Selecting which recommendation algorithm variant to advance to online experimentation is a critical decision in industry practice. Manual evaluation is subjective and time-consuming, while offline metrics such as nDCG often fail to correlate with real-world customer preferences. We present SAER, a two-stage framework (pointwise filtering and pairwise comparison) that uses Large Language Models as judges to evaluate e-commerce recommendation quality. For pointwise evaluation, SAER achieves higher agreement with human consensus (κw = 0.58) than human annotators achieve with each other (κw = 0.38). For pairwise evaluation, SAER mitigates position bias (88.0% consistency) and demonstrates strong adversarial robustness (91.0% detection rate). In a large-scale online case study serving over 10M impressions, the algorithm SAER preferred offline also achieved a statistically significant click-through rate (CTR) lift (p < 0.0001), providing encouraging directional evidence, though this single observation cannot establish a general predictive relationship. SAER produces reproducible, explainable signals in approximately 30 minutes for $28, positioning it as a scalable pre-screening layer for recommendation development.

Internet failures occur, resulting in service disruptions as well as monetary losses. Internet measurement platforms run network diagnostic tests to probe and identify anomalies at a global scale, such as slowdowns which can affect quality of service and user experience. However, maintaining such platforms is complex, as it may involve managing large amounts of hardware and servers in addition to non-negligible monetary costs. To address these challenges this article presents CLAIM, a cloud-based framework for Internet-scale measurements. CLAIM supports running custom probes according to a cloud-native design built on top of the serverless computing paradigm and also supports spot virtual machines. CLAIM was implemented and evaluated in different scenarios. The related analysis showed that CLAIM reduces measurement costs up to 90% compared to standard virtual machines, without a noticeable overhead in running probes.

AWS offers transient instances as a way to sell unused capacity in their data centers. Although these transient instances come with a steep discount at their prices, up to 90% of discount compared to on-demand instances, they do not come with availability guarantees, thus, they are not reliable for regular usage on the Internet. This paper presents PISTIS, a framework that uses reliability engineering models that provides reliable computing resources over transient instances by proactively replacing components that are expected to fail. We evaluated our model and the results show that we can achieve the same reliability of regular on-demand instances but with a price reduction of up to 81% in the best cases compared to on-demand instances.

Edge computing aims to enable applications with stringent latency requirements, e.g., augmented reality, and tame the overwhelming data streams generated by IoT devices. A core principle of this paradigm is to bring the computation from a distant cloud closer to service consumers and data producers. Consequentially, the issue of edge computing facilities' placement arises. We present a comprehensive analysis suggesting where to place general-purpose edge computing resources on an Internet-wide scale. We base our conclusions on extensive real-world network measurements. We perform extensive traceroute measurements from RIPE Atlas to datacenters in the US, resulting in a graph of 11K routers. We identify the affiliations of the routers to determine the network providers that can act as edge providers. We devise several edge placement strategies and show that they can improve cloud access latency by up to 30%.

In the early days of cloud computing, datacenters were sparsely deployed at distant locations far from end-users with high end-to-end communication latency. However, today’s cloud datacenters have become more geographically spread, the bandwidth of the networks keeps increasing, pushing the end-users latency down. In this paper, we provide a comprehensive cloud reachability study as we perform extensive global client-to-cloud latency measurements towards 189 datacenters from all major cloud providers. We leverage the well-known measurement platform RIPE Atlas, involving up to 8500 probes deployed in heterogeneous environments, e.g., home and offices. Our goal is to evaluate the suitability of modern cloud environments for various current and predicted applications. We achieve this by comparing our latency measurements against known human perception thresholds and are able to draw inferences on the suitability of current clouds for novel applications, such as augmented reality. Our results indicate that the current cloud coverage can easily support several latency-critical applications, like cloud gaming, for the majority of the world’s population.

Edge computing has gained attention from both academia and industry by pursuing two significant challenges: 1) moving latency critical services closer to the users, 2) saving network bandwidth by aggregating large flows before sending them to the cloud. While the rationale appeared sound at its inception almost a decade ago, several current trends are impacting it. Clouds have spread geographically reducing end-user latency, mobile phones? computing capabilities are improving, and network bandwidth at the core keeps increasing. In this paper, we scrutinize edge computing, examining its outlook and future in the context of these trends. We perform extensive client-to-cloud measurements using RIPE Atlas, and show that latency reduction as motivation for edge is not as persuasive as once believed; for most applications the cloud is already 'close enough' for majority of the world's population. This implies that edge computing may only be applicable for certain application niches, as opposed to a general-purpose solution.

