Network Intrusion Detection Systems (NIDS) are now increasingly leveraging Machine Learning (ML) techniques to detect malicious network activities. Numerous papers have scrutinized the security of ML-based NIDS (ML-NIDS) by testing them against various attacks involving adversarial perturbations. The findings were oftentimes worrying: by making imperceptible changes to a given input, powerful ML models would be bypassed. In this context, we took a step back and wondered: where (i.e., in what “space”) have these perturbations been applied?

Machine learning (ML)–based intrusion detection systems (IDS) often degrade when deployed across heterogeneous networks due to domain shifts in traffic and configuration. To mitigate this degradation, conventional domain adaptation (DA) methods aim to align source and target data distributions; however, they require access to source data during deployment—an impractical constraint that undermines scalability and reusability. To overcome this limitation, we propose TRANSFA-IDS (Transformer Source-Free Adaptation for IDS), which removes the need for source data during adaptation while preserving the knowledge encoded in the source-trained model. TRANSFA-IDS transforms tabular flow records into structured color image embeddings and employs a compact Vision Transformer with a Deep Support Vector Data Description (Deep-SVDD) head to learn domain-invariant representations of benign behavior. During deployment, it adapts to new environments using only a small portion of unlabeled target traffic by fine-tuning the last Transformer block, efficiently realigning feature distributions without retraining. Experiments across cross-dataset settings (CICIDS2018↔UNSW-NB15) show that TRANSFA-IDS achieves AUROC scores up to 0.908 and 0.873, outperforming traditional non-adaptive unsupervised baselines by over 40% while adapting more than twice as fast as conventional adaptive unsupervised. These results demonstrate that source-free adaptation can deliver both high accuracy and deployment practicality for scalable IDS across diverse network environments.

Microservice applications are omnipresent due to their advantages, such as scalability, flexibility and consequentially resource cost efficiency. The loosely-coupled microservices can be easily added, replicated, updated and/or removed to address the changing workload. However, the distributed and dynamic nature of microservice architectures introduces a complexity with regard to monitoring and observability, which is paramount to ensure reliability, especially in critical domains. Anomaly detection has become an important tool to automate microservice monitoring and detect system failures. Nevertheless, state-of-the-art solutions assume the topology of the monitored application to remain static over time and fail to account for the dynamic changes the application, and the infrastructure it is deployed on, undergoes. This paper tackles these shortcomings by introducing a context-aware anomaly detection methodology using dynamic knowledge graphs to capture contextual features which describe the evolving state of the monitored system. Our methodology leverages resource and network monitoring to capture dependencies between microservices, and the infrastructure they are running on. In addition to the methodology for anomaly detection, this paper presents an open-source benchmark framework for context-aware anomaly detection that includes monitoring, fault injection and data collection. The evaluation on this benchmark shows that our methodology consistently outperforms the non-contextual baselines. These results underscore the importance of contextual awareness for robust anomaly detection in complex, topology-driven systems. Beyond these achieved improvements, our benchmark establishes a reproducible and extensible foundation for future research, facilitating the experimentation with broader ranges of models and a continued advancement in context-aware anomaly detection.

Continuum computing has emerged as a paradigm to improve various aspects of service orchestration by offloading computation from the cloud to the network edge. However, edge orchestration poses two significant challenges compared to cloud computing. On one hand, cloud software scheduling algorithms make suboptimal decisions when applied to the network edge, as edge devices and networks are more hetereogeneous than cloud data centers, and orchestration requires different parameters. On the other hand, most orchestration platforms assume highly centralized cloud data centers, with each server running many easily migrated software instances, whereas edge devices have limited hardware capabilities and migration of tasks between devices is significantly slower than in the cloud. As a result, there is a need for a decentralized orchestration platform that allows scheduling algorithms to take into account a wide variety of device properties and deployment requirements in placement decisions. This article presents Flocky, a decentralized device discovery and service orchestration framework based on Open Application Model (OAM), to address this gap. The architecture of Flocky is elaborated, showing how OAM enables flexible intent modeling in the edge, and combined with a Gossip-like algorithm allows individual edge devices to discover devices in their neighborhoods, map their capabilities, and optimally deploy parts of applications to individual nodes. Evaluation shows Flocky to be highly scalable and mainly dependent on local node density, with nodes discovering over 97% of their viable neighbours on average within two discovery rounds, while using 84% less memory than a centralized orchestrator such as Kubernetes.

Resilient operation of cloud-native applications is a critical requirement to service continuity, and to fostering trust in the cloud paradigm. So far, service meshes have been offering resiliency to a subset of failures. But, they fall short in achieving idempotency for HTTP POST requests. In fact, their current resiliency measures may escalate the impact of a POST request failure. Besides, the current tight control over failures - within central clouds - is being threatened by the growing distribution of applications across heterogeneous clouds. Namely, in moving towards a fog-native paradigm of applications. This renders achieving both idempotency and request satisfaction for POST microservices a non-trivial challenge. To address this challenge, we propose a novel, two-pattern, resiliency solution: Idempotency and Completer. The first is an idempotency management system that enables safe retries, following transient network/infrastructure failure. While the second is a FaaS-based completer system that enables automated resolution of microservice functional failures. This is realised through systematic integration and application of developer-defined error solvers. The proposed solution has been implemented as a fog-native service, and integrated over example service mesh Consul. The solution is evaluated experimentally, and results show considerable improvement in user satisfaction, including 100% request completion rate. The results further illustrate the scalability of the solution and benefit in closing the current gap in service mesh systems.

The rapid adoption of containerized cloud environments requires robust and efficient Auto-Scaling (AS) mechanisms to ensure adequate resource utilization, high performance, and cost-effectiveness. Traditional AS approaches, often based on predefined thresholds, fail to adapt well to dynamic workloads. This paper investigates the potential of Reinforcement Learning (RL) as a generalized solution for efficient AS in containerized clouds. Building on previous studies, this paper examines whether RL approaches can learn adaptive scaling policies when trained on diverse workload datasets and tested across different scenarios. A Multi-Objective (MO) reward function has been designed to optimize key performance factors such as the application's response time, and resource utilization. The results demonstrate that RL algorithms can effectively balance competing objectives and adapt to changing workloads. The Latency strategy resulted in lower latency but required more pods (7.4) and slightly higher CPU usage (28.92%). In contrast, the Cost strategy minimized deployment costs with fewer pods (3.56) and lower CPU usage (24.45%). This study highlights the versatility and efficiency of RL in managing complex, real-time scaling decisions in containerized cloud infrastructures.

The rapid expansion of Internet of Things (IoT), edge, and embedded devices in the past decade has introduced numerous challenges in terms of security and configuration management. Simultaneously, advances in cloud-native development practices have greatly enhanced the development experience and facilitated quicker updates, thereby enhancing application security. However, applying these advances to IoT, edge, and embedded devices remains a complex task, primarily due to the heterogeneous environments and the need to support devices with extended lifespans. WebAssembly and the WebAssembly System Interface (WASI) has emerged as a promising technology to bridge this gap. As WebAssembly becomes more popular on IoT, edge, and embedded devices, there is a growing demand for hardware interface support in WebAssembly programs. This work presents WASI proposals and proof-of-concept implementations to enable hardware interaction with I2C and USB, which are two commonly used protocols in IoT, directly from WebAssembly applications. This is achieved by running the device drivers within WebAssembly as well. A thorough evaluation of the proof of concepts shows that WASI-USB introduces a minimal overhead of at most 8% compared to native operating system USB APIs. However, the results show that runtime initialization overhead can be significant in low-latency applications.

Containers have reshaped application deployment and life-cycle management in recent cloud platforms. The paradigm shift from large monolithic applications to complex graphs of loosely-coupled microservices aims to increase deployment flexibility and operational efficiency. However, efficient allocation and scaling of microservice applications is challenging due to their intricate inter-dependencies. Existing works do not consider microservice dependencies, which could lead to the application’s performance degradation when service demand increases. As dependencies increase, communication between microservices becomes more complex and frequent, leading to slower response times and higher resource consumption, especially during high demand. In addition, performance issues in one microservice can also trigger a ripple effect across dependent services, exacerbating the performance degradation across the entire application. This paper studies the impact of microservice inter-dependencies in auto-scaling by proposing Gwydion , a novel framework that enables different auto-scaling goals through Reinforcement Learning (RL) algorithms. Gwydion has been developed based on the OpenAI Gym library and customized for the popular Kubernetes (K8s) platform to bridge the gap between RL and auto-scaling research by training RL algorithms on real cloud environments for two opposing reward strategies: cost-aware and latency-aware. Gwydion focuses on improving resource usage and reducing the application’s response time by considering microservice inter-dependencies when scaling horizontally. Experiments with microservice benchmark applications , such as Redis Cluster (RC) and Online Boutique (OB), show that RL agents can reduce deployment costs and the application’s response time compared to default scaling mechanisms , achieving up to 50% lower latency while avoiding performance degradation. For RC, cost-aware algorithms can reduce the number of deployed pods (2 to 4), resulting in slightly higher latency ( 300 μ s to 6 ms) but lower resource consumption. For OB, all RL algorithms exhibit a notable response time improvement by considering all microservices in the observation space, enabling the sequential triggering of actions across different deployments. This leads to nearly 30% cost savings while maintaining consistently lower latency throughout the experiment. Gwydion aims to advance auto-scaling research in a rapidly evolving dynamic cloud environment.

