Summary Malwares are growing exponentially in number, and authors of malwares are continuously releasing new ones. Malwares developed by the same author group might have similar signatures. For a number of applications including digital forensic and law enforcement, such characteristics can be used to determine which author group is likely to have released a given malware. In this paper, we describe a new type of classification that identifies which group of authors is most likely to have developed a given malware. We identify and verify a set of various features obtained through static and dynamic analyses of malwares and exploit them for classification. We evaluate our approach through extensive experiments with a real‐world dataset labeled by a group of domain experts. The results show that our approach is effective and provides good accuracy in malware classification.

The large scale and high performance requirements of Cloud computing pose many challenges to the data center network operators. These networks typically require high bisection bandwidth, strict performance isolation, and power-efficient operation. Recently, many researchers have proposed various network controller systems for programming networks, each of them to individually address only one of these challenges. In this paper, however, we show that running multiple controllers in a shared network fabric independently is not only inefficient but conflicting control decisions by different controllers can also lead to serious network performance degradation. We present HERCULES, an integrated control framework, to enable coexistence and operation of multiple controllers. As an initial proof of concept, we have integrated four existing controllers into HERCULES framework. Our evaluation of the integrated controller shows that it can enable multiple controllers to leverage each other and collectively achieve the multiple goals of the controllers simultaneously.

Global network testbeds are crucial for innovative network research. Built on the success of PlanetLab, the next generation of federated testbeds are under active development, but very little is known about resource usage in the shared infrastructures. In this paper, we conduct an extensive study of the usage profiles in PlanetLab that we collected for six years by running CoMon, a PlanetLab monitoring service. We examine various aspects of node-level behavior as well as experiment-centric behavior, and describe their implications for resource management in the federated testbeds. Our main contributions are threefold: (1) Contrary to common belief, our measurements show there is no tragedy of the commons in PlanetLab, since most PlanetLab experiments exploit the system's network reach more than just its hardware resources; (2) We examine resource allocation systems proposed for the federated testbeds, such as bartering and central banking schemes, and show that they would handle only a small percentage of the total usage in PlanetLab; and (3) Lastly, we identify factors that account for high resource contention or poor utilization in PlanetLab nodes. We analyze workload imbalance and problematic slices in PlanetLab, and describe the implications of our measurements for improving overall utility of the testbed.

Datacenters need high-bandwidth interconnection fabrics. Several researchers have proposed highly-redundant topologies with multiple paths between pairs of end hosts for datacenter networks. However, traffic management is necessary to effectively utilize the bisection bandwidth provided by these topologies. This requires timely detection of elephant flows-flows that carry large amount of data-and managing those flows. Previously proposed approaches incur high monitoring overheads, consume significant switch resources, and/or have long detection times. We propose, instead, to detect elephant flows at the end hosts. We do this by observing the end hosts's socket buffers, which provide better, more efficient visibility of flow behavior. We present Mahout, a low-overhead yet effective traffic management system that follows OpenFlow-like central controller approach for network management but augments the design with our novel end host mechanism. Once an elephant flow is detected, an end host signals the network controller using in-band signaling with low overheads. Through analytical evaluation and experiments, we demonstrate the benefits of Mahout over previous solutions.

In wireless networks where communications are made over a shared medium, interference and collisions are the primary causes of packet drops. In multi-hop networks such as wireless mesh networks, due to the hidden terminal problem, limiting the effects of collisions and interference is a key in achieving high performance. Typical wireless medium access control protocols perform carrier sensing to avoid collisions. Most research efforts so far has used the binary model when studying carrier sensing and interference; a node is either carrier sensed or not, and a link is either interfered or not. In reality however, there exists a gray zone. Carrier sensing and interference should be represented in continuous values. Using the measurement data from our 802.11a wireless mesh network test-bed, we propose metrics that represent the levels of carrier sensing and interference. Using our metrics, we also propose methods to estimate broadcast throughput and goodput. We evaluate the accuracy of our methods by comparing our models with the measured data. In addition, we investigate the impact of the capture effect on interference.