The Sixth-generation mobile communication system is expected to serve as a foundation for supporting large-scale connections of IoT devices across various fields, such as smart cities, healthcare, and transportation. Meanwhile, control plane congestion caused by the numerous connection management (CM) procedures for user plane release/re-establishment has emerged as a significant challenge. This paper proposes a novel CM mechanism that loosens the structural coupling between the UE and the U-plane.

The rapid diversification of mobile applications has introduced heterogeneous requirements for bandwidth, latency, and reliability, challenging mobile networks to maintain high QoE. Conventional application identification methods, which uniformly process every packet through offline or high-resource pipelines, are computationally inefficient and unsuitable for real-time, resource-constrained environments. To overcome this limitation, we propose a confidence-aware scheduling method that dynamically adjusts how often the system performs feature extraction and inference according to the model’s confidence. When confidence is high, the system reuses the previous classification result for subsequent packets, skipping redundant computation; when confidence is low, it delays inference until additional packet features are collected, improving reliability. This mechanism is analogous to human decision-making, where confident judgments are made quickly while uncertain ones are postponed until sufficient evidence is obtained—both aiming to balance speed and accuracy under limited resources. We implement and evaluate the method using real traffic from 60 modified terminals running 298 mobile applications. The results show up to 72% reduction in processing time and a 12.2% decrease in early misclassification rate, demonstrating that confidence-guided inference achieves a tunable balance between responsiveness and reliability. The proposed approach provides an energy-efficient, scalable solution for real-time application identification toward digital sustainability.

We present C3-LPWA, a coherent Low-Power-Wide-Area (LPWA) physical layer that embeds a continuous sequence of pseudo-random up- and down-chirp pilots alongside π/2-BPSK data symbols. These embedded chirp pilots provide synchronization and channel estimation, and also serve as a unique device signature. This design enables coherent detection and multi-user uplinks at extremely low signal levels. Simulations demonstrate that C3-LPWA achieves BERs around 10−5at SNRs down to −20 dB in AWGN, corresponding to an RF sensitivity on the order of −142 dBm in a 64 kHz channel (with 4 dB noise figure (NF)). Under more challenging fading channels with device speeds of 5 km/h and 100 km/h, a strong LDPC code (rate-1/2) with 4× repetition reliably achieves BER 10−5at SNR −10 to −12 dB with 384 ms airtime for 192 information bits. Doubling the repetition factor to 8× doubles the frame airtime to 768 ms, while extending coverage by approximately 2–4 dB (operating at −12 to −14 dB SNR). Overall, C3-LPWA offers a link budget on par with NB-IoT and ELTRES, despite using only 64 kHz bandwidth and moderate airtime. C3-LPWA’s waveform uniquely leverages continuous chirp pilots for fine synchronization and channel tracking, enabling long-range, mobile IoT communications at low SNR without any external timing or scheduling coordination.

In the coming Cyber-Physical System (CPS) society, the convergence of the cyber and physical worlds will enable cross-domain data analysis to improve the real world. Among the various types of data, human motion data are indispensable for realizing human-centered CPS loops. Though the value of the data increases when collected simultaneously across a wide area and in large quantities, the wearable sensors to capture the data are often implemented with short-range communication standards. This causes the following issues: distance scalability, multi-device scalability, and accuracy of reproduced global coordinates. However, redeveloping sensors to solve the three issues above is not practical because the specifications are a black box for end users and are costly for developers. To deal with these problems, we propose an architecture to transparently tunnel the black-box sensor protocols over 5G and to integrate motion data and high-precision position information in the same 5G network. In addition, we demonstrate that the proposed architecture is effective for all the issues through hardware system evaluations and simulation evaluations. In particular, the implemented system provides stable communication characteristics regardless of distance up to at least 105 m, and the simulation shows that the average one-way delay including retransmission delays remains low at 13.93 msec even under multiple simultaneous connections.

Low Earth Orbit (LEO) satellite networks provide connectivity in remote and disaster-stricken areas but introduce challenges for traditional protocols due to dynamic link conditions, including latency spikes and periodic bandwidth fluctuations, especially in the uplink direction. Using Starlink as a representative LEO network, we identify a recurring 15-second cycle affecting latency and throughput, causing suboptimal congestion control behavior, e.g., unnecessary window reductions and slow recovery, with protocols like TCP CUBIC. To address these issues, we propose LEO-CUBIC, a TCP congestion control algorithm enhanced with awareness of LEO’s periodicity. Trace-driven simulations show that LEO-CUBIC improves uplink throughput by up to 43%, and in 40% of the cases it achieves at least a 10% throughput gain over standard CUBIC. Any throughput degradation is minor ( 1%) as well as rare, as LEO-CUBIC safely falls back to standard CUBIC behavior or immediately enters a recovery algorithm (safe-guard) under adverse conditions.

RAN slicing in Open RAN (O-RAN) architectures requires dynamic and intelligent resource allocation to ensure both high resource efficiency and strict compliance with Service Level Agreements (SLAs). However, conventional reinforcement learning (RL) methods struggle in this setting due to their unsafe exploration behavior, often resulting in frequent SLA violations. In this paper, we propose a safe and sample-efficient model-based RL (MBRL) framework tailored for SLA-aware RAN slicing. Our agent leverages an online kernelized quantile regressor to estimate the lower quantile of key performance indicators (KPIs), enabling direct modeling of SLA violation risk. To ensure safety during online adaptation, the policy incorporates an uncertainty-aware safety margin, promoting conservative decisions under high model uncertainty. Extensive simulations demonstrate that our method reduces SLA violations to under 1%, while maintaining high resource efficiency and achieving fast, stable convergence.

Satellite communication networks — including Low Earth Orbit (LEO) and Geostationary Earth Orbit (GEO) systems — are becoming increasingly vital for global connectivity, particularly in remote and underserved areas. Despite their growing importance, individual satellite links often suffer from high latency, limited bandwidth, and fluctuating reliability, which can significantly degrade application performance. Multipath Quick UDP Internet Connection (MPQUIC) has emerged as a promising solution for aggregating multiple satellite paths and improving network utilization. However, two major challenges limit the effectiveness of existing MPQUIC schedulers: the heterogeneity of link characteristics across satellite types and the periodicity of LEO link behavior. To address these issues, this paper proposes LoGrα, a novel MPQUIC scheduler that integrates Deep Reinforcement Learning (DRL) to dynamically optimize data distribution and manage adaptation speed. LoGrα intelligently adjusts path usage to account for link diversity and adaptively adjusts the growth rate of the congestion window to respond quickly to periodic variations in LEO links. Experimental results show that LoGrα significantly enhances adaptation speed and reduces file transfer time compared to traditional scheduling strategies.

The broadcast industry aims to leverage 5G for rapid and ubiquitous high-quality video transmission. However, traditional network slices with preconfigured QoS settings for low-latency videos is insufficient to ensure high-quality video transmission, particularly in unstable wireless environments, which often leads to degraded image quality due to Layer 2 (L2) retransmission designed to preserve low latency. In response to this issue, we propose a system that anticipates potential video quality degradation and dynamically adjusts L2's retransmission settings via a Network Exposure Function (NEF). Previous studies have faced challenges with deep neural network (DNN) approaches, which despite being adaptive, require substantial training data, making them impractical or even prohibitive for broadcasters operating in diverse wireless conditions. In contrast, we propose a practical system that dynamically controls base station retransmission based on real-time radio and video quality assessments, aligning with the broadcasting industry's operational requirements. To facilitate rapid broadcasting startup, our system employs a Hidden Markov Model (HMM) for accurate radio quality prediction, requiring minimal training data. We implement our system using local 5G and a Commercial-Off-the-Shelf (COTS) UE and evaluate it in WebRTC video transmission. Our approach reduces Freeze Duration in deteriorating wireless scenarios from 3.88 to 1.91 seconds, significantly enhancing image quality stability. The system adapts to the wireless environment within approximately 280 seconds, demonstrating that HMM outperforms LSTM when only limited labled data is available.

The large-scale deployment of Internet of Things (IoT) devices and the increasing traffic volume bring congestion-related challenges to IoT systems. These challenges are particularly significant in large-scale Industrial IoT (IIoT) environments, where congestion caused by attacks or malfunctions threatens reliability. However, existing methods suffer from the following issues: 1) Control plane (C-Plane) key performance indicators (KPI)-based congestion avoidance methods cannot accurately classify devices based solely on C-Plane features. 2) Existing User Plane (U-Plane) empowered anomaly detection methods are mainly based on supervised learning and rely heavily on labeled datasets. To solve the problems, we propose an anomaly detection and congestion solution system based on U-Plane traffic data and Radio access network intelligent controller (RIC). First, we propose an unsupervised online learning-based anomaly traffic detection and congestion avoidance framework, where U-plane data is utilized to provide accurate classification. Second, we propose an anomaly device isolation mechanism from the main network by steering traffic using a near real-time RIC application (xAPP). Finally, we establish the simulation and hardware experimental platform to evaluate the effectiveness of our proposed system. In the experiment, the proposed method achieves a 94% classification accuracy, while the accuracy of the traditional method is 63%.

Millimeter-wave (mmWave) communications provide ultra-wide transmission bandwidth and ultra-high data rates for 5G and beyond networks. However, the high propagation loss and high transmission frequency make mmWave susceptible to blocking, frequent line-of-sight (LOS)/non-line-of-sight (NLOS) switching, and huge fluctuations in transmission quality. Existing congestion control algorithms face two main challenges in mmWave environments: (1) They are incapable of distinguishing whether a loss is caused by congestion or by channel degradation, and (2) they are vulnerable to the huge throughput fluctuations and frequent LOS/NLOS switches in mmWave links. These challenges cause frequent congestion window initialization and retransmission, thereby degrading the transmission performance in mmWave communication. To solve this issue, we propose an intelligent cross-layer congestion control approach for high-bandwidth and high-loss mmWave links. First, we design a smart cross-layer LOS/NLOS classifier to distinguish LOS and NLOS links based on physical-transport layer features. Second, we propose a deep reinforcement learning-driven online environment evaluation method to decide current transmission conditions. Third, we devise an adaptive congestion control algorithm to determine strategies based on LOS/NLOS detection and transmission condition decision. Finally, experimental results show our proposed method improves transmission performance while guaranteeing fairness.

Mission-critical applications such as Cellular Vehicle-to-Everything (C-V2X) require fine-grained base station control capabilities. This control must extend across the entire country for nationwide mobility use cases like connected vehicles and logistics. However, the 3GPP RAN architecture specifies a single Central Unit - Control Plane (CU-CP) per base station, preventing Mobile Network Operators (MNOs) from offering RAN control interfaces to industry-specific service providers (called as verticals) without compromising their network control. Consequently, these industry-specific entities leveraging 5G-based services are forced to build costly private networks impractical for nationwide coverage. Enabling diverse applications to exercise base station control necessitates a cost-effective and highly scalable architecture that simultaneously accommodates multiple service providers. This paper proposes “O-RAN CU Slicing,” enabling multiple verticals to control base stations by logically partitioning the CU-CP. The approach creates dedicated virtual CU-CPs (vCU-CPs) for each vertical while utilizing existing RAN infrastructure, avoiding the costs of full base station virtualization. The method implements isolation mechanisms at the Distribution Unit (DU) for Radio Resource Control (RRC) messages, the standardized protocol for base station control. The DU routes these control signals to appropriate vCU-CPs according to user identity parameters. A prototype implementation using OpenAirInterface5g demonstrates processing latencies below 100 milliseconds when handling 100 verticals. These results confirm that O-RAN CU Slicing provides a scalable architecture enabling multiple verticals to simultaneously control base stations across nationwide networks while maintaining operational efficiency.

With the diversification of mobile applications, the implementation of priority control that meets the communication requirements of each diversifying application and network slicing technology in 5G is awaited, and the need for Identifying the application names of traffic is increasing. This study introduces an operational scheme and performance evaluation methodology for real-time application identification, utilizing the highaccuracy and updatable application identification system demonstrated in the authors' previous research. We focus on the trade-off between buffer time and identification accuracy, present the effectiveness of the method from the perspective of future users, while providing analysis for the purpose of slicing for a specific application or communication type.