The emergence of cloud computing has driven advancements in software virtualization, particularly microservice containerization. This in turn led to the development of Container Network Interfaces (CNIs) such as Flannel to connect microservices over a network. Despite their objective to provide connectivity, CNIs have not been adequately benchmarked when containers are connected over an external network. This creates uncertainty about the operation reliability of CNIs in distributed edge-cloud ecosystems. Given the multitude of available CNIs and the complexity of comparing different ones, this paper focuses on the widely adopted CNI, Flannel. It proposes the design of novel benchmarks of Flannel across external networks, Software Defined Networking (SDN)-based and non-SDN, characterizing two of the key backend types of Flannel: User Datagram Protocol (UDP) and Virtual Extensible LAN (VXLAN). Unlike existing benchmarks, this study analysis the overhead introduced by the external network and the impact of network disruptions. The paper outlines the systematic approach to benchmarking a set of Key Performance Indicators (KPIs), including: speed, latency and throughput. A variety of network disruptions have been induced to analyse their impact on these KPIs, including: delay, packet loss, and packet corruption. The results show that VXLAN consistently outperforms UDP, offering superior bandwidth with efficient resource consumption, making it more suitable for production environments. In contrast, the UDP backend is suitable for real-time video streaming applications due to its higher data rate and lower jitter, though it requires higher resource utilization. Moreover, the results show less variation in KPIs over SDN, compared to non-SDN. The benchmark data are made publicly available in an open-source repository, enabling researchers to replicate the experiments, and potentially extend the study to other CNIs. This work contributes to the network management domain by providing an extensive benchmark study on container networking highlighting the main advantages and disadvantages of current technologies.

Data visualization recommendation aims to assist the user in creating visualizations from a given dataset. The process of creating appropriate visualizations requires expert knowledge of the available data model as well as the dashboard application that is used. To relieve the user from requiring this knowledge and from the manual process of creating numerous visualizations or dashboards, we present a context-aware visualization recommender system (VisCARS) for monitoring applications that automatically recommends a personalized dashboard to the user, based on the system they are monitoring and the task they are trying to achieve. Through a knowledge graph-based approach, expert knowledge about the data and the application is included as contextual features to improve the recommendation process. A dashboard ontology is presented that describes key components in a dashboard ecosystem in order to semantically annotate all the knowledge in the graph. The recommender system leverages knowledge graph embedding and comparison techniques in combination with a context-aware collaborative filtering approach to derive recommendations based on the context, i.e., the state of the monitored system, and the end-user preferences. The proposed methodology is implemented and integrated in a dynamic dashboard solution. The resulting recommender system is evaluated on a smart healthcare use-case through a quantitative performance and scalability analysis as well as a qualitative user study. The results highlight the performance of the proposed solution compared to the state-of-the-art and its potential for time-critical monitoring applications.

Recent years have seen the adoption of workload orchestration into the network edge. Cloud orchestrators such as Kubernetes have been extended to edge computing, providing the virtual infrastructure to efficiently manage containerized workloads across the edge-cloud continuum. However, cloud-based orchestrators are resource intensive, sometimes occupying the bulk of resources of an edge device even when idle. While various Kubernetes-based solutions, such as K3s and KubeEdge, have been developed with a specific focus on edge computing, they remain limited to container runtimes. This paper proposes a Kubernetes-compatible solution for edge workload packaging, distribution, and execution, named Feather, which extends edge workloads beyond containers. Feather is based on Virtual Kubelets, superseding previous work from FLEDGE. It is capable of operating in existing Kubernetes clusters, with minimal, optional additions to the Kubernetes PodSpec to enable multi-runtime images and execution. Both Containerd and OSv unikernel backends are implemented, and evaluations show that unikernel workloads can be executed highly efficiently, with a memory reduction of up to 20% for Java applications at the cost of up to 25% CPU power. Evaluations also show that Feather itself is suitable for most modern edge devices, with the x86 version only requiring 58-62 MiB of memory for the agent itself.

Traditional Intrusion Detection Systems (IDSs) have been a cornerstone of network security for many years. Nevertheless, with the advent of containerized applications in the last few years, there is a growing need to understand how intrusion detection can adapt to these dynamic environments. This paper presents ChronosGuard, a hierarchical machine learning (ML) IDS designed for containerized environments. ChronosGuard’s adaptable architecture consists of multiple components, each optimized for deployment in varying configurations ranging from monolithic to micro-service architectures. The performance impact of various factors such as network topology, work-load orchestration, and deployment strategies has been assessed through extensive experiments concerning the scalability and resource utilization of ChronosGuard. Results show the effective prioritization of benign traffic of up to 85% compared to malicious traffic, the negligible impact of small network delays on performance metrics, and up to 10% decrease in response times with network-aware orchestration for complex deployment configurations. This study introduces a robust, containerized IDS that can be easily adapted to meet various operational needs, ranging from a full privacy-preserving local deployment to a scalable cloud deployment but also provides foundational insights for future research into optimizing containerized security solutions.

A Kubernetes cluster typically consists of trusted nodes, running within the confines of a physically secure datacenter. With recent advances in edge orchestration, this is no longer the case. This poses a new challenge: how can we trust a device that an attacker has physical access to? This paper presents an architecture and open-source implementation that securely enrolls edge devices as trusted Kubernetes worker nodes. By providing boot attestation rooted in a hardware Trusted Platform Module, a strong base of trust is provided. A new custom controller directs a modified version of Keylime to cross the cloud-edge gap and securely deliver unique cluster credentials required to enroll an edge worker. The controller dynamically grants and revokes these credentials based on attestation events, preventing a possibly compromised node from accessing sensitive cluster resources. We provide both a qualitative and a quantitative evaluation of the architecture. The qualitative scenarios prove its ability to attest and enroll an edge device with role-based access control (RBAC) permissions that dynamically adjust to attestation events. The quantitative evaluation reflects an average of 10.28 seconds delay incurred on the startup time of the edge node due to attestation for a total average enrollment time of 20.91 seconds. The presented architecture thus provides a strong base of trust, securing a physically exposed edge device and paving the way for a robust and resilient edge computing ecosystem.

In recent years, workload containerisation has been extended to the edge, bringing with it the need for flexible overlay networking. However, current container networking solutions are generally designed for the cloud, aimed at relatively static clusters with centralized generation of container subnet addresses and assigning them to nodes. Added to that existing tunneling solutions, such as Virtual Private Networks (VPN), also have centralized components. Conversely, the network edge is geo-dispersed and has a volatile topology,with edge nodes typically hidden behind routers, in private networks. To enable large-scale networking at the edge, there is need for decentralized self-management of container network addresses and overlay tunnels. This manuscript presents Warrens, a framework for fully decentralized and self-organizing cloud-edge container networks. Warrens enables communication between edge nodes in different private networks by enabling connectionless tunnels, supported by decentralized self-assignment of container IP addresses, with the assignment scheme minimizing address conflict to a negligible level. Warrens has been implemented in two variants using kernel-level eBPF for processing speed, and user-level Golang for wider compatibility. Warrens is shown to be highly scalable compared to a typical VPN solution, and performance evaluations demonstrate it can handle a full network load on both x64 devices and a Raspberry Pi with$\approx 0.5\%$to 5% total CPU load, depending on traffic direction and protocols used.

Artificial Intelligence for IT Operations (AIOps) addresses the rising complexity of cloud computing and Internet of Things by assisting DevOps engineers to monitor and maintain applications. Machine Learning is an essential part of AIOps, enabling it to perform Anomaly Detection and Root Cause Analysis. These techniques are often executed in centralized components, however, which requires transferring vast amounts of data to a central location. This increase in network traffic causes strain on the network and results in higher latency. This paper leverages edge computing to address this issue by deploying ML models closer to the monitored services, reducing the network overhead. This paper investigates two architectural approaches: a sidecar architecture and a federated architecture, and highlights their advantages and shortcomings in different scenarios. Taking this into account, it proposes a framework that orchestrates the deployment and management of distributed edge ML models. Additionally, the paper introduces a Python library to assist data scientists during the development of AIOps techniques and concludes with a thorough evaluation of the resulting framework towards resource consumption and scalability. The results indicate up to 98.3% reduction in network usage depending on the configuration used while maintaining a minimal increase in resource usage at the edge.

Fog computing is emerging as geo-distributed and connected edge-to-cloud ecosystems, spanning multiple domains operated by different entities. Consequently, fog-compatible applications need to support distributed operations and decentralized management. This promoted the adoption of the microservices architecture, to facilitate application modularity and autonomy. Transitioning to fog-native applications, i.e., running distributed microservice workflows over multiple domains, is a challenging endeavor. On one hand, distributing workflows require awareness of the intents and dependencies of microservices, as this may impact the supply of data and the perceived Quality of Service (QoS). On the other hand, the variant capacities and energy supply, coupled with limited information-sharing across fog autonomies, hinders the prospect of end-to-end optimization. To tackle such problems, we propose a novel federate optimisation algorithm for multi-domain scheduling of fog-native microservice workflows. The algorithm incorporates workflow intents in decision-making by combining Bender's decomposition with Alternating Direction Method of Multipliers (ADMM) to provide optimized workflow placement, mapping, routing and admission. The performance of the algorithm is evaluated analytically and compared to state-of-the-art intent-based ADMM (iADMM). The results show performance trade-offs with the proposed iBADMM (direct), with the latter improving the fraction of workflow greenness by ≈ 15%.

