Smart contract security audits are essential for trust in decentralized finance (DeFi), yet audit reports from different firms vary widely in scope definition, severity labels, fix verification, and report structure. These differences make it hard for developers, users, and other stakeholders to assess risk. In this paper, we address these issues by empirically analyzing 160 audit reports from 26 leading auditing firms to uncover patterns and gaps in current practices. Using qualitative content analysis, we extract a taxonomy of 19 common properties that audit reports include (or omit). We then apply Formal Concept Analysis (FCA) to identify five distinct “report style families” used by auditors, and perform a temporal trend analysis to see if the industry is converging on certain best practices. Finally, we synthesize a feature model that specifies a minimal defensible baseline for audit reports, distinguishing mandatory sections from optional extensions to support traceability and consistent interpretation across reports. This model enables reproducible comparisons across auditors, strengthens accountability for scope definition and fix verification, and provides an evidence base to improve the quality and uniformity of smart contract audit reporting.

Building a secure electronic voting system that offers the fairness and privacy of current voting schemes, while providing the transparency and flexibility offered by electronic systems has been a challenge for a long time. In this work-in-progress paper, we evaluate an application of blockchain as a service to implement distributed electronic voting systems. The paper proposes a novel electronic voting system based on blockchain that addresses some of the limitations in existing systems and evaluates some of the popular blockchain frameworks for the purpose of constructing a blockchain-based e-voting system. In particular, we evaluate the potential of distributed ledger technologies through the description of a case study; namely, the process of an election, and the implementation of a blockchain-based application, which improves the security and decreases the cost of hosting a nationwide election.

A repository of router configuration files from production networks would provide the research community with a treasure trove of data about network topologies, routing designs, and security policies. However, configuration files have been largely unobtainable precisely because they provide detailed information that could be exploited by competitors and attackers. This paper describes a method for anonymizing router configuration files by removing all information that connects the data to the identity of the underlying network, while still preserving the structure of information that makes the data valuable to networking researchers. Anonymizing configuration files has unusual requirements, including preserving relationships between elements of data, anonymizing regular expressions, and robustly coping with more than 200 versions of the configuration language. Conventional tools and techniques are poorly suited to the problem. Our anonymization method has been validated with a major carrier, earning unprivileged researchers access to the configuration files of thousands of routers in hundreds of networks. Through example analysis, we demonstrate that the anonymized data retains the key properties of the network design. The paper sets out techniques that could be used in an attempt to break the anonymization, and it concludes our anonymization techniques are most applicable to enterprise networks, because the large number of enterprises and the difficulty of probing them from the outside make it hard to recognize an anonymized network based solely on publicly-available information about its topology or configuration. When applied to backbone networks, which are few in number and many of whose properties can be publicly measured, the anonymization might be broken by fingerprinting techniques described in this paper.

In spite of significant work on real-time content distribution, providing consistent service quality across the Internet remains a challenge. Multicast applications further exacerbate that problem as the number of participants-clients, providers and administrative domains-and the level of heterogeneity in a single session is increased. Recently the increasing complexity of managing and operating the Internet has sparked off interest in autonomous networking. In this paper, we introduce vital enhancements to the elementary single source multicast service that facilitates incremental deployment, self-configuration, self-optimization and self-healing. We further introduce an autonomic multicast architecture where a self-monitoring network layer multicast automatically adapts the network layer forwarding service to meet the service quality requirements requested by application level services.

There are a large number of large-scale Ethernet-based local and metropolitan area networks in use. A significant reason for this prolific deployment is the relatively simple manner in which they can be configured and deployed. A critical service on these networks, that epitomises the simple nature of Ethernet, is the Address Resolution Protocol (ARP). This protocol is used to determine the link-layer address of a host given its network-layer identifier, and uses the intrinsic broadcast capability of Ethernet to determine these mappings. In this paper, we present an analysis of ARP behaviour on three sizable local area networks and show that due to poorly configured or malicious software (e.g. viruses) on hosts, performance issues could arise because of ARP. We also propose a scheme that can be used to manage the effect of the problems identified in our analysis.

