Accurate and reliable localization is a key requirement for 6G network operations, but it can be particularly challenging in outdoor environments. In this paper, we propose a machine learning (ML)–based localization framework that leverages angle of arrival (AoA) as a feature extracted from channel state information (CSI). The proposed approach employs high-resolution AoA estimation algorithms, including multiple signal classification (MUSIC) and estimation of signal parameters via rotational invariance techniques (ESPRIT), which feed a hierarchical, two-stage classifier to identify specific trajectories (hereafter referred to as tracks) in a given outdoor environment. The first stage of the classifier is a binary line-of-sight (LoS) / non-line-of-sight (NLoS) classifier, followed by region-specific multi-class classifiers for fine-grained identification of the specific LoS or NLoS tracks. We evaluate our approach using a real-world massive multiple-input multiple-output (mMIMO) orthogonal frequency division multiplexing (OFDM) outdoor CSI dataset collected at the Nokia campus in Stuttgart, Germany. Experimental results show that i) the LoS / NLoS identification accuracy can reach 100%, and ii) the proposed two-stage approach significantly outperforms a single-stage multi-class baseline, achieving accuracy over 98% in LoS regions and 95% in NLoS regions. These findings demonstrate the potential of combining AoA with ML for robust localization in outdoor mMIMO propagation environments.

Malware detection is a critical but very challenging task in cybersecurity. The eternal competition between malware authors (cyber attackers) and security analysts (detectors) is a never-ending game in which malware evolves rapidly and becomes more sophisticated as cyber attackers constantly evolve their tactics to evade detection. Such competition raises the demand for new automated malware detection techniques to keep pace with malware evolution and address sophisticated malware. This paper presents an empirical study that analyzes the effectiveness of static and dynamic features using machine learning algorithms. We propose FETA, a systematic approach for F eature E ngineering on anti-s T atic and anti-dyn A mic malware analysis. FETA combines static and dynamic features through feature aggregation and model integration techniques to improve detection accuracy and robustness. Extensive experiments on a real-world dataset show that the aggregation of static and dynamic features outperforms individual feature sets, achieving a detection rate of 98.06%. Additionally, we provide insights into feature selection and conduct a deep analysis of misclassified samples. This research contributes to the development of more effective and efficient malware detection techniques for enhanced cybersecurity.

The growing complexity of end-to-end Machine Learning (ML) serving across the edge-cloud continuum has raised the necessity for runtime explainability to support service optimizations, transparency, and trustworthiness. That involves many challenges in managing ML service quality and engineering runtime explainability based on ML service contracts. Currently, consumers use ML services almost as a black box with insufficient explainability for not only inference decisions but also other contractual aspects, such as data/service quality and costs. The generic explainability for ML models is inadequate to explain the runtime ML usage for individual consumers. Moreover, ML-specific metrics have not been addressed in existing service contracts. In this work, we introduce a novel contract-based runtime explainability framework for end-to-end ensemble ML serving. The framework provides a comprehensive engineering toolset, including explainability constraints in ML contracts, report schemas, and interactions between ML consumers and the components of the ML serving for evaluating service quality with contract-based explanations. We develop new monitoring probes to measure ML-specific metrics on data quality, inference confidence, inference accuracy, and capture runtime ML usage. Finally, we present essential quality analyses via an observation agent. That interprets ML inferences and evaluates contributions of ML inference microservices, assisting ML serving optimization. The agent also integrates ML algorithms for detecting relations among metrics, supporting constraint developments. We demonstrate our work with two real-world applications for malware and object detection.