Containerization has revolutionized application deployments in current cloud platforms, enabling the flexible instantiation of loosely-coupled microservices and enhancing operational efficacy. However, optimizing the performance of container-based applications remains a challenge and a major topic in cloud research. This paper studies the impact of queue sorting in application scheduling, focused on complex inter-dependencies among microservices. Queue sorting determines the deployment order of containers in the infrastructure, typically based on container priorities and resource requests. Optimizing these algorithms directly influences scheduling efficiency and overall application performance. This paper compares several schedulers and sorting algorithms, leveraging extensive benchmark tests conducted on the widely-used Kubernetes (K8s) platform. The evaluation includes a novel sorting algorithm named Topological-Sort, designed to prioritize containers for application scheduling focused on microservice inter-dependencies. Results show the significant impact of queue sorting on application performance, with TopologicalSort algorithms outperforming default mechanisms, yielding an average increase of 20 % in throughput and reducing response time by at least 15 %. These results highlight the importance of considering microservice inter-dependencies for effective application deployment in modern container-based environments.

Machine learning (ML) has been a staple of academic research into pattern recognition in many fields, including cybersecurity.The momentum of ML continues to speed up alongside the advances in hardware capabilities and the methods they unlock, primarily (deep) neural networks.However, this article aims to demonstrate that the non-judicious use of ML in two prominent domains of data-based cybersecurity consistently misleads researchers into believing that their proposed methods constitute actual improvements.Armed with 17 stateof-the-art datasets in traffic and malware classification and the simplest possible machine learning model this article will show that the lack of variability in most of these datasets immediately leads to excellent models, even if that model is only one comparison per feature.

Containers have revolutionized application deployment and life-cycle management in current cloud platforms. Applications have evolved from large monoliths to complex graphs of loosely-coupled microservices aiming to improve deployment flexibility and operational efficiency. However, modern microservice-based architectures are challenging since proper allocation and scaling of microservices is a difficult task due to their complex inter-dependencies. Existing works do not consider microservice dependencies, which could lead to the application’s performance degradation when service demand increases. This paper studies the impact of microservice interdependencies in auto-scaling mechanisms by proposing a novel framework named gym-hpa that enables different auto-scaling goals via Reinforcement Learning (RL). The framework has been developed based on the OpenAI Gym library for the popular Kubernetes (K8s) platform to bridge the gap between RL and auto-scaling research by training RL agents on real cloud environments. The aim is to improve resource usage and reduce the application’s response time in future cloud platforms by considering microservice inter-dependencies in horizontal scaling. Experiments with microservice benchmark applications show that RL agents trained with the gym-hpa framework can reduce on average resource usage by 30% and reduce the application’s response time by 25% compared to default scaling mechanisms.

Intrusion Detection Systems (IDS) play an important role in detecting network intrusions. Because intrusions have many variants and zero-day attacks, traditional signature- and anomaly-based IDS often fail to detect them. On the other hand, solutions based on Machine Learning (ML), have better capabilities for detecting variants. In this work, we adopt an ML-based IDS which uses three in-sequence tasks, pre-processing, binary detection, and multi-class detection, with a multi-tier architecture with one-, two-, and three-tier architectural configurations. We then mapped three in-sequence tasks into these architectures, resulting in ten task assignments. We evaluated these with queueing theory to determine which tasks assignments were more appropriate for particular service providers. With simulated annealing, we obtained the computation capacity by allocating the total cost appropriate to each tier, based on the fixed parameter set with the objective of minimizing overall delay. These investigations showed that using only the edge and allocating all tasks to it gave the best performance. Furthermore, a two-tier architecture with edge and cloud components was also sufficient for IDS as a Service with the delay that was three times better than for other task assignments. Our results also indicate that more than 85% of the total capacity was allocated and spread across nodes in the lowest tier for pre-processing to reduce delays.

An intrusion detection system (IDS), traditionally an example of an effective security monitoring system, is facing significant challenges due to the ongoing digitization of our modern society. The growing number and variety of connected devices are not only causing a continuous emergence of new threats that are not recognized by existing systems, but the amount of data to be monitored is also exceeding the capabilities of a single system. This raises the need for a scalable IDS capable of detecting unknown, zero-day, attacks. In this paper, a novel multi-stage approach for hierarchical intrusion detection is proposed. The proposed approach is validated on the public benchmark datasets, CIC-IDS-2017 and CSE-CIC-IDS-2018. Results demonstrate that our proposed approach besides effective and robust zero-day detection, outperforms both the baseline and existing approaches, achieving high classification performance, up to 96% balanced accuracy. Additionally, the proposed approach is easily adaptable without any retraining and takes advantage of n-tier deployments to reduce bandwidth and computational requirements while preserving privacy constraints. The best-performing models with a balanced set of thresholds correctly classified 87% or 41 out of 47 zero-day attacks, while reducing the bandwidth requirements up to 69%.

Digital transformation is increasingly reliant onservice-based operations in fog networks. The latter is a geo-dispersed form of the cloud, extending resources closer to end-users for improved privacy and reduced latency. The dispersion leverages diversity of compute-network capacities and energy prices, while promotes the coexistence of multiple providers. This drives variation in operational cost, coupled with limited information sharing across providers. Consequently, there is a critical need for an orchestration solution that preserves autonomy and optimizes operational cost across domains, while meeting service requirements. This paper proposes a novel service-based fog management and network orchestrator (sbMANO), which utilizes service metadata in enabling multi-provider resource management. The sbMANO is empowered with a novel optimization algorithm for service-based joint request mapping and response routing. The algorithm acts on partial information and preserves the edge for delay-critical services. The performance of the algorithm is evaluated analytically fordelay-awareanddelay-agnosticvariants. The results show that both achieve near-optimal performance in maximizing user satisfaction with minimum operational cost. Furthermore, the delay-aware variant outperforms the agnostic counterpart, with higher user satisfaction and lower operational cost.

The cloud native paradigm is emerging as a pathway to developing applications for intrinsic operation on the cloud. This prompted application modularity, leveraging the adoption of the microservices architecture. Meanwhile, fog computing is emerging as a geo-dispersed cloud, bringing services closer to the end-user for localization and improved responsiveness. Transitioning to fog-native applications, i.e. managing microservice workflows over the fog, is a non-trivial challenge. On one hand, engineering workflows require awareness of the dependencies across microservices, as they impact the perceived quality of service. On the other hand, the heterogeneity of capacities, energy prices and supply, introduce challenges that can negate the sought advantages of the fog. This work proposes a novel algorithm based on Alternating Direction Method of Multipliers for intent-based workflow mapping and admission, iADMM. The performance of the algorithm is evaluated analytically and experimentally and compared to a baseline compute-network cost minimization alternative. Evaluation results show that iADMM achieves near optimal decisions in minimizing operational costs without violating workflow intents.

In recent years, the continuing growth of the network edge, along with increasing user demands, has led to the need for increasingly complex and responsive management strategies for edge services. Many of these strategies are cloud-based, offering near-perfect solutions at the cost of requiring massive computational power, or edge-based, offering reactive strategies to changing edge conditions. This paper presents a decentralized, pro-active Quality of Experience (QoE) based architecture designed to run on edge nodes, which allows nodes to predict optimal service providers (fog nodes) in advance and request their services. The concepts behind the components of the architecture are explained, as well as geometry-inspired design decisions to limit model size. Evaluations on an NVIDIA Jetson Nano show that the architecture can predict optimal service providers for an edge node in real-time for 5 to 20 QoS (Quality of Service) and QoE parameters, with at least 50 potential fog nodes, and that overall QoE resulting from its use is improved by 1% to 18% over previous work such as SoSwirly, depending on the scenario.

Most newly proposed detection methods in intrusion detection incorporate machine learning models to distinguish between benign and malicious traffic. The models are validated on a handful of academic datasets and ranked based on their classification performance. This article aims to demonstrate that unbeknownst to the new models' authors, there are features in these datasets which heavily bias the results and obscure a realistic, reliable estimate of the separability of the datasets. This paper proposes a methodology to estimate the contaminating influence of a dataset’s features based on the concept of blind generalization. The novel methodology is subsequently used to assess the features of six widely adopted intrusion detection datasets. In each dataset, several features show a pattern where regardless of training attack class, the models blindly generalize towards all available attack classes with nearly identical classification metrics. These features provide undeserved boosts in the baseline classification scores for each dataset. By themselves, some contaminant features even push these baselines upwards of 90% accuracy (balanced).

Abstract Nowadays, many complex multi‐vendor production environments, such as telecom infrastructures in smart cities or on‐board passenger information systems in trains, are based on micro‐services and deployed in the cloud. From a service integrator viewpoint, building new solutions for these environments, which can host a large number of externally designed and developed micro‐services, is often complex and error‐prone. This is in part due to undocumented behaviour or undocumented architectural specifications of such systems. Advanced service monitoring can offer a solution to quickly detect anomalies or unexpected service interaction behaviour during on‐site integration. However, the monitoring service should not have an impact on the production environment itself. Therefore, this article proposes an agent‐based unobtrusive monitoring platform, capable of monitoring both internally developed and externally developed services through the use of sidecar containers. It monitors state, metrics and network traffic at micro‐service level and the research was conducted as part of the DynAMo research project, a collaboration with various industry partners. Prototype evaluation proves that our solution has a negligible impact (below 0.02% CPU usage on average) on an existing micro‐service environment just as other monitoring systems like Prometheus while offering additional functionality focused on multi‐vendor service integration. This makes it suitable to be deployed in complex production domains to further aid on‐site integration and quickly find potential new anomalies.

