The flexibility and scalability of cloud services have led to their adoption across various industries. While it is easy to identify deployments of very large cloud providers (hypergiants) as they often publish the allocation of their network resources, this is much less commonly the case for smaller providers. Despite efforts by commercial IP intelligence providers to bridge this gap, it is not clear how complete and reliable their data is, which is compounded by the lack of transparency surrounding their identification methods. In this early study, we utilize reverse DNS, a public data source provided and used by network operators, to identify the IP cloud space. We develop a Markov chain-based classifier to identify patterns and structures in the reverse DNS naming schemes of cloud providers. Our results indicate that cloud infrastructure naming often differs significantly from that of residential IP space, although there are some overlaps that require further investigation. We believe that our model can be used by network operators to identify cloud deployments with varying levels of confidence.

In 2009 Google launched its Public DNS service, which has since become the largest DNS service in existence. A common problem with public resolvers is that Content Delivery Networks (CDNs) struggle to map end user origin. The EDNS Client Subnet (ECS) extension allows resolvers to reveal part of a client's IP to authoritative name servers, helping CDNs pinpoint client origin. A side effect of ECS is that authoritative name server operators learn where in its network the public resolver handles queries. We leverage this side effect to study Google Public DNS (GPDNS). We perform a longitudinal analysis over data covering 2.5 years and 3.7 billion queries. Our study focuses on three aspects. First, we show that while GPDNS has PoPs in many countries, traffic is frequently routed out of country. This can reduce performance, and expose DNS requests to state level surveillance. We also show that end users are often served by a suboptimal PoP. Second, we show that end users switch to GPDNS en masse when their ISP resolver is unresponsive, and do not switch back. Finally, we also find that many e-mail providers configure GPDNS as resolver on their servers, causing serious privacy concerns due to information leakage.

With the Internet transitioning from IPv4 to IPv6, the number of IPv6-specific DNS records (AAAA) increases. Misconfigurations in these records often go unnoticed, as most systems are provided with connectivity over both IPv4 and IPv6, and automatically fall back to IPv4 in case of connection problems. With IPv6-only networks on the rise, such misconfigurations result in servers or services rendered unreachable. Using long-term active DNS measurements over multiple zones, we qualify and quantify these IPv6-specific misconfigurations. Applying pattern matching on AAAA records revealed which configuration mistakes occur most, the distribution of faulty records per DNS operator, and how these numbers evolved over time. We show that more than 97% of invalid records can be categorized into one of our ten defined main configuration mistakes. Furthermore, we show that while the number and ratio of invalid records decreased over the last two years, the number of DNS operators with at least one faulty AAAA record increased. This emphasizes the need for easily applicable checks in DNS management systems, for which we provide recommendations in the conclusions of this work.

IP anycast provides DNS operators and CDNs with automatic fail-over and reduced latency by breaking the Internet into catchments, each served by a different anycast site. Unfortunately, understanding and predicting changes to catchments as anycast sites are added or removed has been challenging. Current tools such as RIPE Atlas or commercial equivalents map from thousands of vantage points (VPs), but their coverage can be inconsistent around the globe. This paper proposes Verfploeter, a new method that maps anycast catchments using active probing. Verfploeter provides around 3.8M passive VPs, 430x the 9k physical VPs in RIPE Atlas, providing coverage of the vast majority of networks around the globe. We then add load information from prior service logs to provide calibrated predictions of anycast changes. Verfploeter has been used to evaluate the new anycast deployment for B-Root, and we also report its use of a nine-site anycast testbed. We show that the greater coverage made possible by Verfploeter's active probing is necessary to see routing differences in regions that have sparse coverage from RIPE Atlas, like South America and China.