AWS offers discounted transient virtual instances as a way to sell unused resources in their data-centers, and users can enjoy up to 90% discount as compared to the regular on-demand pricing. Despite the economic incentives to purchase these transient instances, they do not come with regular availability SLAs, meaning that they can be evicted at any moment. Hence, the user is responsible for managing the instance availability to meet the application requirements. In this paper, we present Bricklayer, a software tool that assists users to better use transient resources in the cloud, reducing costs for the same amount of resources, and increasing the overall instance availability. Bricklayer searches for possible combinations of smaller and cheaper instances to compose the requested amount of resources while deploying them into different spot markets to reduce the risk of eviction. We implemented and evaluated Bricklayer using 3 months of historical data from AWS and found out that it can reduce up 54% of the regular spot price and up to 95% compared to the standard on-demand pricing.

The sharing economy has made great inroads with services like Uber or Airbnb enabling people to share their unused resources with those needing them. The computing world, however, despite its abundance of excess computational resources has remained largely unaffected by this trend, save for few examples like SETI@home. We present DeCloud, a decentralized market framework bringing the sharing economy to on-demand computing where the offering of pay-as-you-go services will not be limited to large companies, but ad hoc clouds can be spontaneously formed on the edge of the network. We design incentive compatible double auction mechanism targeted specifically for distributed ledger trust model instead of relying on third-party auctioneer. DeCloud incorporates innovative matching heuristic capable of coping with the level of heterogeneity inherent for large-scale open systems. Evaluating DeCloud on Google cluster-usage data, we demonstrate that the system has a near-optimal performance from an economic point of view, additionally enhanced by the flexibility of matching.

The Internet is largely a self-organizing system that adapts to changes in its operating environment. In this work, we extend these principles to service infrastructure and introduce ICON, standing for intelligent container. Technically, ICON is a container encapsulating a service that is consumed either directly by end-clients or other services. The novelty of ICON is in the ability of containers to adapt to their environment, targeting near-optimal service delivery and requiring only high-level guidance from the application management. Once deployed, containers form an overlay, observe their setting, and migrate or replicate themselves as needed, to the locations e.g., closest to service consumers. ICON captures our long-term vision for self-organizing service overlays that have the potential for global outreach. Bringing intelligence and adaptation to the level of individual containers renders a decentralized solution that has desirable properties, such as scalability, resilience, reliability, and adaptability to volatile environments. We hope that technology like ICON can open the way for more democratized service provisioning, disintermediating service providers from centralized brokers and optimizing orchestrators.

In-network caching of content is a popular technique for eliminating redundant traffic from the network and improve the performance of network applications. In this paper we present a novel cooperative caching strategy to improve performance of in-network caches. Our cooperative scheme is composed of an admission policy for the incoming data and a content exchange protocol between neighbor network caches to improve the search zone. The admission policy enforces that a previously cached data is not unnecessary replicated in other caches, resulting in more space for new data. The content exchange protocol allows for exchange on cached data, increasing the hit rate for incoming requests. The benefits are twofold: first, we reduce the redundant content caching in the network, and second, we improve the hit rate by informing the content cached in the nearby caches. As a proof-of-concept, we have implemented a prototype and evaluated its performance using different large-scale topologies against standard non-cooperative caching algorithms. Our numerical results show that both admission and content exchange policies yield large performance gains over standard algorithms.

In this paper we present an in-network caching architecture based on content routers to improve the traffic efficiency in the Internet. The main idea is to provide a forwarding fabric where data requests are forwarded towards the closest caches in the network path. Conversely, data chunks from the servers are cached in the content routers along the path, serving further requests. In addition, content routers store a neighborhood mapping of available routers, leveraging resource discovery in the network proximity. Some benefits of the architecture include multi-source content retrieval, better traffic efficiency and gradual deployment. As a proof-of-concept, we implemented a content router prototype and evaluated it in different scenarios comparing the bandwidth, latency and neighborhood search. The experimental results show that the content router can leverage multi-source content retrieval with bandwidth reduction without incurring in increased latency.