With the recent advancement of mobile data communication, services that require high-quality communication are expected to be deployed utilizing mobile data communication. However, when these services are provided using only a single connection, there is a challenge in consistently meeting service requirements. This issue can be addressed by enhancing communication quality through the redundant use of multiple connections. While multi-connection communication strategies improve robustness, an existing method does not account for the trade-off between latency reduction and increased data traffic. Specifically, sending all packets over all connections indiscriminately imposes unnecessary overhead, particularly in multi-user environments. In this paper, we propose a method composed of two distinct approaches. Both approaches leverage LSTM to predict increases in communication latency and dynamically switch to the optimal connection. Of particular importance is the fact that the method switches connections while transmitting little to no additional data. Relative to the use of a single connection, the two approaches improve communication quality by reducing the communication latency exceeding 120 ms by up to 97% without increasing data traffic.

Direct-to-cell (D2C) communication using low earth orbit (LEO) satellites has emerged as a promising solution to extend cellular coverage in geographically challenging regions and maintain network connectivity during natural disasters. However, D2C systems face significant technical challenges, par-ticularly the large extended propagation delays may prevent the normal operation of hybrid automatic repeat request (HARQ) and random access procedures. This paper addresses these challenges by proposing protocol modifications at the eNodeB (eNB) side only to support both unmodified smartphone and narrowband internet of things (NB- IoT) systems over long term evolution (LTE) network. We develop a testbed capable of emu-lating the radio channel conditions of D2C communication links to verify the proposed eNB modifications with both smartphone and NB-IoT device in laboratory environment. Furthermore, the random access procedure between the smartphone and ground-based eNB is verified by field experiment using real LEO satellite. Our solution enables billions of legacy LTE devices to seamlessly connect to the D2C network, thereby avoiding the additional cost of purchasing new devices.

6th generation (6G) mobile communication systems will be implemented in private/local domain networks for factory operation, warehouse management, and construction site surveillance. 6G needs more flexible network customization according to diverse users' requirements. In particular, secure and controllable resilient wireless network usages, regardless of the reception of radio signal waves, is essential to maintain business continuity. This is because network attacks resulting from unauthorized access may lead to significant financial losses. The problem with the current wireless network, including the 5G system, is the lack of flexibility to design and implement secure wireless network services tailored to user demands. Although a possible solution is to use shields to insulate radio waves, it is prohibitive as it limits human mobility as well. Therefore, this paper proposes a software-defined, location-based network slicing system to offer users flexible wireless network access control capabilities. The proposed system enables network designers to design secure network areas in wireless network coverage. To demonstrate the feasibility of the proposed system, we implement and deploy it in our lab using commercial phones with Ultra-Wide Band (UWB) location sensors and modified Local 5G base stations. The evaluation shows that our proposed system successfully creates multiple user-designed network areas with distinct network control policies, including controllable access and QoS mechanisms.

In the evolving landscape of Open Radio Access Networks (O-RAN), achieving both high energy efficiency and computational acceleration is crucial for optimizing network performance. Low-Density Parity-Check (LDPC) decoding, a computationally intensive process widely used in wireless communication, is commonly accelerated by hardware to meet the stringent demands of real-time processing. However, balancing this acceleration with energy efficiency remains a significant challenge. In this paper, we propose a Deep Reinforcement Learning (DRL)-based smart offloading strategy to achieve low-latency, energy-efficient LDPC acceleration using an FPGA-based hardware accelerator. We introduce a Quantile Regression Forest (QRF)-based method for predicting latency and energy consumption in real time, enabling per-block decision-making, alongside a Proximal Policy Optimization (PPO)-based algorithm for dynamically adapting offloading weights to optimize energy efficiency. The proposed strategy is implemented on the OpenAir-Interface5G (OAI) and FlexRIC platforms to demonstrate its feasibility within an O-RAN testbed. Evaluation results show that the method adapts dynamically to varying network conditions in under 5 seconds, making offloading decisions in less than 5 µs, resulting in up to 20% energy savings and 14% latency reduction.

High-frequency bands such as millimeter wave (mmW) and Sub-THz are expected to be used in Beyond 5G and 6G. These bands can provide peak throughput but are vulnerable to disturbances owing to their high directivity. This makes achieving high throughput during line-of-sight (LoS) and nonline-of-sight (NLoS) challenging and affects the TCP congestion control algorithm. Previous studies have improved the TCP congestion control algorithm to realize throughput in mmW operations, but there are issues in practical implementation because the TCP must be replaced for each type of radio. To address this issue, this paper proposes a dynamic control method for the Target Block Error Rate (BLER), governing the characteristics of radio delay and error rates. This reduces the excessive bitrate reduction during NLoS and improves the TCP throughput reduction. The proposed method allows using high Modulation and Coding Scheme (MCS) during NLoS to suppress bit rate reduction. The Target BLER is calculated and set in the gNB, considering the UE’s Signal-to-Interference plus Noise Ratio (SINR) and the TCP congestion control algorithm in use. The proposed method does not require changes to the TCP congestion control algorithm because we modify the network characteristics to improve TCP throughput. The proposed method can be implemented using O-RAN’s near-real-time RAN Intelligent Controller (nearRT-RIC). Prototype evaluations show that it suppresses bitrate reduction during NLoS and accelerates throughput recovery under LoS/NLoS and changing environmental conditions. This results in a median improvement of 81% in TCP throughput.

With network function virtualization (NFV) technologies, network functions (NFs) are implemented and isolated from hardware resources to complete complex tasks flexibly and economically in 5G networks. However, high-dynamic traffic puts 5G networks at great risk of NF errors. NF scalability is a promising technology to solve this problem. Existing NF scaling methods suffer from the following issues: 1) Threshold-based methods execute NF scaling strategies afterward, resulting in long-time response issues. 2) Artificial intelligence (AI)-driven methods face problems of insufficient training samples and failure to consider the communication reliability and deployment cost jointly in NF scaling decision-making. To solve these problems, we propose an intelligent traffic flow-based NF scaling mechanism. First, the smart traffic flow-based NF scaling framework is designed, consisting of the intelligent traffic flow prediction component and the NF function configuration component. Second, we propose a few-shot learning (FSL)-enabled traffic flow prediction scheme, where the FSL model is constructed to predict traffic flow in new areas with few training samples. Third, a deep reinforcement learning (DRL)-driven NF configuration scheme is designed, which aims to improve the integrated communication reliability and deployment cost for long-term profits. Finally, experimental evaluation verifies the effectiveness of the proposed intelligent traffic flow-based NF scaling mechanism.

Mobile Edge Clouds (MECs) address the critical needs of bandwidth-intensive, latency-sensitive mobile applications by positioning computing and storage resources at the network's edge in Edge Data Centers (EDCs). However, the diverse, dynamic nature of EDCs' resource capacities and user mobility poses significant challenges for resource allocation and management. Efficient EDC operation requires accurate forecasting of computational load to ensure optimal scaling, service placement, and migration within the MEC infrastructure. This task is complicated by the temporal and spatial fluctuations of computational load.We develop a novel MEC computational demand forecasting method using Federated Learning (FL). Our approach leverages FL's distributed processing to enhance data security and prediction accuracy within MEC infrastructure. By incorporating uncertainty bounds, we improve load scheduling robustness. Evaluations on a Tokyo dataset show significant improvements in forecast accuracy compared to traditional methods, with a 42.04% reduction in Mean Absolute Error (MAE) using LightGBM and a 34.93% improvement with CatBoost, while maintaining minimal networking overhead for model transmission.

As Radio Access Networks (RANs) evolve towards more intelligent and software-defined paradigms, an increasing number of workloads are being offloaded to hardware accelerators. A significant challenge in this context is to minimize CPU consumption while ensuring low and stable latency in processing acceleration. Tailoring load allocation to meet varying latency requirements in different application scenarios is essential. In this paper, we present an application of RF Network on Chip (RFNoC) technology for FPGA-based acceleration of Low-Density Parity-Check (LDPC) code and Polar code. We conduct a comparative analysis of CPU and FPGA processing performance in OpenAinInterface (OAI) platform, with and without the Data Plane Development Kit (DPDK), to determine optimal load allocation for diverse data requirements. The findings indicate that RFNoC serves as an effective FPGA accelerator for the LDPC process, offering up to a fivefold increase in acceleration and significantly reducing processing delay jitter. Furthermore, the experimental outcomes provide a foundation for future research endeavors, specifically in the realm of efficient load optimization strategies.

With the diversification of mobile applications, the implementation of priority control that meets the communication requirements of each diversifying application and network slicing technology in 5G is awaited, and the need for Identifying the application names of traffic is increasing. This study introduces an efficient learning method by packet selection focusing on TCP control flags and a method to guarantee real-time performance by time limitations of packet collection to implement a real-time application identification system. We have implemented an automatic collection system for training data, present the effectiveness of our methodology, and indicate a scheme for updating and operating future application identification systems.

In recent years, disruptions in the core networks of Mobile Network Operators (MNOs) have led to widespread communication failures. There is still no service available that can ensure highly reliable communication across multiple carriers, despite the diversification of mobile network services with the emergence of Mobile Virtual Network Operators (MVNOs). Meanwhile, next-generation mobile networks have the potential to enable mission-critical services, such as remote vehicle control, which require a stable and low-delay mobile network. However, the Internet and handover disrupt the stable and low-delay mobile network; the former causes unstable delays as a public network, while the latter leads to inevitable delays due to momentary communication disruptions during base station switches. In this study, we propose a Multi-carrier MVNO (M-MVNO) architecture. In the architecture, M-MVNO manages an Edge Server (ES) and multiple gateways of MVNO placed in its own core network apart from the core networks of the MNOs. The ES can process mission-critical services without relying on the Internet, and communication across multiple MVNOs can cooperatively compensate for disruptions caused by handovers. Furthermore, we develop a portable mobile network measurement system to enable easy scalability and conduct measurements assuming mission-critical service use to demonstrate its effectiveness. From the measurement data, our analysis indicates that the remote vehicle control service is fully available with our architecture in a given route of an urban area while it fails with the probability of a few percent when utilizing a single MNO.

The use of data collected by edge devices in machine learning, including personal information, has become an important trend in recent years. Most distributed machine learning methods such as Federated Learning aggregate and manage all data or training results on a high-performance edge servers. However, passing users’ personal information to an external server may involve some privacy concerns owing to the risk of information leakage. To address this problem, we consider a distributed machine learning model with excellent privacy protection in which the user can choose not to pass any personal data to the server. In the proposed model, the edge device takes over the training at the edge server and sends only the results for which the user has given permission to the edge server for integration. To validate the effectiveness of the proposed model, we performed experiments on facial image recognition using a Jetson Nano as an edge device. The experimental results confirm that edge devices were able to use personal information in a short period of time, while the edge server was able to obtain more accurate results by integrating several training results. Thus, the results show that the proposed model enables the safe and efficient utilization of data collected by edge devices.

Ultra-low latency video delivery in such places as stadiums is catching much attention because of 5G's ability for isolating network resources per usage scenario via network slicing to satisfy required QoS. However, network slicing in wireless environment poses significant challenges as the radio characteristics dynamically changes. In particular, video transmission is highly susceptible to the impact of wireless environment changes such as packet loss caused by e.g., camera movement. While 5G specifies a static 5G QoS Identifier (5QI) for each network slice, static QoS settings are insufficient for ensuring stable video delivery. To address this issue, we propose a strategic and dynamic selection of 5QI through the Network Exposure Function (NEF) according to the wireless environment to improve video streaming quality. By collecting network data from User Equipment (UE) and sink devices, our proposed method adjusts 5QI and improves transmitted video quality. Our approach utilizes Private 5G where we can customize UE and utilize NEF to achieve stable video delivery. Our proposed method reduces packet loss under low radio-quality conditions, improving the ITU-T G.1072 Predicted Gaming Mean Objective Score (MOS), which considers both delay and image quality, from 1.12 to 2.14, even in degraded radio conditions. It indicates the usefulness of our proposed method in improving video transmission stability. We plan to identify the requirements for dynamic 5QI control via NEF so that we can propose the same scheme for public 5G environment.