In recent years, containers have gained popularity as a lightweight virtualization technology. This rise in popularity has gone hand in hand with the adoption of microservice architectures, mostly thanks to the scalable, ethereal, and isolated nature of containers. More recently, edge devices have become powerful enough to be able to run containerized microservices, while remaining flexible enough in terms of size and power to be deployed almost anywhere. This has triggered research into several container placement strategies involving edge networks, leading to concepts such as osmotic computing. While these container placement strategies are optimal in terms of workload placement, current container orchestrators are often not suitable for running on edge devices due to their high resource requirements. In this article, FLEDGE is presented as a Kubernetes-compatible container orchestrator based on Virtual Kubelets, aimed primarily at container orchestration on low-resource edge devices. Several aspects of low-resource container orchestration are examined, such as the choice of container runtime and how to realize container networking. A number of evaluations are performed to determine how FLEDGE compares to Kubernetes and K3S in terms of resource requirements, showing that it needs around 60MiB memory and 78MiB storage to run on a Raspberry Pi 3, including all dependencies, which is significantly less than both studied alternatives.

Immersive media services, such as Augmented and Virtual Reality (AR/VR) are getting significant attention in recent years with the promise of bringing immersive experiences to end users. However, despite the remarkable advances in the field, AR/VR applications are mostly local and individual experiences. The main obstacle between current technology and future remote, multi-user AR/VR applications is the stringent end-to-end (E2E) latency requirement, which cannot exceed 20 ms to avoid motion sickness. Emerging AR/VR services put even more pressure on current network infrastructures, calling for considerable advancements toward fully cloud-native architectures. Cloud-based VR services, where participants can virtually interact across vast distances, remain a distant dream. Several challenges still arise concerning the deployment and management of VR services. This paper presents a Mixed-Integer Linear Programming (MILP) formulation for the efficient orchestration of VR services in fog-cloud infrastructures. The model considers Fog Computing (FC), an extension of cloud computing, and Segment Routing (SR), which leverages the source routing paradigm. The evaluation of realistic VR container-based service chains shows that deploying VR components hosted in a fog-cloud infrastructure can satisfy the 20 ms latency boundary.

In recent years, computing workloads have shifted from the cloud to the fog and edge, as IoT devices are becoming powerful enough to run containerized services. While the fog and edge computing can increase energy efficiency, reduce network traffic and provide better end user experience, the scale and volatility of the fog and edge also present new problems for service scheduling. In the edge, there are orders of magnitude more devices than in cloud data centers, and conditions are often less stable. Additionally, unlike in data centers, the network topology of the edge often changes, requiring a real-time approach to scheduling. In this demonstration, an implementation of a highly scalable orchestrator named “Swirly” is presented. The challenge of fog service scheduling is illustrated by using this implementation to organize software services in near real-time and on-demand in a virtual representation of a real-world industry park. Performance indicators are presented to show that this solution can scale up to 300.000 edge nodes.

Abstract Internet of Things (IoT) technologies, when adequately integrated, cater for logistics optimisation and operations' environmental impact monitoring, both key aspects for today's EU ports management. This article presents Obelisk, a scalable and multi‐tenant cloud‐based IoT integration platform used in the EU H2020 PortForward project. The landscape of IoT protocols being particularly fragmented, the first role of Obelisk is to provide uniform access to data originating from a myriad of devices and protocols. Interoperability is achieved through adapters that provide flexibility and evolvability in protocol and format mapping. Additionally, due to ports operating in a hub model with various interacting actors, a second role of Obelisk is to secure access to data. This is achieved through encryption and isolation for data transport and processing, respectively, while user access control is ensured through authentication and authorisation standards. Finally, as ports IoTisation will further evolve, a third need for Obelisk is to scale with the data volumes it must ingest and process. Platform scalability is achieved by means of a reactive micro‐services based design. Those three essential characteristics are detailed in this article with a specific focus on how to achieve IoT data platform scalability. By means of an air quality monitoring use‐case deployed in the city of Antwerp, the scalability of the platform is evaluated. The evaluation shows that the proposed reactive micro‐service based design allows for horizontal scaling of the platform as well as for logarithmic time complexity of its service time.

Service Function Chaining and Network Function Virtualization are enabling technologies that provide dynamic network services with diverse QoS requirements. Regarding the limited infrastructure resources, service providers need to prioritize service requests and even reject some of low-priority requests to satisfy the requirements of high-priority services. In this paper, we study the problem of deployment and reconfiguration of a set of chains with different priorities with the objective of maximizing the service provider's profit; wherein, we also consider management concerns including the ability to control the migration of virtual functions. We show the problem is more practical and comprehensive than the previous studies, and propose an MILP formulation of it along with two solving algorithms. The first algorithm is a fast polynomial-time heuristic that calculates an initial feasible solution to the problem. The second algorithm is an exact method that utilizes the initial feasible solution to achieve the optimal solution quickly. Using extensive simulations, we evaluate the algorithms and show the proposed heuristic can find a feasible solution in at least 83% of the simulation runs in less than 7 seconds, and the exact algorithm can achieve 25% more profit 8 times faster than the state-of-the-art MILP solving methods.

Recent trends have caused a shift from services deployed solely in monolithic data centers in the cloud to services deployed in the fog (e.g. roadside units for smart highways, support services for IoT devices). Simultaneously, the variety and number of IoT devices has grown rapidly, along with their reliance on cloud services. Additionally, many of these devices are now themselves capable of running containers, allowing them to execute some services previously deployed in the fog. The combination of IoT devices and fog computing has many advantages in terms of efficiency and user experience, but the scale, volatile topology and heterogeneous network conditions of the fog and the edge also present problems for service deployment scheduling. Cloud service scheduling often takes a wide array of parameters into account to calculate optimal solutions. However, the algorithms used are not generally capable of handling the scale and volatility of the fog. This paper presents a scheduling algorithm, named "Swirly", for large scale fog and edge networks, which is capable of adapting to changes in network conditions and connected devices. The algorithm details are presented and implemented as a service using the Kubernetes API. This implementation is validated and benchmarked, showing that a single threaded Swirly service is easily capable of managing service meshes for at least 300.000 devices in soft real-time.

Fog computing is a paradigm that extends cloud computing services to the edge of the network in order to support delay-sensitive Internet of Things (IoT) services. One of the most promising use-cases of fog computing is Smart City scenarios. Fog computing can substantially improve the quality of citywide services by reducing response delays. Owing to geographically distributed and resource-constrained fog nodes and a multitude of IoT devices in Smart Cities, efficient service deployment and end device traffic routing are quite challenging. Therefore, in this paper, we present an Integer Linear Programming (ILP) formulation for the Joint Application Component Placement and Traffic Routing (JAcPTR) problem in which users' delay requirements and the limited traffic processing capacity of application instances are considered. Besides, the JAcPTR enables users and infrastructure managers to easily enforce their locality and management requirements in the deployment of application instances. To cope with the considerably high execution time in large instances of the JAcPTR problem, we propose a fast polynomial-time heuristic to efficiently solve the problem. The performance of the proposed heuristic has been evaluated through extensive simulation. Results show that in large instances of the problem, while the state-of-the-art Mixed Integer Linear Programming (MILP) solver fails to obtain a solution in 50% of the simulation runs in 300 seconds, our proposed heuristic can obtain a near-optimal solution in less than one second.

The main goal of a smart city is to enhance the quality of life of its inhabitants by providing services using Information and Communications Technology (ICT) components in a city. ICT components include not only Internet of Things (IoT) data sources spread across the city, but also traditional non-IoT data sources. Managing all ICT components in a smart city can be challenging and results in many complexities. Consequently, there is a need for ICT management architectures. Traditional solutions are often based on a centralized ICT architecture using Cloud technologies. Recently, the number of ICT components, services, and their corresponding complexities are growing, leading to large-scale ICT architectures. Centralized Cloud solutions cannot cope with the ever-expanding demands of this kind of architectures. The limitations of the centralized approaches necessitate the design of a new ICT architecture, using distributed technologies, for every layer and element of the city. Many solutions for management from Edge-to-Cloud (E2C) through distributed technologies are forthcoming, including Decentralized-to-Centralized ICT (DC2C-ICT) and Distributed-to-Centralized ICT (D2C-ICT) architectures. The DC2C-ICT architecture and its components work on their own tasks and are solely communicating with a centralized platform. On the other hand, components of the D2C-ICT architecture can work together to provide the services for the citizens across different layers from E2C. Therefore, the D2CICT architecture is less dependent on the central Cloud-based entity, but harder to design and manage. In this paper, an “Edge-to-Cloud-as-a-Service (E2CaaS) ” model is proposed together with a model on how to build efficient software services in smart cities through different layers of E2C. The most important tasks for building these services are the management of“Data/Database,” “Resources,” and “Network Communication and Cybersecurity issues”.

In recent years, cloud computing is evolving towards a distributed paradigm called Fog Computing, aiming to provide a distributed infrastructure by placing computational resources close to end-users. To fully leverage on Fog Computing, proper resource allocation is needed to cope with the demanding constraints introduced by IoT (e.g. low latency, high mobility). One of the main challenges that remain is Service Function Chaining (SFC). Services must be connected in a specific order forming an SFC allowing providers to benefit from the high flexibility and low operational costs introduced by network softwarization. In the demonstration, an SFC controller able to optimize the placement of service chains in Fog-cloud environments will be presented. The SFC controller has been implemented on the Kubernetes platform, an open-source orchestrator for the automatic deployment of micro-services. Our approach allows Kubernetes to deploy micro-services based on up-to-date information on the current status of the network infrastructure. The demonstration will show how application developers could use our approach to set up service chains for their services. Then, performance outcomes of our SFC controller will be shown, especially in terms of container deployment times.