Content distribution is becoming increasingly important with the decreasing cost of broadband access and the growing number of Internet users. Many of today's content distribution applications require a group communication infrastructure. Source-Specific Multicast (SSM) constitutes a promising alternative to the slow takeoff of multicast as a ubiquitous service, whether at the network- or application layer. Still, implementing any-source functionality on top of SSM remains an interesting research topic.In this paper we present how application semantics can be applied to multi-source distribution over source-specific trees. Specifically, we present two novel tree management methods that incorporate application semantics and evaluate them through simulations against the state of the art. The evaluation results manifest that our methods significantly improve perceived quality of service in the multi-source sessions we consider.

The primary purpose of a network is to provide reachability between applications running on end hosts. In this paper, we describe how to compute the reachability a network provides from a snapshot of the configuration state from each of the routers. Our primary contribution is the precise definition of the potential reachability of a network and a substantial simplification of the problem through a unified modeling of packet filters and routing protocols. In the end, we reduce a complex, important practical problem to computing the transitive closure to set union and intersection operations on reachability set representations. We then extend our algorithm to model the influence of packet transformations (e.g., by NATs or ToS remapping) along the path. Our technique for static analysis of network reachability is valuable for verifying the intent of the network designer, troubleshooting reachability problems, and performing "what-if" analysis of failure scenarios.

A repository of router configuration files from production networks would provide the research community with a treasure trove of data about network topologies, routing designs, and security policies. However, configuration files have been largely unobtainable precisely because they provide detailed information that could be exploited by competitors and attackers. This paper describes a method for anonymizing router configuration files by removing all information that connects the data to the identity of the originating network, while still preserving the structure of information that makes the data valuable to networking researchers. Anonymizing configuration files has unusual requirements, including preserving relationships between elements of data, anonymizing regular expressions, and robustly coping with more than 200 versions of the configuration language, that mean conventional tools and techniques are poorly suited to the problem. Our anonymization method has been validated with a major carrier, earning unprivileged researchers access to the configuration files of more than 7600 routers in 31 networks. Through example analysis, we demonstrate that the anonymized data retains the key properties of the network design. We believe that applying our single-blind methodology to a large number of production networks from different sources would be of tremendous value to both the research and operations communities.

In any IP network, routing protocols provide the intelligence that takes a collection of physical links and transforms them into a network that enables packets to travel from one host to another. Though routing design is arguably the single most important design task for large IP networks, there has been very little systematic investigation into how routing protocols are actually used in production networks to implement the goals of network architects. We have developed a methodology for reverse engineering a coherent global view of a network's routing design from the static analysis of dumps of the local configuration state of each router. Starting with a set of 8,035 configuration files, we have applied this method to 31 production networks. In this paper we present a detailed examination of how routing protocols are used in operational networks. In particular, the results show the conventional model of interior and exterior gateway protocols is insufficient to describe the diverse set of mechanisms used by architects, and we provide examples of the more unusual designs and examine their trade-offs. We discuss the strengths and weaknesses of our methodology, and argue that it opens paths towards new understandings of network behavior and design.

Layered multicast is a promising technique for broadcasting adaptive-quality TV video to heterogeneous receivers. While several-layered multicast approaches have been proposed, prior work has identified several problems including significant and persistent instability in video quality, arbitrary unfairness with other sessions, low access link utilization due to conservative bandwidth allocation, and problems with receiver synchronization. In this paper we propose a new layered multicast scheme, where we exploit a simple, coarse-grained, two-tier loss differentiation architecture to achieve stable and fair bandwidth allocation for viewers. Despite the simplicity of our loss differentiation model, we show that it achieves most of the benefits of complex and costly priority dropping schemes. In addition, our protocol is receiver-driven and thus retains the incentives to limit bandwidth usage that are not present in existing priority dropping schemes.

We are currently using the Marvel distributed management environment to provide management functionality for core Pronto services and service level router (SLR) functionality. The Marvel system, composed of a set of servers, is responsible for communicating with Pronto nodes, collecting information and providing the necessary controls for configuring SLR and hosting sites. Management information is provided to management clients according to three main views: platform management (network element layer), service management-network operator's view, service management-customer view.

