Order-preserving pattern matching (OPPM) is a specialized area within the domain of pattern recognition and string matching. This specialized area is dedicated to identifying patterns in sequences where the intrinsic order of elements is crucially important. This comprehensive review provides an in-depth analysis of diverse order-preserving pattern matching techniques, focusing on their algorithms and methodologies. Particular attention is paid to the challenges researchers face in preserving order during pattern matching. The review also evaluates the performance and scalability of various techniques to handle large-scale datasets. By discussing the current state of OPPM research, we identify gaps, opportunities, and potential avenues for future exploration. Through this exploration, we aim to contribute valuable insights that will guide researchers and practitioners in advancing the frontiers of OPPM research, shaping the trajectory of this field in the coming years.

Network slicing in 5G enables flexible resource allocation but faces challenges in accurate traffic prediction due to dynamic variations, inter-slice dependencies, and real-time constraints. LSTM models capture temporal dependencies but struggle with cross-slice interactions, while Transformer models excel in inter-slice data fusion but have high computational costs and limited sequential modeling. This paper proposes a novel hybrid LSTM-Transformer model for multi-slice traffic prediction, integrating the strengths of both architectures. The LSTM component captures short- and longterm temporal dependencies, while the Transformer component models inter-slice relationships through self-attention mechanisms. The proposed approach enables fusion-aware forecasting, improving predictive accuracy and scalability in dynamic network environments. To validate the effectiveness of our model, we conduct experiments using two real-world datasets: the CRAWDAD umkc/networkslicing5g dataset and the Telecom Italia mobile network dataset. The evaluation considers three key performance metrics: prediction accuracy, scalability, and response time. Comparative analysis against baseline models, including ARIMA, LSTM, Transformer, and CNN-LSTM, demonstrates that the hybrid model achieves 7.8 % MAPE, outperforming all baselines while maintaining real-time feasibility with a response time of 24.6 ms per batch.

Today, more and more Machine Learning (ML) and Deep Learning (DL) techniques are adopted to attain efficient feature selection for intrusion detection. Previous efforts have demonstrated that the major challenge of creating efficient ML and DL-based intrusion detection is to determine appropriate features without negatively affecting classification accuracy. This paper explores the impact of connection-based features on performing intrusion detection models, precisely the effect of connection-based features on detecting DDoS attacks in the CICDDoS2019 dataset. We used ML methods where samples trained with Decision Tree (DT) and Random Forest (RF) classifiers with and without connection-based features, understanding the effect on performance, stability, and its diminishing sensitivity with more samples. Our analysis shows that performing connection-based features depends on the available training sample size. Thus, connection-based features significantly impact classification accuracy concerning small training samples, how its importance is diminished along with increased sample size, and their strong effect on imbalanced malicious attacks.

Detecting and identifying heavy hitters on very high speed links is important for many network management applications, ranging from detecting network attacks and traffic anomalies, to relieving link congestion, planning network capacity and traffic engineering. Most existing solutions to the problem are based on sampling and sketch-based techniques. Sampling-based solutions use partial observations of packets or flow records to extract flow-level information. Sketch-based approaches use a compressed data structure to keep a summary of the original data and estimate traffic statistics such as flow size for all traffic flows. However, these approaches either induce information losses due to sampling or incur computational and space overheads for key recovery. In this paper, we propose a novel method, Bitcount, which uses a flexible counter array to detect and identify heavy hitters. Both theoretical analysis and experimental evaluations show that Bitcount can provide higher precision for identifying heavy hitters with low memory and computational overheads.

Low-Power and Lossy Networks (LLNs) are an enabling technology for many Internet of Things (IoT) applications. To allow LLNs to interoperate with the Internet, an address autoconfiguration protocol must be used to assign network addresses. However, the potentially vast number of IoT devices puts a massive strain on IP addressing. In this paper, we present a variable-length address allocating scheme for 6LoWPAN. Our analysis and evaluation results show that the proposed variable-length addresses could guarantee the scalability property of hierarchical addressing, and alleviate the inefficiency of address space due to fixed-length addresses.

