The rapid growth of mobile networks and the need for resilient infrastructure pose challenges to the scalability and fault tolerance of the mobile core network (CN). This study presents Premature-Cloud5GC (P-Cloud5GC), a novel 5G CN architecture designed for public cloud environments. Extending the serverless control plane design of Cloud5GC, P-Cloud5GC incorporates user plane functionality and web-application-based technologies to improve scalability, session management, and fault isolation. Using serverless computing, distributed messaging, and cloud-native databases, P-Cloud5GC deploys a micro Mobile Core per UE procedure, preventing large-scale failures and enhancing redundancy. Performance evaluation during PDU session setup shows that P-Cloud5GC can handle a sufficient volume of UE connection requests within practical time constraints. This work demonstrates the viability of cloud-based mobile core networks, offering a scalable, fault-tolerant, and costeffective alternative to traditional 3GPP-based 5G cores.

The advancement of internet applications over the last decade makes network security a priority, in which Intrusion Detection System (IDS) is responsible for detecting threat in network throughput. Nevertheless, current IDS encounter challenges because (i) the training dataset is seriously class-imbalance, (ii) conventional method requires a lot of hand-crafted feature selection. To address these problems, we propose a novel method that combines data augmentation method as well as convolutional autoencoder to build up an IDS. Our method uses SMOTE to balance the distribution of each attack in the training dataset, then uses a convolutional autoencoder to detect the intrusion, which is free of hand-crafted feature design. Experimentally, we show that our proposed method outperforms conventional method both in binary and multi-class classification in terms of accuracy. We also have an ablation study on how the ratio of minority class in dataset effect the f1-score of the model.

Flower jellies, a delicate dessert in which a flower-shaped jelly floats inside another clear jelly, fascinate people with both their beauty and elaborate construction. In efforts to simplify the challenging fabrication and enrich the design space of this dessert, we present Flower Jelly Printer: a printing device and design software for digitally fabricating flower jellies. Our design software lets users play with parameters and preview the resulting forms until achieving their desired shapes. We also developed slit injection printing that directly injects colored jelly into a base jelly, and shared several design examples to show the breadth of design possibilities. Finally, the user study with novice and experienced users demonstrates that our system benefits creators of all experience levels by iterative design and precise fabrication. We hope to enable more people to design and create their own flower jellies while expanding access and the design space for digitally fabricated foods.

Zero-Touch is a broad concept, but it is understood as a means to limit human exposure to the data-plane states, and therefore reduces the potential for error. By combining the various layers from the administration level down to the switching fabric, introducing a new top to bottom architecture. This paper presents our operational research project HolistIX, a full-stack management solution enabling zero-touch networking within IXP infrastructure networks. HolistIX achieves this by first bringing diagramming to the forefront of topology planning and automated network configuration generation. This is then followed by verifying the proposed network configuration through emulation before deployment to the production network. By utilizing Umbrella SDN switching fabric, HolistIX enables full-stack management, with minimal human interaction required. We also briefly present the results of deploying our HolistIX approach in two IXPs, one in France (TouIX) and the other in Japan (DIX-IE).

Low-Rate DoS (LDoS) attacks degrade the quality of service with less traffic than ordinary DoS attacks. LDoS attacks can easily evade conventional counter-DoS detection mechanisms because their time-averaged flow is small. Thus, LDoS attack is getting a serious problem nowadays. With the recent spread of IoT devices, Zigbee, one of the IoT communication standards, attracts much attention. Zigbee is a low-power wireless communication protocol at the sacrifice of its transfer range and bandwidth. Since Zigbee consumes low power, it is widely adopted for inexpensive small sensors and IoT that run on batteries. The advantage of the low power consumption of Zigbee is due to its use of indirect transmission. However, we newly found that vulnerability to LDoS attacks existed in the indirect transmission. In this study, we first point out this vulnerability and describe new LDoS attack scenarios exploiting it. Next, we propose simple countermeasures against them which require low computational cost. Then, simulation experiments are conducted to evaluate the impact of the attacks and the effectiveness of the proposed countermeasures. The experimental results show that the new LDoS attacks can decrease the normal packet arrival rate to 0% by adjusting the timing of attacks. It is also revealed that our proposed countermeasures successfully prevent such cases and improve the minimum arrival rate to 80% at best.

As signature-based techniques have ever more difficulty detecting increasing and varying malicious activities through network traffic, machine learning has become a promising approach in network security. Many previous studies have aggregated traffic data into groups by hosts or flows for generating features and training detection models. However, two problems degrade detection performance. One is the scarcity of training sets due to the rarity of new types of malicious traffic, and the other is variations in feature values generated from incomplete data due to limited observed traffic. In this paper, we propose a stochastic method called Alchemy that regenerates a set of feature vectors by randomly resampling raw traffic data of each bag into several subsets. Alchemy can increase training sets and represent raw traffic robustly to correct the influence of variations in feature vectors, regardless of types of traffic data and classifiers. We evaluated Alchemy with real-world traffic data of network flows, passive DNS records, and HTTP logs, and demonstrated that it improves detection performance of various classifiers more effectively than the conventional methods in all three types of traffic data.