Identifying mobile apps based on network traffic has multiple benefits for security and network management. However, it is a challenging task due to multiple reasons. First, network traffic is encrypted using an end-to-end encryption mechanism to protect data privacy. Second, user behavior changes dynamically when using different functionalities of mobile apps. Third, it is hard to differentiate traffic behavior due to common shared libraries and content delivery within modern mobile apps. Existing techniques managed to address the encryption issue but not the others, thus achieving low detection/classification accuracy. In this paper, we present MAppGraph, a novel technique to classify mobile apps, addressing all the above issues. Given a chunk of traffic generated by an app, MAppGraph constructs a communication graph whose nodes are defined by tuples of IP address and port of the services connected by the app, edges are established by the weighted communication correlation among the nodes. We extract information from packet headers without analyzing encrypted payload to form feature vectors of the nodes. We leverage deep graph convolution neural networks to learn the diverse communication behavior of mobile apps from a large number of graphs and achieve a fast classification. To validate our technique, we collect traffic of a hundred mobile apps on the Android platform and run extensive experiments with various experimental scenarios. The results show that MAppGraph significantly improves classification accuracy by up to 20% compared to recently developed techniques and demonstrates its practicality for security and network management of mobile services.

Recent developments in intelligent transport systems (ITS) based on smart mobility significantly improves safety and security over roads and highways. ITS networks are comprised of the Internet-connected vehicles (mobile nodes), roadside units (RSU), cellular base stations and conventional core network routers to create a complete data transmission platform that provides real-time traffic information and enable prediction of future traffic conditions. However, the heterogeneity and complexity of the underlying ITS networks raise new challenges in intrusion prevention of mobile network nodes and detection of security attacks due to such highly vulnerable mobile nodes. In this paper, we consider a new type of security attack referred to as crossfire attack, which involves a large number of compromised nodes that generate low-intensity traffic in a temporally coordinated fashion such that target links or hosts (victims) are disconnected from the rest of the network. Detection of such attacks is challenging since the attacking traffic flows are indistinguishable from the legitimate flows. With the support of software-defined networking that enables dynamic network monitoring and traffic characteristic extraction, we develop a machine learning model that can learn the temporal correlation among traffic flows traversing in the ITS network, thus differentiating legitimate flows from coordinated attacking flows. We use different deep learning algorithms to train the model and study the performance using Mininet-WiFi emulation platform. The results show that our approach achieves a detection accuracy of at least 80%.

With the proliferation of network devices and rapid development in information technology, networks such as Internet of Things are increasing in size and becoming more complex with heterogeneous wired and wireless links. In such networks, link faults may result in a link disconnection without immediate replacement or a link reconnection, e.g., a wireless node changes its access point. Identifying whether a link disconnection or a link reconnection has occurred and localizing the failed link become a challenging problem. An active probing approach requires a long time to probe the network by sending signaling messages on different paths, thus incurring significant communication delay and overhead. In this paper, we adopt a passive approach and develop a three-stage machine learning-based technique for link fault identification and localization (ML-LFIL) by analyzing the measurements captured from the normal traffic flows, including aggregate flow rate, end-to-end delay, and packet loss. ML-LFIL learns the traffic behavior in normal working conditions and different link fault scenarios. We train the learning model using support vector machine, multilayer perceptron, and random forest. We implement ML-LFIL and carry out extensive experiments using Mininet platform. Performance studies show that ML-LFIL achieves high accuracy while requiring much lower fault localization time compared to the active probing approach.

Cloud data centers nowadays play an important role in providing computing and network resources for online applications and services. Such applications obtain cloud resources by submitting resource requests in the form of virtual networks that are embedded in the cloud infrastructures, referred to as virtual network embedding (VNE). Developing an effective VNE algorithm is crucial since it affects the performance of data centers, such as rejection ratio, resource utilization, and revenue. The problem is much more challenging when considering ring optical data centers due to multiple issues: wavelength continuity constraint, wavelength selection, and physical path selection for a lightpath. In this paper, we first develop an optimization programming formulation, which is computationally prohibitive. We then develop a novel VNE algorithm that adopts the Web page ranking approach to evaluate the goodness of a top-of-the-rack (ToR)-based on its resources in correlation with that of other ToRs. We also develop efficient methods for wavelength and physical path selections for a lightpath dynamically created during the embedding. We evaluate the proposed algorithm through comprehensive simulations in comparing with the optimal results and baseline algorithms. The simulation results show that the proposed algorithm performs close to the optimal one. It significantly reduces the rejection ratio by at least 23% compared to the baseline algorithms, leading to an increase in revenue by at least 14%.