Recently, the fifth-generation mobile network (5G) is getting significant attention. Empowered by Network Function Virtualization (NFV), 5G networks aim to support diverse services coming from different business verticals (e.g. Smart Cities, Automotive, etc). To fully leverage on NFV, services must be connected in a specific order forming a Service Function Chain (SFC). SFCs allow mobile operators to benefit from the high flexibility and low operational costs introduced by network softwarization. Additionally, Cloud computing is evolving towards a distributed paradigm called Fog Computing, which aims to provide a distributed cloud infrastructure by placing computational resources close to end-users. However, most SFC research only focuses on Multi-access Edge Computing (MEC) use cases where mobile operators aim to deploy services close to end-users. Bi-directional communication between Edges and Cloud are not considered in MEC, which in contrast is highly important in a Fog environment as in distributed anomaly detection services. Therefore, in this paper, we propose an SFC controller to optimize the placement of service chains in Fog environments, specifically tailored for Smart City use cases. Our approach has been validated on the Kubernetes platform, an open-source orchestrator for the automatic deployment of micro-services. Our SFC controller has been implemented as an extension to the scheduling features available in Kubernetes, enabling the efficient provisioning of container-based SFCs while optimizing resource allocation and reducing the end-to-end (E2E) latency. Results show that the proposed approach can lower the network latency up to 18% for the studied use case while conserving bandwidth when compared to the default scheduling mechanism.

The increased reliance of data management applications on cloud computing technologies has rendered research in identifying solutions to the data placement problem to be of paramount importance. The objective of the classical data placement problem is to optimally partition, while also allowing for replication, the set of data-items into distributed data centers to minimize the overall network communication cost. Despite significant advancement in data placement research, replica placement has seldom been studied in unison with data placement. More specifically, most of the existing solutions employ a two-phase approach: 1) data placement, followed by 2) replication. Replication should however be seen as an integral part of data placement, and should be studied as a joint optimization problem with the latter. In this paper, we propose a unified paradigm of data placement, called CPR, which combines data placement and replication of data-intensive services into geographically distributed clouds as a joint optimization problem. Underneath CPR, lies an overlapping correlation clustering algorithm capable of assigning a data-item to multiple data centers, thereby enabling us to jointly solve data placement and replication. Experiments on a real-world trace-based online social network dataset show that CPR is effective and scalable. Empirically, it is approximate to 35% better in efficacy on the evaluated metrics, while being up to 8 times faster in execution time when compared to state-of-the-art techniques.

In crisis situations, it is important to be able to quickly gather information from various sources to form a complete and accurate picture of the situation. However, the different policies of participating companies often make it difficult to connect their information sources quickly, or to allow software to be deployed on their networks in a uniform way. The difficulty in deploying software is exacerbated by the fact that companies often use different software platforms in their existing networks. In this paper, Flexible federated Unified Service Environment (FUSE) is presented as a solution for joining multiple domains into a microservice based ad hoc federation, and for deploying and managing container-based software on the devices of a federation. The resource requirements for setting up a FUSE federation are examined, and a video streaming application is deployed to demonstrate the performance of software deployed on an example federation. The results show that FUSE can be deployed in 10 minutes or less, and that it can support multiple video streams under normal network conditions, making it a viable solution for the problem of quick and easy cross-domain federation.

For years, containers have been a popular choice for lightweight virtualization in the cloud. With the rise of more powerful and flexible edge devices, container deployment strategies have arisen that leverage the computational power of edge devices for optimal workload distribution. This move from a secure data center network to heterogenous public and private networks presents some issues in terms of security and network topology that can be partially solved by using a Virtual Private Network (VPN) to connect edge nodes to the cloud. In this paper, the scalability of VPN software is evaluated to determine if and how it can be used in large-scale clusters containing edge nodes. Benchmarks are performed to determine the maximum number of VPN-connected nodes and the influence of network degradation on VPN performance, primarily using traffic typical for edge devices generating IoT data. Some high level conclusions are drawn from the results, indicating that WireGuard is an excellent choice of VPN software to connect edge nodes in a cluster. Analysis of the results also shows the strengths and weaknesses of other VPN software.

Emergency services must be able to transfer data with high priority over different networks. With 5G, slicing concepts at mobile network connections are introduced, allowing operators to divide portions of their network for specific use cases. In addition, Software-Defined Networking (SDN) principles allow to assign different Quality-of-Service (QoS) levels to different network slices.This paper proposes an SDN-based solution, executable both offline and online, that guarantees the required bandwidth for the emergency flows and maximizes the best-effort flows over the remaining bandwidth based on their priority. The offline model allows to optimize the problem for a batch of flow requests, but is computationally expensive, especially the variant where flows can be split up over parallel paths. For practical, dynamic situations, an online approach is proposed that periodically recalculates the optimal solution for all requested flows, while using shortest path routing and a greedy heuristic for bandwidth allocation for the intermediate flows.Afterwards, the offline approaches are evaluated through simulations while the online approach is validated through physical experiments with SDN switches, both in a scenario with 500 best-effort and 50 emergency flows. The results show that the offline algorithm is able to guarantee the resource allocation for the emergency flows while optimizing the best-effort flows with a sub-second execution time. As a proof-of-concept, a physical setup with Zodiac switches effectively validates the feasibility of the online approach in a realistic setup.

Drones and thermal cameras are often combined within applications such as search and rescue, and fire fighting.Due to vendor specific hardware and software, applications for these drones are hard to develop and maintain.As a result, a pluggable drone imaging analysis architecture is proposed that facilitates the development of custom image processing applications.This architecture is prototyped as a microservice-based plugin framework and allows users to build image processing applications by connecting media streams using microservices that connect inputs (e.g.regular or thermal camera image streams) to image analysis services.The prototype framework is evaluated in terms of modifiability, interoperability and performance.This evaluation has been carried out on the use case of detecting large crowds of people (mobs) during open-air events.The framework achieves modifiability and performance by being able to work in soft real-time and it achieves the interoperability by having an average successful exchange ratio of 99.998%.A new dataset containing thermal images of such mobs is presented, on which a YOLOv3 neural network is trained.The trained model is able to detect mobs on new thermal images in real-time achieving frame rates of 55 frames per second when deployed on a modern GPU.

This paper describes the process and results of analyzing CICIDS2017, a modern, labeled data set for testing intrusion detection systems. The data set is divided into several days, each pertaining to different attack classes (Dos, DDoS, infiltration, botnet, etc.). A pipeline has been created that includes nine supervised learning algorithms. The goal was binary classification of benign versus attack traffic. Cross-validated parameter optimization, using a voting mechanism that includes five classification metrics, was employed to select optimal parameters. These results were interpreted to discover whether certain parameter choices were dominant for most (or all) of the attack classes. Ultimately, every algorithm was retested with optimal parameters to obtain the final classification scores. During the review of these results, execution time, both on consumerand corporate-grade equipment, was taken into account as an additional requirement. The work detailed in this paper establishes a novel supervised machine learning performance baseline for CICIDS2017.

Small-to-medium businesses are increasingly relying on big data platforms to run their analytical workloads in a cost-effective manner, instead of using conventional and costly data warehouse systems. However, the distributed nature of big data technologies makes it time-consuming to process typical analytical queries, especially those involving aggregate and join operations, preventing business users from performing efficient data exploration. In this sense, a workload-driven approach for automatic view selection was devised, aimed at speeding up analytical queries issued against distributed dimensional data. This paper presents a detailed description of the proposed approach, along with an extensive evaluation to test its feasibility. Experimental results shows that the conceived mechanism is able to automatically derive a limited but comprehensive set of views able to reduce query processing time by up to 89%-98%.

Nowadays, the Internet of Things (IoT) continues to expand at enormous rates. Smart Cities powered by connected sensors promise to transform public services from transportation to environmental monitoring and healthcare to improve citizen welfare. Furthermore, over the last few years, Fog Computing has been introduced to provide an answer to the massive growth of heterogeneous devices connected to the network. Nevertheless, providing a proper resource scheduling for delay-sensitive and data-intensive services in Fog Computing environments is still a key research domain. Therefore, in this paper, a network-aware scheduling approach for container-based applications in Smart City deployments is proposed. Our proposal has been validated on the Kubernetes platform, an open source orchestrator for the automatic management and deployment of micro-services. Our approach has been implemented as an extension to the default scheduling mechanism available in Kubernetes, enabling Kubernetes to make resource provisioning decisions based on the current status of the network infrastructure. Evaluations based on Smart City container-based applications have been carried out to compare the performance of the proposed scheduling approach with the standard scheduling feature available in Kubernetes. Results show that the proposed approach achieves reductions of 80% in terms of network latency when compared to the default scheduling mechanism.

Summary Within the context of cloud computing, efficient resource management is of great importance as it can result in higher scalability and significant energy and cost reductions over time. Because of the high complexity and costs of cloud environments, however, newly developed resource allocation strategies are often only validated by means of simulations, for example, by using CloudSim or custom‐developed simulation tools. This article describes a general approach for the validation of cloud resource allocation strategies, illustrating the importance of experimental validation on physical testbeds. Furthermore, the design and implementation of Raspberry Pi as a Service (RPiaaS), a low‐cost embedded testbed built using Raspberry Pi nodes, is presented. RPiaaS aims to facilitate the step from simulations toward experimental evaluations on larger cloud testbeds and is designed using a microservice architecture, where experiments and all required management services are running inside containers. The performance of the RPiaaS testbed is evaluated using several benchmark experiments. The obtained results not only illustrate that the overhead of both using containers and running the required RPiaaS services is minimal but also provide useful insights for scaling up experiments between the Raspberry Pi testbed and a larger more traditional cloud testbed. The introduced validation approach is then illustrated using a case study focusing on the allocation of hierarchically structured tenant data. The results obtained through simulations are compared to the experimental results. The RPiaaS testbed proved to be a very useful tool for the initial experimental validation before moving the experiments to a large‐scale testbed.