LEO constellations are expected to provide low-latency communications, which enables applications such as video streaming even in remote areas. To enable these applications, we need to suppress the delay on the satellite links and avoid congestion to meet their latency requirement. However, managing link delay between each satellite requires scalability for the increasing number of satellites. Moreover, the propagation delay variation in LEO satellite links makes it difficult to control the delay because it is hard to distinguish congestion-related delay and propagation delay. We propose StarBundler: a traffic control middlebox for satellite networks without managing the traffic at the satellite. StarBundler exchanges information about RTT and throughput between ground stations with each other and controls the latency between StarBundlers using congestion control that is not affected by propagation delay variation. Evaluation of a simulated satellite link shows that we can preserve delay and bandwidth between StarBundlers with variable link capacity and propagation delay. In particular, StarBundler can reduce the 95th percentile of end-to-end RTT by 61% compared to the case without it.

Recently, "cooperative driving" in which multiple vehicles acquire, coordinate, and control their position information and drive cooperatively at intersections and merging points in urban areas, has been attracting attention. In cooperative driving, there is a trade-off between the amount of information collected at a control point and the latency in information collection to achieve optimal real-time control. This trade-off makes it difficult to process the information required for each cooperative driving control at the optimum position, hard to satisfy both information and latency requirements in control, and to implement multiple types of cooperative driving controls simultaneously. In light of this observation, there is a problem that control by a single-layer Edge Server (ES) cannot solve those events and cannot optimize the cooperative driving control. To solve the problem, we propose a "multi-layer ES" for selecting the optimal layer of computation depending on the nature of the information to be collected by the Intelligent Transport System (ITS). This multi-layer ES enables multiple types of cooperative driving control simultaneously while satisfying the requirements and optimizing the control. In this paper, we use an urban expressway as a use case and perform simulations using real traffic data. We show that the cooperative driving control using our proposed multi-layer ES reduces natural and accidental traffic congestion, and reduces the average travel time per vehicle by 55.76% compared to the case without multi-layer ES, thus shown to be an effective approach for realizing a smart city.

Edge computing for connected vehicles is expected to become a reality. Compared to public clouds, the computing resources available on individual edge servers are limited: therefore, dynamically allocating computing resources as needed based on load is effective for the efficient use of edge server resources, and the auto-scale functionality using containers and Kubernetes is widely used. However, if the edge servers are overloaded when requests exceed their maximum processing capacity, long response delays and service outages may occur. Cooperative load balancing among neighboring edge servers is known as a method to prevent edge servers from overload, but standard Kubernetes does not have a control function based on server location or distance between servers, making it difficult to implement this. This paper proposes a service mesh controller to achieve cooperative load balancing among neighboring edge servers in an environment where container execution infrastructure controlled by Kubernetes runs on edge servers. Experimental results show that the proposed method with the service mesh controller reduces the median of response time by 96.3% compared with a conventional method without load balancing while also preventing overloads.

We have developed a novel multi-hop graph embedding technique for botnet detection. It can detect the entire layered architecture of a botnet in the internet backbone traffic by starting from a small set of the components of the botnet. A botnet is a group of hosts collaborating each other to launch a variety of attacks, such as distributed denial-of-service attacks and phishing campaigns. Over 20 years of their existence, botnets have been evolved to employ layered architectures for robust operation and efficient management. Several existing methods leverage graph analysis to detect malicious communications. However, they cannot detect such botnet components that communicating each other through multiple layers, which are represented at more than one hop distance in graphs. To solve this problem, our technique trains separate graph embedding models with samples at different distances and select appropriate features from multiple models to represent multi-hop adjacency for each node. By applying our proposal to real-world Internet traffic, we have confirmed that it can outperform other methods in terms of detecting collaborating botnet components with higher accuracy even if their command and control communications are cascading through multiple layers.

We have developed SamE, a novel sampling-based embedding technique for learning representations of the Internet. SamE can classify Internet hosts in a scalable and cost effective manner without sacrificing the classification performance. Machine learning has been applied to Internet traffic analysis for a variety of purposes, including botnet detection and application identification. For example, as a major threat on the Internet, a botnet is a group of computers that collaborate together to launch cyberattacks. To analyze related hosts such as the collaborating constituents of a botnet, graph embedding techniques seem to be promising. However, when applying existing graph embedding techniques to Internet-scale traffic data, the time and space complexities become prohibitively high for practical use. To make graph embedding applicable to Internet-scale problems, SamE only samples a subset of nodes to learn elemental representations and aggregates learned elemental representations to generate synthetic representations for all nodes. We have applied SamE to real-world Internet-scale traffic data, and the experimental results show that SamE outperforms existing methods by reducing the data samples required for representation learning by 99% while achieving the same level of classification performance in botnet detection and application identification.

Network slicing has been proposed to meet the diverse requirements of mobile applications. In a wireless environment with fluctuating link capacity, we need to adjust each slice's bandwidth dynamically according to the capacity while maintaining the user experience. In addition, network operators need to consider the out-of-slices users when the link capacity is insufficient for slicing. The traditional best-effort control does not allocate the bandwidth to them because it prioritizes the slice users. We set a utility function, called slice quality, for each slice based on its requirement and adjust each slice's bandwidth depending on the variable link capacity to keep these qualities fair. We define linear utility functions for the normal slice, which has a fixed bandwidth requirement called SLO, and exponential utility functions for the residual slice, which manages the out-of-slices bandwidth. The experiment results based on the real cellular trace show that we can improve the slice quality's fairness by 56% compared to a simple bandwidth allocation policy while keeping the quality degradation of normal slices below 11%.

Understanding communication delay in mobile networks is becoming more important as delay-sensitive scenarios become more prevalent. Round-trip time measurement, the conventional technique to measure communication delay, e.g., ping, outputs network-induced delay for each packet but is insufficient in identifying specific delay factors. We propose a model called Delay Component Model (DCM) to aid in clearly visualizing communication delay. We construct the DCM on the basis of our measurement study on packet-receipt intervals with packet transmission at a constant interval via commercial mobile networks in Japan. We find that the measured receipt-time intervals form striped patterns due to the combination of two components: a constant scheduler (ConstSched) and probability scheduler (ProbSched). We use the principle of forming striped patterns and develop a method of estimating the DCM structure. Finally, we evaluate our method by analyzing delay patterns measured in Long Term Evolution (LTE) and fifth-generation mobile (5G) networks. The results indicate that delay patterns in these networks are due to the combination of three components, i.e., a ConstSched with 20-ms intervals, ProbSched with 8-ms delay for LTE and 6-ms delay for 5G, and ProbSched with 1-ms delay.

Emerging applications such as video streaming and automated driving require low latency communication in the wireless link. We can classify the traffic in these applications according to bandwidth requirements. We can improve the Quality of Experience if we can satisfy their bandwidth requirements and suppress the latency. However, conventional bandwidth control causes queuing delay due to the highly variable bandwidth of the wireless network. We propose a novel slicing method that enables per-flow bandwidth control while minimizing queuing delay. We use sliceable congestion control, where an individual slice follows an identical rate control equation that obeys linearity in terms of link capacity. The slices as a whole still preserve the desirable characteristics such as queuing delay reduction. We adjust the congestion window size of each class’s flow based on the sliceable congestion control and enforce the control by overwriting this to the TCP receiver window size field. We evaluate the proposed slicing architecture using cellular traffic traces. We show that we can reduce the queuing delay by 82% compared to conventional bandwidth allocation methods.

Network slicing is considered one of the key technologies of the fifth-generation (5G) mobile networks. Especially in Local 5G networks, to ensure that one slice does not affect other slices, narrowband spectrum allocation appears to be particularly important. Band Pass Filter (BPF) is one of the most important components to isolate the spectrum resource of each Local 5G RAN slice. However, it is difficult to buy a BPF with a narrow band frequency on the market. Moreover, due to complicated manufacturing procedures, the price of BPF is usually very expensive, which increases the cost of establishing a Local 5G base station for small enterprises. In our design, we present a simple waveguide filter based on the theoretical principles of a low-pass prototype of Chebyshev approximation. The waveguide filter is designed with a center frequency at 4.75 GHz and narrow bandwidth of 100MHz. After simply forging and evaluation, experimental results prove the feasibility of our method in the processing of low-cost narrowband BPFs.

Traffic reduction for bandwidth-hungry video streaming services, such as YouTube, benefits not only subscribers struggling to avoid going over their contracted data limit, but also service providers when the number of people who use video streaming services increase. Because not all stakeholders who want to reduce traffic usage are willing to conduct cumbersome operations, e.g., manually setting lower resolution, we argue here that network operators should introduce a traffic pacer for providing traffic reduction services as an optional plan for subscribers. This paper proposes NetPacer, an in-network traffic pacing system for reducing traffic usage by degrading the video quality. NetPacer has two features. The first is relative pacing, which degrades the video quality relative to the initial quality by traffic shaping, thus enabling flexible quality control. The second is in-network timely video quality identification via encrypted traffic analysis by using machine learning. Through experiments, we demonstrate that NetPacer successfully reduces traffic by 30.8% by degrading the resolution by one level while keeping the QoE (i.e., Mean Opinion Score (MOS)) degradation below 0.268 points on average for 50 YouTube videos.

It is expected that heavy congestion occurs at a time of a severe disaster. In such a situation, traffic priority control in network elements for preferentially transferring information for rescue is important. For achieving this, service identification from IP flows in network elements is required. A method based on deep packet inspection (DPI) of multiple TLS sessions has been proposed for identifying services from IP flows. However, its analysis is extremely CPU time-consuming. In this paper, we propose a new service identification method based on the analysis of Server Name Indication (SNI). SNI is a not-encrypted field in the ClientHello message, which is transferred in the TLS session establishment. We then evaluate the proposed method and show that the proposed methods significantly reduce time to identify without a large decline in the accuracy of identification.

Recent programmable switches allow developers to profoundly optimize network elements. In this study, we introduce a concept of an application switch that supports a network application based on programmable switches. A developer can optimize not only server computers but also application switches to improve the application performance by implementing functions of the network application. We then introduce a method to apply an application switch to a database management system using the transmission control protocol (TCP). The method migrates a TCP connection from a server computer to the application switch when the switch replies to a query. The method reversely migrates it to the server computer again when a query is processed by the server. The application switch manages the TCP sequence and the Ack numbers for these migrations. In the existing work, we implemented a prototype key-value store (KVS) system based on the proposed system without TCP Ack management. We then showed the potential of the method. In this paper, we show the problem of the prototype system of Ack management and propose a method for solving the problem. In addition, we evaluate the resolved method and demonstrate its effectiveness.

Private mobile networks such as private LTE/local 5G, which support flexibly configured and empowered innovative technologies that are not feasible in closed public mobile networks recently, have been catching much attention both in academia and in industries. In this paper, we design and implement the automatic check-in service as an example of value-added services of private mobile networks utilizing the flexibility of softwarization. To alleviate the inherent coverage problem of a private mobile network, we integrate our private mobile network with a public LTE by sharing the subscriber database so that a user can use the automatic check-in services deployed in various private mobile networks with only one SIM issued by a public network. We perform field tests in a private mobile network and also a private-public hybrid mobile network and disclose that the users' check-out behavior is predictable through numerical analyses. Based on the finding, we introduce two machine learning-based inference mechanisms that can predict a user's check-out behavior at an inference accuracy of 83% and 93% in a private network and a hybrid one separately. We believe this paper can provide valuable experience for those who are developing their private mobile networks.