To enable billions of devices to communicate with each other simultaneously, small end-to-end latency and high scalability and reliability are the essential characteristics for the Internet of Things (IoT). The transition from today's Internet to IoT has demanded a new information and communications infrastructure. In this paper we implement and deploy a scalable and reliable inter-domain infrastructure, LORIF proposed in our previous work, to meet the requirements of IoT. Based on two local network testbeds and an intercontinental network testbed, we evaluate the scalability, resilience, and mobility of LORIF. The results demonstrate that LORIF can provide low end-to-end latency and high scalability and reliability.

A low-latency and reliable message switching network is critical for constructing high-speed datacenter networks. In this paper, we present the design, implementation, and evaluation of a novel Location basEd Source Switching (LESS) for datacenter networks. LESS enables lightweight source switching through a location-based addressing scheme. Each switch and host can independently derive a source route to reach a destination without requiring the full knowledge of the network topology. We demonstrate that using location-based source routes as forwarding labels allows LESS to eliminate the need for routing tables and integrate with minimum required functionality for packet forwarding. Moreover, we propose a fast rerouting solution to address the issue of fault tolerance in source routing. Each switch can locally derive an alternative source route during a failure. The paper evaluates the performance of LESS. Our evaluation results suggest that LESS improves the performance of datacenter networks in terms of latency, throughput, and reliability.

As the Internet of Things technologies evolve, billions of smart devices will be connected to the Internet. Therefore, the accelerated growth of users, applications and devices pose a great demand on the scalability of the Internet. In this paper, we develop a new Internet architecture -- Multiple-inherited Locators (MiL) -- to meet the future demand on addressing. MiL is based on Locator/ID addressing and hierarchical address allocation. The benefit of this new addressing scheme is the improved scalability of Internet routing by enhancing the prefix aggregation of locators. The number of locators which are needed grows with the Internet scale. In order to represent each locator as a unique binary representation by as few bits as possible, we develop a distributed encoding method to efficiently encode locators. As the Internet topology evolves, the distributed encoding method renumbering locators' codeword for the optimal encoding performance, and meanwhile endeavors to keep their codewords unchanged as much as possible. Because, we want to represent locators by fewer bits as well as keep addressing stable. We adopt an Encoding Table Adjustment algorithm to find a "sweet spot" that balances these two goals. According to our experiment, within a 2% increase on the expected locator length, our algorithm reduces the cost of renumbering locator by 99.9%.

The Internet is facing the accelerating growth of routing table size. Backbone routers' routing table has already reached 512k entries, which has a negative effect on the scalability of the Internet. Hierarchical addressing and locator/ID separation solutions have been proposed to address the scalability issue. However, there has been little focus on how to efficiently represent hierarchical location addresses for a large scale distributed network, such as today's Internet. In this paper, we present a variable-length address encoding method to represent hierarchical location addresses. Our analysis and evaluation results show that 1) it is difficult to use fixed-length encoding to represent hierarchical location addresses for a large scale network; and 2) the proposed variable-length addresses could guarantee the scalability property of hierarchical addressing, and alleviate the inefficiency of address space due to fixed-length addresses.

Hierarchical address allocation and hierarchical routing design has long been suggested to reduce the forwarding information base (FIB) size in the Internet core. However, the hierarchical design is not put into practice. We implemented the hierarchical and automatic number allocation (HANA) protocol for allocation of IPv4 and IPv6 address spaces to autonomous systems (ASes) and the FIB size reduction. The HANA protocol allocates multiple address spaces to an AS from the upper ASes. Multihoming using multiple addresses provides an AS with multiple paths. That is, detour paths are inevitably prepared in advance, even when a network failure does not occur. In this paper, we provide the highest flexibility to HANA-based networking, namely, supporting variable-length addressing scheme. The variable-length addressing schemes suppress renumbering caused by the address space extension that occurs in the fixed-bit-length addressing schemes. In addition, we propose a new function of exchanging allocated numbers, and implement it in the current HANA system. The flexible HANA system provides locator allocation with low renumbering costs and realizes scalable addressing in future internetworking.

The Internet is facing the double-challenge of accelerating growth of routing table size and ever higher reliability requirements. Considerable progress has been made toward the scalability and reliability of the Internet. However, most of the proposals are only partial solutions that address some of the challenges. In this paper, we present a new addressing encoding scheme and a corresponding forwarding mechanism for Internet routing to solve the aforementioned problems. Underlying our design is a succinct data structure that allows us to compactly embed a set of addresses into packet headers. At the same time, the structure allows the data plane to efficiently extract multiple address information for the same destination without decompression. We provide time and space complexity analysis, and present experimental results evaluating the performance of our encoding method. It shows that the proposed encoding method can achieve a good compression factor without degrading packet-forwarding performance.

