframes. Blackboard architectures are rule-based and allow for the incremental insertion of knowledge. Subsumption and contradiction can be automatically detected and remedied. Moreover, the use of a segmented knowledge base allows computational resources to be focused where they will do the most good. Objects for directed mining and linking are invoked as rule consequents in a blackboard architecture. The blackboard architecture provides for chaining and incremental knowledge acquisition (including maintenance). Using information hiding, objects can be visually displayed in the form of a tree to facilitate acquisition and maintenance operations. Predicate knowledge is represented using a VHLL that provides several attendant benefits. First, higher-level languages are not only easier to use, but they tend to be self-documenting. Second, the higher the level of language, the more reusable are components written in the language. Not only does this save on the cost of generating new components, but it also serves to further their testing (i.e., debugging).

Collection of user statistics and network traffic is crucial for understanding user behavior and for creating network workload models. It is also valuable for the management of commercial wireless networks. In this paper, we report on the analysis of billing records collected from the Telus Mobility Cellular Digital Packet Data (CDPD) network. The longest continuous billing record that we examined covered approximately twenty one days, spanning the Christmas and New Year holiday seasons. We used various tools to graphically illustrate the billing data. We observed that network activities exhibit daily and weekly cycles. Furthermore, the clustering analysis revealed four distinct behavioral classes of users. Analysis of billing data provided useful information about the usage of an operational wireless network.

The mobile Internet protocol has been proposed by the IETF to support portable IP addresses for mobile devices that often change their network access points to the Internet. In the basic Mobile IP protocol, datagrams sent from wired or wireless hosts and destined for the mobile host that is away from home have to be routed through the home agent. Nevertheless, datagrams sent from mobile hosts to wired hosts can be routed directly. This asymmetric routing, called "triangle routing", is often far from optimal and "route optimization" has been proposed to address this problem. In this paper, we present the implementation of a "route optimization" extension to Mobile IP in the ns-2 simulator. We illustrate simulations of the Mobile IP with route optimization with simulation scenarios, parameters, and simulation results.

In this paper we investigate the impact of traffic patterns on wireless data networks. Modeling and simulation of the cellular digital packet data (CDPD) network of Telus Mobility (a commercial service provider) were performed using the OPNET tool. We use trace-driven simulations with genuine traffic trace collected from the CDPD network to evaluate the performance of the CDPD protocol. This trace tends to exhibit long-range dependent behavior. Our simulation results indicate that genuine traffic traces, compared to traditional traffic models such as the Poisson model, produce longer queues and, thus, require larger buffers in the deployed network's elements.

Veristic computing is defined as computing with words. It necessarily entails the use of informed search in the solution of qualitatively constrained equations. Its use does not preclude computing with numbers. Veristic computing allows for the specification of higher-level programming languages, which can evolve domain-specific knowledge bases. The knowledge is evolved on a high-end computer for subsequent porting to a PC. The application of that knowledge to the translation of a higher-level program is termed expert compilation. This paper serves to clarify the ubiquitous role assumed by randomization in all aspects of software engineering-from programming language design to program design to program testing to knowledge transference.

We discuss distributed denial of service attacks in the Internet. We were motivated by the widely known February 2000 distributed attacks on Yahoo!, Amazon.com, CNN.com, and other major Web sites. A denial of service is characterized by an explicit attempt by an attacker to prevent legitimate users from using resources. An attacker may attempt to: "flood" a network and thus reduce a legitimate user's bandwidth, prevent access to a service, or disrupt service to a specific system or a user. We describe methods and techniques used in denial of service attacks, and we list possible defences. In our study, we simulate a distributed denial of service attack using ns-2 network simulator. We examine how various queuing algorithms implemented in a network router perform during an attack, and whether legitimate users can obtain desired bandwidth. We find that under persistent denial of service attacks, class based queuing algorithms can guarantee bandwidth for certain classes of input flows.

We describe the conceptual design of FuzzyBase, an information-intelligent system. The purpose of the proposed system is to facilitate intelligent and fast retrieval of information that is of interest to scientific research communities with specific needs, such as getting relevant technical information fast. It involves the intelligent retrieval of information (both crisp and fuzzy), a subsystem for collecting usage statistics and traffic data, and a high end computer and communications infrastructure.

Efficient and robust computation of one or more of the operating points of a nonlinear circuit is a necessary first step in a circuit simulator. The application of globally convergent probability-one homotopy methods to various systems of nonlinear equations that arise in circuit simulation is discussed. The coercivity conditions required for such methods are established using concepts from circuit theory. The theoretical claims of global convergence for such methods are substantiated by experiments with a collection of examples that have proved difficult for commercial simulation packages that do not use homotopy methods. Moreover, by careful design of the homotopy equations, the performance of the homotopy methods can be made quite reasonable. An extension to the steady-state problem in the time domain is also discussed.>