The Balian-Low theorem (BLT) states the fundamental impossibility to design waveforms for L2(ℝ), which 1) form an orthogonal set, 2) are time-frequency localized, and 3) attain a critical waveform density such that they form an orthogonal basis. This article closes the gap between existing waveform designs and the BLT. The main contribution is the design of orthogonal, time-frequency localized, spectrum efficient waveforms for hexagonal lattices. The waveform design is adaptive by a single design parameter, which tradesoff time-frequency localization with the waveform density. As the orthogonalization procedure is based on employing the minimum number of most time-frequency localized waveforms (Hermite functions) it is argued that the results may be optimal in terms of combined spectrum efficiency and time-frequency localization. An example is provided for waveforms for a hexagonal lattice, which are quasi-orthogonal, time-frequency localized, and up to 99% of the critical waveform density. Although the designed waveforms are not strictly orthogonal, their cross-correlation can be made arbitrarily small. The robustness in doubly dispersive channels and the efficiency for multiuser scenarios are discussed and compared to conventional orthogonal frequency division multiplexing (OFDM).

Recently the mean-field method has been adopted for analysing systems consisting of a large number of interacting objects in computer science, biology, chemistry, etc. It allows for a quick and accurate analysis of such systems, while avoiding the state-space explosion problem. So far, the method has primarily been used for performance evaluation. In this paper, we use the mean-field method for model-checking. We define and motivate a logic MF-CSL for describing properties of systems composed of many identical interacting objects. The proposed logic allows describing both properties of the overall system and of a random individual object. Algorithms to check the satisfaction relation for all MF-CSL operators are proposed. Furthermore, we explain how the set of all time instances that fulfill a given MF-CSL formula for a certain distribution of objects can be computed.

Multi-carrier communication is associated with a high peak-to-average power ratio (PAPR). A new PAPR reduction method is proposed which is based on rotating the time-frequency representation of a transmit signal, prior to transmission. In general, a time-frequency rotation of a multi-carrier signal would change the signal basis, affecting the robustness of the transmit signal in fading channels. Exceptions are transmit signals constructed by (modulated) Hermite functions. The PAPR has been analyzed for transmit signals based on 64 Hermite functions. Allowing a rotation over 16 angles in time-frequency, the PAPR, which occurs with a probability of 10−3, is reduced by 3.8 dB at the cost of an increased computational complexity and a minor loss in spectral efficiency.

A new signal set, based on the Fourier and Hermite signal bases, is introduced. It combines properties of the Fourier basis signals with the perfect time-frequency localization of the Hermite functions. The signal set is characterized by both a high spectral efficiency and good time-frequency localization. Its robustness against time-frequency shifts is assessed and compared to Hermite and Fourier basis signals. The Fourier-Hermite signal set is particularly designed for communications in spectrum-scarce environments.

Synchronization and matched filtering of signals in time dispersive, frequency dispersive and time-frequency dispersive channels are addressed in this paper. The ‘eigenfunctions’ of these channels form the signal sets under investigation. While using channel-eigenfunctions is a first requirement for undistorted data transmission, a second necessity is to achieve good synchronization over the domains of time and frequency. The synchronization problem in time-frequency for non-stationary signals is discussed. A spiral correlation method is proposed to achieve synchronization and matched filtering in time-frequency. Spiral correlation, using the pattern of a sunflower, is simulated and evaluated. It is argued that partial spiral correlation can lead to a significant reduction in computational complexity necessary for synchronization. Generalizations and identities based on the fractional Fourier transform are provided which omit the need for fractional delay filters.

Anomaly-based intrusion detection systems classify network traffic instances by comparing them with a model of the normal network behavior. To be effective, such systems are expected to precisely detect intrusions (high true positive rate) while limiting the number of false alarms (low false positive rate). However, there exists a natural trade-off between detecting all anomalies (at the expense of raising alarms too often), and missing anomalies (but not issuing any false alarms). The parameters of a detection system play a central role in this trade-off, since they determine how responsive the system is to an intrusion attempt. Despite the importance of properly tuning the system parameters, the literature has put little emphasis on the topic, and the task of adjusting such parameters is usually left to the expertise of the system manager or expert IT personnel. In this paper, we present an autonomic approach for tuning the parameters of anomaly-based intrusion detection systems in case of SSH traffic. We propose a procedure that aims to automatically tune the system parameters and, by doing so, to optimize the system performance. We validate our approach by testing it on a flow-based probabilistic detection system for the detection of SSH attacks.