Automated management and orchestration of cloud applications have become increasingly important, partly due to the large skills shortage in IT operations and the increasing complexity of cloud applications. Cloud modeling languages play an important role in this, both for describing the structure of a cloud application and specifying the management actions around it. The TOSCA cloud model standard recently defined declarative workflows as the preferred way to specify these management actions but, as noted in the standard itself, this is far from ideal. This paper draws lessons from six years of using declarative workflows in Juju for deploying and managing complex platforms such as OpenStack and Kubernetes in production. This confirms the limitations: declarative workflows are inflexible, hard to reuse, and allow for related components to become silently incompatible. This paper proposes the reactive pattern to solve these issues by enabling the creation of emergent workflows using declarative flags and handlers, which can be easily grouped into reusable layers. After more than two years of using this pattern in production as part of our charms. reactive framework, it is clear that it enables reusability and ensures compatibility: 67% of reactive charms share parts of the management workflow and 73% of reactive charms share a relationship workflow.

The advent of big data analytics and cloud computing technologies has resulted in wide-spread research in finding solutions to the data placement problem, which aims at properly placing the data items into distributed datacenters.Although traditional schemes of uniformly partitioning the data into distributed nodes is the defacto standard for many popular distributed data stores like HDFS or Cassandra, these methods may cause network congestion for data-intensive services, thereby affecting the system throughput.This is because as opposed to MapReduce style workloads, data-intensive services require access to multiple datasets within each transaction.In this paper, we propose a scalable method for performing data placement of data-intensive services into geographically distributed clouds.The proposed algorithm partitions a set of data-items into geodistributed clouds using spectral clustering on hypergraphs.Additionally, our spectral clustering algorithm leverages randomized techniques for obtaining low-rank approximations of the hypergraph matrix, thereby facilitating superior scalability for computation of the spectra of the hypergraph laplacian.Experiments on a real-world trace-based online social network dataset show that the proposed algorithm is effective, efficient, and scalable.Empirically, it is comparable or even better (in certain scenarios) in efficacy on the evaluated metrics, while being up to 10 times faster in running time when compared to state-of-the-art techniques.

In recent years, the Internet of Things (IoT) has introduced a whole new set of challenges and opportunities in Telecommunications. Traffic over wireless networks has been increasing exponentially since many sensors and everyday devices are being connected. Current networks must therefore adapt to and cope with the specific requirements introduced by IoT. One fundamental need of the next generation networked systems is to monitor IoT applications, especially those dealing with personal health monitoring or emergency response services, which have stringent latency requirements when dealing with malfunctions or unusual events. Traditional anomaly detection approaches are not suitable for delay-sensitive IoT applications since these approaches are significantly impacted by latency. With the advent of 5G networks and by exploiting the advantages of new paradigms, such as Software-Defined Networking (SDN), Network Function Virtualization (NFV) and edge computing, scalable, low-latency anomaly detection becomes feasible. In this paper, an anomaly detection solution for Smart City applications is presented, focusing on low-power Fog Computing solutions and evaluated within the scope of Antwerp's City of Things testbed. Based on a collected large dataset, the most appropriate Low Power Wide Area Network (LPWAN) technologies for our Smart City use case are investigated.

Automatic scaling of complex software-as-a-service application workflows is one of the most important problems concerning resource management in clouds. In this paper, we study the automatic workflow resource scaling problem for streaming and ASAP workflows, and its time-varying variant where the workflow resource requirements change over time. Service components of streaming workflows execute concurrently while those of ASAP workflows execute sequentially. We propose an intelligent framework, BRAHMA+, which possesses the capability to learn the workflow behavior and construct a knowledge base that serves as its decision making engine. The proposed resource provisioning algorithms leverage this learned information curated in the knowledge base to perform informed and intelligent scaling decisions. Additionally, BRAHMA+ employs the use of online-learning strategies to keep the knowledge base up-to-date, thereby accommodating the changes in the workflow resource requirements over time. We evaluate the proposed algorithms using CloudSim simulations. Results on streaming and ASAP workflows, with both static and time-varying resource requirements show that the proposed algorithms are effective and produce good cost-quality trade-offs. The proactive and hybrid algorithms meet the service level agreements and restrict deadline violations to a small fraction (3%-5% in the considered scenarios), while only suffering a marginal increase in average cost per component compared to the described baseline algorithms.

With cloud computing, the efficient management of resources is of great importance as an increased utilization of the available resources can result in higher scalability and significant energy and cost reductions.Experimental validation of novel resource management strategies is costly and time consuming, and often requires in-depth knowledge of and control over the underlying cloud platform.As a result, many novel strategies are only evaluated by means of simulations, in which the whole cloud computing environment is modelled and simulated.Nonetheless, experimental validation should also be considered during the validation, as these types of experiments can often result in new insights or they can be used to fine-tune some specific parameters.In this paper we present a general approach for the experimental validation of cloud resource management strategies, together with the introduction of a cloud testbed adapter which was designed to facilitate the step from simulations towards experimental validation on physical cloud testbeds.We illustrate our solution by means of two case studies, focusing on two different types of testbeds.The adapter mainly acts as a dispatcher towards specific services of the evaluated cloud setup, and allows researchers to easily validate their ideas without having to dive deep into the complex details of the underlying cloud platform.

Big data storage technologies inherently entail high latency characteristics, preventing users from performing efficient ad-hoc querying and interactive visualization on large and distributed datasets. Most of the existing approaches addressing this issue thrive on de-normalization of the static data schema and creation of application specific (i.e. hard-coded) materialized views, which certainly reduce data access latency but at the expense of flexibility. In this regard, this paper proposes an approach that relies on an iterative process of data transformation intended to generate read-optimized data schemas. The transformation process is able to automatically identify optimization opportunities (e.g. materialized views, missing indexes), by analyzing the original data schema and the record of queries issued by users and client applications against the data set. An experimental evaluation of the proposed approach evidences a significant reduction in the query latency, ranging from 81.60% to 99.99%.

In the last years, traffic over wireless networks has been increasing exponentially, due to the impact of Internet of Things (IoT) and Smart Cities. Current networks must adapt to and cope with the specific requirements of IoT applications since resources can be requested on-demand simultaneously by multiple devices on different locations. One of these requirements is low latency, since even a small delay for an IoT application such as health monitoring or emergency service can drastically impact their performance. To deal with this limitation, the Fog computing paradigm has been introduced, placing cloud resources on the edges of the network to decrease the latency. However, deciding which edge cloud location and which physical hardware will be used to allocate a specific resource related to an IoT application is not an easy task. Therefore, in this paper, an Integer Linear Programming (ILP) formulation for the IoT application service placement problem is proposed, which considers multiple optimization objectives such as low latency and energy efficiency. Solutions for the resource provisioning of IoT applications within the scope of Antwerp's City of Things testbed have been obtained. The result of this work can serve as a benchmark in future research related to placement issues of IoT application services in Fog Computing environments since the model approach is generic and applies to a wide range of IoT use cases.

In media production companies, exchanging large media files is daily business. Due to the predictable nature of network transfers in the media production industry, timeslot-based advance bandwidth reservation results in higher bandwidth utilization and improved network performance. Timeslot-based advance reservation can be based on flexible or fixed timeslot sizes. As the flexible approach is highly beneficial under bursty and limited network traffic conditions, this paper focuses on that approach. We design, implement and evaluate a novel algorithm based on flexible timeslots, taking into account the specific characteristics of media transfers and compare it with a fixed timeslot algorithm to quantitatively study the quality and complexity of both scenarios. We have defined a set of realistic media production use cases that serve as a basis for the evaluations. Results shows that the highest admittance ratio is consistently achieved by using the flexible time interval algorithm, while the execution time of this approach is up to 12 times lower, compared to the approach with fixed timeslot sizes.

With the increasing deployments of Network Functions Virtualization (NFV) in both industry and academia, it becomes necessary to design mechanisms for keeping the integrity of Service Function Chains (SFC) responsible for NFV services delivering. Despite the advances in the development of management and orchestration for NFV, solutions to keep SFCs resilient to well-known and zero-day threats are still much needed. In this paper, we introduce a framework for deploying anomaly detection techniques for SFC in NFV environments. Our framework consists of a set of functional blocks with well-defined functions, composing an additional SFC Integrity Module (SIM) for the standard NFV architecture. The proposed SIM enables NFV orchestrators to analyze NFV elements and perform suggested actions with the goal of keeping service integrity in the network. The results obtained through the evaluation of a Proof-of-Concept implementation show that the proposed framework is able to properly detect different types of anomalies using entropy-based detection techniques.

Unmanned Aerial Vehicle (UAV) technology is advancing at a fast pace following the strong rise in interest in its applications for a wide variety of scenarios. One of the promising use cases for UAVs is their deployment during emergency and rescue operations. Their high mobility, aerial viewpoint and flexibility to be operated autonomously are huge assets during crises. UAVs exist in a wide range when it comes to cost, and so do the sensors or accessories they can carry along as payload. During emergencies it may be beneficial to have several low-cost UAVs on site, as opposed to one highly sophisticated, fully-equipped aerial platform. This way more ground can be covered in a shorter span of time during search-and-rescue operations. The situation where a single UAV is on the ground to recharge its battery can also be avoided. In this paper, we present an architecture that identifies and locates objects of interest in real-time using low-cost hardware and a state of the art object detection algorithm. We avoid the use of expensive LIDAR sensors and UAVs, but still manage to determine the position of specific predefined objects in the field with high precision. Without augmenting our detection setup by using intelligent adaptive flight patterns, we can locate an object within 1.5m of its actual location at very low latency. Our detection chain delivers the result and its location in well under one second.