Machine learning has been applied to network traffic analysis for a variety of purposes, including botnet detection. To improve the computational efficiency, several architectures have been proposed to consolidate processes common across multiple applications that use the same traffic data. However, when introducing conventional architectures to real-world traffic analysis at Internet scale, the amount of input traffic data and the variety of output features to represent global access patterns become new challenges. To address the challenges, we have developed Piper, a machine learning pipeline, that consolidates diversified machine learning applications in a highly efficient manner. On top of the consolidated architecture, Piper employs two novel techniques: (1) selective sampling to reduce traffic data efficiently while maintaining prediction performance, and (2) a set of enriched features to extract temporal and spatial characteristics in global traffic. For the evaluation, we have been deploying Piper to detect botnets from internet backbone traffic over nine months. The evaluation has confirmed the effectiveness of Piper in terms of computational performance, prediction performance, and lead time to detect botnets.

With the proliferation of traffic encryption, the need for application identification of given encrypted traffic using machine learning is growing for application-specific traffic management. However, there is not much research on the negative impact of classification delay and misclassification. In particular, an application generating bursty traffic such as video streaming causes congestion during the classification, which degrades QoE due to a considerable classification delay. In this paper, we propose a new mechanism called Progressive Slicing, which adaptively assigns the flow to multiple slices according to the state of the classifications. This new classification mechanism mitigates the classification delay by progressively isolating flows into the slices in the course of the classifications. In addition, multiple stages of classifications improve accuracy and enable more flexible application slicing based on the confidence scores. We evaluate the proposed method on multiple user scenarios on Android VMs. We show that this method improves search response time on Twitter by 35% compared to the slicing with a single classification even when the traffic of video applications coexists.

Network operations for real-time and stateful Internet-of-Things (IoT) services, such as Cyber Physical System (CPS) are considered a necessity for driving further innovation in smart and inclusive society. MEC (Multi-access Edge Computing) is one of the essential enablers for those services. But moving devices cannot enjoy the MEC efficacy of low-latency because the geographical coverage area of a single MEC is limited. In this paper, we posit that one of the most significant challenges for realizing real-time and stateful services utilizing MEC is a geographically distributed data store that is designed to support the three requirement, low-latency, stateful, and data locality. Especially the control of the location of data and the directory service that enable quick data access are required to enable real-time and stateful IoT services. Our contributions are four-fold. First, we define the architecture of a geographically distributed data store providing low-latency and consistent data access. Second, we propose in-network directory cache that accelerates the search for the distributed data. Third, we propose a novel algorithm which decides data location to achieve low-latency data access. Finally, we define an index to evaluate the efficacy of the geographically distributed data store. Our evaluation result shows that the proposed method enables low-latency and consistent data access, even when mobility devices move across edge coverage areas.

We observe two major revolutionary trends in net-work operations: democratization of cost-effective and flexible communication means for vertical players, such as public safety, by private mobile networking combined with edge computing, and automatic and autonomic network operations empowered by Artificial Intelligence (AI). Further innovations are required for making private networking readily available for vertical players that are reluctant to acquire expertise in complex network operations. We propose Edge Concierge, of which concept is to democratize cost-effective and flexible network operations using network layer AI at private network edges. Edge Concierge assists smart network operations for private mobile network operators and energy saving by changing working state of AI-empowered anomaly detection applications by network layer AI. We also employ unsupervised machine learning using Hidden Markov Model (HMM) for estimating contexts by solely observing net-work traffic at mobile edge computing (MEC) middle boxes. In detail, we design a system of real-time and self-learning context estimation by a multi-level probabilistic state transition model trained by unsupervised learning, which is implemented in a commodity PC. In order to evaluate our proposed system, we take public safety context of smart cities as an example use case and show the benefits.

The future mobile networks are expected to support multiple kinds of applications with different QoS requirements. How to efficiently assign spectrum resources to different applications is still an open issue. In this paper, we first introduce our field test with customized phones for analyzing the association between application-level log and radio signal-level log. We find out that the conventional spectrum allocation scheme is inefficient use of spectrum resources. To address this issue, we design and prototype an application-specific Radio Access Network (RAN) slicing system, where we can assign each RAN slice with application-specific radio spectrum scheduling policy as well as application-specific radio resource blocks. The preliminary experimental results show the feasibility and efficiency of proposed application-specific spectrum scheduling and resource blocks allocation. Finally, we introduce how to extend our proposed application-specific RAN slicing to a product network with network intelligence.

In this paper, we propose a high-precision zero-rating architecture based on our application-specific slicing technology [1] [2], where we tag traffic with application info at customized smart phones, which can be used to identify applications at MVNOs with 100% accuracy. We examine several zero-rating MVNO networks and observe that the existing zero-rating schemes of MVNOs are not accurate enough, and charge users on those applications that are advertised as count-free, which may result in disruption in the MVNO market. We also posit that the evaluation result highlights the necessity of our proposed architecture.

In many countries, mobile virtual network operators (MVNOs) provide mobile network services to users by leasing the wireless bandwidth from mobile network operators (MNOs). To attract many users and increase the number of subscribers, some MVNOs introduce the strategy called zero rating (ZR) which exempts traffic of specific content providers (CPs) from usage-based charging. The ZR differentiates traffic of specific CPs from that of other CPs, so the ZR violates the principle of network neutrality, and the ZR is prohibited in some countries. However, to clarify the desirable rules against the ZR, we need to analyze its impact on end users. In this paper, we investigate the charging strategy of ZR MVNOs by analyzing the price plans of major MVNOs in Japan. Moreover, we model the dynamics of the MVNO market consisting of low-price (LP) MVNOs and ZR MVNOs by the evolutionary game which can model the dynamics of social environment described by strategic distribution. We show that the MVNO market will be monopolized by MVNOs using either strategy, and the monthly fee of users will increase at the steady state. Therefore, we conclude that ZR MVNOs are required to introduce a service plan for users who do not benefit from the ZR.

As signature-based techniques have ever more difficulty detecting increasing and varying malicious activities through network traffic, machine learning has become a promising approach in network security. Many previous studies have aggregated traffic data into groups by hosts or flows for generating features and training detection models. However, two problems degrade detection performance. One is the scarcity of training sets due to the rarity of new types of malicious traffic, and the other is variations in feature values generated from incomplete data due to limited observed traffic. In this paper, we propose a stochastic method called Alchemy that regenerates a set of feature vectors by randomly resampling raw traffic data of each bag into several subsets. Alchemy can increase training sets and represent raw traffic robustly to correct the influence of variations in feature vectors, regardless of types of traffic data and classifiers. We evaluated Alchemy with real-world traffic data of network flows, passive DNS records, and HTTP logs, and demonstrated that it improves detection performance of various classifiers more effectively than the conventional methods in all three types of traffic data.

Recently, Mobile/Multi-access Edge Computing (MEC) has attracted significant attention as a key component for executing cooperative driving systems that exhibit low latency. However, achieving low latency communication among evolved Node Bs (eNBs) is a critical challenge while implementing cooperative driving systems using MEC. The Edge Server (ES) deployed at the eNB is required to collect various sensor data from physically close vehicles, although the vehicles may not be connected to the eNB attached to the ES. If the vehicle and the ES belong to different mobile carriers, the sensor data of the vehicle is required to pass through a network of multiple carriers and the Internet. In this paper, we propose the ''Edge eXchange (EX).'' The EX is a conceptual eNB, which is equipped with ''wireless backhaul communication'' between eNBs regardless of the carriers. Here, the wireless backhaul communication indicates a direct communication between eNBs using wireless communication. To evaluate the EX, we propose an ES deployment method and consider two types of distances as alternatives to communication latency. The first is the communication distance between adjacent eNBs. The second is the communication distance between the vehicle and the closest computational nodes. Using the Japanese network model, we analyze the above distances and evaluate the effect of the EX. From the result of the analysis, the EX can dramatically suppress communication latency between eNBs for small range wireless backhaul communication. Furthermore, the EX can suppress the number of ESs required for achieving low latency by using the wireless backhaul communication.

This paper provides an overview of tourist information distribution system that sends information corresponding to places and times. We completed the system successfully, although it is difficult to clearly extract information of the date, time, place, and event name from non-structured data written in natural language such as the language used on the SNS. We evaluated how many pieces of information are collected.

Many services, such as email, video sharing, and social networking service (SNS), are provided on the Internet. Service identification from given flows is important for various purposes. For example, a severe congestion occurs in disasters and priority control is required for transmitting important information, such as requests for rescues, in that case. Identification of the service of a traffic in network elements achieves this control. The most simple way to identify is that based on IP addresses and port numbers. However, the accuracy of this way is not sufficient. A method for identifying service based on analyzing multiple TSL sessions without using IP addresses and port numbers was proposed. This method clusters TLS sessions according to the 2-gram frequencies of unencrypted parts, which are the fields in handshake messages transmitted at session establishing. However, the existing work did not discuss the effect of each field of the TLS protocol. In this paper, we analyze the ability to cluster of each field. We investigate the ability to cluster sessions of all the unencrypted fields of the handshake messages. We then reveal that some fields do not have the ability. We discuss methods for improving the existing method based on these finding.

Multiple network anomaly detection methods have been proposed to deal with rapidly increasing attacks and network disruptions. The existing hierarchical heavy hitter (HHH) is well studied, but it is still difficult to identify more specifically targeted anomalies, as they tend to be small in volume, thus, buried in the entire traffic. To resolve this issue, this paper proposes a new two-stage traffic aggregation method: first screening target application traffic and then applying HHH analysis on classified traffic. Characterizing the normal traffic behavior per application through HHH lattice facilitates the detection of anomalies even in the small traffic volume. Our preliminary evaluation reveals that our proposed method has an advantage in effectively detecting anomalies compared to the existing methods. We plan to further elaborate the anomaly detection capability of our proposed method under various traffic data.

When the Great East Japan Earthquake occurred in 2011, the network connectivity was significantly degraded in the wide area due to the multiple network failures as well as the traffic congestion. When the network failures occurred in multiple areas, it was difficult to quickly recognize the entire network situation only using the network traffic monitor system. In our prior works, we found that SNS messages contain the useful information to recognize the big picture of the network failures and proposed the network control system using SNS messages to improve the quickness of the network recovery. As the another critical issue in case of a large-scale disaster, users could not obtain the emergency information due to the network disturbance because the current IP network is operated not being aware of the applications. Thus we propose the application specific traffic control system with failure detection function based on SNS message to prioritize the important application traffic in the event of the large-scale disaster. Based on a series of experiments, this paper shows the effectiveness of a system that detects connection failure based on social information and controls the network bandwidth for each application. Especially, we focus on application specific traffic control experiment. An automatic SDN control is performed with the network virtualization node FLARE having SDN extension capability as well as the network slicing capability. We perform the experiments to determine the type of application based on the traffic and perform bandwidth control for each application using real Internet applications.

When the Great East Japan Earthquake occurred in 2011, the network connectivity was significantly degraded in the wide area due to the multiple network failures as well as the traffic congestion. When the network failures occurred in multiple areas, it was difficult to quickly recognize the entire network situation only using the network traffic monitor system. In our prior works, we found that SNS messages contain the useful information to recognize the big picture of the network failures and proposed the network control system using SNS messages to improve the quickness of the network recovery. As the another critical issue in case of a large-scale disaster, people could not obtain the emergency information due to the network disturbance because the current IP network is operated not being aware of the applications. Thus we propose the specific application traffic control system with failure detection function based on SNS message to prioritize the important application traffic in the event of the large-scale disasters. Based on a series of experiments, this paper shows the effectiveness of a system that detects connection failure based on social information and controls the network bandwidth for each application. Especially, we focus on application specific traffic control experiment. An automatic SDN control is performed with the network virtualization node FLARE having SDN extension capability as well as the network slicing capability. We perform the experiments to determine the type of application based on the traffic and perform bandwidth control for each application using some real Internet applications.