In software-defined networks, distributed controller architectures provide improved scalability and reliability by using multiple controllers, each managing a partition of the network. However, due to the dynamics of network control traffic, static switch-controller mapping causes load imbalance while dynamic mapping causes frequent switch migrations among controllers. In this paper, we present a novel game-theoretic switch-controller mapping approach that considers control traffic variations in distributed-controller software-defined networks. We formulate the problem as a Markov decision process that is a non-cooperative stochastic game in which the players are controllers. They compete to serve the switches within their processing capacity so as to maximize their reward based on the amount of traffic processed and their per-unit price while trying to reduce switch migrations due to traffic variations. We show the existence of a Markov perfect equilibrium for the game. We evaluate the performance of the proposed approach through comprehensive simulations, including comparisons with other alternatives. The results show that the switch-controller mapping solution obtained by the proposed approach is stable against the control traffic dynamics with good load balancing among controllers.

The advances in fiber-optic technology and wavelength division multiplexing technique have led to the adoption of optical networks into cloud data centers to meet the ever-growing traffic demands. The hybrid optical-electrical data center network architecture becomes a transition solution from the all-electrical network architecture to the all-optical one since it is efficient in terms of the operational cost and resource efficiency in data centers. Network traffic can be routed through either the electrical network or optical network or migrated between the networks. Selection of the target network (optical or electrical) for embedding and decision of migration are challenging problems for providers since it depends on multiple inter-related constraints such as wavelength availability, computing resource availability and residual bandwidth on the links. A sub-optimal decision will affect the overall performance of data centers in terms of blocking ratio and bandwidth efficiency. We address the problem of virtual network embedding and migration in hybrid data centers in this paper. We first develop an optimization programming formulation that gives the embedding solution with target networks for a given set of virtual networks while maximizing the total bandwidth utilized. Since the formulation is computationally prohibitive, we then propose a heuristic algorithm, namely Time and Bandwidth-Aware Virtual Network Embedding and Migration (TBA-VNEM), that efficiently embeds and migrates virtual networks in hybrid data centers so as to improve bandwidth efficiency. We evaluate the proposed algorithm through comprehensive simulations. The results show that the proposed algorithm outperforms baseline algorithms by reducing the rejection ratio by up to 52% and increasing the bandwidth efficiency of the optical network alone by up to 20%.

Security in Software Defined Networks (SDNs) has been a major concern for its deployment. Byzantine threats in SDNs are more sophisticated to defend since control messages issued by a compromised controller look legitimate. Applying traditional Byzantine Fault Tolerance approach to SDNs requires each switch to be mapped to 3f + 1 controllers to defend against f simultaneous controller failures. This approach, on one hand, overloads the controllers due to multiple requests from switches. On the other hand, it raises new challenges concerning the switch-controller mapping and determining minimum number of controllers required in the network. In this paper, we present a novel primary-backup controller mapping approach in which a switch is mapped to only f + 1 primary and f backup controllers to defend against simultaneous Byzantine attacks on f controllers. We develop an optimization programming formulation that provides the switch-controller mapping solution and minimizes the total number of controllers required. We consider the controller processing capacity and communication delay between switches and controllers as problem constraints. Our approach also facilitates capacity sharing of backup controllers when two switches use the same backup controller but do not need it simultaneously. We demonstrate the effectiveness of the proposed approach through numerical analysis. The results show that the proposed approach significantly reduces the total number of controllers required by up to 50% compared to an existing scheme while guaranteeing better load balancing among controllers with a fairness index of up to 0.92.