The growing demand for ubiquitous computing lead manufactures to develop multi-band devices supporting different network access technologies, such as GSM, Wi-fi, and UMTS. Although these devices support different access technologies, they lack of native vertical handover support, breaking any ongoing connections whenever users switch between access technologies. In this paper we present a next-generation Internet architecture with native vertical handover support, providing mechanisms to support mobility between different access technologies without disruptions. The architecture introduces an identification layer that decouples the host identification from its location, enabling native mobility support for legacy applications. The identification layer employs cryptographic identifiers to identify end-hosts over the Internet and to provide security mechanisms for identity management during vertical handovers. As a proof of concept, a prototype was implemented and evaluated in different vertical handover scenarios in GSM, Wi-fi and wired domains.

Current security protocols such as IPSec and TLS/SSL provide security mechanisms to authenticate and protect the communication between end-hosts over the Internet. Nonetheless, new communication scenarios like mobility and heterogeneous networks have exposed some technical limitations of these protocols. Both protocols employ the IP address as end-host identifier to establish security associations between the parties, entangling the end-host identification with its topological location. In order to overcome these limitations, we propose the Identification Layer Security (IDSec), a security model to provide authentication based on public key cryptography with denial of service resistance capabilities and data integrity and confidentiality. IDSec introduces a new communication substrate based on cryptographic identifiers which natively support new services such as mobility and heterogeneous networks with security embedded in the identification layer. In order to validate the proposal, a prototype was implemented and evaluated, analyzing the performance of legacy applications in static and mobility scenarios.

Peer-to-peer systems provide a scalable content distribution environment where each peer contributes with a share of resources in the distributed system. The efficiency of peer-to-peer networks comes from the file segmentation procedure, allowing peers to redistribute small pieces of the original file as soon as they finish downloading them instead of waiting for the complete file download. Moreover, the decentralized fashion of the paradigm with multiple sources makes it scalable and robust under high churn. Due to the popularity of such systems, many attacks such as content pollution arose, targeting the content integrity by inserting bogus data in the network to increase the download time and bandwidth consumption. In this paper we present the piece fingerprinting mechanism, a new integrity verification procedure that algorithmically binds all pieces together and relates them to the complete file. Each data block resulted from the segmentation of a large file has a fingerprint indicating whether a block belongs to the content file and also allows the integrity verification of specific parts of the content. The mechanism allows the early detection and correction of the corrupted blocks only, reducing the download time and bandwidth consumption which would be spent re-downloading larger pieces. The analytical evaluation shows that the fingerprinting mechanism has low overhead, usually less than 1% of the file size, and can reduce the bandwidth consumption by 90% in the best case by saving the amount of bandwidth consumed from the re- downloaded pieces.

The current internetworking architecture presents some limitations to naturally support mobility, security and multi- homing. Among the limitations, the IP semantic overload seems to be a primary issue to be considered. In this paper we present a next generation internetworking architecture to overcome the IP semantic overload by introducing an identity layer located between the network and transport layers. This new layer provides a stable cryptographic identifier for end-hosts and seamlessly allows the deployment of new services, such as mobility, multi-homing and security. A prototype was implemented and evaluated considering some mobility scenarios, including intra-domain, inter-domain and simultaneous node mobility.

The publish/subscribe communication paradigm is an appealing mechanism for efficient content retrieval due to the decoupling of data sources and consumers. However, the location decoupling nature of the paradigm opens security issues related to the content authentication and integrity since there is no binding between published content and its providers. In this paper we propose a new control plane called security plane, which is responsible for providing all essential security functionalities, such as efficient content authentication, data integrity and publication control. The security plane creates a binding between information providers and their contents, allowing secure content authentication by subscribers, mitigating security flaws such as fake content publication and data corruption.

The current internetworking architecture presents some limitations to naturally support mobility and multi-homing. Among the limitations, the IP semantic overload seems to be a primary issue to be considered. In this paper we present a next generation internetworking architecture to overcome the IP semantic overload by introducing an identification layer located between the network and transport layers. This new layer provides a stable identifier for end-hosts, enabling the natural deployment of new services, such as mobility, multi-homing and security embedded. We implemented a prototype and evaluated it considering the legacy application support in mobility scenarios.