Traditional infrastructure models are being replaced by Cloud-enabled models with support for several different applications/services. One of these services is professional real-time Audio/Video collaboration. Although high-end business collaboration solutions are nowadays offered with high reliability, they rely on dedicated specialized (and costly) hardware and network infrastructure setups, and usually prove difficult to scale up. On the other hand, existing cloud-based A/V collaboration solutions do allow for easier elasticity and scalability, but do so on a best-effort basis with no guarantees for reliability or quality. In this context, this paper proposes cloud-enabled A/V collaboration resource allocation algorithms focused on solving the business requirements and SLAs dealing with elasticity and scalability. The proposed algorithms attempt to minimise Cloud resource usage, in order to keep the cost within budget, while striving for the reliability and quality of dedicated hardware solutions. The evaluation is conducted using a version of the CloudSim simulator that has been extended to support collaborative meeting patterns, usage seasonality, resource expenditure prediction, network congestion and streaming multicast. Compared to the second best solution applied to the same evaluated scenario, our results show a reduction of bandwidth usage and virtual machine costs by 49% and 63%, respectively, and an effectiveness of 99% in meeting A/V collaboration setup deadlines.

The data science skills shortage means that those who have the knowledge are under constant pressure to do more with less. While the data science tools are improving at a staggering pace, the operational tools around them can not keep up. Even researchers at Google state that the issue of automatic configuration and dependency management of services is still an “open, hard problem”. This manifests itself in data scientists either constantly having to solve operational challenges or having to be in constant close collaboration with a skilled operations team. This paper addresses the operational challenges behind deploying and managing workflows on top of analytics platforms by starting from three key requirements: data scientists want to model their workflows in a reusable way, this model should be automatically deployed, managed and connected to other services, and this solution should be compatible with existing cloud modeling languages, infrastructure, analytics platforms and tools. The paper explores where the state-of-the-art falls short in meeting these requirements, proposes an architecture to solve the open challenges, and implements and evaluates this architecture.

Cloud-based Software-as-a-Service (SaaS) providers want to grow into the space of business process outsourcing (BPO). BPO refers to the systematic and controlled delegation of many steps of a company's business process. BPO is a new and important extension to SaaS, as it allows the provider to add more value in the online application services and as it enables the outsourcer to obtain more cost efficiency. BPO results in decentralized federated workflows. To describe these workflows, companies often use business process modeling languages. Currently, Business Process Modeling Notation (BPMN) is one of the best-known standards. It is crucial to ascertain that the modeled workflow is executed as intended. Errors that happen during execution of a federated workflow can come with huge costs. Validating the model is limited to syntactical checks and there is little support for validating the execution at design time. In this paper a method is presented to validate the correct execution of BPMN 2.0 Collaborations. The methods in this research use concepts from virtual time previously described for Web Services Choreography Description Language (WS-CDL). To validate the results of this research, the Eclipse BPMN modeler was extended with an implementation of the validation method.

Current Cloud software development efforts to come up with novel Software-as-a-Service (SaaS) applications are, just like traditional software development, usually no longer built from scratch. Instead more and more Cloud developers are opting to use multiple existing components and integrate them in their application workflow. Scaling the resulting application up or down, depending on user/tenant load, in order to keep the SLA, no longer becomes an issue of scaling resources for a single service, rather results in a complex problem of scaling all individual service endpoints in the workflow, depending on their monitored runtime behavior. In this paper, we propose and evaluate algorithms through CloudSim for automatic and runtime scaling of such multi-tenant SaaS workflows. Our results on time-varying workloads show that the proposed algorithms are effective and produce the best cost-quality trade-off while keeping Service Level Agreements (SLAs) in line. Empirically, the proactive algorithm with careful parameter tuning always meets the SLAs while only suffering a marginal increase in average cost per service component of approximate to 5-8% over our baseline passive algorithm, which, although provides the least cost, suffers from prolonged violation of service component SLAs.

Real-time Audio/Video (A/V) collaboration is an application domain for which Cloud adoption is being investigated. However, the professional market generally prefers reliability over elasticity / scalability, in terms of managed delay and quality, and hence usually relies on dedicated specialized hardware and network setups, which are costly and hard to scale. This paper proposes cloud-enabled A/V resource allocation algorithms that combine elasticity and scalability with a focus on solving professional SLA requirements. The proposed algorithms attempt to minimize cloud cost and network usage by intelligently provisioning service endpoints along distributed data centers and splitting A/V streaming content in selected endpoints, while striving for the measurable and controlled reliability offered by dedicated solutions. An extended version of the CloudSim simulator, developed to generate and simulate A/V collaboration patterns while collecting statistics about resource usage and cost, network congestion and delay, among others, was used for evaluation purposes. When comparing results between the most efficient proposed approach and the second one, bandwidth usage and virtual machine costs are reduced by 60% and 65%, respectively, while maintaining industry-accepted SLA compliance levels.

The prevalent use of multi-component, multi-tenant models for building novel Software-as-a-Service (SaaS) applications has resulted in wide-spread research on automatic scaling of the resultant complex application workflows. In this paper, we propose a holistic solution to Automatic Workflow Scaling under the combined presence of Streaming and Deadline-critical workflows, called AWS-SD. To solve the AWS-SD problem, we propose a framework BRAHMA, that learns workflow behavior to build a knowledge-base and leverages this info to perform intelligent automated scaling decisions. We propose and evaluate different resource provisioning algorithms through CloudSim. Our results on time-varying workloads show that the proposed algorithms are effective and produce good cost-quality trade-offs while preventing deadline violations. Empirically, the proposed hybrid algorithm - combining learning and monitoring, is able to restrict deadline violations to a small fraction (3-5%), while only suffering a marginal increase in average cost per component of 1-2% over our baseline naïve algorithm, which provides the least costly provisioning but suffers from a large number (35-45%) of deadline violations.

Due to the predictable nature of network transfers in media production industry, advance bandwidth reservation results in higher bandwidth utilization and improved network performance. However, in unreliable networks, this may fail. As a first provisional stage, deploying protection mechanisms ensures that the schedule remains valid when the system is in operation. Constant monitoring and modification is also required in order to be capable of dynamically adapting the network to changing conditions. In this paper, we propose an efficient dual approach consisting of two processes. First, a schedule is produced by a resilient advance reservation algorithm. Then, the generated schedule is continually updated over time using a runtime adaptation approach. As this step uses the interconnecting network links' leftover capacity, following this approach leads to increased performance in case of steady network conditions, or neutral performance when transmitting admitted requests in uncertain network conditions.

Cloud computing is closely related to multi-tenancy, as it relies on resources that are shared among multiple clients. The provisioning and management of storage resources for cloud applications is an interesting research topic, as reallocation of data over time should be minimised, and the developed strategy should guarantee both data separation and performance isolation for every tenant. In this demo, we present a simulation tool for evaluating and comparing different data allocation strategies. Evaluation using real implementations can be very expensive and time consuming, and is not always possible, due to the scale and complexity of the infrastructure on which they are intended to run. The simulator aids as a tool for inexpensive and rapid evaluation of new techniques, and to validate and finetune new data allocation strategies.

Cloud computing is growing in adoption for different services previously supported by traditional infrastructure, including dedicated hardware setups. One of these cloud-enabled services is real-time Audio/Video collaboration. Existing cloud-based collaboration systems generally function on a best-effort basis, and offer little to no delivery and quality guarantees. High-quality business-focused solutions are therefore offered using dedicated and often manually configured hardware. In this paper, we present resource provisioning algorithms to provide the mentioned elasticity under strict quality requirements. These algorithms are evaluated, using an extended version of the CloudSim simulator, making use of realistic collaborative meeting patterns prepared to deal with seasonality and usage prediction. Our results show that the algorithms improve costs by up to 98.38% when compared with previously designed more naive approaches and with an effectiveness of 99.9% in meeting A/V collaboration setup deadlines.

Software-as-a-service (SaaS) providers are further expanding their offering by growing into the space of business process outsourcing (BPO). Therefore, the SaaS provider wants to administer and manage the business process steps according to a service level agreement. Outsourcing of business processes results in decentralized business workflows. However, current business process modeling languages, e.g. Business Process Execution Language (BPEL), Business Process Model and Notation (BPMN), are based highly on a centralized execution model and current BPMN engines offer limited constructs for federation and decentralized execution. To guarantee execution of business processes according to a service level agreement, different parties involved in a federated workflow must be able to inspect the state of external workflows. This requires advanced inspection interfaces and monitoring facilities. Current business process modeling languages must thus be extended to support monitoring in the s pecification, support modeling and support deployment of decentralized workflows. In this paper, correlation and monitoring extensions for BPMN are described. These extensions to BPMN are described such that the existing specification can still be used as is in a backwards compatible way.

Software-Defined Storage (SDS) is an evolving concept in which the management and provisioning of data storage is decoupled from the physical storage hardware. Data-intensive multi-tenant SaaS applications running on the public cloud could benefit from the concepts introduced by SDS by managing the allocation of tenant data from the tenant's perspective, taking custom tenant policies and preferences into account. In this paper, we propose the design of a scalable multi-tenant SDS system. In our approach, tenants are hierarchically clustered based on multiple scenario-specific characteristics. The storage elasticity component of the SDS system is responsible for the dynamic (re-)allocation of tenant data over the available storage resources. It invokes the Hierarchical Bin Packing algorithm introduced in this paper to determine an optimized distribution of tenant data based on the hierarchical tenant tree. We evaluate our system by means of two case studies based on real-life data sets. Experiments confirm that the Hierarchical Bin Packing algorithm achieves a good performance, with execution times below 100 ms to calculate the allocation for 1000 tenants in a worst-case scenario. Furthermore, our system achieves an average utilization of the storage resources close to the configured allocation factor, with reallocation of tenant data balanced over time.