Large amount of data is being generated at an alarming rate by various systems and devices such as computing systems, cameras and mobile devices. Owing to the huge volume of this data, its processing and analysis cannot be just limited to the place of origin but require to be done at multiple computing sites. A crucial problem is how to efficiently transfer and handle big data in a network, whose performance is affected by the transfer path and bandwidth allocated to the path. In this paper, we propose a bandwidth allocation scheme that flexibly and adaptively allocates bandwidth to big data transfer requests with an objective to maximize the acceptance ratio of the requests while satisfying the deadline constraints. We first develop an optimization programming formulation and then propose a heuristic algorithm to solve the problem due to its non-linear nature. We evaluate the performance of the proposed algorithm through comprehensive simulations on a realistic network topology for two routing scenarios: a pre-computed path scenario and a load-based routing scenario. In both scenarios, the proposed algorithm outperforms baseline algorithms by reducing the rejection ratio by at least 40% and increasing the data transferred by at least 21 TB in a day.

Distributed controller architectures in software defined networks raise the issue of switch-controller mapping. In a mapping approach where a switch distributes flow setup requests (traffic) to multiple controllers, a solution that finds the optimal switch-controller mapping and traffic distribution among the controllers for long term performance and responds effectively to network events such as short term traffic variation and controller failure is necessary. We develop a Multi-Controller Traffic Engineering (MCTE) scheme that: i) finds the long term switch-controller mapping and traffic distribution that minimizes flow setup time, ii) manages traffic distribution during short term variation, and iii) pre-computes backup controllers and traffic distribution upon controller failure. We formulate optimization problems for MCTE components and develop heuristic algorithms to obtain solutions in reasonable time. Numerical simulations show that the proposed algorithms achieve flow setup time within 2% of the lower bound and effectively manage traffic upon traffic variations and controller failures.

Wavelength division multiplexed optical networks have become an attractive candidate to meet the ever-growing traffic demands in cloud data centers due to the features of large capacity and dynamic reconfiguration capability. While the bandwidth does not affect the makespan of compute-intensive and content-delivery-network applications, it has an impact on data-intensive applications that therefore require guaranteed bandwidth beside computing and storage resources for predictable performance. Motivated by this, we consider the problem of dynamically adjusting bandwidth so as to increase the acceptance of virtual networks embedded in optical data centers. We first develop an optimization programming formulation for the problem. We then develop a heuristic algorithm that efficiently embeds and adaptively allocates bandwidth to virtual networks such that the applications complete and release resources for future requests. We evaluate our algorithm through extensive simulations. The results show that our algorithm outperforms baseline algorithms by reducing rejections by up to 25%.

With more parallel and distributed applications moving to Cloud and data centers, it is challenging to provide predictable and controllable resources to multiple tenants, and thus guarantee application performance. In this paper, we propose an integrated QoS-aware resource provisioning platform based on virtualization technology for computing, storage and network resources. Coarse-grained CPU mapping and fine-grained CPU scheduling mechanisms are proposed to enable adjustable computing power. A hierarchical distributed scheduling mechanism is implemented on a scalable storage system to guarantee I/O throughput for individual tenants and applications. A network manager has also been developed to guarantee the data transmission rate. Web-based interface enables users to monitor real time resource utilization and to adjust resource QoS levels on the fly. According to our experimental results, the resource cost can be saved up to 45% without degrading the performance of a distributed data processing benchmark, and the performance of a parallel agent-based simulation can be improved by 91% using the same amount of resources.