This paper proposes a novel approach for fast container networking that enables applications in containers to utilize host network stacks directly with proper access control. Our approach, called socket-grafting, offers a new socket-layer communication channel by grafting sockets in containers onto sockets in host network stacks. In contrast to recent approaches that make network stacks faster by using high-speed packet I/O techniques, socket-grafting makes container networking faster by bypassing a container's network stack and virtual interfaces. As a concrete implementation of socket-grafting, we designed AF_GRAFT, which is a new address family for the socket layer. AF_GRAFT performs interconnection between the two socket layers in the container and host network stacks. In this paper, we describe socket-grafting, AF_GRAFT design, and its implementation on Linux. Our evaluation results demonstrate that the proposed method doubled throughput and reduced latency by 23% compared with traditional NAT-based container networking, and improved the network performance of containerized HTTP servers and message queues.

As is the case for recently networked systems, traffic analysis that detects malicious hosts is one of the most important issues in achieving better security. Many methods for detecting cyber attacks have been proposed; however, methods that specialize in detecting and identifying specific attacks will be obsolete in the near future. Instead of identifying types of cyber attacks, we propose a novel method to detect malicious hosts based on their behavior characteristics when they send SYN packets. Our method does not identify types of cyber attacks. It detects malicious hosts suspiciously sending SYN packets. This paper shows that (1) we have developed a method to convert a series of SYN packets to a visual image as input for neural networks, (2) the image represents distinctive features of the behavior of the hosts and (3) our convolutional neural network model successfully distinguishes malicious host from normal ones. Our preliminary evaluation using real-word traffic shows that the detection accuracy for identifying malicious hosts is over 98% regardless of types of attack.

Service chaining is an emerging architecture from the trend of Software Defined Networking and Network Functions Virtualization. This architecture is expected to improve network flexibility and reduce equipment and operational costs. However, recent approaches for service chaining require new networking technologies that need to be standardized, implemented and developed. In this paper, we present and demonstrate a scalable and deployable service chaining architecture, called FlowFall. FlowFall does not require any novel technologies, only requires OpenFlow and current Virtual Machines as Virtual Network Function. Moreover, we focus on the NFV backbone network and how to achieve scale-out its performance. We describe the approach of FlowFall and an evaluation in which our method achieves 10-gigabit wire-rate throughput with 128-byte packets on a single Hyper Visor and scale-out performance among multiple Hyper Visors. Finally, we demonstrate a proof-of-concept of FlowFall in an actual service network at Interop Tokyo 2015 ShowNet.

Various overlay networks have been proposed and developed to increase flexibility on networks to address issues of the IP network. However, the existing overlay networks have two problems: 1) the topology of existing overlays is essentially full-mesh tunneling topology, 2) dependence of control plane and data plane. The full-mesh tunneling topology cannot enable the overlay routing for performance improvement of networks. The dependence of them causes complication of operations due to the isolation of overlay networks, and increases development costs. To improve the problems, we propose a new abstraction layer provides a common architecture for data planes of overlay networks that can deploy overlay routing. Based on the architecture, we design and implement a protocol stack, called ovstack. In this paper, we describe the architecture, design and implementation, then evaluate the performance of overlays including ovstack. The ovstack can contribute to construct more flexible overlay networks on the current networks easily.

Domain Name Systems (DNS) servers provide a critical service to users and application on the internet. At the top of the DNS hierarchy is the Root DNS servers providing pointers to Top Level Domain servers on the Internet. Over the past years the number of Root DNS servers has grown to cope with the exponential growth of the Internet. This paper reports on the status and performance of the Root DNS servers gathered by the Gulliver's project SEIL probes which are deployed globally. This is the first effort to carry out long term study, from 2007 till 2009, on the performance of Root DNS servers. The data gathered shows the performance of anycast Root DNS servers in terms of Loss Rate and Query Response Time (QRT). Anycast servers' performance on the whole has been improving with more deployment of its instances, while unicast servers' performance has been roughly the same. We have correlated changes in the QRT to events that has occurred, eg. Cable breaks and deployment of a new anycast instance.

Black hole attack is a serious threat in a mobile ad hoc network (MANET). In this attack, a malicious node injects a faked route reply message to deceive the source node so that the source node establishes a route to the malicious node and sends all the data packets to the malicious node. Every conventional method to detect such an attack has a defect of rather high rate of misjudgment in the detection. In order to overcome this defect, we propose a new detection method based on checking the sequence number in the route reply message by making use of a new message originated by the destination node and also by monitoring the messages relayed by the intermediate nodes in the route. Computer simulation results demonstrate that our method has a feature of much lower false positive and negative rates in detecting any number of malicious nodes than the conventional methods.