Integrating multipath technology with internet routing is becoming one of the most promising trends in building the next generation Internet system. However, incrementally evolving today's Internet routing from single-path routing to multipath routing is a hard problem. One of the fundamental issues is route oscillation caused by routing policy conflicts. Failing in solving this problem will discourage further deployment of inter-domain multipath routing. The goal of this paper is to understand route oscillation in intra-domain multipath routing. To this end, we propose a formal policy representation model to represent the routing policies about multipath dissemination. Based on the proposed model, we present a Linear Temporal Logic-based framework to verify routing policies about multipath dissemination. The ability of the framework is demonstrated by analyzing iBGP multipath dissemination examples.

As the Internet becomes the critical information infrastructure for both personal and business applications, fast and reliable routing protocols need to be designed to maintain the performance of those applications in the presence of failures. Today's interdomain routing protocol, BGP, is known to be slow in reacting and recovering from network failures. Many works and techniques have been focused on the reliability of inter-domain routing. However, those approaches require to modify BGP, which makes them impractical in the Internet. In this paper, we propose a simple and practical approach to strengthen the reliability without any modification on BGP. Our experimental result shows that our method can reduce packet loss during link failures significantly.

Multiple path dissemination is recognized as an important feature to improve the reliability and efficiency of networks. However, most multipath routing proposals focus only on disseminating additional routes to increase the reliability of the Internet, and do not concern the security issues that the additional routes bring to the table. In this paper, we attempt to understand the feasibility of utilizing multipath dissemination to detect prefix hijacking attacks. We investigate the minimum level of security enhancement that would be achieved by multipath dissemination. We systematically analyze the effectiveness of two types of multipath advertisements, advertising the most disjoint path advertisement or the second best path advertisement with the best path, on detecting prefix hijacking. Our analysis and measurement results show that advertising the second best route with the best route is an efficient and effective way to disseminate multipath information with respect to inter-domain routing security.

As the Internet becomes the critical information infrastructure for both personal and business applications, fast and reliable routing protocols need to be designed to maintain the performance of those applications in the presence of failures. Today's interdomain routing protocol, BGP, is known to be slow in reacting and recovering from network failures. Increasing path diversity by advertising multiple paths is an effective strategy to achieve reliable interdomain routing. However, designing a scalable and efficient multiple path advertisement to enhance the reliability of interdomain routing is still challenging. In this paper, we propose two path diversity aware routing protocols, D-BGP and B-BGP, to improve the resilience of interdomain routing. The two protocols can establish multiple paths with low routing overhead by exploiting the path diversity existing in the underlying network infrastructure. We evaluate the reliability improvements by simulation.

As the Internet steadily increases in importance, it is still based on a quite fragile routing design. From network operators perspective it is therefore crucial to detect end-to- end path performance due to routing outages early to either mitigate them directly or contact other entities to mitigate them. In this work we demonstrate the feasibility of a real-time tool for detecting degraded forwarding performance due to routing problems. Our tool passively monitors the traffic within the network and actively probes paths for which the TCP traffic characteristics indicate a possible routing problem. More importantly, our tool focuses on detecting routing events that actually affect network traffic, which from the network operators' perspective is most relevant. The experimental results based on large-scale measurement in the Internet indicate that our tool effectively detects a significant number of routing outages and forwarding loops.

As the Internet becomes the critical information infrastructure for both personal and business applications, survivable routing protocols need to be designed that maintain the performance of those services in the presence of failures. This paper examines the survivability of interdoamin routing protocols in the presence of routing failure events, and provides a backup route aware routing protocol that performs non-stop routing in the presence of failures. We demonstrate through simulation its effectiveness in preventing packet losses during transient routing failures.