With the maturity of Cloud computing comes research into converting a range of traditionally best effort programs into cloud-enabled services. One such service currently under investigation in the Elastic Media Distribution (EMD) project, is how to enable qualitative, reliable and scalable realtime media collaboration services using proven Cloud technology. While existing best-effort solutions provide plenty of features, they do not provide the quality guarantees and reliability required for critical services in globally distributed corporations. On the other hand, some pricey dedicated solutions do offer these low-delay, reliable cooperation services, but without the benefits that clouds can bring in terms of scalability. In this paper we describe results attained in the EMD project on novel resource provisioning algorithms for a mixture of end-to-end Audio/Video streams with file-based transfers, allowing for configurable tradeoffs between service response time and cost. We extended the CloudSim simulator with models allowing us to simulate collaborative interactive sessions (more specifically educational real-time collaboration), and evaluated the performance of our proposed provisioning heuristics. The results show that the proposed dynamic algorithm allows for automated cost-performance tradeoff by reducing average total Virtual Machine (VM) cost by a maximum of 58% compared to more naive approaches, while keeping average time for clients to join a meeting in line.

Real-Time Travel Information (RTTI) for rail commuters is still used inefficiently today and is rarely combined with other knowledge to come to a truly personalised and situation-aware multimodal travelling assistance. It is up to the travellers themselves to look for important info about their trip through static schedules or dedicated non-personalised applications. In a highly dynamic context such as that of public transportation, it would make life easier if one was able to consult the right information at the right time (removing superfluous information), for a variety of multimodal public transportation options, taking into account the context of the person travelling. In this paper we present the LimeDS framework, allowing application developers to rapidly define data workflows from a variety of data sources, deploy these workflows in a scalable and resilient manner and expose results to client applications as REST endpoints. A Proof-of-Concept (PoC) shows how our proposed framework can be used to tie together different open transportation data sources in order to create highly dynamic multimodal travel assistance applications by semantically enriching the data into knowledge, checking for ontological consistency and reason over the resulting knowledge.

Nowadays, public as well as private communication infrastructures are all contending for the same limited amount of bandwidth. To optimally share network resources, symbiotic networks have been proposed, which cross logical and physical boundaries to improve the reliability, scalability, and energy efficiency of the network as a whole as well as its constituents. This paper focuses on software services in such symbiotic networks. We propose a platform for the intelligent composition of services provided by symbiotically connected parties, resulting in novel cooperation opportunities. The platform harvests Semantic Web technology to describe services in a highly expressive manner, and constructs service compositions using SeCoA, our tunable best-first search algorithm. The resulting compositions are then enacted via CaPI, a reconfigurable middleware infrastructure. By means of an illustrative scenario, we provide further insight into the platform's functioning.

We propose symbiotic networks, a novel approach toward sharing of network resources in order to increase the scalability, dependability and energy efficiency of colocated networks. As symbiotic networks offer large amounts of software services, one challenge is to allow these services to operate “symbiotically” as well. By combining services from different parties, service compositions arise, which allow for a richer set of functionality. Creating such compositions, however, requires intricate knowledge about services and their interoperability. Using a semantic domain and service model, we describe SeCoA, a tunable best-first search algorithm for autonomously constructing symbiotic service compositions. A performance evaluation of SeCoA was conducted, showing that the algorithm offers acceptable performance for moderately sized compositions.

We propose a software platform which pairs context awareness with over-the-top (OTT) service deployment. By augmenting OTT services with local context information, we allow them to react upon various types of changes in the environment in which they are being deployed. This lets service providers offer more personalized and fine-grained applications, while making use of a third-party infrastructure, via the OTT paradigm. Through UML diagrams, we describe the architecture of the proposed service platform. By means of a detailed illustrative scenario, the components involved are further clarified. In addition, in order to prove the feasibility of the architecture, a prototype implementation was developed and deployed on a large wireless sensor network test bed. Using a set of benchmarks, we identified the strengths and weaknesses of both test bed and prototype.

The use of semantic technology has recently witnessed a huge increase. One of the areas in which this technology is being used increasingly more often is that of context-aware agents. However, the use of ontologies in general and reasoning in particular can rapidly become resource intensive. Certainly if the data set, called the A-Box, used by these agents grows considerably over time. Moreover, in order to create context-aware applications, taking into account a wide range of different data sets and context parameters, agents have to be provided to expose that data. The collaboration between the agents in the system is necessary to correlate the information and augment the intelligence and added value of the context-aware agents. Therefore, there is a need to have a distributed approach by means of a service-platform, where the different agents in a context-aware environment can collaborate. The main focus of this article is on the research on the design of a service-platform for semantic ontology-based context-aware collaboration. The platform architecture to allow the collaboration and scheduling, together with the associated algorithms, will be presented. The engineering and implementation details will be highlighted. By means of detailed UML sequence diagrams, we will present the workflow and collaboration between the different modules in the platform. Additionally, supporting developments, such as the meta-ontology and our ontology generator, OTAGen, will be presented. Furthermore, we will detail how the platform can operate in an autonomous way, taking into account the changing context of the agents in the platform.

As the adoption of the Service Oriented Architecture paradigm has dramatically increased over the past few years, proper coordination of loosely coupled services becomes an important issue when building state-of-the-art applications. This coordination is typically organized through orchestration (requiring a central coordinating entity) or through choreographies. While the latter approach allows for a fully distributed coordination, the need also arises for a distributed conformance check, ensuring that each participant of the choreography behaves according to the general choreography. In this paper, a formalism is presented to ensure this conformance at design time, with possible extensions to deploy time and to runtime conformance checking. This formalism is referred to as the piX-model and it will be shown that the approach taken is inherently less complex, both in time and space, than the conventional π-calculus-based approach, whilst offering the same conformance guarantees. This gain in performance allows for a small design turnaround time, and also opens the avenue to runtime conformance checking by resource constrained devices.

This paper presents a dynamic composer for Web services. The services are enriched with semantic descriptions in OWL-S, based on which the composer automatically creates a combination of services reaching a specified goal. As an example, a trip planning use case is chosen where the goal ranges from booking of a single flight to planning of an entire trip including flight, hotel, transport, etc. The composition is achieved using local and global algorithms satisfying specific quality of service (QoS) constraints and requirements such as the execution time or cost of the invoked Web services. At the same time a more extended HTN planning algorithm is discussed, matching not only service outputs to inputs but also satisfying service preconditions through effects. In addition to the automatic composition, the paper also proposes a recovery mechanism in case of unavailable services. When executing the composition of flight services, unavailable services are dynamically replaced by equivalent services or a new composition achieving the needed result. The presented platform and planning algorithms are put through extensive performance and scalability tests for typical trip booking scenarios, in which basic services are composed to a complex trip planning service.

Service choreographies describe the interactions that take place in a distributed service collaboration without central entity orchestrating these interactions. It is obvious that each partner will execute parts of the choreography to fulfill the global collaborative effort. This paper focuses on translating the global choreography to local projections at design time. These projections need to be implemented by each participating partner. The process is decomposed in two steps: instantiation and extraction. In the instantiation step the abstraction levels are automatically determined, ranging from the choreography level to its smallest building blocks, the channel instances. In the extraction step, we present a way to map these channel instances to WS-BPEL. It is shown that this results in small WS-BPEL processes with a very straightforward correlation set, allowing for even resource-limited devices to participate in the choreography.

This paper describes how an infrastructure can be built for automating workflows in content production using a service oriented architecture (SOA). We fully adopted the SOA and the Business Process Management (BPM) vision in which stand-alone services provide modular functionality, service invocations are being orchestrated by a process engine, and human interaction is possible in the business processes through human tasks. We aimed at increased efficiency and control, shorter setup times, and increased flexibility. Our architecture is illustrated with a use case in which we automated a process that deals with the intake, review, transcoding and publishing of user-generated content.

In this paper, we propose the use of a distributed service management architecture for state-of-the-art service-enabled grids. The architecture is capable of performing automated resource and network bandwidth partitioning based on registered grid resource properties and monitored grid service demand. A main characteristic is that it enables the use of different service priority schemes and allows for policy-based differentiation between local and foreign service offerings. Resource and network bandwidth partitioning algorithms are introduced and their performance is evaluated on a sample grid topology using NSGrid, an ns-2 based grid simulator. Our results show that the use of this Service Management Architecture improves resource efficiency, simplifies schedule making decisions, reduces the overall complexity of managing the grid system, and at the same time improves grid service QoS support (with regard to job response times) by automatically making grid resource and network service reservations prior to scheduling.

In this paper, we address the design and implementation of a generic and scalable platform for efficient management of computational resources. The developed platform is called the Intelligent Agent Platform. Its architecture is based on middleware technology in order to ensure easy distribution of the software components between the participating workstations and to exploit advanced software techniques. The computational tasks are referred to as agents, defined as software components that are capable of executing particular algorithms on input data. The platform offers advanced features such as transparent task management, load balancing, run time compilation of agent code and task migration and is therefore denoted by the adjective "Intelligent". The architecture of the platform will be outlined from a computational point of view and each component will be described in detail. Furthermore, some important design issues of the platform are covered and a performance evaluation is presented.