In Software Defined Networks (SDNs), a reactive approach for failure recovery involves the centralized SDN controller which incurs long delay leading to packet losses. While a proactive approach enables fast failure recovery, it poses a new challenge concerning the number of additional forwarding rules required at every switch traversed by a flow on the primary and backup paths. These forwarding rules are stored in Ternary Content Addressable Memory (TCAM) which is limited in size and can hold only a few thousands of rules at a switch since it is expensive and power hungry. In this paper, we develop and analyze two proactive local rerouting algorithms namely Forward Local Rerouting (FLR) and Backward Local Rerouting (BLR) to compute backup paths for a primary path. By rerouting the failed traffic from the point of failure, local rerouting enables fast recovery. The proposed FLR and BLR algorithms choose backup paths so as to reduce the number of forwarding table entries with improved sharing of forwarding rules at the switches along the primary and backup paths. We evaluate the proposed algorithms through simulations on different topologies. The results show that the proposed algorithms reduce the average number of additional rules required to protect a flow by up to 75% compared to the existing approaches which do not take into account the limited size of TCAM. The results also show that the proposed algorithms are effective in terms of backup bandwidth sharing efficiency.

Mobile devices like smartphones have become the computing device of choice for many users, heralding the era of mobile computing. Many applications have been developed to run on mobile devices. However, despite the increased processing and wireless network speeds of mobile devices, their resources are still limited in terms of processing capacity and battery lifetime. Some applications, in particular computationally intensive ones such as multimedia processing, often require more resources than a mobile device can afford. To overcome this hurdle, we propose a mobile ad-hoc cloud in which a mobile device can access resources from other sources, such as nearby mobile devices, to share the workload. The difficulty that arises with this concept is the mobility of nearby devices, i.e. A neighbouring device may move out of range before it can communicate its results back to the source node. In this paper, we propose a workload distribution scheme among these nearby mobile devices that takes into account the randomness of the connection time between cooperating devices. In order to cope with this randomness, we adopt a multi-stage stochastic programming approach which is able to take posterior recourse actions to compensate for inaccurate predictions. Numerical studies and simulations were carried out to evaluate the performance of this scheme. The results show that the stochastic programming approach outperforms a naive scheme and a baseline scheme that only considers the average connection time.

The significant development of mobile cloud computing allows a mobile user to access resources of the nearby mobile devices, i.e., Cloudlets, for processing tasks by using the offloading mechanism. However, due to the mobility of the user and cloudlets, the connection between the user's device and cloudlets may be interrupted since cloudlets move out of transmission range of the user's device. Consequently, the task transmission may fail, forcing the user to re-offload the task to another cloudlet or process on the local device. In this paper, we propose a dynamic opportunistic offloading algorithm which allows the user to make the decision of offloading or deferring the processing of each task in a set of parallel tasks. We formulate and solve a Markov Decision Process (MDP) model for the mobile user to obtain an optimal offloading policy while minimizing the offloading and processing cost. We extend the MDP model to a constrained MDP to solve the offloading problem when the user has a processing deadline. Numerical studies and simulations were carried out to evaluate the performance of the proposed model. The results show that the proposed model outperforms conventional baseline schemes.

Having received significant attention in the industry, the cloud market is nowadays fiercely competitive with many cloud providers. On one hand, cloud providers compete against each other for both existing and new cloud users. To keep existing users and attract newcomers, it is crucial for each provider to offer an optimal price policy which maximizes the final revenue and improves the competitive advantage. The competition among providers leads to the evolution of the market and dynamic resource prices over time. On the other hand, cloud providers may cooperate with each other to improve their final revenue. Based on a service level agreement, a provider can outsource its users' resource requests to its partner to reduce the operation cost and thereby improve the final revenue. This leads to the problem of determining the cooperating parties in a cooperative environment. This paper tackles these two issues of the current cloud market. First, we solve the problem of competition among providers and propose a dynamic price policy. We employ a discrete choice model to describe the user's choice behavior based on his obtained benefit value. The choice model is used to derive the probability of a user choosing to be served by a certain provider. The competition among providers is formulated as a noncooperative stochastic game where the players are providers who act by proposing the price policy simultaneously. The game is modelled as a Markov Decision Process whose solution is a Markov Perfect Equilibrium. Then, we address the cooperation among providers by presenting a novel algorithm for determining a cooperation strategy that tells providers whether to satisfy users' resource requests locally or outsource them to a certain provider. The algorithm yields the optimal cooperation structure from which no provider unilaterally deviates to gain more revenue. Numerical simulations are carried out to evaluate the performance of the proposed models.