Standardisation, research and development efforts for the fifth generation (5G) of mobile telecommunication networks are well under way. Software Defined Networking (SDN) and Network Function Virtualisation (NFV) are two of the key enabling technologies, considered in these efforts. The need for a flexible, high performant and efficient architecture is well established. Network slicing, which combines SDN and NFV, can contribute to such an architecture. It allows the parallel deployment of differing network stacks on top of any physical infrastructure. SDN's separation of control and data plane components allows for flexible deployments. How can SDN's flexibility be leveraged in a sliced, 5G network infrastructure? There needs to be an efficient way to integrate SDN into 5G networks. In this paper, we posit a way of integration, which allows decoupling the data plane components from any particular control plane. This can improve flexibility, utilisation and extensibility. We envision utilising an SDN switch implementation as the User Plane Function (UPF), and introducing an SDN controller between Session Management Function (SMF) and UPF, to effectively decouple the two. Based on this decoupling, control and data plane components can be deployed in separatelyand new slice orchestration opportunities can be developed. Furthermore, we can leverage deep data plane programmability, to enhance the system in terms of function and flexibility.

Current network switches cannot be programmed and flexibly controlled. Then, developers of a data center application system, which is composed of software and computers connected with a network, are not able to optimize behavior of network switches on which the application is running. On the other hand, Deeply Programmable Network (DPN) switches can completely analyze packet payloads and be profoundly programmed. In our previous work, we introduced an application switch based on DPN. The switch was able to be deeply programed and developers could implement a part of functions of a data center application in the switch. The switch deeply analyzed packets, which is called Deep Packet Inspection (DPI), and provided some functions of the application in the switch. However, the switch did not manage connection and not support communication with TCP. In this paper, we proposed a method for constructing an application switch supporting TCP based communication. The method analyzes IP headers, TCP headers, and payloads of packets. When the switch detects a request which the switch supports, the switch replies according to its TCP session. We then introduce our implementation and evaluate performance of our application switch. Our evaluation has demonstrated that our switch has been able to improve performance of the data center applications.

Software-Defined Networking (SDN) is an emerging technology that controls network by using software. OpenFlow switches have predefined actions to be executed by the controller, but if any undefined actions need to be executed on given packets, they are transferred to the controller by the exception mechanism called Packet-In and processed there. When we execute undefined custom actions with Packet-In on the controller, there are three problems. (1) concentration of Packet-In messages, (2) latency of Packet-In message transfer and (3) incompatibility among controller frameworks. In this paper, we propose OpenFlow Click Action Extension (OFCAE), which provides sharing custom actions among various controller frameworks with low latency while keeping the compatibility with the OpenFlow architecture. We introduce Packet-In Proxy, which implements local Packet-In processing within the switch to alleviate the concentration of Packet-In messages. Furthermore, we propose Packet-In Of-floader to perform custom packet processing for Packet-In Proxy. We implement and evaluate the prototype of our proposed system and show a case of custom actions.

Application identification is beneficial for malware detection, content cache, application-specific QoS, traffic control, etc. The existing identification methods using machine learning are usually limited to identification of protocols, not applications, and hard to adapt to the emergence of new applications. We have been proposing a new method for adaptive application identification with machine learning where we create training dataset in real-time by tagging traffic with application process names from a small number of modified smartphones and identify the unknown flow using the classifier trained by the training data. Our previous research [1] achieves more than 80% of accuracy in application identification when not using DPI (Deep Packet Inspection). In this paper, we propose an extension to the previous method using DPI and on-line machine learning with pre-classification of traffic based on ports to improve the inference accuracy. The evaluation shows that our method can identify more than 92% of traffic accurately using DPI when learning period is 5 days, and achieves up to 93% of accuracy at best for general traffic. When limited to HTTP, the accuracy becomes 96%. This result shows that we can build a system identifying more than 92% of the applications adaptively in relatively short training period, e.g., 5 days of training, even when new applications emerge. We envision that our proposed system eventually enables application specific traffic engineering as well as application specific network function execution within the network.

Large scale applications in data centers are composed of computers connected with a network. Traditional network switches do not perform routing based on packet contents. Thus, packets cannot be transmitted to the optimal computer for the request which is written in the packet payload. On the other hand, Deeply Programmable Network (DPN) switches can completely analyze packet payloads and perform routing based on their contents. In this paper, we focus on packet routing based on Deep Packet Inspection (DPI), i.e. analyzing packet payload, using DPN switches, and discuss performance of applications on a network using application aware DPN switches. We introduce application aware network and propose a method for improving application performance with DPN switch support. We evaluate our method with the several applications and show that our method can increase application performance.

Following the emergence of peer-to-peer (P2P) applications, millions of computer users have used P2P systems to search for desired content. P2P traffic is known to be highly redundant because of its inherent self-scaling characteristics, which means that file sharing is performed more efficiently when more users exchange the same content. To remove redundant P2P traffic, we have proposed a method to control the P2P traffic through a packet-level data cache that acts as a network function at the edge of the Internet service provider (ISP) networks [1]. However, our previous method involves high levels of memory consumption. Software-defined networking (SON) and network functions virtualization (NFV) are representative trends in network soft-warization that may lower the barrier to deployment of network management functions that are considered to be useful but are difficult to actually implement and deploy. In this paper, we propose a new flow classification for P2P that uses a queue Bloom filter (QBF) to reduce the memory consumption of the P2P cache. The QBF is a time series queue that manages Bloom filters and it can remove inserted Bloom filter elements without generating false positives. If the router can confirm that P2P flows are carrying duplicate contents using QBF, it then begins to cache the duplicate content. Our analysis shows that the proposed method reduces memory consumption to 67% and improves the P2P cache hit ratio by 4% when compared with the previous approach, while its performance in removing redundancy from the P2P traffic is degraded by only 14% . In addition, we discuss the implementation and deployment of the proposed system at the edge routers of ISP networks by applying SON and NFV.

This paper shows the effectiveness of the system that controls the network route based on social information. An automatic route control is performed with the network virtualization node FLARE that uses VLAN coupling between each base of the wide area network test bed called JGN-X as a platform.

To achieve network availability in disaster situations, we propose the traffic control system based on SNS information. In order to utilize the data of packet payload obtained from SNS, Deeply Programmable Network (DPN) is needed. In this paper, we implement and evaluate the proposed method with FLARE switch and achieve more flexible control of the network.

OpenFlow switches have predefined actions to be executed by the controller, but if any undefined actions need to be executed on given packets, they are transferred to the controller by the exception mechanism called Packet-In and processed there. When we execute undefined custom actions with Packet-In on the controller, there are three problems. (1) concentration of Packet-In messages, (2) latency of Packet-In message transfer and (3) incompatibility among controller frameworks. In this paper, we propose OpenFlow Click Action Extension (OFCAE), which provides reusable custom actions with low latency while keeping the compatibility with the OpenFlow architecture. We introduce OpenFlow Packet-In Proxy, which implements local Packet-In processing within the switch to alleviate the concentration of Packet-In messages. Furthermore, we propose Packet-In Offloader to perform custom packet processing for Packet-In Proxy. We implement and evaluate the prototype of our proposed system and show a case of custom actions.

We introduce the latest extended functions for the VNode infrastructure. We present new extended VNode infrastructure functions that achieve high performance and provide convenient deep programmability to network developers. In addition, we extend network virtualization from the core network to edge networks and terminals. We deploy an enhanced VNode infrastructure on the JGN-X testbed in evaluation experiments. We also succeeded to create international federation slice between GENI and Fed4FIRE.

BitTorrent causes redundant inter-AS traffic that increases the operational cost by constructing topology-agnostic overlay network. One promising way for eliminating the redundant traffic is to utilize the in-network cache. Even though LRU algorithm is widely used for cache eviction in practice and believed to result in good performance in most cases, we posit that LRU may lead to suboptimal performance in the context of BitTorrent. This is due to the fact that BitTorrent adopts so called rarest-first algorithm for exchanging content pieces. Thus, LRU is rendered suboptimal in BitTorrent since LRU exploits temporal locality. In this paper, we propose a method consisting of two steps: (1) inference of the pieces of content to be requested in near future and (2) content piece rarity aware caching strategy for BitTorrent. To be concrete, our network node infers rare pieces transparently to BitTorrent applications, inspecting HAVE/BITFIELD messages within network and setting high priority for caching rare pieces. Simulation results show that our approach increases the cache hit ratio from 6.9% up to 45.7% compared to LRU. In particular, the less the size of cache is, the more effective our proposed caching algorithm is compared to LRU.

An architecture called the slice-exchange-point (SEP) has been designed for federating heterogeneous net-work-virtualization platforms by creating and managing slices (virtual networks). SEP enables whole inter-domain resources to be managed by the network manager of any single domain. Slice-operation commands are propagated to other domains through SEP by using a common API. SEP introduces the following four features: infrastructure neutrality, single interface federation, abstract and clean federation, and extensibility of capabilities. SEP's functions to achieve these features are discussed. SEP was partially implemented on two VNode domains and one ProtoGENI domain and was verified to function effectively.

Software-Defined Networking (SDN) increasingly attracts more researchers as well as industry attentions. Open-Flow as a major API for SDN appliesrules to every packet. However, it only supports a few actions that are all predefined. We extend this limitation of OpenFlow and propose User-Defined Actions (UDAs) for SDN. We discuss usecases of UDAs and propose an architecture to realize UDAs. Using our architecture we conduct a series of tests. We indicate that our UDAs can elevate millisecond-scale running time of current proposals to nanosecond-scale (including proposals from northbound applications of SDN community and virtual appliances of Network Function Virtualization or NFV community). Also, regarding ease of programmability, we show that our proposal decrease the lines of code of by 72.9% and 79.3% compared to implementing the same functionality as a northbound application and as a standalone middlebox, respectively. In addition, we extended OpenFlow to support UDAs and implemented a few sample UDAs.

Software-Defined Networking (SDN) increasingly attracts more researchers as well as industry attentions. Most of current SDN packet processing approaches classify packets based on matching a set of fields on the packet against a flow table and then applying an action on the packet. We argue we can simplify this mechanism using single-field classification and reduce the overhead. We propose a tag-based packet classification architecture to reduce filtering and flow management overhead. Then, we show how to use this extra capacity to perform application layer classification for different purposes. In this work-in-progress paper we demonstrate our preliminary evaluation results to indicate the effectiveness of the proposal.

Software-Defined Networking (SDN) research, from the beginning, focuses more on the development and programmability of the control plane. In this paper, first we posit that we need data plane focused research in addition to control plane for SDN. Then, we review data plane related contributions in SDN to indicate there is a gap that need to be considered from the community. Next, we review some existing technologies that can be used to realize a software-centric SDN data plane compared with the current hardware-centric proposals. Finally, we discuss challenges and directions for the community as the future steps in SDN data plane development.

We propose Bloom filter-based data structure, hdFilter to improve the forwarding performance in Bloom filter-based packet forwarding architecture. hdFilter includes one Bloom filter for corresponding prefixes and one negative Bloom filter for some prefixes that cause the false positive. Through mathematical work and corresponding simulations, we show that hdFilter lowers the false positive rate (that affects the number of accesses to the slow memory) while showing the same fast memory access time or reduces the fast memory access time while showing similar false positive rate compared to normal Bloom filter.

The misalignment between the host-centric architecture and the content-centric usage of the current Internet results in inefficient content and service access. Recent content-oriented network research fails to address the critical importance of an information-centric network architecture providing the availability of clients accessing services with user-generated content as well as accessing published content from the Internet services. This paper proposes a Deployable and Scalable Information-Centric Network Architecture (DSINA) that incorporates route-by-name system into the current Internet infrastructure. In this architecture, not only DSINA name information but also traditional host location is handled by network devices. With the register-access-result model, DSINA can handle not only content retrieval, but also other applications including user-generated content uploading and notification pushing.

As practical ways to control BitTorrent traffic, we examine two basic approaches that exploit existing features of BitTorrent instead of modifying BitTorrent system. Based on PEX that allows BitTorrent clients to exchange their neighboring peer information directly, we propose topology-aware PEX, tPEX to inject some local peers to each local peer in the target network domain for the traffic localization. We also try to redirect the unavoidable inter-domain traffic from the transit links to the peering links by affecting tit-for-tat (TFT) strategy through the delay insertion (indirectly guided TFT, gTFT). Through simulations, we show that tPEX increases the intra-domain traffic volume by up to 316% and reduces the charging volume by up to 32.2% and the download completion time by up to 43.3%. gTFT reduces the inter-domain traffic volume of the transit links by up to 11.1% and increases the inter-domain traffic volume of the peering links by 9.2%. gTFT reduces the charging volume by up to 9.7%. Even though gTFT does not much affect the average download completion time, gTFT increases the performance difference among peers by up to 28.6% by adding the artificial delay selectively. tPEX+gTFT shows almost similar performance to that of tPEX, since gTFT loses its ability to redirect the inter-domain traffic once tPEX is applied. Above results show that tPEX can be the practical win-win approach to satisfy both ISP and users.

