The increasing use of microservices architectures has been accompanied by the profusion of tools for their design and operation. One relevant tool is API Gateways, which work as a proxy for microservices, hiding their internal APIs, providing load balancing, and multiple encoding support. Particularly in cloud environments, where the inherent flexibility allows on-demand resource deployment, API Gateways play a key role in seeking quality of service. Although multiple solutions are currently available, a comparative performance assessment under real workloads to support selecting the more suitable one for a specific service is time-consuming. In this way, the present work introduces AGE, a service capable of automatically deploying multiple API Gateways scenarios and providing a simple comparative performance indicator for a defined workload and infrastructure. The designed proof of concept shows that AGE can speed up API Gateway deployment and testing in multiple environments.

Cryptographic ransomware attacks are constantly evolving by obfuscating their distinctive features (e.g., I/O patterns) to bypass detection mechanisms and to run unnoticed at infected servers. Thus, efficiently exploring the I/O behavior of ransomware families is crucial so that security analysts and engineers can better understand these and, with such knowledge, enhance existing detection methods. In this paper, we propose CRIBA, an open-source framework that simplifies the exploration, analysis, and comparison of I/O patterns for Linux cryptographic ransomware. Our solution combines the collection of comprehensive information about system calls issued by ransomware samples, with a customizable and automated analysis and visualization pipeline, including tailored correlation algorithms and visualizations. Our study, including 5 Linux ransomware families, shows that CRIBA provides comprehensive insights about the I/O patterns of these attacks while aiding in exploring common and differentiating traits across families.

With continuous technological advancement, multihomed devices are becoming common. They can connect simultaneously to multiple networks through different interfaces. However, since TCP sessions are bound to one interface per device, it hampers applications from taking advantage of all the available connected networks. This has been solved by MPTCP, introduced as a seamless extension to TCP, allowing more reliable sessions and enhanced throughput. However, MPTCP comes with an inherent risk, as it becomes easier to fragment attacks towards evading NIDS. This paper presents a study of how MPTCP can be used to evade NIDS through simple cross-path attacks. It also introduces tools to facilitate assessing MPTCP-based services in diverse network topologies using an emulation environment. Finally, a new solution is proposed to prevent cross-path attacks through uncoordinated networks. This solution consists of a host-level plugin that allows MPTCP sessions only through trusted networks, even in the presence of a NAT.

Adaptability and energy-efficient sensing are essential properties to sustain the easy deployment and lifetime of WSNs. These properties assume a stronger role in autonomous sensing environments where the application objectives or the parameters under measurement vary, and human intervention is not viable. In this context, this paper proposes LiteSense, a self-adaptive sampling scheme for WSNs, which aims at capturing accurately the behavior of the physical parameters of interest in each WSN context yet reducing the overhead in terms of sensing events and, consequently, the energy consumption. For this purpose, a set of low-complexity rules auto-regulates the sensing frequency depending on the observed parameter variation. Resorting to real environmental datasets, we provide statistical results showing the ability of LiteSense in reducing sensing activity and power consumption, while keeping the estimation accuracy of sensing events.

Understanding network workload through the characterization of network flows, being essential for assisting network management tasks, can benefit largely from traffic sampling as long as an accurate snapshot of network behavior is captured. This paper is devoted to evaluate the real applicability of using sampling to support flow analysis. Considering both classical and emerging sampling techniques, a comparative performance study is carried out to assess the accuracy of estimating flow parameters through sampling. After identifying the main building blocks of sampled-based measurements, a sampling framework has been implemented to provide a versatile and fair platform for carrying out the testing and comparison process. Through an encompassing coverage of representative sampling techniques, the present study aims to provide useful insights regarding the use of sampling in traffic flow analysis.

Within network measurement context, traffic sampling has been targeted as a promising solution to cope with the huge amount of traffic traversing network devices as only a subset of packets is elected for analysis. Although this brings an evident advantage to measurement overhead, the computational burden of performing sampling tasks in network equipment may overshadow the potential benefits of sampling. Attending that sampling techniques evince distinct temporal and spatial characteristics in handling traffic, this paper is focused on studying the computational weight of current and emerging techniques in terms of memory consumption, CPU load and data volume. Furthermore, the accuracy of these techniques in estimating network parameters such as throughput is evaluated. A sampling framework has also been implemented in order to provide a versatile and fair platform for carrying out the testing and comparison process.

Traffic Sampling is a crucial step towards scalable network measurements, enclosing manifold challenges. The wide variety of foreseeable sampling scenarios demands for a modular view of sampling components and features, grounded on a consistent architecture. Articulating the measurement scope, the required information model and the adequate sampling strategy is a major design issue for achieving an encompassing and efficient sampling solution. This is the main focus of the present work, where a layered architecture, a taxonomy of existing sampling techniques distinguishing their inner characteristics and a flexible framework able to combine these characteristics are introduced. In addition, a new multiadaptive technique proposal, based on linear prediction, allows to reduce the measurement overhead significantly, while assuring that traffic samples reflect the statistical behavior of the global traffic under analysis.

Facing the huge traffic volumes involved in today's networks it is of utmost importance to deploy efficient network measurement solutions to assist network management and traffic engineering tasks correctly, without interfering with normal network operation. Sampling techniques contribute effectively for this purpose as the amount of traffic processed is reduced, ideally without endangering the accuracy of network statistical behavior estimation. Although recent proposals of sampling techniques tend to improve the correctness of the estimation process, their underlying overhead is yet considerably when handling high traffic volumes. This paper proposes a new traffic sampling technique for performing lightweight network measurements. This technique, based on linear prediction, is multiadaptive regarding the packet sampling process, allowing to reduce significantly the amount of traffic under analysis while maintaining the representativeness of network samples for accurate network parameters' estimation. The performance evaluation of the sampling technique demonstrates the effectiveness and versatility of the proposal when considering real traces representing distinct traffic load scenarios. The statistical analysis provided evinces that the present solution outperforms classic sampling techniques, both in accuracy and amount of data involved in the measurement process.