The Bring-Your-Own-Handheld-device (BYOH) phenomenon continues to make inroads as more people bring their own handheld devices to work or school. While convenient to device owners, this trend presents novel management challenges to network administrators. Prior efforts only focused on studying either the comparative characterization of aggregate network traffic between BYOHs and non-BYOHs or network performance issues, such as TCP and download times or mobility issues. We identify one critical question that network administrators need to answer: how do these BYOHs behave individually? In response, we design and deploy Brofiler, a behavior-aware profiling framework that improves visibility into the management of BYOHs. The contributions of our work are two-fold. First, we present Brofiler, a time-aware device-centric approach for grouping devices into intuitive behavioral groups. Second, we conduct an extensive study of BYOHs using our approach with real data collected over a year, and highlight several novel insights on the behavior of BYOHs. These observations underscore the importance of that BYOHs need to be managed explicitly as they behave in unique and unexpected ways.

In this paper, we study the intertwined propagation of two competing "memes" (or data, rumors, etc.) in a composite network. Within the constraints of this scenario, we ask two key questions: (a) which meme will prevail? and (b) can one influence the outcome of the propagations? Our model is underpinned by two key concepts, a structural graph model (composite network) and a viral propagation model (SI1I2S). Using this framework, we formulate a non-linear dynamic system and perform an eigenvalue analysis to identify the tipping point of the epidemic behavior. Based on insights gained from this analysis, we demonstrate an effective and accurate prediction method to determine viral dominance, which we call the EigenPredictor. Next, using a combination of synthetic and real composite networks, we evaluate the effectiveness of various viral suppression techniques by either a) concurrently suppressing both memes or b) unilaterally suppressing a single meme while leaving the other relatively unaffected.

Landmark-based routing (LR) provides a promising approach for scalable point-to-point routing in wireless sensor networks (WSNs). Though various approaches have been proposed for landmark-based routing, they either introduce significant computational complexity or are inefficient in realistic, dynamic environments. In this paper, we identify three design principles that could form the basis of efficiency: algorithmic simplicity, update efficiency, and application awareness. Motivated by these principles, we present XLR, a new, flexible and comprehensive framework that tackles the inefficiency of landmark-based routing. XLR consists of four components: Relay Selection (RS), Parametric P-Norm distance function (PPN), Efficient Update with Coordinate Difference (EUCD) and General Forwarding (GF). The key advantage of XLR is that any subset of XLR's components can be independently incorporated into most landmark-based routing protocols.We perform extensive simulations to demonstrate that: (i) RS, a simple method, yields good performance comparable with previous methods, (ii) PPN increases LR performance considerably, (iii) EUCD reduces coordinate update overhead by up to 39%, and (iv) our GF outperforms previous approaches that consider factors such as link quality, delay and power consumption independently.

Given a network of who-contacts-whom or who links-to-whom, will a contagious virus/product/meme spread and 'take-over' (cause an epidemic) or die-out quickly? What will change if nodes have partial, temporary or permanent immunity? The epidemic threshold is the minimum level of virulence to prevent a viral contagion from dying out quickly and determining it is a fundamental question in epidemiology and related areas. Most earlier work focuses either on special types of graphs or on specific epidemiological/cascade models. We are the first to show the G2-threshold (twice generalized) theorem, which nicely de-couples the effect of the topology and the virus model. Our result unifies and includes as special case older results and shows that the threshold depends on the first eigenvalue of the connectivity matrix, (a) for any graph and (b) for all propagation models in standard literature (more than 25, including H.I.V.) [20], [12]. Our discovery has broad implications for the vulnerability of real, complex networks, and numerous applications, including viral marketing, blog dynamics, influence propagation, easy answers to 'what-if' questions, and simplified design and evaluation of immunization policies. We also demonstrate our result using extensive simulations on one of the biggest available social contact graphs containing more than 31 million interactions among more than 1 million people representing the city of Portland, Oregon, USA.

Industry has responded to the ever-growing presence of spam by attacking the spam distribution infrastructure, essentially trying to prevent spam email from ever landing in the inbox of end-users. Recently, industry and academia have begun investigating the web hosting infrastructure of spam campaigns, attacking spammers where it hurts most, in their pocketbooks. Spammers have responded by introducing cooperative interme- diaries that redirect traffic, effectively decoupling the spam-advertised URL from the final destination website. In this study, we analyze not only the URLs in spam messages, but the less-studied redirection infrastructure that takes the user to a target website or other malicious host. Our initial results show that among all the hosts that can be reached directly from URLs embedded in email bodies, 64.87% are cooperative redirection hosts. However, these redirection hosts are only used to protect a small portion (11.33%) of final destination websites. Additionally, we find that around 70% of embedded URLs resolve to two ranges of IP space (61.0.0.0/8 and 124.0.0.0/8). By further analyzing the relationship between the final destinations and redirection hosts, we find that 74.19% of the final destination hosts are located in the same AS with their redirection hosts.

The Border Gateway Protocol (BGP) is one of the fundamental computer communication protocols. Monitoring and mining BGP update messages can directly reveal the health and stability of Internet routing. Here we make two contributions: firstly we find patterns in BGP updates, like self-similarity, power-law and lognormal marginals; secondly using these patterns, we find anomalies. Specifically, we develop BGP-lens, an automated BGP updates analysis tool, that has three desirable properties: (a) It is effective, able to identify phenomena that would otherwise go unnoticed, such as a peculiar 'clothesline' behavior or prolonged 'spikes' that last as long as 8 hours; (b) It is scalable, using algorithms are all linear on the number of time-ticks; and (c) It is admin-friendly, giving useful leads for phenomenon of interest.