In this letter, we propose one easily deployable traffic localization technique, tPEX for BitTorrent. Using peer exchange (PEX) of BitTorrent, tPEX injects a set of local peers to the local peers in the target network domain so that they realize the traffic localization. Through simulations, we show that, in AS with 200 simultaneous local peers, tPEX enables the local peers to download around 60% of content within the same AS. The traffic localization by tPEX also improves the download performance by 45%. Even in AS with 13 simultaneous local peers, tPEX enables the local peers to download around 35% of content within the same AS and improves the download performance by 17%.

Although the virtual collocation of service providers (SPs) on top of infrastructure providers (InPs) via network virtualization brings various benefits, we posit that operational confidentiality has not been considered in this network model. We extend and apply the Secure Multiparty Computation (SMC) protocol to solving Minimum Disclosure Routing (MDR), namely, enabling an SP to route packets without disclosing routing information to InPs. We implement the proposed MDR protocol and evaluate its performance via experiments by comparing it against the prediction based on our analytical performance model. Our study reveals that MDR can be securely achieved with marginal latency overhead with regard to the convergence time in well-engineered nonsecure routing algorithms. Our study sheds light on the path for network virtualization to be used to resolve the challenges for the ISPs of today.

Research efforts have been put into content retrieval in the Internet, ranging from traditional web proxy to recent content-oriented network architectures. With the emerging trends of uploading large user-generated content, we argue that Internet should not only aid end users in downloading content from steadily available servers but also facilitate uploading content. In this paper, we propose upload cache in edge networks, a new edge-network mechanism assisting upload of user-generated content (UGC). Our proposed mechanism brings benefit for both end users and service providers. For end users, it shortens the duration while user must stay online for uploading their generated content. Also for service providers, it reduces peak traffic volume between edge networks and data centers by slightly shifting the upload timing without incurring much extra latency overhead added. Our analysis with replaying the captured traffic shows that this mechanism reduces upload tether time of 24% end users by more than half and flattens the traffic peak for the access service provider by 37%.

Although BitTorrent scales well to support large peer populations, the non-uniform seeder distribution over swarms leads to suboptimal content distribution. In this paper, we propose SeederTrading enabling the over-seeded swarms to trade the seeder bandwidth with the under-seeded swarms to examine the potential improvement through trading seeder bandwidth across swarms. Simulation results show that the under-seeded swarms can improve the content download performance while retaining the performance of over-seeded swarms, which means the content distribution performance and efficiency are improved. We also show that the trading seeder bandwidth across swarms can be done within short time (i.e., 60 seconds in our simulation).

As one alternative architecture of the current Internet, information-centric networking (ICN) concept has been proposed. In this paper, we first present implications of ICN features on P2P content distribution and identify one research topic: how to utilize the user resources efficiently in ICN. Then, we introduce the contribution-aware ICN to incentivize the user-assisted content distribution. Simulation results show that the contribution-aware ICN encourages the users to contribute their resources and prevent free-riders from using the resources. We also show that the content download performance improves significantly as the number of users contributing the resources increases.

AMPHIBIA is a framework which enables dynamic virtual network provisioning over wired and wireless networks for providing diverse services by coordinated reconfiguration in both sides of wired and wireless networks, exploiting the emerging network virtualization and cognitive radio technologies. AMPHIBIA introduces a new concept of a virtual cognitive base station (vCBS), a cognitive base station built on the virtualized infrastructure. The target applications of AMPHIBIA include flexible and rapid deployment of mobile services, end-to-end QoS, efficient wireless and wired resource utilization, and green networking. In prior work, we proposed a basic framework design of AMPHIBIA and a service model. In this paper, we show the implementation and prototype system of AMPHIBIA including the implementation of a cognitive virtualization manager (CVM), which is responsible for coordinated reconfiguration. We implement the AMPHIBIA prototype as an extension of CoreLab, a flexible software-based virtual router platform. Specifically, we develop vCBS by incorporating cognitive radio functionalities into a CoreLab virtual machine (VM). We also implement CVM and a reconfiguration manager of cognitive radio as external entities to enhance CoreLab. We confirm the basic behavior of the prototype and demonstrate with a set of simple typical scenarios that a VM-based virtual network including vCBS can be dynamically created, expanded, and deleted, and mobile streaming services can be flexibly deployed on the virtual network on an on-demand basis. We also demonstrate that AMPHIBIA can create and reconfigure a vCBS in about 51 seconds, and can timely operate the successive handover of a mobile terminal.

One key requirement for achieving network virtualization is resource isolation among slices (virtual networks), that is, to avoid interferences between slices of resources. This paper proposes two methods, per-slice shaping and per-link policing for network-resource isolation (NRI) in terms of bandwidth and delay. These methods use traffic shaping and traffic policing, which are widely-used traffic control methods for guaranteeing QoS. Per-slice shaping utilizes weighted fair queuing (WFQ) usually applied to a fine grained flow such as a flow from a specific server application to a user. Since the WFQ for fine-grained flows requires many queues, it may not scale to a large number of slices with a large number of virtual nodes. Considering that the purpose of NRI is not thoroughly guaranteeing QoS but avoiding interferences between slices, we believe per-slice shaping suffices our objective. In contrast, per-link policing uses traffic policing per virtual link. It requires less resource and achieves less strict isolation between hundreds of slices. Our results show that both methods perform NRI well but the performance of the former is better in terms of delay. Accordingly, per-slice shaping is effective for delay-sensitive services while per-link policing may be sufficiently used for the other types of services.

In this paper, we examine a new kind of P2P traffic localization approach exploiting the peer selection adaptation (i.e., preferring peers who are likely to provide better performance), called Netpherd. Netpherd tries to affect the peer selection adaptation to localize the P2P traffic by manipulating the network performance. To manipulate the network performance, Netpherd adds an artificial delay to inter-domain traffic going to target peer. Evaluation results show that Netpherd localizes the P2P traffic while improving the content download performance.

In this paper, we propose a new kind of P2P traffic control technique, called Netpherd exploiting the peer selection adaptation (i.e., preferring peers who are likely to provide better performance). Netpherd tries to enable the peers to communicate with the peers of the local domain by manipulating network performance (i.e., adding an artificial delay to the inter-domain traffic) at network device like router. Simulation results show that Netpherd can increases (decreases) the intra-domain (inter-domain) traffic by affecting the peer selection adaptation. Netpherd also improves the content download performance.

Currently, on one hand, there exist much work about network formation and/or growth models, and on the other hand, cooperative strategy evolutions are extensively investigated in biological, economic, and social systems. Generally, overlay networks are heterogeneous, dynamic, and distributed environments managed by multiple administrative authorities, shared by users with different and competing interests, or even autonomously provided by independent and rational users. Thus, the structure of a whole overlay network and the peers' rational strategies are ever coevolving. However, there are very few approaches that theoretically investigate the coevolution between network structure and individual rational behaviors. The main motivation of our article lies in that: Unlike existing work which empirically illustrates the interaction between rational strategies and network structure (through simulations), based on EGT (Evolutionary Game Theory), we not only infer a condition that could favor the cooperative strategy over defect strategy, but also theoretically characterizes the structural properties of the formed network. Specifically, our contributions are twofold. First, we strictly derive the critical benefit-to-cost ratio (b/c) that would facilitate the evolution of cooperation. The critical ratio depends on the network structure (the number of peers in system and the average degree of each peer), and the evolutionary rule (the strategy and linking mutation probabilities). Then, according to the evolutionary rules, we formally derive the structural properties of the formed network in full cooperative state. Especially, the degree distribution is compatible with the power-law, and the exponent is (4-3v)/(1-3v), wherevis peer's linking mutation probability. Furthermore, we show that, without being harmful to cooperation evolution, a slight change of the evolutionary rule will evolve the network into a small-world structure (high global efficiency and average clustering coefficient), with the same power-law degree distribution as in the original evolution model.

Heterogeneities (heterogeneous characteristics) are intrinsic in dynamic and autonomous networks, and may be caused by the following factors: finite nodes, structured network graph, mutation of node's strategy and topological view, and dynamic linking, and so on. However, few works systematically investigate the effect of the intrinsic heterogeneities on the evolutionary dynamics of incentive mechanisms in autonomous networks. In this article, we thoroughly discuss this interesting problem. Specifically, this article respectively models the pairwise interaction between peers as PD (prisoner's dilemma)-like game and multiple peers' interactions as public-goods game, proposes a general analytical framework for dynamics in evolutionary game theory (EGT)-based incentive mechanisms, and draws the following conclusions. First, for explicit incentive mechanisms, due to heterogeneity, it is impossible to get the static equilibrium of absolutely-full-cooperation (or state that provides service to the networks—so-called reciprocation), but, on the other hand, heterogeneity can facilitate reciprocation evolution, and drive the whole system into almost-full-reciprocation state, that is, most of the system time would be occupied by the full reciprocation state. Second, even without any explicit incentive mechanisms, simultaneous coevolution between dynamic linking and peers' rational strategies can not only facilitate the cooperation evolution, but drive the network structure into the desirable small-world structure. The philosophical implication of our work is that simplicity and homogeneity are too idealized for incentive mechanisms in autonomous networks—diversity and heterogeneity are intrinsic for any incentive mechanism that is compatible with the essence of our real society. Diversity is everywhere.

The packet cache router enabling the packet-level redundant data elimination is effective to reduce the P2P swarm traffic traversing ISP inter-domain links. To deploy the packet cache router in the ISP networks, the high performance packet processing is required. In this paper, we implement a packet cache router by a multi-core network processor using fast path/slow path application structure and evaluate its performance.

In spite of its success, BitTorrent is facing a content unavailability problem where peers can not finish their content download due to an absence of seeders. Although some approaches have been proposed to improve the content availability, the prior conditions such as a downloaded content and a set of related contents to be bundled limit their application scopes. Our main contribution is a multi-swarm collaboration to improve the content availability of the BitTorrent-like systems without the content-related limitations. The multi-swarm collaboration enables the collaborating swarms cache some chunks that are likely to be unavailable in near future of each other when the seeders are online and share the cached chunks when the content unavailability happens. Our approach enables any swarms that have appropriate amount of resources to collaborate with each other for the improved content availability. Through simulations, we show that the multi-swarm collaboration improves the peer performance as well as the content availability.

Due to integrated high-speed networks accommodating various types of services and applications, the quality of service (QoS) requirements for those networks have also become diverse. The network resources are shared by the individual service traffic in the integrated network. Thus, the QoS of all the services may be degraded indiscriminately when the network becomes congested due to a sudden increase in traffic for a particular service if there is no traffic engineering taking into account each service's QoS requirement. To resolve this problem, we present a method of controlling individual service traffic by using an overlay network, which makes it possible to flexibly add various functionalities. The overlay network provides functionalities to control individual service traffic, such as constructing an overlay network topology for each service, calculating the optimal route for the service's QoS, and caching the content to reduce traffic. Specifically, we present a method of overlay routing that is based on the Hedge algorithm, an online learning algorithm to guarantee an upper bound in the difference from the optimal performance. We show the effectiveness of our overlay routing through simulation analysis for various network topologies.