This paper studies the contributions of routing dynamics to the duration of long-lived end-to-end Internet path failures. Studies have shown that end-to-end Internet failures (periods of prolonged packet loss) are widespread. These failures are typically attributed to either congestion or routing dynamics. Unfortunately, the extent to which congestion and routing dynamics contribute to long-lasting path failures, and the effect of routing dynamics on end-to-end performance, are not well understood. This paper uses a joint analysis of active measurements and routing data to characterize end-to-end failures observed over one month on a topologically diverse Internet testbed. We find that routing dynamics coincide with most prolonged end-to-end failures, suggesting that routing dynamics contribute significantly to the duration of these failures. We also find that most long-lived end-to-end path failures that coincide with routing dynamics are caused by BGP convergence or instability. Our results provide new insights into the effects of routing instability on end-to-end Internet path performance.

Extensive measurement studies have shown that end-to-end Internet path performance degradation is correlated with routing dynamics. However, the root cause of the correlation between routing dynamics and such performance degradation is poorly understood. In particular, how do routing changes result in degraded end-to-end path performance in the first place? How do factors such as topological properties, routing policies, and iBGP configurations affect the extent to which such routing events can cause performance degradation? Answers to these questions are critical for improving network performance.In this paper, we conduct extensive measurement that involves both controlled routing updates through two tier-1 ISPs and active probes of a diverse set of end-to-end paths on the Internet. We find that routing changes contribute to end-to-end packet loss significantly. Specifically, we study failover events in which a link failure leads to a routing change and recovery events in which a link repair causes a routing change. In both cases, it is possible to experience data plane performance degradation in terms of increased long loss burst as well as forwarding loops. Furthermore, we find that common routing policies and iBGP configurations of ISPs can directly affect the end-to-end path performance during routing changes. Our work provides new insights into potential measures that network operators can undertake to enhance network performance.

The convergence time of the interdomain routing protocol, BGP, can last as long as 30 minutes. Yet, routing behavior during BGP route convergence is poorly understood. BGP can experience transient loss of reachability during route convergence. We refer to this transient loss of reachability during route convergence as transient routing failure. Transient routing failures can lead to end-to-end forwarding failures. Furthermore, the prolonged routing failures can make deploying applications such as voice-over-IP and interactive games infeasible. In this paper, we study the extent to which transient interdomain routing failures occur in the Internet and the duration that these failures can last through both analysis and measurement. We first present a formal model that captures the transient behavior of the interdomain routing protocol. We derive sufficient conditions for and an upper bound for the duration of transient routing failures. Furthermore, we demonstrate the occurrence and duration of transient routing failures in the Internet through measurement. We find that majority of transient failures occur under the commonly applied routing policy setting, and popular and unpopular prefixes can experience transient failures.

Border Gateway Protocol allows Autonomous Systems (ASs) to apply diverse routing policies for selecting routes and for propagating reachability information to other ASs. Although a significant number of studies have been focused on the Internet topology, little is known about what routing policies network operators employ to configure their networks. In this paper, we infer and characterize routing policies employed in the Internet. We find that routes learned from customers are preferred over those from peers and providers, and those from peers are typically preferred over those from providers. We present an algorithm for inferring and characterizing export policies. We show that ASs announce their prefixes to a selected subset of providers. The main reasons behind the selective announcement are the traffic engineering strategy for controlling incoming traffic. The impact of these routing policies might be significant. For example, many Tier-1 ASs reach their (direct or indirect) customers via their peers instead of customers. Furthermore, the selective announcement routing policies imply that there are much less available paths in the Internet than shown in the AS connectivity graph. We hope that our findings will caution network operators in choosing the selective announcement routing policy for traffic engineering. Finally, we study export policies to peers and find that ASs tend to announce all of their prefixes to other peers. To the best of our knowledge, this is the first study on systematically understanding routing policies applied in the Internet.

A route in the Internet may take a longer AS (autonomous systems) path than the shortest AS path due to routing policies. We systematically analyze AS paths and quantify the extent to which routing policies inflate AS paths. The results show that AS path inflation in the Internet is more prevalent than expected. We first present the extent of AS path inflation observed from the route view routing tables. From an ISP, at least 55% of AS paths are inflated by at least one AS hop and AS paths can be inflated by as long as 6 AS hops. We then employ two typical routing policies to show the extent of AS path inflation for all AS pairs; we find that at least 45% of AS paths are inflated by at least one AS hop and AS paths can be inflated by as many as 9 AS hops. Quantifying AS path inflation in the Internet has important implications on the extent of routing policies and traffic engineering performed on the Internet, and on BGP (border gateway protocol) convergence speed.