The complexity of current Internet applications makes understanding network traffic a challenging task. By providing larger-scale aggregates for analysis, unsupervised clustering approaches can greatly aid in the identification of new applications, attacks, and other changes in network usage patterns. In this paper we introduce ADHIC, a new algorithm that clusters similar network traffic together without prior knowledge of protocol structures. Packet similarity is determined through comparisons of substrings within packets at distinguishing offsets. ADHIC is notable in that it 1) produces a hierarchical decomposition of network traffic in the form of a cluster-identifying decision tree, 2) needs only a small fraction of packets to generate the tree, and 3) clusters packets at wire speeds. We find that ADHIC appropriately segregates well-known protocols, clusters together traffic of the same protocol running on multiple ports, and segregates traffic from applications, such as p2p, that do not use standard ports. Potential applications include network performance analysis, real-time alerts of flash crowds or worm activity, and dynamic DoS-resistant bandwidth management. NetADHICT, our implementation of ADHIC, is available for download and is licensed under the GNU GPL license.

Accurately predicting object lifetimes is important for improving memory management systems. Current garbage collectors make relatively coarse-grained predictions (e.g., "short-lived" versus "long-lived") and rely on application-independent heuristics related to the local characteristics of an allocation. This paper introduces a prediction method which is fully precise and makes its predictions based on application-specific training rather than application-independent heuristics. By "fully precise" we mean that the granularity of predictions is equal to the smallest unit of allocation. The method described is the first to combine high precision and efficiency in a single lifetime predictor. Fully precise prediction enables us, for the first time, to study zero-lifetime objects. The paper reports results showing that zero-lifetime objects comprise a significant fraction of object allocations in benchmark programs for the Java programming language and that they are correlated with their allocation context (the call stack and allocation site). Beyond zero-lifetime objects, the paper reports results on predicting longer lived objects, where, in some cases, it is possible to predict the lifetime of objects based on their allocation context (the call stack and allocation site) well. For the SPEC benchmark programs, the number of dynamically allocated objects whose call sites have accurate predictors ranges from 0.2 percent to 61 percent. This method could potentially improve the performance of garbage collectors. The paper proposes a death-ordered collector (DOC) and analyzes its implementation overheads and its best possible performance. The study shows how memory performance could be enhanced using the extra information provided by fully precise prediction.

forrest @ cs.unm.edu We describe an anomaly intrusion-detection system for platforms that incorporate dynamic compilation and profiling. We call this approach "dynamic sandboxing. " By gathering information about applications ' behavior usually unavailable to other anomaly intrusion-detection systems, dynamic sandboxing is able to detect anomalies at the application layer. We show our implementation in a Java Virtual Machine is both effective and efficient at stopping a backdoor and a virus, and has a low false positive rate.