Access to Internet services is granted based on application-layer user identities, which also offer accountability. The revered layered network model dictates a disparate network-layer identity scheme for systems. We challenge this religious layered model adherence by demonstrating the practical benefits derived from a cross-layer identity scheme. Instead of a rigid identity, our malleable identity (MI) scheme empowers a traffic originator to fine-tune, on a per-case basis if necessary, her 3rd-party issued identity attributes embedded in an identity voucher (IV). When tagged to traffic, IVs benefit users, the Internet and services. A user can (a) control her traffic identifiability, ranging from anonymous, pseudonymous to personally-identifiable through attributes fine-tuning and (b) enjoy Internet-wide Single-Sign On (SSO) to network-layer Internet resources and application-layer services through IV persistence, without privacy loss naturally associated with SSO. The Internet and services can prioritize traffic, using IV attributes, as defense against Denial-of-Capability (DoC), Distributed Denial-of-Service (DDoS) and Border Gateway Protocol (BGP) prefix hijack/route forgery. MI is protocol/architecture agnostic, and backwards/forwards compatible.

Mobile devices such as smartphones have become commodity and access more and more large content from cloud platforms. In this paper, we propose a novel method to enable cache around edges of the network, i.e., at multiple stand-alone IEEE802.il access points (APs) not necessarily connected to the Internet. In a nutshell, we enable external cache around a mobile edge device that can be accessed via IEEE 802.11 while it still uses 3G connectivity to access non-cached content. Our method does neither require smartphones to have large storage, nor limit the opportunity to spatially share popular content with the other smartphones, thus, provides the best caching solution for smartphones to access large content from the cloud platforms. Our evaluation shows that we can successfully improve the latency for accessing large content from a mobile device.

To cope with the increasingly diversifying services, QoS, and network architectures, network virtualization is a promising technology that enables the concurrent deployment of multiple network technologies on a shared network. However, traditional research on network virtualization preliminarily focuses on a wired environment and network virtualization for a wireless environment is not well studied. Considering that in near-future, various wireless technologies will play the most important role in access networks and multi-mode wireless terminals will become more popular, it is crucial to extend the concept of network virtualization to wireless networks. We refer to building such extended virtual networks as "end-to-end slicing". The key technical challenges for such extension are (1) abstraction of heterogeneous wireless access networks for maximizing radio frequency utilization and (2) isolation of wireless resources such as radio frequencies, throughput, or name spaces for accommodating multiple virtual networks on a single wireless access network. In this paper, we tackle the first challenge and propose a Cognitive Virtualization Platform, called AMPHIBIA, which enables end-to-end slicing over heterogeneous wired and wireless networks. AMPHIBIA is a platform to provide independent virtual networks each of which can be configured for the corresponding service and to coordinate the resource management in both sides of wired and wireless networks, exploiting the network virtualization and cognitive radio technology. AMPHIBIA is motivated by the shared property of "reconfigurability" of network virtualization and cognitive radio, and provides network operators with the capability of cooperative resource allocation over wired and wireless networks. In other words, AMPHIBIA virtualizes a cognitive base station to dynamically configure a wireless access network for each virtual network. In this paper, we first show the basic architecture of AMPHIBIA from the perspective of network virtualization. Then we show the hardware and software design of prototype system.

Despite its great success, BitTorrent suffers from a content unavailability problem where peers can not complete their content downloads due to some missing chunks, which is caused by an absence of seeders. Multi-swarm collaboration approach is a natural choice for improving the content avail- ability, since the content unavailability can not be managed by one swarm easily. Most existing multi-swarm collaboration approaches, however, show content-related limitations, which limit their application scopes. In this paper, we introduce a new kind of multi-swarm collaboration utilizing a swarm as a temporal storage. In a nutshell, the collaborating swarms cache some chunks of each other that are likely to be unavailable when the seeders are online and share the cached chunks when the content unavailability happens. Our approach enables any swarms to collaborate with each other without the content-related limitations. Simulation results show that our approach improves the number of download completions by over 50% compared to vanilla BitTorrent with low caching overhead. The results also show that our approach enables the peers participating in our approach to enjoy better performance than other peers, which can be an peer incentive.

This paper describes an assurance diversity network platform for the New-generation Network (NWGN)/Future Internet. The primary focus is on the vision and five concrete network targets to realize the NWGN, which should ultimately contribute to global society over several decades. In the latter half of the paper, we propose a diversity network platform (DNP) concept for effectively accommodating various networks concurrently. In the DNP, physical resources such as network bandwidth, computation, and storage are managed as a logically integrated resource. Optical/electronic, path/packet, and wired/wireless networks are also managed as a unified network. Apart from this, a new network can be created by installing new functions since the unified network is equipped not only with network resources but also computation and storage resources. Later in the paper we describe technological challenges for the assurance DNP that is the DNP with error-tolerant and reliable features.

This paper thoroughly investigated the Evolutionary Game Theory (EGT) based modeling and analysis of reciprocation-based incentive mechanisms. Unlike existing work which adopts replicator equation to analyze the stability of incentive mechanisms (actually, replicator equation is only applicable to describe deterministic selection in infinitely large and well-mixed population), we paid special attentions to the intrinsic heterogeneity in real autonomous networks: finite users, mutation probability and structured network graph, and proposed the unified framework to characterize the evolutionary dynamics. Specifically, through modeling and analyzing Prisoner's Dilemma (PD)-like game based and Public-goods game based incentive mechanisms, we show that although it is impossible for incentive mechanisms to get the whole network into static "absolute full cooperation (or reciprocation)" state, they can still drive the whole system into "almost reciprocation" state, that is, most of the system time would be occupied by the cooperation (or reciprocation) state.

Bit Torrent is one of the most popular P2P file sharing applications in the world. Each Bit Torrent network is called a swarm and millions of peers may join multiple swarms. Due to swarm's large network size and complexity, many resources (PC servers, the Internet connection, etc.) are required for measuring all the swarms in the world. For this reason, the existing work is forced to measure only a part of the entire set of swarms, thus, ends up understanding only a part of it. In this paper, we propose a resource-efficient method for crawling multiple Bit Torrent swarms by only a limited amount of resources such as a single PC server. In the proposed method, our crawler avoids collecting redundant information of swarms without pressing WAN access links nor expending much processing resources. We also use a number of techniques to efficiently crawl all the participating peers of multiple swarms. We crawl over 4.3 million unique .torrent files, small files that store metadata used in Bit Torrent, and 48,000 tracker addresses. We can crawl 4.3 million swarms within an hour. We obtain 24 swarm snapshots and 10 million unique peers in a day.

In the network operator-friendly P2P traffic control technique such as P4P, peers are supposed to select their communication partners by following a guidance issued by the network operator. Thus, the guidance has significant impact on the traffic control. However, detailed performance study of available guidances is missing. Most existing work does not show how they affect intra-domain traffic control in detail while mostly focusing on inter-domain traffic control. In this paper, we try to understand how the guidances affect the intra and inter-domain traffic control for better guidance improving the traffic control. Through simulations, we reveal followings. The performance- based guidance reflecting the networking status shows attractive results in distributing the traffic over intra-domain links and in reducing the cross-domain traffic and the charging volume of inter-domain link compared to the distance-based guidance enforcing simple localization. However, the performance-based guidance shows one limitation that can cause unstable traffic control. To overcome the identified limitation, we propose peer-assisted measurement and traffic estimation approach. Then, we verify our approach through simulations.

The continuous growth of P2P traffic imposes a large burden on ISP network operation. To reduce P2P traffic, the redundancy elimination using P2P packet cache scheme is effective since P2P swarm contains the high redundancy. We have developed the P2P shared packet cache architecture. We have validated the basic operations of the proposed architecture on Emulab [1], [2]. In this demo, we present the test platform desirable to perform the in-network P2P cache processing together with the scalable generation of the user clients. The test network can be created on the programmable virtualized slice network by VNode which has been developed for the future network study [3]. To enable the emulation of the scalable user access, VM clustered overlay network is integrated with the slice network. Using the virtualized test network platform, we demonstrate the effectiveness of the P2P cache processing.

BitTorrent is one of the most popular P2P file sharing applications in the world. Each BitTorrent network is called a swarm and millions of peers may join multiple swarms. However, there are many unreachable peers (NATed, Fire-Walled, or inactive at the time of the measurement) in each swarm. Due to this unreachable peers problem, the existing work can measure only a part of the entire peers in a swarm. In this paper, we propose an improved measurement method for BitTorrent swarms that many unreachable peers. In a nutshell, our crawler obtains peers behind NAT and firewalls by letting them connect to our crawlers through actively advertising our crawlers addresses to them. The evaluation result shows that our proposed method increases the number of unique contacted peers by 112 % compared to the conventional method. The proposed method also increases the total volume of downloaded pieces by 66 %. We then investigate the sampling bias among our proposed method and conventional methods, and find that different measurement methods can lead to significantly different measurement results.

Peer-to-Peer (P2P) file sharing applications have dramatically increased in popularity for the past few years. Although a P2P file sharing network shares many files, it does not usually have a management and control mechanism for the files exchanged. Consequently, copyright infringement and malware propagation in P2P file sharing networks have become prevalent. In order to prevent these file distribution, content poisoning has attracted much attention recently. Although content poisoning aims to obfuscate users by diffusing a lot of poisoned chunks in P2P networks, its effect to the networks have not been well studied yet. In this paper, we apply content poisoning to “Share”, one of the most popular P2P file sharing applications in Japan, to control its file distribution. Our evaluation includes how effective our proposed content poisoning method to a live Share network composed of over 100,000 active peers. The evaluation result shows that our content poisoning method decreases the number of peers that complete file download to less than 5% compared to the case without our control. Our content poisoning method also reduces additional traffic required for poisoning to 4%.

In this paper, we propose a DDoS defense architecture, named NEIF (Network Egress and Ingress Filtering), which is deployed at the Internet Service Provider's (ISP) edge routers to prohibit DDoS attacks into and from the ISPs' networks. The main challenge is how to implement NEIF with a small fixed amount of memory and low implementation complexity so that it may be acceptable by ISPs. We first design a bloom filter based data structure to identify and measure a few relatively large flows instead of all flows, where the amount of required memory is independent of link speeds and the number of flows. Then, the relatively large flows are rate-limited to their fair share based on the packet symmetry-the ratio of received and transmitted packets of a host. The dropping decisions of each flow are made on the observed counters directly that are with low implementation complexity. Finally, we implement NEIF with Click and perform experiments on PlanetLab. The experimental results validate our analysis and show that the Internet can benefit from NEIF even under partial deployment.

Distributed Denial of Service (DDoS) attacks have become one of the most serious threats to the Internet. In this paper, we propose Mantlet, an overlay-based approach to detect and mitigate DDoS attacks. Mantlet combines three innovative mechanisms for anti-spooflng, attack detection and mitigation, respectively. To circumvent IP spoofing, we first propose a probing mechanism named Bypass Check to authenticate the clients of TCP or UDP services. Then, Cumulative Sum (CUSUM) is adopted to detect DDoS attacks based on the abrupt change of sequential packet symmetry, the ratio of received to transmitted packets of a service. After detection, the suspicious flows that contribute to asymmetry are segregated and experience preferential dropping test (PDT). A suspicious flow is confirmed as malicious if it is unresponsive to packet drops. Finally, we implement Mantlet with Click and perform experiments on PlanetLab. The experimental results validate our analysis and show that Mantlet is applicable to not only TCP services but also UDP services.

While distributed denial-of-service (DDoS) threats have been raising concerns for many years, a widely-acceptable solution is still absent. In this paper, we advocate a novel and promising solution for DDoS defense by using powerful cloud infrastructures as new battlefields. To explore this idea, we design and implement a cloud-based attack defense system called CLAD, which is running on cloud infrastructures as a network service to protect Web servers.

The volume of P2P application traffic has increased so much that network-operator-driven traffic control techniques such as P4P for localizing the P2P traffic are recently proposed. The gist of the existing approach is that the network operators provide traffic and topology information as a guidance to peers so that P2P traffic will flow as the network operators intend, thus, realizing unilateral interaction from the network operators to the peers. Thus, this paper proposes bilateral cooperation between the network operators and the peers in P2P networks so that both parties may enjoy even further benefit in reducing cross-domain traffic and in optimizing content download time. In a nutshell, the peers provide peer-level network information to the network operators, which would otherwise require the network operators to perform costly flow-level analysis.We divide measurement work into two parts, letting the peers collect fine-grained traffic information and enabling the network operators to grasp macroscopic information in order to issue a useful guidance to peers including traffic bound missing in the existing work. Our simulation result shows that the bilateral cooperation reduces maximum link utilization of intra links by 34.41%, cross-network traffic by 23.02%, and content download time by 4.65% compared to the existing unilateral interaction.