Cloud computing is emerging as a paradigm for large-scale data-intensive applications. Cloud infrastructures allow users to remotely access to computing power and data over the Internet. Beside the huge economical impact, data centers consume enormous amount of electrical energy, contributing to high operational cost and carbon footprints to the environment. An advanced resource allocation model is therefore needed to not only reduce the energy consumption of data centers but also provide incentives to users to optimize their resource utilization and decrease the amount of energy consumed for executing their application. In particular, we present in this paper a novel resource allocation model using combinatorial auction mechanisms and taking into account the energy parameter. Based on this model, we propose three monotone and truthful algorithms used for winners determination and payments computation, namely exhaustive search algorithm (ESA), linear relaxation based randomized algorithm (LRRA) and green greedy algorithm (GGA). We perform numerical simulations to evaluate the performance of three proposed algorithms. Our numerical simulations show that the green greedy algorithm can significantly reduce the amount of consumed energy while generating higher revenue for cloud providers.

In spite of the growing interest for grids and cloud infrastructures among scientific communities and the availability of such facilities at large-scale, achieving high performance in production environments remains challenging due to at least four factors: the low reliability of very large-scale distributed computing infrastructures, the performance overhead induced by shared facilities, the difficulty to obtain fair balance of all user jobs in such an heterogeneous environment, and the complexity of large-scale distributed applications deployment. All together, these difficulties make infrastructure exploitation complex, and often limited to experts. This paper introduces a pragmatic solution to tackle these four issues based on a service-oriented methodology, the reuse of existing middleware services, and the joint exploitation of local and distributed computing resources. Emphasis is put on the integrated environment ease of use. Results on an actual neuroscience application show the impact of the environment setup in terms of reliability and performance. Recommendations and best practices are derived from this experiment.

Cloud computing infrastructures are providing resources on demand for tackling the needs of large-scale distributed applications. Determining the amount of resources to allocate for a given computation is a difficult problem though. This paper introduces and compares four automated resource allocation strategies relying on the expertise that can be captured in workflow-based applications. The evaluation of these strategies was carried out on the Aladdin/Grid'5000 testbed using a real application from the area of medical image analysis. Experimental results show that optimized allocation can help finding a trade-off between amount of resources consumed and applications make span.

Through the recent emergence of joint resource and network virtualization, dynamic composition and provisioning of time-limited and isolated virtual infrastructures is now possible. One other benefit of infrastructure virtualization is the capability of transparent reliability provisioning (reliability becomes a service provided by the infrastructure). In this context, we discuss the motivations and gains of introducing customizable reliability of virtual infrastructures when executing large-scale distributed applications, and present a framework to specify, allocate and deploy virtualized infrastructure with reliability capabilities. An approach to efficiently specify and control the reliability at runtime is proposed. We illustrate these ideas by analyzing the introduction of reliability at the virtual-infrastructure level on a real application. Experimental results, obtained with an actual medical-imaging application running in virtual infrastructures provisioned in the experimental large-scale Grid'5000 platform, show the benefits of the virtualization of reliability.

With the expansion and the convergence of computing and communication, the dynamic provisioning of customized processing and networking infrastructures as well as resource virtualization are appealing concepts and technologies. Therefore, new models and tools are needed to allow users to create, trust and exploit such on-demand virtual infrastructures within wide area distributed environments. This paper proposes to combine network and system virtualization with cryptographic identification and SPKI/HIP principles to help the user communities to build and share their own resource reservoirs. These ideas are implemented in the HIPerNet framework enabling the creation and the management of customized confined execution environments in a large scale context. Based on the example of biomedical applications, the paper focuses on the security model of the HIPerNet system and develops the key aspects of our distributed security approach. Then the paper discusses and illustrates how HIPerNet solutions fulfill the security requirements of applications through different scenarios.