We examine an approach for providing reliable, scalable multicast communication, involving the use of multiple multicast channels for reducing receiver processing costs and reducing network bandwidth consumption in a multicast session. In this approach a single multicast channel is used for the original transmission of packets. Retransmissions of packets are done on separate multicast channels, which receivers dynamically join and leave. We first show that protocols using an infinite number of multicast channels incur much less processing overhead at the receivers compared to protocols that use only a single multicast channel. This is due to the fact that receivers do not receive retransmissions of packets they have already received correctly. Next, we derive the number of unwanted redundant packets at a receiver due to using only a finite number of multicast channels, for a specific negative acknowledgment (NAK)-based protocol. We then explore the minimum number of multicast channels required to keep the cost of processing unwanted packets to a sufficiently low value. For an application consisting of a single sender transmitting reliably to many receivers we find that only a small number of multicast channels are required for a wide range of system parameters. In the case of an application where all participants simultaneously act as both senders and receivers a moderate number of multicast channels is needed. Finally, we present two mechanisms for implementing multiple multicast channels, one using multiple IP multicast groups and the other using additional router support for selective packet forwarding. We discuss the impact of both mechanisms on performance in terms of end-host and network resources.

Control-on-demand is a paradigm for network programmability at the network transport level. Prior work on active and programmable networking at this level either achieves flexibility by inserting significant software in the critical path of forwarding or achieves efficiency by sacrificing functionality and relegating programmability to connection management. In contrast, control-on-demand acts both in the control plane and in the data plane, still without adding software in the critical forwarding path. Rather than applying essential programs to every datagram, our approach is to apply the installed service logic asynchronously from data forwarding. This way we avoid essential processing in the critical forwarding path, applying the (user) installed service logic for service enhancement only. In this paper, we describe control-on-demand and how its service model provides sufficient richness to act in the data path. Set is restrictive enough to avoid the significant performance overhead of other in-data path approaches. The expressiveness of the programmable model is limited to observing and suggesting to the forwarding engine, but is never essential for correct processing, thus significantly reducing security and robustness concerns. Consequently, control-on-demand is efficient enough to make it viable for elementary services. Rather than replacing the interoperability layer, control-on-demand represents an evolution of router (switch) control functionality. As the required modification of router forwarding engines is insignificant, control-on-demand is viable in practice in the near future. These concepts have been prototyped as part of the Pronto Control Platform. In this paper, we describe our IPv6 router prototype implementation and discuss the application of control-on-demand on a number of interesting problems.

Networks support a wide range of applications with diverse service quality requirements. This demands distinct identification of flows according to their requirements, and the ability to service them differently. Different networking technologies have been evolving towards this common goal. ATM is cost-efficient by exploiting switching. But signaling is slow making ATM unattractive for bursty data traffic. One difficulty with ATM signaling is the inextricable connection between basic connectivity and QoS management. Consequently, every flow, even a best-effort flow suffers the overhead of end-to-end connection establishment. We propose a new lightweight architecture for ATM signaling called UNITE. The fundamental philosophy of UNITE is the separation of connectivity from QoS control. This eliminates the round-trip connection setup delay before initiating data transmission. Using a single cell with proper encoding, we avoid the overhead of reassembly and segmentation on the signaling channel, and enable hardware implementation. Performing QoS negotiation in-band, allows the switches in the path to process QoS-requests in parallel, facilitates connection specific control policies, supports both sender and receiver initiated QoS, and allows for uniform treatment of unicast and multicast connections. UNITE supports variegated multicast trees.

Several researchers have suggested employing two-stage entry monitors for high-speed networks; the first stage enforcing a long term rate, the second stage enforcing a peak rate over a shorter time scale. In spite of this interest, little work on analyzing such systems has appeared. Not only is the analysis hard because of the the correlation between the stages, but for the most popular policing scheme, the leaky bucket, prior work is not easily generalized to two stages. This paper presents a performance analysis of a two-stage entry monitor, by analyzing the combined queue length of a two-stage system. Our analysis is for a two-stage buffered moving window. Analyzing such a conservative scheme enables us to bound the penalty of more optimistic schemes, in particular a two stage leaky bucket based system. We obtain a closed form analytical result, and show how to evaluate it for a wide range of parameters of interest. Our results show that the performance penalty of having the second stage is minimal under reasonable rate assumptions.