In this paper, we propose the DoubleFace algorithm to infer peers’ reputation rankings, which explicitly includes two phases. First is the computation of peers’ Recommendation Ability (RA) based on the following intuitive idea: Peer's RA will be reversely determined by how many peers it points to and how bad those peers have been rated, which comprise two subroutines: the badness propagation and the conversion of RA from badness. In the first subroutine, we thoroughly consider the effect of sybils’ attack on badness propagation, which has been investigated in previous work rarely; in the second subroutine, we design two methods to convert the badness into peer's RA: the disproportional way and the logistic way. The second phase is the integration of RA into adjacent matrix used to represent P2P trust graph, to reflect peer's RA in trust propagation. The simulation results show that the disproportional and logistic DoubleFace can be robust against sybils’ and front peers’ attacks to reputation ranking and can achieve significant performance improvement in comparison with Eigentrust-like algorithms, in hostile P2P environments. Moreover, we also discuss the effect of hostile and hospitable P2P environments on the performance of DoubleFace. Specifically, disproportional DoubleFace can perform slightly better than logistic DoubleFace in hostile P2P environments, but, in hospitable P2P environments, disproportional DoubleFace performs anti-intuitively poorly, and logistic DoubleFace achieves the same performance as traditional Eigentrust-like algorithms.

In overlay networks, the interplay between network structure and dynamics remains largely unexplored. In this paper, we study dynamic coevolution between individual rational strategies (cooperative or defect) and the overlay network structure, that is, the interaction between peer's local rational behaviors and the emergence of the whole network structure. We propose an evolutionary game theory (EGT)-based overlay topology evolution scheme to drive a given overlay into the small-world structure (high global network efficiency and average clustering coefficient). Our contributions are the following threefold: From the viewpoint of peers' local interactions, we explicitly consider the peer's rational behavior and introduce a link-formation game to characterize the social dilemma of forming links in an overlay network. Furthermore, in the evolutionary link-formation phase, we adopt a simple economic process: Each peer keeps one link to a cooperative neighbor in its neighborhood, which can slightly speed up the convergence of cooperation and increase network efficiency; from the viewpoint of the whole network structure, our simulation results show that the EGT-based scheme can drive an arbitrary overlay network into a fully cooperative and efficient small-world structure. Moreover, we compare our scheme with a search-based economic model of network formation and illustrate that our scheme can achieve the experimental and analytical results in the latter model. In addition, we also graphically illustrate the final overlay network structure; finally, based on the group selection model and evolutionary set theory, we theoretically obtain the approximate threshold of cost and draw the conclusion that the small value of the average degree and the large number of the total peers in an overlay network facilitate the evolution of cooperation.

In overlay networks, the interplay between network structure and dynamics remains largely unexplored. In this paper, we study dynamic coevolution between individual rational strategies (cooperative or defect) and the overlay network structure, that is, the interaction between peer's local rational behaviors and the emergence of the whole network structure. We propose an evolutionary game theory (EGT)-based overlay topology evolution scheme to drive a given overlay into the small-world structure (high global network efficiency and average clustering coefficient). Our contributions are the following threefold: From the viewpoint of peers' local interactions, we explicitly consider the peer's rational behavior and introduce a link-formation game to characterize the social dilemma of forming links in an overlay network. Furthermore, in the evolutionary link-formation phase, we adopt a simple economic process: Each peer keeps one link to a cooperative neighbor in its neighborhood, which can slightly speed up the convergence of cooperation and increase network efficiency; from the viewpoint of the whole network structure, our simulation results show that the EGT-based scheme can drive an arbitrary overlay network into a fully cooperative and efficient small-world structure. Moreover, we compare our scheme with a search-based economic model of network formation and illustrate that our scheme can achieve the experimental and analytical results in the latter model. In addition, we also graphically illustrate the final overlay network structure; finally, based on the group selection model and evolutionary set theory, we theoretically obtain the approximate threshold of cost and draw the conclusion that the small value of the average degree and the large number of the total peers in an overlay network facilitate the evolution of cooperation.

It is known that there exist Triangle Inequality Violations (TIVs) with respect to network Quality of Service (QoS) metrics such as latency between nodes in the Internet. This motivates the exploitation of QoS-aware routing overlays. To find an optimal overlay route, we would usually need to examine all the possible overlay routes. However, this requires both measuring QoS between all node pairs and investigating all the routes in the full-mesh overlay topology, which poses scalability problem in terms of both measurement cost and route calculation and dissemination cost. We thus propose a method of constructing a QoS overlay network that enables us to find a near optimal route in a cost-effective manner. Our idea is based on the finding that a small number of overlay nodes can provide the optimal routes for a large number of node pairs, which is obtained through measurement data analysis between PlanetLab nodes. Our overlay network has two layers where the upper-layer consists of such small number of overlay nodes that can provide the optimal routes while the lower-layer consists of the other overlay nodes. By allocating such overlay nodes at the upper-layer, we can provide better QoS routes for each node pair with high probability. We construct the overlay network topology where the upper-layer overlay nodes are connected in full-mesh manner while the lower-layer overlay nodes are not connected in full-mesh but only to upper-layer nodes. Through this structure, we can reduce measurement and route calculation costs. Using PlanetLab data, we show that our method can achieve almost the same performance as the optimal solution.

Current information networks acting as the fundamental infrastructure of our society, possess the economic-social characteristics, so, in formulating new definitions and computational models for the networked environment, it is imperative to take economic and incentive considerations into account. The paper’s contribution is twofold: first, to characterize the economic implication of some proposed centrality in weighted network, we design the VCG (Vickrey-Clarke-Groves) overpayment based centrality in bi-connected networks, and compare it with existing global efficiency based centrality. Our experiments on weighted scale-free networks and small-world networks show the high correlation between global efficiency based centrality and VCG-based centrality (the Pearson correlation coefficients exceed 0.95); Then, inspired by the definition of global efficiency based centrality, we propose local efficiency based centrality, which, unlike global efficiency based centrality, can be calculated locally, and illustrates the effect of the proposed metric on the attack vulnerability of those weighted networks through comparing with strength-based attack.

The current interdomain routing protocol, BGP, is not resilient to a path failure due to its single-path and slowly-converging route calculation. This paper proposes a novel approach to improve the resilience of the interdomain communication by enabling a set of ASes to form an alliance for themselves. The alliance members cooperatively discover a set of disjoint paths using not only the best routes advertised via BGP but also the ones unadvertised. Since such a set of disjoint paths are unlikely to share a link or an AS failure, a member AS can provide a pair of the other members with a transit to circumvent the failure. We evaluate how many disjoint paths we could discover from both advertised and hidden (unadvertised) routes by analyzing publicly available BGP route data. Our feasibility study indicates that an alliance of ASes can establish a set of disjoint paths between arbitrary pair of its alliance members to improve the resilience of interdomain routing among the members.

Endhost path selection---the ability for endhosts to specify the paths which their packets should traverse---has been proposed as a promising means for meeting next-generation Internet goals such as high availability and application-tailored routing. However, current proposals have serious shortcomings. First, they typically allow only limited path selection; second, they generally do not provide a billing method by which users may pay operators along their chosen path for service. Moreover, to date, proposals do not consider the use of non-network layer technologies such as MPLS which offer considerable performance advantages.

Network testbeds for developing, deploying, and experimenting with new network services have evolved as recent rapid progress in virtualization technology. This paper proposes a new network testbed that enhances PlanetLab and is based on a hosted virtual machine monitor (VMM) as a virtual execution environment (VEE) for network services to run on.This paper reports our experiences in developing such a prototype network testbed employing Kernel-based Virtual Machine (KVM) as a hosted VMM. The paper examines the performance and scalability of the prototype to see whether or not it fulfills what we believe to be the requirements for a new network testbed.

Despite the Internet's ability to recover from link failures, the process is laborious. Scalable one-hop source routing (SOSR) hastens the recovery, without complex routing algorithms, by routing around failures via indirect paths created using randomly-selected intermediate end-nodes. Even with only 39 intermediaries available, SOSR effectively masks out 89% of Internet core link failures. However, SOSR is restricted in 2 ways: (1) it employs only end-node intermediaries, thus traffic utilizing the indirect paths has to detour to the intermediaries at the Internet edges en-route to their destinations and (2) although the number of intermediaries can be scaled up to increase the indirect paths available, failure-masking rate is unlikely to improve much since it is difficult to find an indirect path that can mask a given failure, even if one exists, through random intermediary selection. To overcome these, we introduce the "AI-RON-E" prophecy-a loosely-federated infrastructure consisting of clients, "oracles" and Internet routers that are all One-hop Source Routing (OSR) aware. OSR routers can act as intermediaries to redirect traffic, avoiding the need to detour to the Internet edges, thereby shortening indirect paths formed. To increase the probability of finding a failure-masking intermediary from ineffective ones, AI-RON-E clients select intermediaries from partial views of the Internet obtained from the oracles and apply heuristics to filter out "bad" candidates from those views during the selection process. By hypothetically analyzing around 4500 link failures in 375 paths, we can conclusively foretell, even in the absence of the yet-to-be-built AI-RON-E infrastructure, that indeed AI-RON-E can be deployed at Internet-scale to seek out indirect paths faster and masks more link failures while offering shorter hop-count indirect paths at the expense of a small cache of path information.

Simultaneous use of multiple disjoint Internet paths holds promise for exploiting available bandwidth as well as reacting more quickly to Internet path faults. While routing overlay networks have provided a method for accessing these paths, out-of-order packet delivery, which results from dispersion of packets across paths of varying latency, severely degrades the performance of highly optimized transport protocols such as TCP, which assume largely in-order delivery. While traditional approaches perform reordering at the transport or application layers, such approaches have the disadvantage of entangling the complexity of reordering with their own operation, as well as requiring reimplementation for each protocol or application. Herein, we address these issues by proposing the modularization of packet reordering functionality as an optional, best-effort, network layer service for routing overlay networks. We empirically demonstrate the feasibility of this approach by showing that it can realize performance and reliability gains even using unmodified TCP in the face of highly multipath environments and heavy packet reordering.

The Internet community has been long convinced that Distributed Denial-of-Service (DDoS) attacks are difficult to combat since IP spoofing prevents traceback to the sources of attacks. Even if traceback is possible, the sheer number of sources that must be shutdown renders traceback, by itself, ineffective. Due to this belief, much effort has been focused on winning the “arms race” against DDoS by over-provisioning resources. This paper shows how Overfort can possibly withstand DDoS onslaughts without being drawn into an arms race by using higher-level traceback to DDoS agents’ local DNSes (LDNSes) and dealing with those LDNSes instead. Overfort constructs an on-demand overlay using multiple overlay-ingress gateways with their links partitioned into many virtual links—each with different bandwidth and IP—leading to the server to project the illusion of multiple server IPs. An attacker will be faced with the daunting puzzle of finding all the IPs and thereafter the confusion of how much traffic to clog each IP with. Furthermore, Overfort has a mechanism to segregate LDNSes that are serving DDoS agents and restrict them to a limited number of IPs thus saving the other available IPs for productive use. Both proliferation of access channels to the server and LDNS segregation mechanism are the key components in Overfort to defend against DDoS with significantly less resources.

We argue that designing overlay services to independently probe the Internet--with the goal of making informed application-specific routing decisions--is an untenable strategy. Instead, we propose a shared routing underlay that overlay services query. We posit that this underlay must adhere to two high-level principles. First, it must take cost (in terms of network probes) into account. Second, it must be layered so that specialized routing services can be built from a set of basic primitives. These principles lead to an underlay design where lower layers expose large-scale, coarse-grained static information already collected by the network, and upper layers perform more frequent probes over a narrow set of nodes. This paper proposes a set of primitive operations and three library routing services that can be built on top of them, and describes how such libraries could be useful to overlay services.